Word set acquisition method, word set-based intelligent measurement terminal application detection method, device, equipment and storage medium

Abstract

The present application relates to a word set acquisition method, a word set-based intelligent measurement terminal application detection method, device, equipment and readable storage medium, and relates to the field of power grid technology, and can improve the accuracy of abnormal application detection of intelligent measurement terminals. The method includes: obtaining a sample interface call sequence; obtaining a first interface code sequence from the sample interface call sequence based on the interval code, the first truncation interval and the first interface code as the center of the interval in the sample interface call sequence, performing self-supervised training on a word embedding vector acquisition model based on the first interface code sequence, and at the end of the training, determining the word embedding vector corresponding to each interface code based on the word embedding vector acquisition model; obtaining candidate words based on each sample interface call sequence, determining the coding association of each interface code contained in the candidate word based on the word embedding vector of each interface code, and constructing a word set of multiple application types based on each candidate word whose coding association meets a preset condition.

Description

Technical Field

[0001] The present application relates to the field of power grid technology, and in particular to a word set acquisition method for intelligent measurement terminal application detection, a word set-based intelligent measurement terminal application detection method, device, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] As a key component of the power grid, smart measurement terminals connect the master station system with various metering devices, playing an indispensable role in accurately capturing comprehensive grid data. With the digitalization and intelligentization of the power industry, smart measurement terminals can be installed with various application software to flexibly provide various required functions. However, this flexible installation of application software also brings potential security risks.

[0003] In related technologies, lexical-level semantic analysis technology in natural language processing can be used to analyze the interface relationships of the Application Programming Interface (API) called by applications on smart measurement terminals during runtime. For example, the interface can be embedded and encoded as a word, and then the word embedding vectors of the interface can be clustered. The application detection results can be determined based on the clustering results.

[0004] However, the above method is difficult to effectively identify the interface call combination of abnormal applications and is difficult to accurately detect abnormal applications of smart measurement terminals. Summary of the Invention

[0005] Based on this, it is necessary to provide a word set acquisition method for smart measurement terminal application detection, a word set-based smart measurement terminal application detection method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a method for acquiring a word set for application detection of an intelligent measurement terminal, the method comprising:

[0007] Obtaining sample interface call sequences of sample applications under multiple application types; the sample interface call sequences include interface codes and interval codes corresponding to the platform interfaces called sequentially when the sample applications are run; the interval code is inserted when the time interval between calls of two adjacent platform interfaces is greater than a preset threshold;

[0008] Obtaining a first interface code sequence from the sample interface call sequence based on the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence; performing self-supervised training on a word embedding vector acquisition model based on the plurality of first interface code sequences; and determining, at the end of the training, a word embedding vector corresponding to each of the interface codes based on the word embedding vector acquisition model; the word embedding vector acquisition model is used to determine a word embedding vector based on each interface code in the first interface code sequence, and predict the first interface code based on the word embedding vector;

[0009] According to each of the sample interface call sequences, candidate words containing at least two interface codes are obtained, and based on the word embedding vectors corresponding to each of the interface codes, the coding association of each interface code contained in each of the candidate words is determined. Based on each candidate word whose coding association meets preset conditions, a plurality of word sets of the application type are constructed; the word sets are used to detect the application type of the intelligent measurement terminal application.

[0010] In one embodiment, the determining of the coding association of each interface code contained in each candidate word according to the word embedding vector corresponding to each interface code, and constructing a plurality of word sets of the application type according to each candidate word whose coding association satisfies a preset condition, includes:

[0011] For each candidate word, obtaining the adjacency entropy corresponding to the candidate word, determining the overall closeness of the candidate word according to the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word, and determining the coding association degree of each interface code contained in the candidate word according to the adjacency entropy and the overall closeness of the candidate word;

[0012] Adding each candidate word whose coding relevance is greater than a preset threshold to the word library;

[0013] The sample interface call sequences under each application type are segmented according to the word library, and a word set of each application type is obtained according to the segmentation result.

[0014] In one embodiment, determining the overall closeness of the candidate word according to the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word includes:

[0015] Dividing the candidate words to obtain multiple groups of front-end interface coding sequences and back-end interface coding sequences;

[0016] For each group of the front-end interface code sequence and the back-end interface code sequence, determining a splitting probability according to the respective occurrence probabilities of the candidate word, the front-end interface code sequence, and the back-end interface code sequence, and determining the semantic similarity of the front-end interface code sequence and the back-end interface code sequence according to the word embedding vector corresponding to each interface code contained in the candidate word;

[0017] The overall closeness of the candidate words is determined according to the splitting probabilities and the semantic similarities corresponding to the multiple groups of the front-end interface coding sequences and the back-end interface coding sequences.

[0018] In one embodiment, the word segmentation of the sample interface call sequence under each application type is performed according to the word library, and the word set of each application type is obtained according to the word segmentation result, including:

[0019] Reversely obtain a second interface code sequence from the current sample interface call sequence according to the interval code in the sample interface call sequence, the second truncated interval of the preset length, and the second interface code as the center of the interval;

[0020] Determining whether the word library includes a matching word for the second interface code sequence; the matching word is an interface code combination including the first interface code and the last interface code in the current second interface code sequence;

[0021] If so, the current second interface code sequence is segmented from the current sample interface call sequence as a word segmentation result, and added to the word set corresponding to the application type. If the current sample interface call sequence has not been segmented, the step of obtaining the second interface code sequence from the current sample interface call sequence is returned to execution;

[0022] If not, remove the first interface code in the current second interface code sequence, and return to the step of determining whether the vocabulary includes a matching word.

[0023] In one embodiment, obtaining the first interface code sequence from the sample interface call sequence according to the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence includes:

[0024] In the sample interface call sequence, a first interception interval with a preset length of 2N+1 and a first interface code as the interval center is used to perform sequence interception to obtain an interception sequence; wherein N is a positive integer;

[0025] When the interval code exists among the N interface codes before the first interface code, setting each interface code before the interval code in the intercepted sequence as the interval code; and when the interval code exists among the N interface codes after the first interface code, setting each interface code after the interval code in the intercepted sequence as the interval code;

[0026] A first interface coding sequence is obtained according to the intercepted sequence obtained after setting the interval coding.

[0027] In a second aspect, the present application further provides a method for detecting an application of an intelligent measurement terminal based on a word set, the method comprising:

[0028] Acquire an actual interface call sequence corresponding to a target application to be detected by the intelligent measurement terminal; the actual interface call sequence includes interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application;

[0029] Segmenting the actual interface call sequence to obtain corresponding segmented words; each segmented word is composed of at least one interface code;

[0030] If all the segmented words in the actual interface call sequence are included in the word set of normal type applications, determining that the target application is the normal type application;

[0031] If part of the segmented words of the actual interface call sequence is included in the word set of abnormal type applications, determining that the target application is the abnormal type application, and determining the abnormal code in the target application according to the interface call code corresponding to each interface code in part of the segmented words;

[0032] Wherein, each of the word sets is obtained according to any of the above word set acquisition methods for intelligent measurement terminal application detection.

[0033] In a third aspect, the present application further provides a word set acquisition device for intelligent measurement terminal application detection, the device comprising:

[0034] A sample acquisition module is configured to acquire sample interface call sequences of sample applications under multiple application types; the sample interface call sequences include interface codes and interval codes corresponding to the platform interfaces called sequentially when the sample applications are run; the interval code is inserted when the time interval between calls of two adjacent platform interfaces is greater than a preset threshold;

[0035] a word embedding acquisition module, configured to acquire a first interface code sequence from the sample interface call sequence based on the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence; perform self-supervised training on a word embedding vector acquisition model based on the plurality of first interface code sequences; and at the end of the training, determine a word embedding vector corresponding to each of the interface codes based on the word embedding vector acquisition model; the word embedding vector acquisition model is configured to determine a word embedding vector based on each interface code in the first interface code sequence, and predict the first interface code based on the word embedding vector;

[0036] A word set acquisition module is used to obtain candidate words containing at least two interface codes based on each of the sample interface call sequences, determine the coding association of each interface code contained in each of the candidate words based on the word embedding vector corresponding to each of the interface codes, and construct a plurality of word sets of the application type based on each of the candidate words whose coding associations meet preset conditions; the word sets are used to detect the application type of the intelligent measurement terminal application.

[0037] In a fourth aspect, the present application further provides a device for detecting an application of an intelligent measurement terminal based on a vocabulary, the device comprising:

[0038] The actual sequence acquisition module is used to obtain the actual interface call sequence corresponding to the target application to be detected by the intelligent measurement terminal; the actual interface call sequence includes the interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application;

[0039] A word segmentation module is used to segment the actual interface call sequence to obtain corresponding word segments; each word segment is composed of at least one interface code;

[0040] a first identification module, configured to determine that the target application is a normal type application if all the segmented words in the actual interface call sequence are included in a word set of normal type applications;

[0041] a second identification module, configured to determine that the target application is the abnormal type application if some of the segmented words in the actual interface call sequence are included in the word set of the abnormal type application, and determine the abnormal code in the target application based on the interface call code corresponding to each interface code in some of the segmented words;

[0042] Wherein, each of the word sets is obtained according to any of the above word set acquisition methods for intelligent measurement terminal application detection.

[0043] In a fifth aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0044] In a sixth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of any of the above methods when executed by a processor.

[0045] In a seventh aspect, the present application also provides a computer program product, comprising a computer program, which implements the steps of any of the above methods when executed by a processor.

[0046] The above-mentioned word set acquisition method for intelligent measurement terminal application detection, word set-based intelligent measurement terminal application detection method, device, computer equipment, computer-readable storage medium and computer program product, on the one hand, by inserting interval codes into the sample call sequence, it is possible to avoid using other interfaces with little correlation as the context of the current interface, avoid adding noise to the word embedding vector, improve the accuracy and expression effect of the word embedding vector, and effectively deal with the problem of long interface call time intervals. On the other hand, by obtaining the word embedding vector corresponding to the interface code, determining the encoding correlation of each interface code contained in the candidate word based on the word embedding vector, and constructing multiple word sets of the application type based on this, it is possible to regard each called interface as a word and the interface call combination as a word. The word set constructed through unsupervised training combines highly correlated interface call sequences into words, which can effectively enhance the ability to represent the interface call sequence combination and deal with the problem of irrelevant API insertion calls. Subsequently, by combining with word segmentation technology, it can achieve accurate detection of interface call anomalies, effectively improving the accuracy of detecting abnormal applications of intelligent measurement terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 A flowchart of a method for acquiring a word set for application detection in an intelligent measurement terminal according to an embodiment;

[0049] Figure 2 1 is a flow chart of a method for detecting an application of an intelligent measurement terminal based on a word set in one embodiment;

[0050] Figure 3 1 is a flow chart of another method for detecting an application of an intelligent measurement terminal based on a word set in one embodiment;

[0051] Figure 4 It is a structural block diagram of a word set acquisition device for intelligent measurement terminal application detection in one embodiment;

[0052] Figure 5 It is a structural block diagram of a word set-based intelligent measurement terminal application detection device in one embodiment;

[0053] Figure 6 is a diagram of the internal structure of a computer device in one embodiment;

[0054] Figure 7 FIG. 1 is a diagram showing the internal structure of another computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0056] In order to enable those skilled in the art to better understand this application, the relevant technologies are first introduced below.

[0057] Smart measurement terminals are integrated, intelligent power equipment capable of collecting real-time grid electrical parameters such as voltage, current, power factor, frequency, and harmonics. These data can be uploaded to a grid dispatch center or cloud platform via a communication interface. They also process and analyze the collected data, providing assessment, prediction, and alarm functions for grid operating status. Furthermore, smart measurement terminals feature remote control capabilities, receiving instructions from higher-level systems to remotely control and optimize grid equipment. This functionality makes grid management more convenient and efficient, improving grid security and reliability.

[0058] The digitization and intelligentization of the power industry are placing higher demands on the flexibility of smart metering terminals to flexibly respond to and support increasingly diverse functional requirements. In this context, the combination of configurable software platforms and diverse applications has emerged, enabling smart metering terminals to flexibly adapt to diverse application scenarios and functional requirements by simply installing or uninstalling various application modules. However, this flexibility and diversity of applications also bring potential security risks. To ensure the safe and stable operation of the power grid, applications installed on smart metering terminals (e.g., before being put on the shelf and / or after being deployed on the smart metering terminals) must be thoroughly tested and verified to identify abnormal code within the applications.

[0059] Abnormal code (such as malicious code) in applications is a software program designed to damage, disrupt, or harm computer systems. Malicious code poses a serious threat to the operational security of power grids through one or more means, including but not limited to attacking computer systems and disrupting system functions. Therefore, rigorous code detection in smart metering terminal applications is particularly important. To effectively identify and prevent such threats, detection methods include signature detection (based on comparison with known malicious code signature libraries), heuristic detection (inferring potential maliciousness through behavioral patterns), behavioral analysis (monitoring specific program behavior during runtime), and cloud-based detection (using cloud-based big data and machine learning technologies to quickly identify unknown threats). As key devices in power grid systems, smart metering terminals operate in a unique application environment. Communication between applications and master stations and metering devices, as well as data exchange between applications, is achieved through specific software platform interfaces. Therefore, an effective approach to detecting abnormal code is to observe and record interface call behavior during application operation. By comparing normal operation with potential abnormal behavior, potential malicious code can be identified.

[0060] Using interface call behavior to identify malicious code mainly utilizes the pattern differences in the types and number of API calls and the API call sequence between abnormal code and normal code, including sequence matching, association rules, hybrid feature encoders, clustering, word embedding encoding, semantic analysis and other methods.

[0061] In related technologies, when using lexical-level semantic analysis techniques in natural language processing to analyze interfaces called during application execution, the API call sequence is first statically extracted, and each API is embedded and encoded as a word to obtain the API's word embedding vector. Word embedding is a technique in natural language processing (NLP) that maps words or phrases in a vocabulary to real-valued vectors in a high-dimensional space. These vectors generally capture the semantic relationships between words, meaning similar words are close to each other in the vector space. The goal of word embedding is to convert language symbols (such as words) into a form that computers can understand and process, enabling efficient computation and reasoning. The API's word embedding vectors are then clustered, and the application is converted into a clustered encoding. Finally, anomalous applications are identified using the clustered encoding and ensemble model contained in the application.

[0062] However, the above method is difficult to effectively identify the interface call combination of abnormal applications, and the ability to extract the API call combination features of abnormal codes is not strong, which is not conducive to the positioning of abnormal codes and the analysis of their API call features, making it difficult to accurately detect abnormal applications of smart measurement terminals.

[0063] Based on this, it is necessary to provide a word set acquisition method for smart measurement terminal application detection, a word set-based smart measurement terminal application detection method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0064] In one embodiment, Figure 1 As shown, a method for acquiring a word set for intelligent measurement terminal application detection is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0065] S101, obtaining a sample interface call sequence of sample applications under multiple application types; the sample interface call sequence includes the interface code and interval code corresponding to each platform interface called in sequence when the sample application is running; the interval code is inserted when the time interval between the calls of two adjacent platform interfaces is greater than a preset threshold.

[0066] In a specific implementation, a list of smart measurement terminal software platform interfaces (APIs) can be pre-established and each API can be encoded to obtain the interface code corresponding to each platform interface. In addition, a code indicating a discontinuity (i.e., an interval code) can be added. In some examples, the APIs can be one-hot encoded.

[0067] Then, multiple sample applications pre-labeled with application types can be obtained. Each application type can include one or more applications. For ease of distinction, the applications used to construct the word set are referred to as sample applications. In some embodiments, the multiple application types can include normal applications and abnormal applications. Normal applications refer to applications that can run normally and will not attack the system, while abnormal applications may refer to applications that contain abnormal code and / or attack the system. Abnormal applications can also be classified into different types based on the specific circumstances and methods of the abnormality.

[0068] After obtaining sample applications under multiple application types, in some embodiments, the sample applications with the labeled application types can be run separately in the sandbox. For each sample application, the software platform interface called when the sample application is running can be recorded in sequence. According to the interface code corresponding to the platform interface and the calling time interval between the platform interfaces, an API calling timing sequence is generated. This sequence is also called an interface calling sequence. The calling time interval is the interval between the calling time of any called platform interface and the calling time of the previous called platform interface. For the sake of distinction, the interface calling sequence of the sample application is called a sample interface calling sequence. Furthermore, a training data set can be constructed based on multiple sample interface calling sequences.

[0069] It can be understood that in step S101, a plurality of sample applications of labeled application types can be first prepared as a training set, wherein the plurality of samples include normal applications and different types of abnormal applications. Then, the sample applications of each application type are run separately in a sandbox, and the code of the software platform API called by each sample application during operation, as well as the time interval between the current API call and the previous API call, are recorded in sequence. Based on this, an API interface call sequence is generated, which records the calling order of each called platform interface and the time interval between the calls of two adjacent platform interfaces. Furthermore, the sample interface call sequence obtained after running all applications of each application type can constitute a training data set for that application type.

[0070] After obtaining multiple original sample interface call sequences, it can be determined whether it is necessary to insert an interval code into the original sample interface call sequence according to the call time interval to obtain the sample interface call sequence used in the subsequent steps. Specifically, for every two adjacent platform interfaces, when the call time interval between the two adjacent platform interfaces is greater than a preset threshold, an interval code can be inserted between the interface codes corresponding to the two adjacent platform interfaces in the original sample interface call sequence, and its call time is set to half of the call time interval between the two adjacent platform interfaces. For example, if the call time interval corresponding to the two adjacent platform interfaces is t1-t2, and t1-t2 exceeds the preset threshold, the interval code can be inserted at the position of (t1-t2) / 2.

[0071] S102, according to the interval code in the sample interface call sequence, the first truncated interval of a preset length and the first interface code as the center of the interval, obtain a first interface code sequence from the sample interface call sequence, perform self-supervised training on the word embedding vector acquisition model according to the multiple first interface code sequences, and at the end of the training, determine the word embedding vector corresponding to each interface code according to the word embedding vector acquisition model; the word embedding vector acquisition model is used to determine the word embedding vector according to each interface code in the first interface code sequence, and predict the first interface code according to the word embedding vector.

[0072] In the related art, the API call time interval is not taken into account when obtaining word embeddings. That is, when the call time interval between two adjacent platform interfaces is too long, the possibility of correlation between the two platform interfaces is very small. If they are used as context for each other, noise will be added to the word embedding, affecting the expression effect of the word embedding. In response to this, in this embodiment, an interval code can be inserted when the call time interval between two adjacent platform interfaces is greater than a preset threshold. That is, for excessively long call intervals, the time interval can be regarded as a separator in natural language. By inserting the interval code, multiple interface codes can be more reasonably segmented, which can make subsequent feature extraction more accurate.

[0073] Specifically, in this step, an interface code sequence is obtained from the sample interface call sequence based on the interval code in the sample interface call sequence, the first truncation interval of a preset length, and the first interface code as the center of the interval. That is, the corresponding truncation sequence can be first determined based on the first truncation interval of a preset length and the first interface code as the center of the interval. Then, based on whether the interval code appears in the truncation sequence, the continuous interface code containing the first interface code in the truncation sequence can be determined, and the interface code sequence can be determined based on the continuous interface code. For ease of distinction, the interface code sequence used in step S102 is called the first interface code sequence. In some examples, the first interface code sequence can be understood as a sequence centered on the first interface code and containing multiple interface codes, which includes the first interface code and a context highly associated with the first interface code.

[0074] Then, the word embedding vector acquisition model can be self-supervised trained based on multiple first interface coding sequences. For example, for each first interface coding sequence, all interface codes in the first interface coding sequence can be merged into a vector as the input of the word embedding vector acquisition model, for example, all interface codes in the first interface coding sequence are spliced, and the spliced vector is input into the model. After obtaining the input, the word embedding vector acquisition model can perform feature extraction and output the corresponding feature extraction result in the hidden layer. The feature extraction result can be used as the word embedding vector of the first interface code. Then, the word embedding acquisition model can predict the first interface code based on the word embedding vector and output it. According to the difference between the first interface code prediction result and the actual first interface code, the model parameters are adjusted. When the training end condition is met (such as the number of model iterations reaches the number threshold or the difference is less than the difference threshold), each first interface code sequence can be input into the word embedding vector acquisition model to obtain the word embedding vector corresponding to each first interface code.

[0075] In some examples, a continuous bag-of-words model can be used to train word embedding vectors. Specifically, all interface codes in the first interface code sequence can be combined into a vector as the input of the continuous bag-of-words model, and the first interface code can be used as the output. The continuous bag-of-words model is trained with self-supervision. When the training end condition is met, the vector output by the hidden layer of the continuous bag-of-words model is used as the word embedding vector.

[0076] S103: Based on each sample interface call sequence, candidate words containing at least two interface codes are obtained. Based on the word embedding vector corresponding to each interface code, the coding association of each interface code contained in each candidate word is determined. Based on each candidate word whose coding association meets the preset conditions, a word set of multiple application types is constructed; the word set is used to detect the application type of the intelligent measurement terminal application.

[0077] After obtaining the word embedding vectors for each interface code, the interface code can be considered as a character, and the combination of interface codes as a word to construct a vocabulary for interface calls. In this embodiment, multiple candidate words can be obtained based on each sample interface call sequence, and each candidate word can contain at least two interface codes.

[0078] Then, based on the word embedding vector corresponding to each interface code, the coding association of each candidate word contained in each interface code can be determined, and the candidate words whose coding association meets the preset conditions can be screened out. According to the candidate words whose coding association meets the preset conditions, a word set corresponding to each of the multiple application types can be constructed, so that the application type corresponding to the application on the intelligent measurement terminal can be detected based on the word set.

[0079] When abnormal code adds irrelevant calls between API calls, the detection capabilities of the related technologies mentioned above are not strong. However, in this embodiment, by treating the combination of multiple platform interfaces called during the running of the sample application as candidate words and identifying the relevance of each interface in the candidate words based on the word embedding vector, abnormal code that inserts irrelevant API calls between key API calls can be effectively detected.

[0080] In the above-mentioned word set acquisition method for intelligent measurement terminal application detection, sample interface call sequences of sample applications under multiple application types can be obtained, wherein the sample interface call sequence includes interface codes and interval codes corresponding to each platform interface called in sequence during the operation of the sample application, and the interval code is inserted when the call time interval between two adjacent platform interfaces is greater than a preset threshold; then, a first interface code sequence can be obtained from the sample interface call sequence based on the interval code in the sample interface call sequence, a first truncation interval of a preset length, and the first interface code as the center of the interval, and a word embedding vector acquisition model is self-supervised trained based on the multiple first interface code sequences. At the end of the training, the word embedding vector corresponding to each interface code is determined based on the word embedding vector acquisition model; then, based on each sample interface call sequence, candidate words containing at least two interface codes are obtained, and based on the word embedding vector corresponding to each interface code, the code correlation of each interface code contained in each candidate word is determined, and multiple word sets for detecting the application type of the intelligent measurement terminal are constructed based on each candidate word whose code correlation meets the preset conditions. In this embodiment, on the one hand, by inserting interval codes into the sample call sequence, it is possible to avoid using other interfaces with little correlation as the context of the current interface, avoid adding noise to the word embedding vector, improve the accuracy and expression effect of the word embedding vector, and effectively deal with the problem of long interface call time intervals. On the other hand, by obtaining the word embedding vector corresponding to the interface code, the coding correlation of each interface code contained in the candidate word is determined according to the word embedding vector, and a plurality of word sets of the application type are constructed accordingly. Each called interface can be regarded as a word, and the interface call combination can be regarded as a word. The word set constructed through unsupervised training combines highly correlated interface call sequences into words, which can effectively enhance the ability to represent the sequential combination of interface calls and deal with the problem of irrelevant API insertion calls. Subsequently, by combining with word segmentation technology, accurate detection of interface call anomalies can be achieved, effectively improving the detection accuracy of abnormal applications of intelligent measurement terminals.

[0081] In one embodiment, in step S103, based on the word embedding vectors corresponding to the interface codes, the coding relevance of the interface codes contained in each candidate word is determined, and a word set of multiple application types is constructed based on each candidate word whose coding relevance meets the preset conditions, which may include the following steps:

[0082] S1031, for each candidate word, obtain the adjacency entropy corresponding to the candidate word, determine the overall closeness of the candidate word based on the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word, and determine the coding association of each interface code contained in the candidate word based on the adjacency entropy and the overall closeness of the candidate word.

[0083] In a specific implementation, multiple candidate words can be obtained. In an exemplary embodiment, a maximum string length of 2M+1 (M is a positive integer) can be set. Then, a segment of length 2M+1 is intercepted from the sample interface call sequence centered around the current interface code (also known as the third interface code). If there is an interval code in the M interface codes before the current interface code, the interval code and all interface codes before it can be removed. If there is an interval code in the M interface codes after the current interface code, the interval code and all interface codes after it can be removed. This can prevent interface codes with excessively long call intervals from being merged into the same candidate word, reducing data noise and interference contained in the candidate word. After removing the interface code (including the interval code or the interface codes before and / or after the interval code) and obtaining the corresponding code sequence (also known as the third interface code sequence), all interface code combinations containing the current interface code can be selected from the third interface code sequence as candidate words. For example, if the third interface code sequence obtained after processing is ABC (where A, B, and C are different interface codes, and interface code B is the current interface code), the resulting candidate words can include AB, BC, and ABC.

[0084] Then, on the one hand, the adjacency entropy of the candidate word can be obtained. In some exemplary embodiments, the adjacency entropy can be determined as follows :

[0085]

[0086] in They are respectively expressed as the left adjacent entropy and right adjacent entropy of the candidate word w. For example, they can be calculated using the following formula:

[0087]

[0088]

[0089] in, is the left adjacent character set of candidate word w, k is the number of characters in the left adjacent character set, is the right adjacent character set of the candidate word w, is the number of characters in the right adjacent character set, Indicates the left adjacent word The probability of occurrence, Indicates the right adjacent word The probability of occurrence is calculated using the following formula:

[0090]

[0091]

[0092] in, Represents characters The number of times it appears to the left of the word segment w, Represents characters The number of times it appears to the right of the word segment w.

[0093] On the other hand, the overall closeness of the candidate word can be determined based on the word embedding vectors corresponding to the various interface codes contained in the candidate word and the probability of occurrence of the interface code sequence corresponding to the candidate word. Specifically, the semantic and / or grammatical closeness of the various interface codes contained in the candidate word can be measured based on the word embedding vectors corresponding to the various interface codes. At the same time, the appropriateness of grouping the various interface codes into the same combination can be measured based on the probability of occurrence of the interface code sequence contained in the candidate word. Thus, the overall closeness of multiple interface codes in the candidate word can be determined based on these two pieces of information.

[0094] Then, the coding relevance of each interface coding contained in the candidate word can be determined based on the adjacency entropy and the overall closeness of the candidate word. In some examples, the coding relevance is also called the candidate word score, which can be calculated as follows:

[0095]

[0096] in, is the overall closeness of the candidate word w, Represents the maximum and minimum normalization operation, which can be shown as follows:

[0097]

[0098] and for The maximum and minimum values of is the sigmoid function.

[0099] S1032: adding candidate words with coding relevance greater than a preset threshold to the vocabulary.

[0100] After determining the coding association of each candidate word, for each candidate word, if its corresponding coding association is greater than a preset threshold, the candidate word can be added to the vocabulary; if its corresponding coding association is less than or equal to the preset threshold, the candidate word is discarded.

[0101] S1033 , segmenting the sample interface call sequences under each application type according to the word library, and obtaining a word set of each application type according to the segmentation result.

[0102] After the word library is constructed, the word library can be used to segment the sample interface call sequences under each application type, and word sets of different application types can be constructed based on the segmented words that appear in the sample interface call sequences of different application types.

[0103] In this embodiment, on the one hand, the coding correlation is determined by considering the adjacency entropy, word embedding vector and occurrence probability of the candidate words. Combining multiple factors can more comprehensively and accurately measure the close relationship between the interface codes in the candidate words, avoiding the one-sidedness of single factor analysis, and thus more accurately mining the potential connections between the interface codes; on the other hand, by adding candidate words with coding correlation greater than a preset threshold to the vocabulary, it is possible to screen out words with higher correlation and representativeness, making the vocabulary more refined and accurate, improving the quality and practicality of the vocabulary, and helping to better adapt to the characteristics and needs of different application types.

[0104] In an exemplary embodiment, in step S1031, determining the overall closeness of the candidate word based on the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word may include the following steps:

[0105] The candidate words are divided to obtain multiple groups of front-end interface coding sequences and back-end interface coding sequences; for each group of front-end interface coding sequences and back-end interface coding sequences, the splitting probability is determined according to the respective occurrence probabilities of the candidate words, the front-end interface coding sequences and the back-end interface coding sequences, and the semantic similarity of the front-end interface coding sequences and the back-end interface coding sequences is determined according to the word embedding vectors corresponding to each interface coding contained in the candidate words; the overall closeness of the candidate words is determined according to the splitting probabilities and the semantic similarities corresponding to the multiple groups of front-end interface coding sequences and the back-end interface coding sequences.

[0106] In practical applications, the candidate words can be divided based on the interface codes contained in the candidate words to obtain multiple groups of front-end interface code sequences and back-end interface code sequences. (that is, the i-th interface code that constitutes the candidate word), the previous interface code sequence can be obtained and back-end interface coding sequence , front-end interface coding sequence and back-end interface coding sequence Together they form a candidate word of length n, that is, the candidate word .

[0107] For each set of the front-end interface code sequence and the back-end interface code sequence, on the one hand, the splitting probability can be determined according to the respective occurrence probabilities of the candidate word, the front-end interface code sequence, and the back-end interface code sequence. In some examples, the splitting probability can be calculated as follows:

[0108]

[0109] in, is the probability of the above candidate words appearing in the training set, and For all intercepted API strings and The probability of occurrence of the string of characters. The split probability can measure the probability of the candidate word appearing as a whole. If and The smaller the ratio is, the higher the probability of the candidate word appearing alone is, while the probability of the two parts appearing as a whole is relatively low. In this case, the candidate word may be split into more independent vocabulary units. On the contrary, if and The larger the ratio is, the more likely it is that after the candidate word is split into two parts, the probability of the two parts appearing separately is relatively low, while the probability of appearing as a whole is relatively high, then the candidate word may be more suitable to appear as a whole.

[0110] On the other hand, the semantic similarity of the front-end interface coding sequence and the back-end interface coding sequence can be determined based on the word embedding vectors corresponding to the various interface codes contained in the candidate words. In some examples, the cosine similarity of the mean vectors of the front-end interface coding sequence and the back-end interface coding sequence can be calculated, which can measure the degree of semantic and grammatical similarity between the characters of the front and back parts. The higher the similarity, the closer the semantic and grammatical connection between the front and back parts. The cosine similarity of the mean vectors of the front-end interface coding sequence and the back-end interface coding sequence can be calculated as follows:

[0111]

[0112] in, and For strings and The mean of all character word embedding vectors in .

[0113] Furthermore, the overall closeness of the candidate words can be determined based on the splitting probabilities and semantic similarities corresponding to the multiple groups of front-end interface coding sequences and back-end interface coding sequences. In one example, the overall closeness can be determined as follows: , overall tightness Also known as the vector-enhanced mutual information of candidate words:

[0114]

[0115] in, is the weight, which can be set according to experience.

[0116] In this embodiment, the overall closeness of the candidate words is determined based on the splitting probabilities and the semantic similarities corresponding to multiple groups of front-end interface coding sequences and back-end interface coding sequences. The rationality of a candidate word as a complete unit can be evaluated by comprehensively considering the probability distribution of the candidate words and the semantic and grammatical similarity of their character composition. Through the combination of the two, the candidate words can be analyzed and processed more comprehensively.

[0117] In one embodiment, in step S1033, the sample interface call sequences under each application type are segmented according to the word library, and a word set of each application type is obtained according to the segmentation result, which may include the following steps:

[0118] According to the interval code in the sample interface call sequence, the second truncation interval of the preset length and the second interface code as the center of the interval, the second interface code sequence is obtained from the current sample interface call sequence in reverse; it is determined whether the vocabulary includes matching words for the second interface code sequence; the matching words are all interface code combinations including the first interface code and the last interface code in the current second interface code sequence; if so, the current second interface code sequence is segmented from the current sample interface call sequence as a word segmentation result, added to the vocabulary of the corresponding application type, and if the current sample interface call sequence has not been segmented, the step of obtaining the second interface code sequence from the current sample interface call sequence is returned; if not, the first interface code in the current second interface code sequence is removed, and the step of determining whether the vocabulary includes matching words is returned.

[0119] In natural language processing, Chinese word segmentation is the process of breaking down a continuous sequence of Chinese characters into meaningful words or phrases. Because the Chinese writing system does not naturally separate words with spaces like in English, Chinese word segmentation is a fundamental step in natural language processing tasks such as text analysis, information retrieval, and machine translation. In addition to API calls with excessively long intervals between calls, the sample API call sequence also lacks proper segmentation for multiple consecutive API codes.

[0120] To this end, in this embodiment, a reverse maximum matching algorithm can be used to segment the sample interface call sequence. Specifically, a second interface code sequence can be obtained from the current sample interface call sequence in reverse order based on the interval code in the sample interface call sequence, the second truncated interval of a preset length, and the second interface code serving as the center of the interval. Specifically, for the sample interface call sequence, the last 2M+1 (M is a positive integer) characters (i.e., interface codes) can be taken as the segments to be matched. If an interval code exists in the M interface codes preceding the current interface code, the interval code and all preceding interface codes can be removed. If an interval code exists in the M interface codes following the current interface code, the interval code and all subsequent interface codes can be removed, thereby obtaining the second interface code sequence.

[0121] Then, it can be determined whether the vocabulary includes any matching words of the second interface code sequence, and the matching words refer to all interface code combinations including the first interface code and the last interface code in the current second interface code sequence. For example, if the first interface code and the last interface code of the second interface code sequence are "A" and "G", it is possible to query in the vocabulary whether all interface code combinations including the first interface code "A" and the last interface code "G" in the second interface code sequence exist in the vocabulary. If so, the match is successful, and the second interface code sequence can be segmented out from the sample interface call sequence as a word and added to the vocabulary of the application type corresponding to the sample interface call sequence. If the sample interface call sequence has been completely segmented, the process ends. If the current sample interface call sequence has not been segmented, the process returns to the step of obtaining the second interface code sequence from the current sample interface call sequence.

[0122] If the vocabulary does not include the matching words of the second interface code sequence, the first interface code in the current second interface code sequence can be removed, and the process returns to the judgment step again to determine whether the vocabulary includes any matching words of the second interface code sequence. For example, if all interface code combinations including the first interface code "A" and the last interface code "G" in the second interface code sequence do not exist in the vocabulary, the first interface code of the second interface code sequence can be removed (that is, the first interface code "A" can be removed). After removing the first interface code, if there is only one interface code left in the current second interface code sequence, the remaining interface code words can be determined to be independent words, and then it can be determined whether the current sample interface call sequence has been completely segmented. If so, the process ends, otherwise the process returns to the step of obtaining the second interface code sequence from the current sample interface call sequence. If there are two or more interface codes left, the process returns to the judgment step again to determine whether the vocabulary includes any matching words of the current second interface code sequence.

[0123] By matching the candidate words in the vocabulary with the interface codes in the sample interface call sequences, all sample interface call sequences used for training can be segmented, and the words used by normal applications can be combined into a normal word set. The words used by abnormal applications are removed from the normal word set to form an abnormal word set corresponding to each type of abnormal application. In one example, the abnormal word set can be understood as a feature of malicious code.

[0124] In this embodiment, on the one hand, during the word segmentation process, by judging whether the word library contains a matching word for the second interface code sequence, the existing word library information can be used to guide the word segmentation operation. If the match is successful, the sequence can be directly segmented as a word segmentation result to ensure that the segmented result is consistent with the knowledge in the word library, thereby improving the rationality and consistency of the word segmentation result. On the other hand, when there is no matching word in the word library, by removing the first interface code in the current second interface code sequence and re-judging, this dynamic adjustment mechanism enables the algorithm to continuously try different combinations to find a word segmentation result that conforms to the word library. By gradually narrowing the range of the intercepted sequence, it is possible to find a suitable word segmentation method as much as possible, avoiding erroneous word segmentation caused by a mismatch in one judgment, thereby improving the flexibility and adaptability of word segmentation. On the other hand, adding the segmented second interface code sequence as a word segmentation result to the word set of the corresponding application type helps to continuously enrich and improve the word set. As different sample interface call sequences are processed, the word set can cover more interface code combinations, thereby better reflecting the characteristics and rules of different application types, and providing more comprehensive and accurate data support for subsequent word set-based application type detection.

[0125] In an exemplary embodiment, in step S102, obtaining a first interface code sequence from the sample interface call sequence according to the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence may include the following steps:

[0126] In a sample interface call sequence, a first interception interval with a first interface code as the interval center and a preset length of 2N+1 is used for sequence interception to obtain a interception sequence; when there is an interval code in the N interface codes before the first interface code, each interface code before the interval code in the interception sequence is set as the interval code, and when there is an interval code in the N interface codes after the first interface code, each interface code after the interval code in the interception sequence is set as the interval code; according to the interception sequence obtained after setting the interval code, a first interface code sequence is obtained.

[0127] Wherein, N is a positive integer.

[0128] In practical applications, a first interception interval with a preset length of 2N+1 and a first interface code as the center of the sample interface call sequence can be used to perform sequence interception to obtain an interception sequence. Specifically, the current interface code for the context information to be extracted, i.e., the first interface code, can be determined. Then, all interface codes within a window with a length of 2N+1, centered on the first interface code, can be intercepted in the sample interface call sequence.

[0129] If there is an interval code in the N interface codes before the first interface code, all interface codes in the current window and before the interval code can be set as interval codes. If there is an interval code in the N codes after the first interface code, all interface codes in the current window and after the interval code can be set as interval codes. In this way, the first interface code can be separated from irrelevant interface codes with too long a calling time interval, avoiding using the coding information with too long a calling time interval as the context of the first interface code and introducing interference information.

[0130] In one embodiment, Figure 2 As shown, a method for detecting intelligent measurement terminal applications based on a word set is also provided. This embodiment uses the method applied to a server as an example. It is understood that the method can also be applied to a terminal, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0131] S201 , obtaining an actual interface calling sequence corresponding to a target application to be detected by the intelligent measurement terminal; the actual interface calling sequence includes interface codes corresponding to multiple platform interfaces called in sequence during the running of the target application.

[0132] In a specific implementation, the application to be detected by the smart measurement terminal can be determined. For easy identification, the application is called the target application. In some examples, the target application may include other applications completely different from the sample application, or an updated version of the sample application.

[0133] After determining the target application, you can run the target application and obtain its interface call sequence. For ease of distinction, the target application's interface call sequence is referred to as the actual interface call sequence. The actual interface call sequence includes the interface codes corresponding to the multiple platform interfaces called sequentially during the target application's execution. In some examples, the actual interface call sequence may not include interval codes; that is, it may simply record the interface codes corresponding to the platform interfaces called sequentially during the target application's execution.

[0134] S202, segmenting the actual interface call sequence to obtain corresponding segmented words; each segmented word is composed of at least one interface code.

[0135] Then, the actual interface call sequence can be segmented to obtain corresponding word segments. In some exemplary embodiments, the word segmentation process of the actual interface call sequence can be exactly the same as the word segmentation process of the sample interface call sequence segmentation. For details, please refer to the introduction of the aforementioned embodiment and will not be repeated here. In other embodiments, other word segmentation algorithms can also be used to segment the actual interface call sequence. For example, it can be segmented according to other maximum matching algorithms (such as forward maximum matching algorithm, two-way matching algorithm, etc.).

[0136] S203: If all the segmented words of the actual interface call sequence are included in the word set of normal type applications, the target application is determined to be a normal type application.

[0137] S204: If the partial word segmentation of the actual interface call sequence is included in the word set of the abnormal type application, the target application is determined to be an abnormal type application, and the abnormal code in the target application is determined according to the interface call code corresponding to each interface code in the partial word segmentation.

[0138] Each word set may be obtained according to any one or more embodiments of the above-mentioned word set acquisition method for smart measurement terminal application detection.

[0139] After obtaining the segmented words, it can be determined whether the segmented words in the actual interface call sequence are all in the word set of normal type applications. If so, it can be determined that the target application is a normal application.

[0140] If not, you can check whether the segmented words outside the word set of normal type applications are included in the word set of abnormal type applications of known abnormal types. If so, you can determine that the target application is the above-mentioned abnormal type application. Then you can determine the segmented words included in the word set of abnormal type applications, and in the target application code, determine the call code corresponding to the interface code of the segmented words, thereby obtaining the location of the abnormal code in the target application. If some segmented words do not appear in any word set, it can be determined that the target application is an unknown type application.

[0141] In the above-mentioned word set-based intelligent measurement terminal application detection method, the actual interface call sequence corresponding to the target application to be detected by the intelligent measurement terminal can be obtained, and the actual interface call sequence includes the interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application; then the actual interface call sequence can be segmented to obtain corresponding word segments; each word segment consists of at least one interface code; if each word segment of the actual interface call sequence is included in the word set of normal type applications, the target application is determined to be the normal type application; if some of the word segments of the actual interface call sequence are included in the word set of abnormal type applications, the target application is determined to be an abnormal type application, and the abnormal code in the target application is determined according to the interface call code corresponding to each interface code in the partial word segment, wherein each word set can be obtained according to the word set acquisition method for intelligent measurement terminal application detection in any of the aforementioned embodiments. In this embodiment, on the one hand, by pre-constructing a word set of normal type applications and abnormal type applications, it is possible to better characterize the interface call combinations of various types of applications based on candidate words composed of multiple interface codes in the word set, so that the characteristics of abnormal code API calls can be extracted more clearly and effectively; on the other hand, by dividing the actual interface call sequence of the target application into different segments through word segmentation, it is possible to more easily identify the API call location of the abnormal code, accurately locate and analyze the abnormal code, and improve the detection accuracy and efficiency of abnormal applications of the intelligent measurement terminal.

[0142] In order to enable those skilled in the art to better understand the above steps, the embodiment of the present application is illustrated below by using an example, but it should be understood that the embodiment of the present application is not limited to this.

[0143] In related technologies, when using lexical-level semantic analysis technology in natural language processing to analyze interfaces called during application execution, the API call sequence is first statically extracted, and each API is embedded and encoded as a word to obtain the API's word embedding vector; the API's word embedding vector is then clustered, and the application is converted into a clustered encoding. Finally, abnormal applications are identified through the clustered encoding and integrated model contained in the application.

[0144] However, the above method has the following shortcomings: (1) API is embedded as a word, and the ability to represent the sequential combination of API calls is not strong enough; (2) The time interval of API calls is not considered in the word embedding process, that is, when the time interval between two adjacent API calls is too long, the possibility of correlation between them is very small. If they are used as context, it is equivalent to adding noise to the word embedding, which affects the effect of word embedding; (3) When malicious code adds irrelevant calls between API calls, the detection ability of the method proposed in this paper is not strong; (4) The word embedding vectors of API are clustered in this paper, and then the clustering code contained in the application is used to determine whether there is malicious code. The ability to extract the API call combination features of malicious code is not strong, which is not conducive to the positioning of malicious code and the analysis of its API call features.

[0145] In this regard, the present application provides an application detection method for an intelligent measurement terminal, such as Figure 3 As shown, the following steps may be included:

[0146] S301: Create a list of APIs for the intelligent measurement terminal software platform and encode each API.

[0147] S302: Run an application program for training an initial model with a marked type in a sandbox, and sequentially record the time intervals of the coded calls of the software platform API called when the application program is running, to form an API call sequence.

[0148] S303 , treating each API as a word, and using a model (such as a model of the word2vc framework) to train the word embedding vector of the API.

[0149] S304, building a vocabulary of API calls based on the word embedding vectors of the API.

[0150] S305 , using the vocabulary to segment the application API call sequences in the training set.

[0151] S306, segment all application API call sequences used for training, form a normal word set with the words used by normal applications, remove the words in the normal word set from the words used by abnormal applications, and form an abnormal word set corresponding to each type of abnormal application.

[0152] S307, for the new application to be tested (i.e., the target application), first segment its API call sequence and check whether the words it uses are all in the normal word set. If so, it is judged as a normal application. Otherwise, check whether the words outside the normal word set are included in the abnormal word set of known types. If so, it is judged as the above-mentioned abnormal type. If there are words that are not included in all word sets, it is judged as an unknown type.

[0153] Compared with the related art, this application has the following advantages:

[0154] (1) This application regards API as a character and the combination of API calls as a word. By constructing a vocabulary in an unsupervised manner, the application combines highly related API call sequences into words. This has a stronger ability to represent the combination of API call sequences and can well handle the problems of long call time intervals and irrelevant API calls inserted.

[0155] (2) The vocabulary constructed by this application can more clearly and effectively extract the characteristics of malicious code API calls.

[0156] (3) This application divides the application's API call sequence into different segments through word segmentation, which makes it easier to locate and analyze malicious code.

[0157] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0158] Based on the same inventive concept, embodiments of the present application also provide a word set acquisition device for intelligent measurement terminal application detection, which is used to implement the aforementioned word set acquisition method for intelligent measurement terminal application detection. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more embodiments of the word set acquisition device for intelligent measurement terminal application detection provided below can be found in the aforementioned limitations of the word set acquisition method for intelligent measurement terminal application detection, and will not be repeated here.

[0159] In an exemplary embodiment, Figure 4 As shown, a word set acquisition device for intelligent measurement terminal application detection is provided, comprising:

[0160] The sample acquisition module 401 is configured to acquire sample interface call sequences of sample applications under multiple application types; the sample interface call sequences include interface codes and interval codes corresponding to the platform interfaces sequentially called by the sample applications during runtime; the interval code is inserted when the time interval between calls of two adjacent platform interfaces exceeds a preset threshold;

[0161] A word embedding acquisition module 402 is configured to acquire a first interface code sequence from the sample interface call sequence based on the interval code, the first truncated interval of a preset length, and the first interface code serving as the center of the interval in the sample interface call sequence, perform self-supervised training on a word embedding vector acquisition model based on the plurality of first interface code sequences, and at the end of the training, determine a word embedding vector corresponding to each interface code based on the word embedding vector acquisition model; the word embedding vector acquisition model is configured to determine a word embedding vector based on each interface code in the first interface code sequence, and predict the first interface code based on the word embedding vector;

[0162] The word set acquisition module 403 is used to obtain candidate words containing at least two interface codes based on each of the sample interface call sequences, determine the coding association of each interface code contained in each of the candidate words based on the word embedding vector corresponding to each of the interface codes, and construct a plurality of word sets of the application type based on each of the candidate words whose coding associations meet preset conditions; the word sets are used to detect the application type of the intelligent measurement terminal application.

[0163] In one embodiment, the word set acquisition module 403 is used to:

[0164] For each candidate word, obtaining the adjacency entropy corresponding to the candidate word, determining the overall closeness of the candidate word according to the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word, and determining the coding association degree of each interface code contained in the candidate word according to the adjacency entropy and the overall closeness of the candidate word;

[0165] Adding each candidate word whose coding relevance is greater than a preset threshold to the word library;

[0166] The sample interface call sequences under each application type are segmented according to the word library, and a word set of each application type is obtained according to the segmentation result.

[0167] In one embodiment, the word set acquisition module 403 is used to:

[0168] Dividing the candidate words to obtain multiple groups of front-end interface coding sequences and back-end interface coding sequences;

[0169] For each group of the front-end interface code sequence and the back-end interface code sequence, determining a splitting probability according to the respective occurrence probabilities of the candidate word, the front-end interface code sequence, and the back-end interface code sequence, and determining the semantic similarity of the front-end interface code sequence and the back-end interface code sequence according to the word embedding vector corresponding to each interface code contained in the candidate word;

[0170] The overall closeness of the candidate words is determined based on the split probabilities and the semantic similarities corresponding to multiple groups of the front-end interface coding sequences and the back-end interface coding sequences.

[0171] In one embodiment, the word set acquisition module 403 is used to:

[0172] Reversely obtain a second interface code sequence from the current sample interface call sequence according to the interval code in the sample interface call sequence, the second truncated interval of the preset length, and the second interface code as the center of the interval;

[0173] Determining whether the word library includes a matching word for the second interface code sequence; the matching word is an interface code combination including the first interface code and the last interface code in the current second interface code sequence;

[0174] If so, the current second interface code sequence is segmented from the current sample interface call sequence as a word segmentation result, and added to the word set corresponding to the application type. If the current sample interface call sequence has not been segmented, the step of obtaining the second interface code sequence from the current sample interface call sequence is returned to execution;

[0175] If not, remove the first interface code in the current second interface code sequence, and return to the step of determining whether the vocabulary includes a matching word.

[0176] In one embodiment, the word embedding acquisition module 402 is configured to:

[0177] In the sample interface call sequence, a first interception interval with a preset length of 2N+1 and a first interface code as the interval center is used to perform sequence interception to obtain an interception sequence; wherein N is a positive integer;

[0178] When the interval code exists among the N interface codes before the first interface code, setting each interface code before the interval code in the intercepted sequence as the interval code; and when the interval code exists among the N interface codes after the first interface code, setting each interface code after the interval code in the intercepted sequence as the interval code;

[0179] A first interface coding sequence is obtained according to the intercepted sequence obtained after setting the interval coding.

[0180] Based on the same inventive concept, embodiments of the present application also provide a word set-based smart measurement terminal application detection device for implementing the aforementioned word set-based smart measurement terminal application detection method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more embodiments of the word set-based smart measurement terminal application detection device provided below can be found in the limitations of the word set-based smart measurement terminal application detection method described above and will not be further elaborated here.

[0181] In an exemplary embodiment, Figure 5 As shown, a smart measurement terminal application detection device based on a word set is provided, comprising:

[0182] The actual sequence acquisition module 501 is used to obtain the actual interface call sequence corresponding to the target application to be detected by the intelligent measurement terminal; the actual interface call sequence includes the interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application;

[0183] The word segmentation module 502 is used to segment the actual interface call sequence to obtain corresponding word segments; each word segment is composed of at least one interface code;

[0184] A first identification module 503 is configured to determine that the target application is a normal type application if all the segmented words in the actual interface call sequence are included in a word set of normal type applications;

[0185] A second identification module 504 is configured to determine that the target application is an abnormal type application if some of the segmented words in the actual interface call sequence are included in a word set of abnormal type applications, and determine the abnormal code in the target application based on the interface call code corresponding to each interface code in some of the segmented words;

[0186] Wherein, each of the word sets is obtained according to any of the above word set acquisition methods for intelligent measurement terminal application detection.

[0187] The various modules in the aforementioned vocabulary acquisition device for intelligent measurement terminal application detection and vocabulary-based intelligent measurement terminal application detection device can be implemented in whole or in part through software, hardware, or a combination thereof. Each of these modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0188] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store interface call sequence data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a word set acquisition method for intelligent measurement terminal application detection or an intelligent measurement terminal application detection method based on a word set is implemented.

[0189] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless means, and the wireless means can be implemented via Wi-Fi, a mobile cellular network, near-field communication (NFC), or other technologies. When executed by the processor, the computer program implements a word set acquisition method for intelligent measurement terminal application detection or a word set-based intelligent measurement terminal application detection method. The display unit of the computer device is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0190] Those skilled in the art will understand that Figure 6 and Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0191] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0192] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0193] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0194] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0195] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0196] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0197] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for acquiring a word set for intelligent measurement terminal application detection, characterized in that: The method comprises: Obtaining sample interface call sequences of sample applications under multiple application types; the sample interface call sequences include interface codes and interval codes corresponding to the platform interfaces called sequentially when the sample applications are run; the interval code is inserted when the time interval between calls of two adjacent platform interfaces is greater than a preset threshold; Obtaining a first interface code sequence from the sample interface call sequence based on the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence; performing self-supervised training on a word embedding vector acquisition model based on the plurality of first interface code sequences; and determining, at the end of the training, a word embedding vector corresponding to each of the interface codes based on the word embedding vector acquisition model; the word embedding vector acquisition model is used to determine a word embedding vector based on each interface code in the first interface code sequence, and predict the first interface code based on the word embedding vector; According to each of the sample interface call sequences, candidate words containing at least two interface codes are obtained. For each of the candidate words, the adjacency entropy corresponding to the candidate word is obtained. The overall closeness of the candidate words is determined based on the word embedding vectors corresponding to the interface codes contained in the candidate words and the occurrence probability of the interface code sequence corresponding to the candidate words. The coding association of the interface codes contained in the candidate words is determined based on the adjacency entropy and the overall closeness of the candidate words. Each candidate word with a coding association greater than a preset threshold is added to a vocabulary. The sample interface call sequences under each of the application types are segmented according to the vocabulary. A vocabulary set for each of the application types is obtained based on the segmentation results. The vocabulary set is used to detect the application type of the intelligent measurement terminal application.

2. The method according to claim 1, characterized in that The determining the overall closeness of the candidate word according to the word embedding vector corresponding to each interface code contained in the candidate word and the occurrence probability of the interface code sequence corresponding to the candidate word includes: Dividing the candidate words to obtain multiple groups of front-end interface coding sequences and back-end interface coding sequences; For each group of the front-end interface code sequence and the back-end interface code sequence, determining a splitting probability according to the respective occurrence probabilities of the candidate word, the front-end interface code sequence, and the back-end interface code sequence, and determining the semantic similarity of the front-end interface code sequence and the back-end interface code sequence according to the word embedding vector corresponding to each interface code contained in the candidate word; The overall closeness of the candidate words is determined according to the splitting probabilities and the semantic similarities corresponding to the multiple groups of the front-end interface coding sequences and the back-end interface coding sequences.

3. The method according to claim 1, characterized in that The word segmentation of the sample interface call sequence under each application type is performed according to the word library, and a word set of each application type is obtained according to the word segmentation result, including: Reversely obtain a second interface code sequence from the current sample interface call sequence according to the interval code in the sample interface call sequence, the second truncated interval of the preset length, and the second interface code as the center of the interval; Determining whether the word library includes a matching word for the second interface code sequence; the matching word is an interface code combination including the first interface code and the last interface code in the current second interface code sequence; If so, the current second interface code sequence is segmented from the current sample interface call sequence as a word segmentation result, and added to the word set corresponding to the application type. If the current sample interface call sequence has not been segmented, the step of obtaining the second interface code sequence from the current sample interface call sequence is returned to execution; If not, remove the first interface code in the current second interface code sequence, and return to the step of determining whether the vocabulary includes a matching word.

4. The method according to any one of claims 1 to 3, characterized in that The obtaining of a first interface code sequence from the sample interface call sequence according to the interval code in the sample interface call sequence, the first truncated interval of a preset length, and the first interface code as the center of the interval includes: In the sample interface call sequence, a first interception interval with a preset length of 2N+1 and a first interface code as the interval center is used to perform sequence interception to obtain an interception sequence; wherein N is a positive integer; When the interval code exists among the N interface codes before the first interface code, setting each interface code before the interval code in the intercepted sequence as the interval code; and when the interval code exists among the N interface codes after the first interface code, setting each interface code after the interval code in the intercepted sequence as the interval code; A first interface coding sequence is obtained according to the intercepted sequence obtained after setting the interval coding.

5. A method for detecting intelligent measurement terminal applications based on a word set, characterized in that: The method comprises: Acquire an actual interface call sequence corresponding to a target application to be detected by the intelligent measurement terminal; the actual interface call sequence includes interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application; Segmenting the actual interface call sequence to obtain corresponding segmented words; each segmented word is composed of at least one interface code; If all the segmented words in the actual interface call sequence are included in the word set of normal type applications, determining that the target application is the normal type application; If part of the segmented words of the actual interface call sequence is included in the word set of abnormal type applications, determining that the target application is the abnormal type application, and determining the abnormal code in the target application according to the interface call code corresponding to each interface code in part of the segmented words; Wherein, each of the word sets is obtained according to the word set acquisition method for intelligent measurement terminal application detection according to any one of claims 1 to 4.

6. A word set acquisition device for intelligent measurement terminal application detection, characterized in that: The device comprises: A sample acquisition module is configured to acquire sample interface call sequences of sample applications under multiple application types; the sample interface call sequences include interface codes and interval codes corresponding to the platform interfaces called sequentially when the sample applications are run; the interval code is inserted when the time interval between calls of two adjacent platform interfaces is greater than a preset threshold; a word embedding acquisition module, configured to acquire a first interface code sequence from the sample interface call sequence based on the interval code, the first truncated interval of a preset length, and the first interface code as the center of the interval in the sample interface call sequence; perform self-supervised training on a word embedding vector acquisition model based on the plurality of first interface code sequences; and at the end of the training, determine a word embedding vector corresponding to each of the interface codes based on the word embedding vector acquisition model; the word embedding vector acquisition model is configured to determine a word embedding vector based on each interface code in the first interface code sequence, and predict the first interface code based on the word embedding vector; A word set acquisition module is used to obtain candidate words containing at least two interface codes based on each of the sample interface call sequences, obtain the adjacency entropy corresponding to each candidate word for each candidate word, determine the overall closeness of the candidate words based on the word embedding vectors corresponding to each interface code contained in the candidate words and the occurrence probability of the interface code sequence corresponding to the candidate words, and determine the coding association of each interface code contained in the candidate words based on the adjacency entropy and the overall closeness of the candidate words, add each candidate word with the coding association greater than a preset threshold to a word library, segment the sample interface call sequences under each of the application types based on the word library, and obtain a word set for each of the application types based on the segmentation results; the word set is used to detect the application type of the intelligent measurement terminal application.

7. A smart measurement terminal application detection device based on a word set, characterized in that: The device comprises: The actual sequence acquisition module is used to obtain the actual interface call sequence corresponding to the target application to be detected by the intelligent measurement terminal; the actual interface call sequence includes the interface codes corresponding to multiple platform interfaces called in sequence during the operation of the target application; A word segmentation module is used to segment the actual interface call sequence to obtain corresponding word segments; each word segment is composed of at least one interface code; a first identification module, configured to determine that the target application is a normal type application if all the segmented words in the actual interface call sequence are included in a word set of normal type applications; a second identification module, configured to determine that the target application is the abnormal type application if some of the segmented words in the actual interface call sequence are included in the word set of the abnormal type application, and determine the abnormal code in the target application based on the interface call code corresponding to each interface code in some of the segmented words; Wherein, each of the word sets is obtained according to the word set acquisition method for intelligent measurement terminal application detection according to any one of claims 1 to 4.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 or the steps of the method according to claim 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 or the steps of the method according to claim 5 are implemented.

Images