Method and device for determining risk level of application program, equipment and storage medium

Abstract

The invention provides a method and device for determining the risk level of an application program, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring a user interface image of a target application program, and inputting the user interface image into a target image recognition model and a target text recognition model; and then, obtaining violation image elements output by the target image recognition model and violation texts output by the target text recognition model. And determining a first risk level of the target application program according to the first number of the violation image elements, and determining a second risk level of the target application program according to the second number of the violation texts. And further, comparing the first risk level with the second risk level, and determining a final risk level of the target application program according to a comparison result. According to the method and the device, the violation information in the target application program can be comprehensively and accurately identified, and the risk level of the target application program can be finely determined according to the violation information.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for determining the risk level of an application. Background Art

[0002] With the growing development of internet finance, the scale of online economic platforms has shown a significant growth trend. Some illegal businesses have taken advantage of this opportunity to design and launch illegal platforms disguised as legitimate applications. For example, these illegal platforms may disguise themselves as legitimate social networking, gaming, or entertainment applications to evade regulation and attract users. Therefore, how to effectively identify and determine the risk level of applications is a key issue in information security and risk management.

[0003] Existing technologies use traditional deep learning models to extract features from a single modality of data within an application. For example, convolutional neural networks can extract visual features from an application's image data, while recurrent neural networks can extract semantic features from an application's text data. The data features extracted by the deep learning model are then fed into a classifier, which determines whether the application contains illegal content and outputs a risk rating.

[0004] However, existing technologies cannot comprehensively and accurately identify illegal information in applications, and the risk level determination process is not sophisticated enough. Summary of the Invention

[0005] The present application provides a method, apparatus, device and storage medium for determining the risk level of an application, so as to solve the technical problems that the existing technology cannot comprehensively and accurately identify illegal information in the application and the risk level determination process is not sophisticated enough.

[0006] In a first aspect, the present application provides a method for determining a risk level of an application, comprising:

[0007] Obtaining a user interface image of a target application, and inputting the user interface image into a target image recognition model and a target text recognition model; wherein the target image recognition model is used to identify illegal image elements in the user interface image, and the target text recognition model is used to identify illegal text included in the user interface image;

[0008] Obtaining the illegal image elements output by the target image recognition model, and obtaining the illegal text output by the target text recognition model;

[0009] Determining a first number of the violating image elements and a second number of the violating text; determining a first risk level of the target application based on the first number, and determining a second risk level of the target application based on the second number;

[0010] The first risk level is compared with the second risk level, and a final risk level of the target application is determined according to the comparison result.

[0011] In one possible design, the target image recognition model includes a plurality of violation recognition sub-models, wherein the violation recognition sub-models are used to recognize suspected violation image elements in the user interface image;

[0012] The obtaining of the illegal image elements output by the target image recognition model includes:

[0013] Obtaining the suspected violation image element output by the violation identification sub-model and the confidence level of the suspected violation image element;

[0014] Determining the suspected illegal image elements corresponding to the confidence levels greater than a preset threshold as the initial illegal image elements identified by the illegal identification sub-model;

[0015] Analyze the initial violation image elements identified by each violation recognition sub-model. If more than a preset number of violation recognition sub-models identify the same target initial violation image element, the target initial violation image element is determined as the violation image element and output through the target image recognition model.

[0016] In one possible design, the target text recognition model includes a text recognition sub-model and a text matching sub-model;

[0017] The obtaining of the illegal text output by the target text recognition model includes:

[0018] Based on the text recognition sub-model, identifying text elements included in the user interface image;

[0019] Sending the text element to the text matching sub-model to match the text element with a violation keyword preset in the text matching sub-model;

[0020] The text element that successfully matches the illegal keyword is determined as illegal text and output through the target text recognition model.

[0021] In one possible design, determining the first risk level of the target application based on the first quantity includes:

[0022] If the first number is greater than a first preset number threshold, determining the first risk level of the target application as high risk;

[0023] If the first number is less than or equal to a second preset number threshold, determining the first risk level of the target application as low risk;

[0024] If the first number is greater than the second preset number threshold and less than or equal to the first preset number threshold, the first risk level of the target application is determined to be medium risk.

[0025] In one possible design, determining a second risk level of the target application based on the second number includes:

[0026] If the second number is greater than a third preset number threshold, determining the second risk level of the target application as high risk;

[0027] If the second number is less than or equal to a fourth preset number threshold, determining the second risk level of the target application as low risk;

[0028] If the second number is greater than the fourth preset number threshold and less than or equal to the third preset number threshold, the second risk level of the target application is determined to be medium risk.

[0029] In one possible design, the first risk level and the second risk level both include high risk, medium risk, and low risk;

[0030] Determining the final risk level of the target application according to the comparison result includes:

[0031] If the first risk level is higher than the second risk level, determining the first risk level as the final risk level of the target application;

[0032] If the first risk level is lower than the second risk level, determining the second risk level as the final risk level of the target application;

[0033] If the first risk level is equal to the second risk level, the first risk level or the second risk level is determined as the final risk level of the target application.

[0034] In one possible design, the method further includes:

[0035] Determine pre-collected violation image element samples and known category labels corresponding to the violation image element samples as training data; perform model training based on the training data to obtain a trained initial violation recognition sub-model;

[0036] Inputting a pre-collected user interface image sample into the initial violation recognition sub-model to determine the image element output by the initial violation recognition sub-model; wherein the user interface image sample includes the image element;

[0037] Sending the image element to a pre-created target annotation platform; if the image element exists in the training data, automatically annotating the image element with a corresponding known category label based on the target annotation platform;

[0038] If the image element does not exist in the training data, a labeling request is sent to a target worker, and based on the target labeling platform, a new category label for the image element is received from the target worker;

[0039] Sending image elements that do not exist in the training data and corresponding new category labels to the incremental learning component of the initial violation identification sub-model to generate new updated training data in the incremental learning component;

[0040] The updated training data is added to the training data, and based on the updated training data, the initial violation identification sub-model is updated and trained to obtain an updated violation identification sub-model.

[0041] In a second aspect, the present application provides a device for determining a risk level of an application, comprising:

[0042] An acquisition module, used to acquire a user interface image of a target application;

[0043] An input module, configured to input the user interface image into a target image recognition model and a target text recognition model; wherein the target image recognition model is configured to identify illegal image elements in the user interface image, and the target text recognition model is configured to identify illegal text included in the user interface image;

[0044] The acquisition module is further configured to acquire the illegal image elements output by the target image recognition model, and acquire the illegal text output by the target text recognition model;

[0045] a determination module configured to determine a first number of the violating image elements and a second number of the violating texts; determine a first risk level of the target application based on the first number; and determine a second risk level of the target application based on the second number;

[0046] The determination module is further configured to compare the first risk level with the second risk level, and determine a final risk level of the target application according to the comparison result.

[0047] In one possible design, the target image recognition model includes a plurality of violation recognition sub-models, wherein the violation recognition sub-models are used to recognize suspected violation image elements in the user interface image;

[0048] The acquisition module is further configured to acquire the suspected illegal image elements output by the illegal identification sub-model and the confidence levels of the suspected illegal image elements;

[0049] The determining module is further configured to:

[0050] Determining the suspected illegal image elements corresponding to the confidence levels greater than a preset threshold as the initial illegal image elements identified by the illegal identification sub-model;

[0051] Analyze the initial violation image elements identified by each violation recognition sub-model. If more than a preset number of violation recognition sub-models identify the same target initial violation image element, the target initial violation image element is determined as the violation image element and output through the target image recognition model.

[0052] In one possible design, the target text recognition model includes a text recognition sub-model and a text matching sub-model;

[0053] The acquisition module further includes: a recognition module for recognizing text elements included in the user interface image based on the text recognition sub-model;

[0054] The apparatus for determining the risk level of an application further includes: a sending module for sending the text element to the text matching sub-model to match the text element with a violation keyword preset in the text matching sub-model;

[0055] The determination module is further configured to determine the text element that successfully matches the illegal keyword as illegal text, and output the illegal text through the target text recognition model.

[0056] In one possible design, the determining module is further configured to:

[0057] If the first number is greater than a first preset number threshold, determining the first risk level of the target application as high risk;

[0058] If the first number is less than or equal to a second preset number threshold, determining the first risk level of the target application as low risk;

[0059] If the first number is greater than the second preset number threshold and less than or equal to the first preset number threshold, the first risk level of the target application is determined to be medium risk.

[0060] In one possible design, the determining module is further configured to:

[0061] If the second number is greater than a third preset number threshold, determining the second risk level of the target application as high risk;

[0062] If the second number is less than or equal to a fourth preset number threshold, determining the second risk level of the target application as low risk;

[0063] If the second number is greater than the fourth preset number threshold and less than or equal to the third preset number threshold, the second risk level of the target application is determined to be medium risk.

[0064] In one possible design, the first risk level and the second risk level both include high risk, medium risk, and low risk;

[0065] The determining module is further configured to:

[0066] If the first risk level is higher than the second risk level, determining the first risk level as the final risk level of the target application;

[0067] If the first risk level is lower than the second risk level, determining the second risk level as the final risk level of the target application;

[0068] If the first risk level is equal to the second risk level, the first risk level or the second risk level is determined as the final risk level of the target application.

[0069] In a possible design, the determination module is further configured to determine pre-collected illegal image element samples and known category labels corresponding to the illegal image element samples as training data;

[0070] The apparatus for determining the risk level of an application further includes: a training module for performing model training based on the training data to obtain a trained initial violation identification sub-model;

[0071] The input module is further configured to input pre-collected user interface image samples into the initial violation recognition sub-model;

[0072] The determination module is further configured to determine an image element output by the initial violation identification sub-model; wherein the user interface image sample includes the image element;

[0073] The sending module is further used to send the image element to a pre-created target annotation platform;

[0074] The apparatus for determining the risk level of an application further includes: a labeling module configured to automatically label the image element with a corresponding known category label based on the target labeling platform if the image element exists in the training data;

[0075] The sending module is further configured to send a labeling request to a target worker if the image element does not exist in the training data;

[0076] The apparatus for determining the risk level of an application further includes: a receiving module for receiving, based on the target annotation platform, a new category label annotated by the target staff for the image element;

[0077] The sending module is further configured to send image elements that do not exist in the training data and corresponding new category labels to the incremental learning component of the initial violation recognition sub-model to generate new updated training data in the incremental learning component;

[0078] The input module is further configured to add the updated training data to the training data;

[0079] The training module is further configured to perform update training on the initial violation identification sub-model based on the updated training data to obtain an updated violation identification sub-model.

[0080] In a third aspect, the present application provides an electronic device, comprising:

[0081] memory and processor;

[0082] wherein the memory stores computer-executable instructions;

[0083] The processor executes the computer-executable instructions stored in the memory to implement the method for determining the risk level of an application program as described in the first aspect and various possible implementations.

[0084] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the method for determining the risk level of an application as described in the first aspect and various possible implementation methods.

[0085] In a fifth aspect, the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the method for determining the risk level of an application as described in the first aspect and various possible implementation methods.

[0086] The method, apparatus, device, and storage medium for determining the risk level of an application provided herein obtain a user interface image of a target application and input the user interface image into a target image recognition model for identifying illegal image elements in the user interface image and a target text recognition model for identifying illegal text included in the user interface image. The target image recognition model and the target text recognition model then recognize the user interface image to obtain multimodal information of the user interface image, namely, illegal image elements output by the target image recognition model and illegal text output by the target text recognition model. By identifying the multimodal information of the user interface image, the recognition coverage of illegal information in the target application is improved, thereby enabling more comprehensive and accurate capture of illegal information in the target application. Furthermore, a first risk level of the target application is determined based on a first number of illegal image elements, and a second risk level of the target application is determined based on a second number of illegal text. The first risk level is compared with the second risk level, and a final risk level of the target application is determined based on the comparison result. By analyzing the number of illegal information in the user interface image in different modalities and comparing the corresponding risk levels of the target application in different modalities, a multimodal information-based risk level determination process is implemented, enabling a more refined determination of the risk level of the target application. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0088] Figure 1 A flowchart of a method for determining the risk level of an application provided in an embodiment of the present application;

[0089] Figure 2 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 1 ;

[0090] Figure 3 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 2 ;

[0091] Figure 4 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 3 ;

[0092] Figure 5 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 4 ;

[0093] Figure 6 A schematic diagram of the structure of an apparatus for determining the risk level of an application program provided in an embodiment of the present application;

[0094] Figure 7 This is a hardware structure diagram of the electronic device provided in an embodiment of the present application.

[0095] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0096] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0097] The terms "first," "second," "third," "fourth," and so forth (if any) in the description and claims of the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequential sequence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present invention described herein can, for example, be implemented in sequences other than those illustrated or described herein.

[0098] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0099] With technological advancements and the widespread adoption of the internet, financial services are increasingly being conducted online, leading to a significant growth in the scale of online economic platforms. Some illicit businesses are capitalizing on this growth by developing platforms disguised as legitimate applications. These platforms often appear as social, gaming, or entertainment apps to evade regulation and attract users.

[0100] Because these illegal platforms can pose security risks and financial risks, it is particularly important to effectively identify and determine the risk level of applications. By identifying the true intent and functionality of applications, users can be effectively protected from potential data leaks.

[0101] Currently, with the widespread adoption of deep learning and the demand for large-scale datasets, existing technologies mostly use traditional deep learning models to extract features from a single modality of application data. For example, convolutional neural networks can extract visual features from an application's image data, while recurrent neural networks can extract semantic features from an application's text data. The data features extracted by the deep learning model are then input into a classifier, which determines whether the application contains illegal content and outputs a risk rating.

[0102] Traditional deep learning models typically process data in a single modality, such as images or text. This single-modality approach results in an incomplete understanding of the application and fails to capture the complex relationships between multiple modalities within the application. Consequently, single-modality feature extraction cannot fully capture all important features of the application, and thus cannot fully and accurately identify all violations within the application.

[0103] Furthermore, when determining an application's risk level, it's important to consider not only the application's inherent characteristics but also its diversity and complexity. If the classifier's training data is biased or unbalanced, it may overfit certain features and underrecognize others. Consequently, the classifier may be unable to process the multi-layered and multi-dimensional nature of violations, resulting in an overly simplistic and insufficiently refined risk level for the application.

[0104] This shows that existing technologies are unable to comprehensively and accurately identify illegal information in applications, and the risk level determination process is not sophisticated enough.

[0105] In response to the above technical problems, the inventors considered that relying solely on data from a single modality would not be enough to fully capture all the important features of an application. Based on this, the inventors thought of inputting the collected application data into multiple models that process data from different modalities, thereby obtaining data from multiple modalities of the application and capturing the complex relationships between multiple modalities in the application. In addition, regarding the technical problem that the risk level of an application cannot be precisely determined using a classifier, the inventors thought of first determining a risk level for the application based on the data and quantity of each modality, and then comparing these risk levels to determine the final risk level of the application, thereby achieving a refined determination of the risk level of the application.

[0106] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0107] Figure 1 A flow chart of a method for determining the risk level of an application provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the method for determining the risk level of an application includes:

[0108] S101 . Acquire a user interface image of a target application, and input the user interface image into a target image recognition model and a target text recognition model.

[0109] The target image recognition model is tasked with finding all illegal image elements in the user interface image and determining their categories and locations. The target text recognition model is used to identify illegal text included in the user interface image.

[0110] S102: Obtain the illegal image elements output by the target image recognition model, and obtain the illegal text output by the target text recognition model.

[0111] S103: Determine a first number of illegal image elements and a second number of illegal texts; determine a first risk level of the target application based on the first number, and determine a second risk level of the target application based on the second number.

[0112] It should be noted that Figure 2 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the target image recognition model includes four violation recognition sub-models. Among them, the violation recognition sub-model is used to identify suspected violation image elements in the user interface image.

[0113] Explanatory analysis shows that by training four violation recognition sub-models with different parameter configurations and using the collected user interface images as input, the four violation recognition sub-models output four different recognition results. Each recognition result includes the suspected violation image elements in each user interface image and the confidence level of the suspected violation image elements. For example, the recognition result output by a violation recognition sub-model is image1-poker-0.83, indicating that the user interface image image1 contains the suspected violation image element poker, and the confidence level of the presence of poker is 0.83.

[0114] It should be understood that suspected illegal image elements corresponding to confidence levels greater than a preset threshold (e.g., 0.5) need to be determined as the initial illegal image elements identified by the illegal recognition sub-model. After obtaining the initial illegal image elements identified by the four illegal recognition sub-models, due to the different performance of each illegal recognition sub-model, a specific strategy needs to be adopted to determine the illegal image elements ultimately output by the target image recognition model.

[0115] Specifically, the initial violation image elements identified by each violation recognition sub-model are analyzed. If more than a preset number of violation recognition sub-models all identify the same target initial violation image element, the target initial violation image element is determined as the violation image element and output through the target image recognition model.

[0116] In other words, if multiple violation recognition sub-models identify the same target initial violation image element for the same user interface image, the violation risk of that user interface image will increase significantly. For example, if all violation recognition sub-models identify the same target initial violation image element for the same user interface image, the risk level of the target application is set to high. If only one violation recognition sub-model recognizes a specific initial violation image element, the risk level of the target application is set to low, as a model misjudgment may have occurred.

[0117] It should be noted that after obtaining the violating image elements output by the target image recognition model, it is necessary to determine the first risk level of the target application based on the first number of violating image elements. In one possible implementation, if the first number is greater than a first preset number threshold, the first risk level of the target application is determined to be high risk; if the first number is less than or equal to a second preset number threshold, the first risk level of the target application is determined to be low risk; if the first number is greater than the second preset number threshold and less than or equal to the first preset number threshold, the first risk level of the target application is determined to be medium risk.

[0118] Since the target image recognition model includes multiple violation recognition sub-models, it has a faster training speed and more accurate image recognition accuracy. In addition, the output results of the target image recognition model have been comprehensively considered by multiple violation recognition sub-models, which greatly reduces the possibility of misjudgment and misjudgment, and can identify the violation image elements that may be contained in the user interface image to the greatest extent.

[0119] What needs to be explained is that Figure 3 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 2 ,like Figure 3 As shown, the training process for each violation recognition sub-model is as follows: pre-collected samples of violation image elements and the known category labels corresponding to the violation image element samples are determined as training data. Model training is performed based on this training data to obtain a trained initial violation recognition sub-model. Subsequently, a pre-collected user interface image is input into the initial violation recognition sub-model to obtain image elements output by the initial violation sub-model, wherein the user interface image includes image elements, and these image elements are violation-related. The image elements are sent to a pre-created target annotation platform, which is a semi-automated annotation platform and an image annotation tool. The target annotation platform can be written in a high-level programming language and use a corresponding software framework as its graphical interface.

[0120] If the image element exists in the training data, the target annotation platform automatically annotates the image element with the corresponding known category label, and displays the automatically annotated image element and its category label on the target annotation platform. If the image element does not exist in the training data, a labeling request is sent to the target staff member, and the new category label annotated by the target staff member for the image element is returned to the target annotation platform.

[0121] As can be seen from this, the target labeling platform can automatically detect the categories of image elements output by the initial violation recognition sub-model and label them by category through a semi-automated human-machine collaborative approach. Furthermore, image elements not present in the training data, along with their corresponding new category labels, are sent to the incremental learning component of the initial violation recognition sub-model to generate new, updated training data within the incremental learning component. This updated training data is then added to the original training data, and the initial violation recognition sub-model is updated and trained based on this updated training data, resulting in an updated violation recognition sub-model.

[0122] Incremental learning is a closed-loop machine learning approach that allows the initial violation recognition sub-model to continuously learn from new data (image elements not present in the training data, and corresponding new category labels), rather than retraining the entire initial violation recognition sub-model from scratch. This allows the initial violation recognition sub-model to continuously learn from new data, adapting to complex and changing real-world environments.

[0123] Figure 4 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 3 ,like Figure 4 As shown in the figure, incremental learning consists of three stages: weakly supervised automatic labeling, incremental learning, and target detection. The weakly supervised automatic labeling stage corresponds to the automatic and manual labeling of the target labeling platform; the incremental learning stage corresponds to the learning of new data (image elements that do not exist in the training data, and the corresponding new category labels) while retaining the old data (the original training data); the target detection stage indicates that in an open-world scenario, the initial violation recognition sub-model needs to recognize not only image elements of known categories, but also image elements of unknown categories.

[0124] It should be understood that when using a traditional deep learning model to recognize user interface images, if an image element of an unknown category is recognized, the deep learning model needs to be retrained to help the deep learning model recognize the unknown category. However, for the target image recognition model of this embodiment, which is provided with an incremental learning component, when recognizing user interface images, if an image element of an unknown category is recognized, the incremental learning component allows for continuous learning of the unknown category of image elements without the need to retrain the entire target image recognition model, thereby improving the recognition efficiency of the target image recognition model.

[0125] It should be noted that since the amount of new data is relatively small compared to the original training data, the Model-Agnostic Meta-Learning (MAML) algorithm is introduced into the incremental learning component to obtain optimal initialization parameters based on this small amount of new data. The MAML algorithm can find a suitable initial value range based on a small amount of new data, providing a good set of initialization parameters for the incremental learning component. This allows the incremental learning component to quickly fit the limited new data, thereby achieving open-world learning capabilities.

[0126] In addition, it should be noted that in order to prevent the incremental learning component from catastrophically forgetting old data when learning new data, and to enable the incremental learning component to achieve better performance and accuracy, knowledge distillation technology can also be introduced into the incremental learning component.

[0127] In the incremental learning component, knowledge distillation techniques can be used to retain old data in the initial violation identification sub-model. Figure 5 Scenario diagram of the method for determining the risk level of an application provided in an embodiment of the present application Figure 4 ,like Figure 5 As shown in the figure, when the incremental learning component receives new data, the initial violation identification sub-model can be used as a teacher model to guide the student model (the incremental learning component) to learn the new data while retaining the old data. By using the output of the initial violation identification sub-model, the incremental learning component can still consider the output distribution of the old data when learning the new data. In this case, the output of the incremental learning component can reduce the forgetting of the old data.

[0128] Furthermore, the distillation loss between the output of the incremental learning component and the output of the initial violation identification sub-model is calculated and optimized. This allows the incremental learning component to not only learn new category labels but also learn deeper knowledge from the initial violation identification sub-model, such as similarities and differences between categories. Therefore, knowledge distillation technology can help the incremental learning component maintain a small scale while keeping the performance as close as possible to that of the initial violation identification sub-model.

[0129] Next, Figure 2 The target text recognition model shown is introduced in detail. The target text recognition model adopts a text recognition model based on the segmentation text detection algorithm. The text recognition model based on the segmentation text detection algorithm is an ultra-lightweight model and supports Chinese and English number combination recognition, vertical text recognition, and long text recognition. At the same time, the text recognition model based on the segmentation text detection algorithm can achieve an image recognition rate of more than 90%, and the image processing speed is relatively fast. It usually takes only 0.5 seconds to process a 1M image. In addition, the text recognition model based on the segmentation text detection algorithm is also compatible with different operating systems, including but not limited to Windows systems, Mac systems, and Linux systems. It is also possible to further train new data sets on the basis of the text recognition model based on the segmentation text detection algorithm, and use transfer learning to deal with new problems in new businesses and new scenarios.

[0130] It should be noted that the text recognition model based on the segmented text detection algorithm of this embodiment includes a text recognition sub-model and a text matching sub-model. After a user interface image is input into the text recognition model based on the segmented text detection algorithm, the text elements included in the user interface image are first identified by the text recognition sub-model. Furthermore, the text elements are sent to the text matching sub-model to match the text elements with the violation keywords pre-set in the text matching sub-model. The text matching sub-model also outputs the matching confidence levels between the text elements.

[0131] If the matching confidence of a text element is greater than a preset threshold (such as 0.5), it indicates that the text element successfully matches the offending keyword. The text element that successfully matches the offending keyword is determined to be an offending text and outputted through the target text recognition model.

[0132] Next, a second risk level of the target application is determined based on the second number of violating texts. Specifically, if the second number is greater than a third preset number threshold, the second risk level of the target application is determined to be high risk; if the second number is less than or equal to a fourth preset number threshold, the second risk level of the target application is determined to be low risk; and if the second number is greater than the fourth preset number threshold and less than or equal to the third preset number threshold, the second risk level of the target application is determined to be medium risk.

[0133] S104: Compare the first risk level with the second risk level, and determine a final risk level of the target application according to the comparison result.

[0134] In one possible implementation, since both the first risk level and the second risk level include high risk, medium risk, and low risk, if the first risk level is higher than the second risk level, the first risk level is determined as the final risk level of the target application. If the first risk level is lower than the second risk level, the second risk level is determined as the final risk level of the target application. If the first risk level is equal to the second risk level, either the first risk level or the second risk level is determined as the final risk level of the target application.

[0135] The method for determining the risk level of an application provided in this application obtains a user interface image of a target application and inputs the user interface image into a target image recognition model and a target text recognition model, respectively. The target image recognition model is used to identify illegal image elements in the user interface image, and the target text recognition model is used to identify illegal text included in the user interface image. The target image recognition model uses multiple illegal recognition sub-models to identify the user interface image and output suspected illegal image elements and their corresponding confidence levels. Based on the suspected illegal image elements and their confidence levels, the illegal image elements in the image modality output by the target image recognition model are further determined. Next, the user interface image is identified using the text recognition sub-model and text matching sub-model included in the target text recognition model, and illegal text in the text modality output by the target text recognition model is determined based on the recognition results. By identifying multimodal information in the user interface image, the recognition coverage of illegal information in the target application is improved, thereby enabling more comprehensive and accurate capture of illegal information in the target application. Furthermore, a first risk level of the target application is determined based on a first number of illegal image elements, and a second risk level of the target application is determined based on a second number of illegal text elements. The first risk level is compared with the second risk level. If the first risk level is higher than the second risk level, the first risk level is determined as the final risk level of the target application. If the first risk level is lower than the second risk level, the second risk level is determined as the final risk level of the target application. If the first risk level is equal to the second risk level, either the first risk level or the second risk level is determined as the final risk level of the target application. By analyzing the number of violation messages in different modalities of the user interface image and comparing the corresponding risk levels of the target application in different modalities, a multi-modal information and multi-level risk level determination process is achieved, enabling a more refined determination of the target application's risk level.

[0136] Figure 6 A schematic diagram of the structure of the device for determining the risk level of an application provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the apparatus 600 for determining the risk level of an application program includes: an acquisition module 601, an input module 602, and a determination module 603;

[0137] The acquisition module 601 is used to acquire the user interface image of the target application;

[0138] Input module 602, configured to input the user interface image into a target image recognition model and a target text recognition model; wherein the target image recognition model is configured to identify illegal image elements in the user interface image, and the target text recognition model is configured to identify illegal text included in the user interface image;

[0139] The acquisition module 601 is further configured to acquire the illegal image elements output by the target image recognition model and the illegal text output by the target text recognition model;

[0140] A determination module 603 is configured to determine a first number of illegal image elements and a second number of illegal texts; determine a first risk level of the target application based on the first number, and determine a second risk level of the target application based on the second number;

[0141] The determination module 603 is further configured to compare the first risk level with the second risk level, and determine a final risk level of the target application according to the comparison result.

[0142] In one possible design, the target image recognition model includes a plurality of violation recognition sub-models, wherein the violation recognition sub-model is used to recognize suspected violation image elements in the user interface image;

[0143] The acquisition module 601 is further configured to acquire the suspected illegal image elements output by the illegal identification sub-model and the confidence levels of the suspected illegal image elements;

[0144] The determination module 603 is further configured to:

[0145] Determine the suspected illegal image elements corresponding to the confidence levels greater than a preset threshold as the initial illegal image elements identified by the illegal identification sub-model;

[0146] Analyze the initial violation image elements identified by each violation recognition sub-model. If more than a preset number of violation recognition sub-models identify the same target initial violation image element, the target initial violation image element is determined as the violation image element and output through the target image recognition model.

[0147] In one possible design, the target text recognition model includes a text recognition sub-model and a text matching sub-model;

[0148] The acquisition module 601 further includes: a recognition module 604 for recognizing text elements included in the user interface image based on the text recognition sub-model;

[0149] The apparatus 600 for determining the risk level of an application further includes: a sending module 605 for sending the text element to the text matching sub-model to match the text element with a violation keyword preset in the text matching sub-model;

[0150] The determination module 603 is further configured to determine the text elements that successfully match the illegal keywords as illegal texts and output them through the target text recognition model.

[0151] In one possible design, the determining module 603 is further configured to:

[0152] If the first number is greater than a first preset number threshold, determining the first risk level of the target application as high risk;

[0153] If the first number is less than or equal to a second preset number threshold, determining the first risk level of the target application as low risk;

[0154] If the first number is greater than the second preset number threshold and less than or equal to the first preset number threshold, the first risk level of the target application is determined to be medium risk.

[0155] In one possible design, the determining module 603 is further configured to:

[0156] If the second number is greater than a third preset number threshold, determining the second risk level of the target application as high risk;

[0157] If the second number is less than or equal to a fourth preset number threshold, determining the second risk level of the target application as low risk;

[0158] If the second number is greater than the fourth preset number threshold and less than or equal to the third preset number threshold, the second risk level of the target application is determined to be medium risk.

[0159] In one possible design, both the first risk level and the second risk level include high risk, medium risk, and low risk;

[0160] The determination module 603 is further configured to:

[0161] If the first risk level is higher than the second risk level, determining the first risk level as the final risk level of the target application;

[0162] If the first risk level is lower than the second risk level, determining the second risk level as the final risk level of the target application;

[0163] If the first risk level is equal to the second risk level, the first risk level or the second risk level is determined as the final risk level of the target application.

[0164] In one possible design, the determination module 603 is further configured to determine pre-collected illegal image element samples and known category labels corresponding to the illegal image element samples as training data;

[0165] The apparatus 600 for determining the risk level of an application further includes: a training module 606 for performing model training based on training data to obtain a trained initial violation identification sub-model;

[0166] The input module 602 is further configured to input pre-collected user interface image samples into the initial violation recognition sub-model;

[0167] The determination module 603 is further configured to determine the image elements output by the initial violation identification sub-model; wherein the user interface image sample includes the image elements;

[0168] The sending module 605 is further used to send the image elements to a pre-created target annotation platform;

[0169] The apparatus 600 for determining the risk level of an application further includes: a labeling module 607 for automatically labeling corresponding known category labels for image elements based on a target labeling platform when image elements exist in the training data;

[0170] The sending module 605 is further configured to send a labeling request to a target worker if the image element does not exist in the training data;

[0171] The apparatus 600 for determining the risk level of an application further includes: a receiving module 608 for receiving, based on a target annotation platform, a new category label annotated by a target worker for an image element;

[0172] The sending module 605 is further configured to send the image elements that do not exist in the training data and the corresponding new category labels to the incremental learning component of the initial violation recognition sub-model to generate new updated training data in the incremental learning component;

[0173] The input module 602 is further configured to add updated training data to the training data;

[0174] The training module 606 is further configured to perform update training on the initial violation identification sub-model based on the updated training data to obtain an updated violation identification sub-model.

[0175] The device for determining the risk level of an application provided in an embodiment of the present application can be used to execute the method for determining the risk level of an application in any of the above embodiments. The implementation principles and technical effects are similar and will not be repeated here.

[0176] It should be noted that it should be understood that the division of the various modules of the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by processing elements; they can also all be implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. In addition, these modules can be fully or partially integrated together or implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or by instructions in the form of software.

[0177] Figure 7 This is the hardware structure diagram of the electronic device provided in this application. Figure 7 As shown, the electronic device 700 includes:

[0178] Processor 701 and memory 702;

[0179] Memory stores computer-executable instructions;

[0180] The processor executes the computer-executable instructions stored in the memory 702 , so that the electronic device executes the above-mentioned method for determining the risk level of an application program.

[0181] It should be understood that the processor 701 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention can be directly implemented as being executed by a hardware processor, or can be implemented by a combination of hardware and software modules in the processor. The memory 702 may include high-speed random access memory (RAM), and may also include non-volatile memory (NVM), such as at least one disk storage, and can also be a USB flash drive, a mobile hard disk, a read-only memory, a disk or an optical disk, etc.

[0182] The electronic device provided in the embodiment of the present application can be used to execute the method for determining the risk level of an application provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0183] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the method for determining the risk level of an application as described above.

[0184] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it is used to implement the method for determining the risk level of an application as described above.

[0185] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0186] It should be further noted that, although the various steps in the flowchart are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps may be performed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but may be performed at different times. The execution order of these sub-steps or stages is not necessarily to be performed in sequence, but may be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0187] It should be understood that the above-described device embodiments are merely illustrative, and the device of the present application may also be implemented in other ways. For example, the division of units / modules in the above-described embodiments is merely a logical functional division, and actual implementations may employ other division methods. For example, multiple units, modules, or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0188] In addition, unless otherwise specified, the functional units / modules in the various embodiments of the present application may be integrated into a single unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The aforementioned integrated units / modules may be implemented in the form of hardware or software program modules.

[0189] If the integrated unit / module is implemented in hardware, the hardware may be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor may be any appropriate hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC. Unless otherwise specified, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0190] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0191] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a particular embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined in any way. To keep the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0192] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0193] It should be understood that the present application is not limited to the exact structure described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for determining the risk level of an application, characterized in that: include: Obtaining a user interface image of a target application, and inputting the user interface image into a target image recognition model and a target text recognition model; wherein the target image recognition model is used to identify illegal image elements in the user interface image, and the target text recognition model is used to identify illegal text included in the user interface image; Obtaining the illegal image elements output by the target image recognition model, and obtaining the illegal text output by the target text recognition model; Determining a first number of the violating image elements and a second number of the violating text; determining a first risk level of the target application based on the first number, and determining a second risk level of the target application based on the second number; The first risk level is compared with the second risk level, and a final risk level of the target application is determined according to the comparison result.

2. The method according to claim 1, characterized in that The target image recognition model includes a plurality of violation recognition sub-models, wherein the violation recognition sub-models are used to recognize suspected violation image elements in the user interface image; The obtaining of the illegal image elements output by the target image recognition model includes: Obtaining the suspected violation image element output by the violation identification sub-model and the confidence level of the suspected violation image element; Determining the suspected illegal image elements corresponding to the confidence levels greater than a preset threshold as the initial illegal image elements identified by the illegal identification sub-model; Analyze the initial violation image elements identified by each violation recognition sub-model. If more than a preset number of violation recognition sub-models identify the same target initial violation image element, the target initial violation image element is determined as the violation image element and output through the target image recognition model.

3. The method according to claim 1, characterized in that The target text recognition model includes a text recognition sub-model and a text matching sub-model; The obtaining of the illegal text output by the target text recognition model includes: Based on the text recognition sub-model, identifying text elements included in the user interface image; Sending the text element to the text matching sub-model to match the text element with a violation keyword preset in the text matching sub-model; The text element that successfully matches the illegal keyword is determined as illegal text and output through the target text recognition model.

4. The method according to claim 1, wherein Determining a first risk level of the target application based on the first quantity includes: If the first number is greater than a first preset number threshold, determining the first risk level of the target application as high risk; If the first number is less than or equal to a second preset number threshold, determining the first risk level of the target application as low risk; If the first number is greater than the second preset number threshold and less than or equal to the first preset number threshold, the first risk level of the target application is determined to be medium risk.

5. The method according to claim 1, wherein Determining a second risk level of the target application based on the second number includes: If the second number is greater than a third preset number threshold, determining the second risk level of the target application as high risk; If the second number is less than or equal to a fourth preset number threshold, determining the second risk level of the target application as low risk; If the second number is greater than the fourth preset number threshold and less than or equal to the third preset number threshold, the second risk level of the target application is determined to be medium risk.

6. The method according to claim 1, characterized in that The first risk level and the second risk level both include high risk, medium risk and low risk; Determining the final risk level of the target application according to the comparison result includes: If the first risk level is higher than the second risk level, determining the first risk level as the final risk level of the target application; If the first risk level is lower than the second risk level, determining the second risk level as the final risk level of the target application; If the first risk level is equal to the second risk level, the first risk level or the second risk level is determined as the final risk level of the target application.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Determine pre-collected violation image element samples and known category labels corresponding to the violation image element samples as training data; perform model training based on the training data to obtain a trained initial violation recognition sub-model; Inputting a pre-collected user interface image sample into the initial violation recognition sub-model to determine the image element output by the initial violation recognition sub-model; wherein the user interface image sample includes the image element; Sending the image element to a pre-created target annotation platform; if the image element exists in the training data, automatically annotating the image element with a corresponding known category label based on the target annotation platform; If the image element does not exist in the training data, a labeling request is sent to a target worker, and based on the target labeling platform, a new category label for the image element is received from the target worker; Sending image elements that do not exist in the training data and corresponding new category labels to the incremental learning component of the initial violation identification sub-model to generate new updated training data in the incremental learning component; The updated training data is added to the training data, and based on the updated training data, the initial violation identification sub-model is updated and trained to obtain an updated violation identification sub-model.

8. A device for determining the risk level of an application, characterized in that: include: An acquisition module, used to acquire a user interface image of a target application; An input module, configured to input the user interface image into a target image recognition model and a target text recognition model; wherein the target image recognition model is configured to identify illegal image elements in the user interface image, and the target text recognition model is configured to identify illegal text included in the user interface image; The acquisition module is further configured to acquire the illegal image elements output by the target image recognition model, and acquire the illegal text output by the target text recognition model; a determination module configured to determine a first number of the violating image elements and a second number of the violating texts; determine a first risk level of the target application based on the first number; and determine a second risk level of the target application based on the second number; The determination module is further configured to compare the first risk level with the second risk level, and determine a final risk level of the target application according to the comparison result.

9. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method for determining the risk level of an application according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method for determining the risk level of an application according to any one of claims 1 to 7.

Images