Method and device for analyzing association relationship of mobile application software

Abstract

The invention discloses a method and a device for analyzing an association relationship of mobile application software. The method comprises the following steps of: acquiring mobile application software samples and associated software development kit data from a plurality of software distribution platforms; extracting different types of attribute information from mobile application software samples and software development kit data; constructing a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph taking different entities as graph nodes and taking an association relationship among the different entities as a node relationship; the association relationship comprises a direct association relationship among different entities and an indirect association relationship among different entities based on different attribute information; generating an entity relationship network of the mobile application software based on the multi-entity association graph; and the entity relationship network is used for performing propagation path analysis on each entity and calculating a network risk assessment value of the entity. The method is used for improving the analysis accuracy and effectiveness of the association relationship of the mobile application software.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a method and device for analyzing the association relationship of mobile application software. Background Art

[0002] This section is intended to provide a background or context for the presented embodiments of the invention. No admission is made that the description herein is prior art by virtue of its inclusion in this section.

[0003] The widespread adoption of smart mobile devices and the rapid development of the mobile internet industry have brought significant convenience to users' lives and work. However, with the increasing number of apps, issues such as apps accessing user data and infringing on user rights have also emerged, posing a threat to user privacy and financial security. Open source ecosystems, due to their open and transparent nature, have become a key target for malicious developers. These malicious behaviors, including but not limited to fee deductions, resource consumption, and forced pop-up ads, are becoming increasingly subtle, making detection and prevention more difficult.

[0004] Furthermore, the complexity of the current mobile internet ecosystem (e.g., the numerous upstream and downstream enterprise entities, the long application service chain, and the complex dissemination paths of personal information) further exacerbates the challenges of industry situation analysis, app security detection, anomaly tracing, and platform security assessment. Therefore, an effective method is needed to clarify the relationships between different entities, such as apps, developers and operators, and distribution platforms, and to build high-quality datasets and correlation analysis methods to enhance industry situation awareness and security analysis capabilities.

[0005] Currently, existing sample data primarily comes from software app stores and a small number of third-party distribution platforms, and most is obtained through web crawlers, making it difficult to ensure data integrity, timeliness, and accuracy. Current knowledge graphs primarily focus on classifying and identifying malicious families, ignoring the relationships between important entities such as third-party SDKs and developers, which limits their application scenarios. Existing methods are not well suited for apps that use hardening and obfuscation techniques, as invalid code and redundant resource information lead to a large number of invalid connections between nodes in the knowledge graph. Summary of the Invention

[0006] An embodiment of the present invention provides a method for analyzing mobile application software association relationships, which is used to more comprehensively, accurately, and effectively construct a mobile Internet multi-entity knowledge graph, thereby improving the accuracy and effectiveness of analyzing mobile application software association relationships. The method includes:

[0007] Obtaining mobile application software samples and associated software development kit data from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining a feature clustering algorithm;

[0008] Extracting different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes, and developer entity attributes;

[0009] A multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and associations between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the associations include direct associations between different entities and indirect associations between different entities based on different attribute information;

[0010] Based on the multi-entity association graph, an entity relationship network of the mobile application software is generated; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0011] The present invention also provides a device for analyzing the relationship between mobile application software, which is used to more comprehensively, accurately and effectively construct a mobile Internet multi-entity knowledge graph, thereby improving the accuracy and effectiveness of analyzing the relationship between mobile application software. The device includes:

[0012] An information acquisition module, configured to acquire mobile application software samples and associated software development kit data from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining a feature clustering algorithm;

[0013] An attribute information extraction module is used to extract different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes;

[0014] An association graph building module is configured to construct a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information;

[0015] The entity relationship network generation module is used to generate an entity relationship network of the mobile application software based on the multi-entity association graph; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0016] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for analyzing the association relationship of mobile application software when executing the computer program.

[0017] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned method for analyzing the association relationship of mobile application software when executed by a processor.

[0018] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for analyzing the association relationship of mobile application software.

[0019] In an embodiment of the present invention, mobile application software samples and associated software development kit data are obtained from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining with a feature clustering algorithm; different categories of attribute information are extracted from the mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes; a multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information; based on the multi-entity association graph, a Entity relationship network of mobile application software; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity. By obtaining data from multiple software distribution platforms, the diversity and comprehensiveness of data sources are ensured; by extracting attribute information of different categories, a wider range of attribute categories can be covered, so that the constructed knowledge graph can reflect more relationships between entities, solving the problem of incomplete knowledge graph construction, and introducing entities of more dimensions into the knowledge graph, enhancing its practicality in various application scenarios; by constructing a multi-entity association graph, multi-dimensional association analysis between mobile application software samples, software development toolkit data, software development operators and software distribution platforms is realized, and complex association networks are effectively identified; by generating an entity relationship network of mobile application software, it helps to identify and evaluate complex association relationships, and even those applications that have been reinforced and obfuscated can be effectively analyzed, improving the analysis ability and efficiency of mobile application software association relationships. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0021] Figure 1 Schematic diagram of a flow chart of a method for analyzing association relationships of mobile application software according to an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the relationship structure of a multi-entity knowledge graph in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the relationship structure of an APP and developer operator relationship network in an embodiment of the present invention;

[0024] Figure 4 This is an example of a personal information sharing relationship between enterprises in an embodiment of the present invention;

[0025] Figure 5 This is a statistical diagram of the detection rate of risky apps on a distribution platform in an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of a risky APP propagation path in an embodiment of the present invention;

[0027] Figure 7 This is a structural example diagram of a device for analyzing association relationships of mobile application software according to an embodiment of the present invention;

[0028] Figure 8 Schematic diagram of a computer device used for analyzing association relationships of mobile application software in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0030] The term "and / or" herein simply describes an association relationship, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, and the existence of B alone. In addition, the term "at least one" herein refers to any combination of at least two of any one or more of a plurality of items. For example, "at least one of A, B, and C" can represent any one or more elements selected from the set consisting of A, B, and C.

[0031] In the description of this specification, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps therein is not limited and can be appropriately adjusted as needed.

[0032] The acquisition, storage, use, and processing of data in this application's technical solution comply with relevant regulations. The information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data comply with relevant standards, adopt necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse.

[0033] It should be noted that in the embodiments of the present application, some software, components, models and other existing solutions in the industry may be mentioned. For example, some existing software tools, components, algorithm models or other well-known solutions in other technical fields may be cited. They should be regarded as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application. These references should be understood as typical examples, and their core purpose is to explain and verify the rationality and feasibility of the implementation of the technical solution proposed in the present application. However, it does not mean that the applicant has or will necessarily use the solution. Such references do not imply that the applicant has actually adopted these existing solutions, or will inevitably adopt these methods in the future during its technical implementation. In other words, these references only serve to illustrate the nature of the invention, to help understand the relationship between the innovation of the present application and the prior art and its transcendence, and do not constitute an endorsement or reliance statement on a specific prior art product.

[0034] The widespread adoption of smart mobile devices and the booming mobile internet industry have brought convenience to users' lives and work. However, apps frequently exploiting user data and infringing on their rights and interests, threatening their privacy and financial security. Open source ecosystems, due to their open and transparent nature, have become a key target for malicious developers. Risky apps, primarily engaging in malicious charges, resource depletion, and forced pop-up ads, are becoming increasingly covert in their anomalous behavior and tactics, posing threats to users' privacy, data, and financial security.

[0035] The current mobile internet ecosystem faces challenges in analyzing industry trends, detecting app security, tracing the source of anomalies, and assessing platform security due to the numerous upstream and downstream enterprise entities, the long application service chain, and the complex dissemination paths for personal information. Therefore, it is imperative to clarify the relationships between different entities, such as apps, developers and operators, and distribution platforms, build high-quality datasets and methods for analyzing app relationships, and enhance industry situational awareness and security analysis capabilities.

[0036] By analyzing the characteristics and relationships of entities such as apps, distribution platforms, and developers and operators, we build a multi-entity knowledge graph for the mobile internet. This graph provides graph-based relationship analysis and data mining capabilities, helping security testing and analysis personnel conduct comprehensive, multi-dimensional research and analysis of mobile internet security development trends and specific scenarios.

[0037] Research and practice have been conducted in the construction of app-related knowledge graphs. For example, numerous app samples are collected from distribution platforms through web crawlers and other methods, and metadata is integrated based on this data to construct knowledge graphs. Large-scale app knowledge graphs are established, and dynamic and static analysis methods are used to extract app representation information and basic attributes. Apps, publishers, and app markets are then linked by calculating attribute correlations to generate app knowledge graphs.

[0038] First, the existing sample data sources only include official stores and a small number of third-party distribution platforms, and the data is mostly obtained by web crawling. The integrity, timeliness, and accuracy of the data are difficult to guarantee, resulting in few node attribute types and missing associations. Secondly, the existing APP knowledge graph uses a large amount of code information and file structured information as the main node attributes, but invalid code and redundant resource information lead to a large number of invalid connection relationships between nodes in the knowledge graph. Most nodes are still in an isolated state. At the same time, this method cannot analyze APPs that use reinforcement and obfuscation, and its applicability is poor. Finally, the current APP knowledge graph is mainly used for malicious family classification and identification. The node and attribute settings tend to build a connection relationship between APP and malicious families, while important entities such as third-party SDKs and developers are only regarded as attribute information of APP nodes, resulting in limited association analysis scenarios.

[0039] In order to solve the above problems, the embodiment of the present invention provides a method for analyzing the relationship between mobile application software. It constructs a knowledge graph for multiple entities such as APP, SDK, developer and operator in the mobile Internet, establishes the relationship between different entities and different levels, proposes relationship mining scenarios such as developer and operator security assessment, personal information flow analysis, and distribution platform security capability analysis, and performs relationship extraction and analysis verification to more comprehensively, accurately and effectively construct a multi-entity knowledge graph for the mobile Internet, and improve the accuracy and effectiveness of the analysis of mobile application software relationship. Figure 1 , the method may include:

[0040] Step 101: Obtain mobile application software samples and associated software development kit data from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining a feature clustering algorithm;

[0041] Step 102: extracting different categories of attribute information from the mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes, and developer entity attributes;

[0042] Step 103: Construct a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and associations between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the associations include direct associations between different entities and indirect associations between different entities based on different attribute information;

[0043] Step 104: Based on the multi-entity association graph, an entity relationship network of the mobile application software is generated; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0044] In an embodiment of the present invention, mobile application software samples and associated software development kit data are obtained from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining with a feature clustering algorithm; different categories of attribute information are extracted from the mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes; a multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information; based on the multi-entity association graph, a Entity relationship network of mobile application software; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity. By obtaining data from multiple software distribution platforms, the diversity and comprehensiveness of data sources are ensured; by extracting attribute information of different categories, a wider range of attribute categories can be covered, so that the constructed knowledge graph can reflect more relationships between entities, solving the problem of incomplete knowledge graph construction, and introducing entities of more dimensions into the knowledge graph, enhancing its practicality in various application scenarios; by constructing a multi-entity association graph, multi-dimensional association analysis between mobile application software samples, software development toolkit data, software development operators and software distribution platforms is realized, and complex association networks are effectively identified; by generating an entity relationship network of mobile application software, it helps to identify and evaluate complex association relationships, and even those applications that have been reinforced and obfuscated can be effectively analyzed, improving the analysis ability and efficiency of mobile application software association relationships.

[0045] During specific implementation, step 101 is first performed: mobile application software samples and associated software development kit data are obtained from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining a feature clustering algorithm.

[0046] In one embodiment, to achieve a comprehensive analysis of mobile applications and their relationships, we first need to obtain mobile application samples and related software development kit data from multiple software distribution platforms. This step is intended to ensure that the collected data is broadly representative and accurately reflects the true state of various applications in the market.

[0047] Specifically, to build a comprehensive and diverse sample library, we collected mobile application samples from 12 mainstream domestic application distribution platforms. These platforms cover a wide range of user groups and provide a rich set of application resources. Each sample includes not only the installation package file (i.e., APK file) but also a range of metadata, such as the application package name, developer name, release date, and permission usage. This metadata is crucial for subsequent data processing and analysis, providing essential background information about the application and helping to understand its functions and purpose.

[0048] In addition, considering the widespread use of software development kits (SDKs) in modern mobile applications and their impact on security and privacy protection, this method places special emphasis on the extraction of relevant SDK data. Since SDKs usually do not have independent distribution channels but are embedded in mobile applications for dissemination, extracting SDK data directly from application samples becomes an effective means. By parsing the code structure of mobile application software samples and combining feature clustering algorithms, the third-party SDKs contained therein are identified and extracted. This process is not limited to simple file extraction, but also includes cleaning and completing the relevant attribute information of the SDK, such as supplementing missing or incomplete SDK description information by analyzing web page tag information.

[0049] After completing the aforementioned data collection, we further utilized decompilation tools to deeply analyze the binary executable files, resource files, and configuration files within the sample code packages to extract more detailed structural information. This step helped reveal the internal workings of the application, including but not limited to functional features such as permission application, service registration, and broadcast monitoring. Based on this detailed information, we could more accurately establish the relationship between the mobile application and the SDK it uses.

[0050] In summary, by systematically collecting and processing data from multiple sources, this invention effectively overcomes the existing issues of single data sources and insufficient data integrity, thereby providing strong support for security analysis of the mobile internet ecosystem. This process not only covers a wide range of application samples, but also deeply explores the development toolkits behind them.

[0051] In the above-mentioned embodiment, target mobile application software samples and associated software development kit data are obtained through multiple mobile application distribution platforms, including but not limited to official app stores, third-party app marketplaces, and open source software hosting platforms. The data collection process utilizes a combination of application programming interfaces (APIs) and web crawler technology. For platforms that offer open interfaces, structured data is obtained by invoking the platform's standard data interfaces. For platforms that don't offer open interfaces, a targeted crawling strategy based on document object model parsing is employed to obtain the mobile application software sample's installation package files and their associated metadata.

[0052] The mobile application software sample contains two types of data entities: installation package files and metadata:

[0053] The installation package file is a binary file packaged in the Android application package format or the Apple application package format, which contains executable code, resource files, and digital signature information;

[0054] Metadata includes application name, version number, developer ID, permission application list, user privacy agreement link and text description information displayed on the distribution platform, and is stored in the form of extensible markup language or structured query language database records.

[0055] During specific implementation, after performing step 101: obtaining mobile application software samples and associated software development kit data from multiple software distribution platforms, step 102 is performed: extracting different categories of attribute information from the mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes.

[0056] In the embodiment, different categories of attribute information are extracted from mobile application software samples and software development kit data, including:

[0057] Parsing software attribute information from the metadata; the software attribute information includes: application name, version number, developer identification information and permission declaration information;

[0058] Using a decompilation tool to parse the software development kit data to obtain information on code structure attributes; the code structure attributes include: function call relationships, class inheritance structure, and code complexity indicators;

[0059] Perform security detection, permission usage analysis, vulnerability scanning, and code detection on the installation package file to obtain information on security detection attributes; the security detection attribute information includes: permission usage range information, software vulnerability information, and code risk information;

[0060] The developer entity attribute information is extracted from the metadata; the developer entity attribute information includes: developer legal person information and developer enterprise information.

[0061] In one embodiment, parsing metadata of the mobile application software sample and extracting software attribute information includes:

[0062] The application name and version number, obtained by parsing the version identifier element in the XML file;

[0063] Developer identification information, including the digital certificate signature subject field and the distribution platform registration account number;

[0064] Permission declaration information, extracting a list of declared system permissions from the manifest configuration file of the installation package file, wherein the permissions involve hardware device access, user data reading and writing, and network communication functions.

[0065] In one embodiment, code structure analysis is performed on the software development kit data, specifically by:

[0066] Using decompilation tools to generate intermediate code representations, including but not limited to Jadx decompiler and Apktool reverse engineering framework;

[0067] Build a function call relationship graph based on the intermediate code, record the function entry address, parameter transfer path and return instruction location;

[0068] Analyze the class inheritance structure, generate the dependency tree between parent and child classes, and mark the implementation hierarchy of abstract classes and interfaces;

[0069] Calculate code complexity metrics, including method cyclomatic complexity, lines of code statistics, and Halstead software science metrics.

[0070] In one embodiment, a security check and analysis is performed on the installation package file, including the following check items:

[0071] Permission usage coverage analysis: Compare the declared permission list with the actual system application programming interface called to identify implicit calling behaviors of undeclared permissions;

[0072] Vulnerability scanning: Matches known vulnerability signatures against public vulnerability databases to detect buffer overflows, weak encryption algorithms, and insecure deserialization flaws.

[0073] Code risk detection: Use data flow tracking technology to discover privacy data leakage paths and mark code segments that transmit personal identity information and device identifiers without encryption.

[0074] In one embodiment, extracting developer entity attribute information from the metadata specifically includes:

[0075] Developer legal person information, parsing the unified social credit code and legal representative name in the digital certificate;

[0076] Developer company information: query the business registration address, business scope, and equity structure through the Enterprise Credit Information Publicity System interface;

[0077] Associated entity identification, based on domain name registration information and intellectual property database, establishes the holding or investment relationship between developers and other commercial entities.

[0078] In one embodiment, the extracted attribute information is classified and stored in a structured database, and the following mapping relationship is established:

[0079] The software attributes form a primary key association with the unique identifier of the mobile application software sample;

[0080] The code structure attributes are bound to the corresponding software development kit data version number through hash digest;

[0081] Security detection attributes are associated with vulnerability database entry numbers and risk assessment level codes;

[0082] The developer entity attributes are linked to the public data identifier of the Enterprise Credit Information Publicity System.

[0083] Through the above steps, we can systematically extract various attribute information from mobile application samples and software development kit data, building a detailed and multidimensional dataset. This process not only deepens our understanding of individual applications but also lays a solid foundation for subsequent knowledge graph construction and security analysis. Furthermore, this multi-layered information extraction approach facilitates a comprehensive assessment of the security status of mobile applications, improving the security of the entire ecosystem.

[0084] During specific implementation, after performing step 102: extracting different categories of attribute information from mobile application software samples and software development kit data, perform step 103: constructing a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information.

[0085] In this embodiment, each entity in the multi-entity association graph represents an independent object or subject, while the relationships between entities are defined and connected based on their attribute information. This graph not only displays direct relationships between entities, but also reveals indirect relationships formed based on different attribute information, providing strong data support for subsequent security assessments, risk predictions, and industry situation analysis.

[0086] Specifically, mobile application software samples: contain basic information of the application and its metadata, such as application name, version number, permission declaration, etc.

[0087] Software Development Kit Data (SDK): refers to third-party libraries or toolkits embedded in mobile applications to implement specific functions.

[0088] Software developer and operator: The individual or organization responsible for developing and operating the above-mentioned mobile application software. Relevant information can be obtained from public resources.

[0089] Software distribution platform: an online platform that provides application download services, such as major app stores.

[0090] In the embodiment, the Resource Description Framework (RDF) is used to model and describe the above entities and their relationships. RDF allows the connection relationship between each node to be expressed in the form of "entity-relationship-entity" triples. For example, the form "entity A-relationship X-entity B" can be used to express the existence of a certain type of relationship X between entity A and entity B.

[0091] In addition, two types of relationships can be defined to further refine the connection between entities:

[0092] Parameter-free association: used to describe relationships with high certainty, such as "development" and "release".

[0093] Parameter association: Specific numerical values ​​are assigned according to specific circumstances to quantify the strength or degree of influence of the relationship between the two, such as the amount of shared personal information.

[0094] The multi-entity association graph constructed in this way can not only clearly show the direct associations between entities, but also reveal deep indirect connections based on attribute information.

[0095] In one embodiment, the method further includes: establishing direct association relationships between different entities in the following manner:

[0096] Confirm the software development kit data embedded in the application through code analysis, and establish a direct inclusion relationship between the mobile application software sample and the software development kit data;

[0097] Based on the developer information in the metadata, a direct development relationship is established between the mobile application software sample and the software developer and operator;

[0098] Based on the developer information in the software development kit data, a direct development relationship is established between the software development kit data and the software development operator;

[0099] According to the mobile application software listing platform, a direct relationship between the mobile application software samples and the software distribution platform is established.

[0100] In one embodiment, to construct a multi-entity association graph, direct associations between different entities need to be established in the following manner:

[0101] By parsing the code of the mobile application software sample, we can confirm the embedded software development kit data. The specific steps are as follows:

[0102] Use decompilation tools to analyze the code structure of mobile application software samples.

[0103] Identify and extract any third-party software development kits (SDKs) integrated into your application.

[0104] Based on the extraction results, a direct inclusion relationship is established between the mobile application software sample and the included SDK data. This relationship indicates that the specific SDK data is indeed integrated into the specific mobile application software sample.

[0105] In one embodiment, a direct development relationship is established between the mobile application software sample and its developer and operator based on the developer information in the metadata. Specific operations include:

[0106] Parse the metadata of mobile application software samples to obtain developer identification information.

[0107] Based on the developer identification information, the specific individual or organization responsible for developing and operating the mobile application software is determined.

[0108] Establish a direct development relationship between mobile application software samples and the corresponding software development operators, and clarify the development ownership relationship between the two.

[0109] In one embodiment, a direct development relationship is established between the software development kit data and the software development operator based on the developer information in the software development kit data. The specific method is as follows:

[0110] Parse the software development kit data and extract the developer information recorded inside it.

[0111] Identify the specific individual or organization responsible for developing the SDK data.

[0112] Establish a direct development relationship between SDK data and the corresponding software development operator, ensuring that each SDK data can be traced back to its original developer.

[0113] In one embodiment, based on the actual situation of the mobile application software being put on the shelves, a direct publishing relationship is established between the mobile application software sample and the software distribution platform. The specific process is as follows:

[0114] Collect listing information of mobile application software samples on various software distribution platforms.

[0115] Based on this listing information, confirm on which software distribution platforms each mobile application software sample is specifically released.

[0116] Establish a direct publishing relationship between mobile application software samples and corresponding software distribution platforms, and clarify the release channels of application programs.

[0117] Through the above steps, we can systematically establish direct relationships between mobile application software samples, software development kit data, software developers and operators, and software distribution platforms. This approach helps clearly demonstrate the direct connections between these entities.

[0118] In one embodiment, the method further includes: establishing an indirect association relationship between different entities based on the association of different attribute information in the following manner:

[0119] For multiple entities, when the software attributes of the multiple entities are the same, determining that there is an indirect relationship of shared information between the multiple entities;

[0120] For multiple entities, when the developer entity attributes of the multiple entities are the same, it is determined that the same developer indirect relationship exists between the multiple entities.

[0121] In one embodiment, in order to more comprehensively reveal the deep connections between entities, it is also necessary to establish indirect associations based on different attribute information. Specifically, the indirect associations between multiple entities are determined by analyzing their software attributes and developer entity attributes.

[0122] In an embodiment, when multiple entities (such as mobile application software samples or software development kit data) have the same software attributes, it can be determined that there is an indirect relationship of shared information between these entities. The specific steps are as follows:

[0123] Extract relevant software attributes from each entity, including but not limited to application name, version number, permission declaration, etc.

[0124] Compare the software attributes of multiple entities and find the set of entities with the same attribute values.

[0125] If multiple entities are consistent in certain key software attributes, they are considered to have an indirect relationship of shared information. For example, if two applications request the same set of permissions or use the same SDK version, this indicates that they may share certain information or functional modules.

[0126] In this embodiment, when multiple entities have the same developer entity attribute, it can be determined that there is an indirect relationship with the same developer between these entities. The specific operation is as follows:

[0127] Extract relevant developer entity attributes from each entity, including but not limited to developer legal person information, company name, etc.

[0128] Compare the developer entity attributes of multiple entities to identify a set of entities with the same developer identifier.

[0129] If multiple entities are created or operated by the same developer, they are considered to have an indirect relationship with the same developer. For example, if the developer's legal entity information recorded in the metadata of multiple applications is consistent, it indicates that these applications are developed and maintained by the same developer or organization.

[0130] In the embodiment, parsing tools are used to extract detailed software attribute information from mobile application software samples and software development kit data. This information not only covers basic application descriptions but also technical details such as permission declarations and API call patterns.

[0131] An algorithm systematically compares the extracted software attributes to identify entity combinations with high similarity. For example, by comparing permission declaration lists, we can find which applications request the same set of permissions and infer that they may have a relationship of shared information.

[0132] Extract relevant information about the developer entity from metadata to ensure that the actual developer of each application can be accurately identified.

[0133] By comparing key fields in the developer entity attributes, such as legal person name and company registration address, we can determine which applications were created by the same developer. This helps identify the developer's activity patterns on the network and the overall security status of the applications they developed.

[0134] The indirect association relationships between different entities established through the above method can not only reveal more complex connections in the mobile Internet ecosystem, but also provide an important basis for subsequent security assessments, risk predictions and industry situation analysis.

[0135] In the above embodiment, constructing a multi-entity association graph based on the attribute information includes:

[0136] Assign corresponding unique identifiers to different entities;

[0137] The resource description framework is adopted to build a knowledge graph with the unique identifiers of different entities as graph nodes and the association relationships between different entities as node relationships.

[0138] In one embodiment, first, a unique identifier is assigned to each entity. This process ensures that each entity in the multi-entity association graph has a unique identity tag, facilitating subsequent data processing and analysis operations. The specific steps are as follows:

[0139] Each application is assigned a unique identifier, which can be generated based on information such as the application name and version number in its metadata.

[0140] For each SDK embedded in an application, a unique identifier is assigned based on its internal characteristics or metadata.

[0141] A unique identifier is assigned to each developer based on the developer's legal person information, company name and other public information.

[0142] Assign a unique identifier to each software distribution platform based on the platform's name, domain name, or other identifying information.

[0143] Next, we use the Resource Description Framework (RDF) to build a knowledge graph using the unique identifiers of different entities as graph nodes and the relationships between different entities as node relationships. The specific steps are as follows:

[0144] The unique identifiers assigned above are used as nodes in the graph. Each node represents an independent entity, such as a specific mobile application sample, a specific SDK, a specific developer, or a software distribution platform.

[0145] Establish connections between nodes based on direct and indirect relationships between entities. For example:

[0146] The nodes and relationships described above are described using RDF. RDF allows connections between nodes to be expressed as "entity-relationship-entity" triples. For example, "entity A-relationship X-entity B" can be used to express a relationship X between entity A and entity B.

[0147] The multi-entity association graph constructed using this method not only clearly displays direct connections between entities but also reveals deeper indirect connections based on attribute information. This approach helps identify potential security threats, optimizes security management within the mobile internet ecosystem, and provides decision support for stakeholders. It also provides a solid foundation for subsequent risk assessment and propagation path analysis. This systematic approach improves data organization and accessibility, making information across the entire ecosystem more transparent and manageable.

[0148] During specific implementation, after performing step 103: constructing a multi-entity association graph based on the attribute information, step 104 is performed: generating an entity relationship network of the mobile application software based on the multi-entity association graph; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0149] In one embodiment, the method further includes: calculating the network risk assessment value of the entity according to the following formula:

[0150]

[0151] Where h(C) represents the network risk assessment value of the software development operator set C; D represents the total number of software development operator entities in the software development operator set C; d represents the d-th software development operator entity in the software development operator set C; sum(risk_app d ) is the number of risky mobile application software samples associated with the d-th software development operator entity, sum(app d ) is the total number of mobile application software samples associated with the d-th software developer and operator entity. For example, h(C) represents the group or set of associated developers and operators; sum(risk_app d ) function is the number of risky apps associated with the developer and operator, sum(app d ) is the total number of apps associated with the developer operator; D represents the total number of developers and operators in the associated developer operator group or set. The h(C) value calculated using these parameters can help assess the network risk profile of a developer operator group and provide a quantitative basis for mobile application security analysis.

[0152] In one embodiment, when generating an entity relationship network, the nodes and edges in the multi-entity relationship graph are first mapped to the network. Each entity is represented as a node in the network, and the direct or indirect relationships between entities are represented as edges between nodes. This method clearly demonstrates the position of each entity in the network and their connections with each other.

[0153] For example, propagation path analysis includes the following steps:

[0154] Using the generated entity relationship network, we can perform propagation path analysis on each entity. This process includes but is not limited to:

[0155] Identify nodes with high influence in the network, which may be high-risk applications, developers, or distribution platforms.

[0156] Analyze the path of risk transmission from one node to other nodes and understand the mode and scope of risk spread.

[0157] In one embodiment, in order to quantify the risk level of an entity in the network, the network risk assessment value of the entity is calculated. For example, the risk value of a certain entity node (APP, SDK) is uniquely determined based on whether it has any security issues or violation records. The risk of the developer and operator associated with it is associated with the entity, that is, if the APP is risky, its associated developer and operator node is also determined to be risky.

[0158] This entity-relationship network-based approach not only provides detailed propagation path analysis but also effectively assesses the risk level of each entity in the network, providing a scientific basis for subsequent security management. It also helps identify and prevent new security threats, improving the security level of the entire ecosystem.

[0159] For example, the present invention establishes the connection relationship between nodes through the triple basic unit of "entity-relationship-entity", and constructs a comprehensive multi-entity relationship graph. This graph covers core entities such as mobile application software (APP), software development kit (SDK), development operators and distribution platforms, and is modeled in detail based on the various direct and indirect relationships between these entities. The following is a detailed description:

[0160] 1. Triple basic unit

[0161] In this invention, the connection relationship between each node is represented by a triplet of "entity-relationship-entity". This structure not only clearly shows the relationship between entities, but also facilitates subsequent data mining and analysis. For example:

[0162] APP and APP: Two applications may share the same SDK or other resources.

[0163] APP and SDK: An application integrates a specific SDK, forming an inclusion relationship.

[0164] APP and developer operator: An application is developed by a specific developer or organization, forming a development relationship.

[0165] APP and distribution platform: The application is published on a specific platform, forming a publishing relationship.

[0166] Sharing from APP to SDK: The application transmits personal information to a third-party SDK, forming an information flow relationship.

[0167] 2. Relationship Type

[0168] To further refine the connection between entities, the following two types of relationships are defined:

[0169] Parameter-free association: used to describe relationships with strong determinism, such as development and release. For example, "develop" means the former is developed by the latter; "market" means the former is distributed by the latter.

[0170] Parameterized association: Specific numerical values ​​are assigned to quantify the strength or impact of the relationship between two parties based on the specific circumstances. For example, "share" indicates that personal information is shared between the two parties, and the specific type of information shared can be specified, such as the device IMEI and IMSI.

[0171] 3. Entities and their relationships

[0172] ① The relationship between APP, SDK and developers and operators

[0173] Apps and SDKs: By analyzing the application code structure, identifying the integrated SDKs and establishing inclusion relationships, this helps identify third-party libraries used within the application and assess their security.

[0174] APP and developer operators: Establish a development relationship based on the developer information in the metadata and identify the actual developer of the application.

[0175] SDK and developer operators: Establish development relationships through developer information within the SDK to ensure that each SDK can be traced back to its original developer.

[0176] ② Develop and operate the connection relationship between enterprise entities

[0177] By comparing publicly available information such as the legal person information and company names of development and operation companies, it is possible to identify which applications were created by the same developer, thereby establishing indirect relationships between them. This approach helps identify the developer's network activity patterns and the overall security status of the applications they developed.

[0178] ③The relationship between personal information sharing and information flow from APP to SDK

[0179] Pay special attention to situations involving the transfer of personal information, particularly information sharing between third-party SDKs and applications. Record and analyze these data flows, including but not limited to library function calls, network data transmission, and other attribute data, to build a detailed map of personal information flows. This helps identify potential data leakage risks and protect user privacy.

[0180] 4. Knowledge graph of the spread paths and trends of risky apps across various channels

[0181] The generated entity-relationship network can be used to track the distribution of risky applications across multiple distribution platforms, assessing each platform's security management capabilities and risk diffusion trends. By analyzing historical data, potential risks can be predicted and preventative measures implemented. For example, by calculating the risk level of each developer and operator, security trends across the entire ecosystem can be dynamically monitored.

[0182] In summary, this invention achieves effective management and analysis of various entities and their complex relationships in the mobile internet environment by constructing a multi-entity knowledge graph. This systematic construction approach not only improves information transparency but also contributes to protecting user privacy and property security.

[0183] A specific embodiment is given below to illustrate the specific application of the method of the present invention.

[0184] This specific embodiment mainly includes three parts: data collection, information extraction and graph relationship construction. First, when collecting APP samples and related data, taking into account the characteristics of multiple domestic distribution channels and fragmented APP ecology, in order to ensure the integrity and consistency of relationship nodes in the knowledge graph, the present invention chooses to collect sample information of more than hundreds of thousands of APPs from multiple mainstream APP distribution platforms, including APK files and various descriptive information, such as application package name, developer name, release time, personal information processing rules, permission usage, etc.

[0185] In addition, in the process of collecting SDK samples, since SDK has no independent distribution channels and most of them are distributed in the form of official websites, it is difficult to obtain them in batches. Therefore, the present invention uses package structure analysis and feature clustering algorithms to extract third-party SDKs loaded in APP samples, and combines SDK web page tag information to clean and fill in missing or blank attributes.

[0186] The present invention mainly extracts characteristic attributes from four dimensions:

[0187] The first is the basic information of the sample, including 10 attributes such as the application package name, version number, personal information processing status, developer and operator information, permission usage, release time, and application category. This information is mainly obtained from the distribution platform;

[0188] The second is the sample structured information. Decompilation tools are used to parse the binary executable files, resource files, configuration files, etc. in the sample code package to extract 11 attributes such as permission application, service registration, broadcast monitoring, network access, sensitive API calls, and developer signatures.

[0189] The third is the sample security detection information. The present invention uses a variety of APP security analysis and detection tools to scan the sample's APP security, personal information security, user rights and other related risks and security detection results, and extracts a total of 3 attributes.

[0190] Fourth, developer and operator company information, including seven attributes obtained from public channels, including legal person information, company equity relationships, operating conditions, and affiliated companies. The target samples include not only APK installation packages but also third-party SDK package data collected through feature clustering analysis algorithms and online channels. The specific attribute types are shown in Table 1, along with the corresponding table of attribute types and main attributes.

[0191] Table 1

[0192]

[0193] After the information processing is completed, the Resource Description Framework (RDF) is used for modeling and description. The connection relationship between nodes is established through the "entity-relationship-entity" triple basic unit and the knowledge graph is constructed, which can be specifically expressed as G = {V, R, E}.

[0194] V represents a collection of entities in the knowledge graph. This paper defines four types of entity collections: apps, SDKs, developers and operators, and distribution platforms. Each node in the collection represents an independent entity and is associated with its own attribute information and specific attribute values. For example, a developer and operator node represents a specific developer and operator, which has attributes such as legal person information, company name, and company type.

[0195] R represents the set of relationships between entities in the knowledge graph, which is used to describe the correlation between different entity sets. The present invention defines two types of relationships: parameter-free correlation and parameter-based correlation to describe the correlation between APP and APP, APP and SDK, APP and developer operator, APP and distribution platform, etc.

[0196] Parameterless relationships represent defined relationships between nodes, such as the relationship between an app and its developer and operator. Parameterized relationships indicate that the relationship between two nodes is determined by a specific value or set of values, such as the personal information sharing relationship between an app and an SDK, where the shared information is the device's IMEI and IMSI. Specific relationship types and associated entities are shown in the entity relationship type table in Table 2.

[0197] Table 2

[0198]

[0199] Table 2 Entity relationship types

[0200] Among them, E:V×V→R represents the set of edges connecting nodes in two sets through the relationship R. According to the relationship type, it is divided into parameterized edges and parameterless edges. For example, sharing IMEI information from APP to SDK can be expressed as (APP,SDK)→(share:IMEI). The graph relationship structure constructed by the present invention is as follows Figure 2 A schematic diagram of the relationship structure of a multi-entity knowledge graph is shown.

[0201] For malicious developers who use different signatures to package APPs, or use different corporate entities to list on distribution platforms to circumvent platform review and security detection, the present invention uses the Louvain algorithm to quickly divide the characteristic relationship node set and construct the APP-developer operator relationship network. The APP-developer operator relationship network is as follows: Figure 3 The relationship structure of the relationship network between APP and developer operator is shown. The same developer operator node represents that there is a correlation between enterprises and they belong to the same relationship set.

[0202] In the APP-developer operator relationship network, the present invention defines the risk level h(C) to calculate the security risk level of the relationship set. The specific calculation formula is as follows:

[0203]

[0204] where sum(risk_app d ) function is the number of risky apps associated with the developer and operator, sum(app d ) is the total number of apps associated with the developer and operator. The higher the h(C) result, the lower the security risk of the relationship set.

[0205] The present invention also mines and evaluates risky apps, including identifying potentially risky apps within high-risk relationship sets, and conducting risk warnings and assessments for newly added apps. First, the relationship network associated with the app is determined based on changes in module values ​​within each relationship network. Then, correlation analysis is performed based on the risk level of the relationship network and the already marked risky apps within the network to determine whether they are risky apps with similar characteristics.

[0206] Let me give you a specific example:

[0207] Based on the personal information sharing relationship between APP, SDK and other nodes, the present invention extracts the following Figure 4The above-mentioned inter-enterprise personal information sharing relationship diagram supports analysts in conducting in-depth analysis and exploration of the flow of personal information in complex scenarios. Figure 4 A subgraph of personal information sharing relationships is displayed, which includes multiple relationship connections in which multiple APP samples share personal information with third-party SDKs. By extracting and analyzing the subordination and correlation between the corporate entities of developers and operators, 16 personal information sharing relationships between enterprises were discovered.

[0208] Based on the mobile APP distribution scenario, the information of APPs on the distribution platform in different time periods is extracted from the knowledge graph. Combined with the attribute information such as the risk APP listing platform, listing time, historical versions, and historical versions on each platform, the platform security management capabilities and the propagation path of risky APPs are counted and evaluated.

[0209] Taking into account the dynamic changes in platform security capabilities, this paper counts the number of risky apps on each platform in 2023 and calculates their detection rate. Figure 5 The following is a statistical diagram of the risky app detection rate on the distribution platform. Since the risky app detection rate is affected by multiple factors such as the platform's detection capabilities, the total number of apps on the platform, and the detection strategy, a comprehensive analysis and judgment is required.

[0210] In addition, the present invention analyzes and traces the listing status of risky APPs on various platforms, specifically Figure 6 The schematic diagram of the risk APP transmission path shown is as follows, Figure 6 The figure in the middle shows the dissemination path of a certain risky APP on the distribution platform. With the continuous upgrade of the version, the APP attempts to be listed on a certain distribution platform multiple times, and also attempts to spread to other distribution platforms.

[0211] In summary, the mobile Internet multi-entity knowledge graph in the present invention can provide graph-structured association relationship analysis and data mining capabilities, such as establishing a complete relationship between APP, SDK and developer operators, as well as the connection relationship between development and operation enterprise entities; analyzing and evaluating the security management capabilities of the distribution platform and the propagation paths and trends of risky APPs among various channels; constructing a node relationship personal information flow diagram involving attribute data such as third-party SDK library function calls and network data transmission involving personal information parameter transmission; and helping security detection and analysis personnel to conduct all-round and multi-dimensional research and analysis on the development trend of mobile Internet security and specific scenarios.

[0212] In summary, the mobile internet multi-entity knowledge graph in this invention provides graph-based relationship analysis and data mining capabilities, which are specifically reflected in the following aspects:

[0213] 1. Establish a complete relationship between APP, SDK and developers and operators, as well as the connection between corporate entities

[0214] By constructing a multi-entity association graph, the graph not only covers the direct and indirect relationships between mobile application software samples (APPs), software development kit data (SDKs), and software developers and operators, but also extends to the connections between these entities and other related entities (such as software distribution platforms). This comprehensive association helps identify complex network structures and provides a solid foundation for subsequent security assessments.

[0215] 2. Analyze and evaluate the security management capabilities of the distribution platform and the transmission paths and trends of risky apps across various channels

[0216] Using the generated entity-relationship network, we can analyze the propagation path of each entity and calculate its network risk assessment. This approach not only tracks the distribution of risky applications across multiple distribution platforms but also assesses each platform's security management capabilities and risk diffusion trends. By analyzing historical data, we can predict potential risks and implement appropriate preventative measures.

[0217] 3. Construct a personal information flow diagram involving third-party SDK library function calls and network data transmission involving personal information parameter transmission, with attribute data as node relationships

[0218] In particular, for situations involving the transfer of personal information, particularly information sharing between third-party SDKs and applications, the present invention can record and analyze these data flows. This includes, but is not limited to, attribute data such as library function calls and network data transmission, thereby creating a detailed information flow map. This map allows analysts to delve deeper into the flow patterns of personal information between different entities and identify potential data leakage risks.

[0219] 4. Support security testing and analysis personnel in conducting all-round and multi-dimensional research and analysis on the development trend of mobile Internet security and specific scenarios

[0220] The methods and technical means provided by this invention provide security monitoring and analysis personnel with a powerful tool set for monitoring and assessing the security status of the mobile internet. This technology can be used to understand the security trends of the entire ecosystem at a macro level, or to conduct in-depth analysis of specific application scenarios. Through systematic data analysis, it can not only improve awareness of existing threats, but also provide early warning of new potential threats, enhancing overall protection capabilities.

[0221] In summary, this invention, by establishing a multi-entity association graph, enables effective management and analysis of various entities and their complex relationships in the mobile internet environment, providing important technical support for improving industry situational awareness and security analysis capabilities. This approach not only promotes greater information transparency but also contributes to protecting user privacy and property security.

[0222] Of course, it is understandable that the above detailed process may have other variations, and all relevant variations should fall within the scope of protection of the present invention.

[0223] The embodiments of the present invention ensure the diversity and comprehensiveness of data sources by obtaining data from multiple software distribution platforms; by extracting attribute information of different categories, it can cover a wider range of attribute categories, so that the constructed knowledge graph can reflect more entity relationships, solve the problem of incomplete knowledge graph construction, and introduce entities of more dimensions into the knowledge graph, enhancing its practicality in various application scenarios; by constructing a multi-entity association graph, it realizes multi-dimensional association analysis between mobile application software samples, software development toolkit data, software development operators and software distribution platforms, and effectively identifies complex association networks; by generating an entity relationship network of mobile application software, it helps to identify and evaluate complex association relationships, and even those applications that have been reinforced and obfuscated can be effectively analyzed, thereby improving the analysis ability and efficiency of mobile application software association relationships.

[0224] The present invention also provides a device for analyzing mobile application software associations, as described in the following embodiments. Since the principles of the device for solving problems are similar to those of the method for analyzing mobile application software associations, the implementation of the device can refer to the implementation of the method for analyzing mobile application software associations, and the repeated parts will not be repeated.

[0225] The embodiment of the present invention also provides a mobile application software association analysis device, which is used to construct a mobile Internet multi-entity knowledge graph in a more comprehensive, accurate and effective manner, thereby improving the accuracy and effectiveness of the analysis of mobile application software associations. Figure 7 The structure of a mobile application software association analysis device shown in FIG. 1 includes:

[0226] Information acquisition module 701, configured to acquire mobile application software samples and associated software development kit data from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining it with a feature clustering algorithm;

[0227] Attribute information extraction module 702, used to extract different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes;

[0228] The association graph building module 703 is configured to construct a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information;

[0229] The entity relationship network generation module 704 is used to generate an entity relationship network of the mobile application software based on the multi-entity association graph; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0230] In one embodiment, different categories of attribute information are extracted from mobile application software samples and software development kit data, including:

[0231] Parsing software attribute information from the metadata; the software attribute information includes: application name, version number, developer identification information and permission declaration information;

[0232] Using a decompilation tool to parse the software development kit data to obtain information on code structure attributes; the code structure attributes include: function call relationships, class inheritance structure, and code complexity indicators;

[0233] Perform security detection, permission usage analysis, vulnerability scanning, and code detection on the installation package file to obtain information on security detection attributes; the security detection attribute information includes: permission usage range information, software vulnerability information, and code risk information;

[0234] The developer entity attribute information is extracted from the metadata; the developer entity attribute information includes: developer legal person information and developer enterprise information.

[0235] In one embodiment, the method further includes: establishing direct association relationships between different entities in the following manner:

[0236] Confirm the software development kit data embedded in the application through code analysis, and establish a direct inclusion relationship between the mobile application software sample and the software development kit data;

[0237] Based on the developer information in the metadata, a direct development relationship is established between the mobile application software sample and the software developer and operator;

[0238] Based on the developer information in the software development kit data, a direct development relationship is established between the software development kit data and the software development operator;

[0239] According to the mobile application software listing platform, a direct relationship between the mobile application software samples and the software distribution platform is established.

[0240] In one embodiment, the method further includes: establishing an indirect association relationship between different entities based on the association of different attribute information in the following manner:

[0241] For multiple entities, when the software attributes of the multiple entities are the same, determining that there is an indirect relationship of shared information between the multiple entities;

[0242] For multiple entities, when the developer entity attributes of the multiple entities are the same, it is determined that the same developer indirect relationship exists between the multiple entities.

[0243] In one embodiment, constructing a multi-entity association graph based on the attribute information includes:

[0244] Assign corresponding unique identifiers to different entities;

[0245] The resource description framework is adopted to build a knowledge graph with the unique identifiers of different entities as graph nodes and the association relationships between different entities as node relationships.

[0246] In one embodiment, generating an entity relationship network of the mobile application software based on the multi-entity association graph includes:

[0247] Based on the multi-entity association graph, the Louvain algorithm is used to divide the node sets of different relationships and construct an entity relationship network centered on different entities of the mobile application software.

[0248] In one embodiment, it further includes:

[0249] The entity's network risk assessment value is calculated using the following formula:

[0250]

[0251] Where h(C) represents the network risk assessment value of the software development operator set C; D represents the total number of software development operator entities in the software development operator set C; d represents the d-th software development operator entity in the software development operator set C; sum(risk_app d ) is the number of risky mobile application software samples associated with the d-th software development operator entity, sum(app d ) is the total number of mobile application software samples associated with the dth software development operator entity.

[0252] An embodiment of the present invention provides an embodiment of a computer device for implementing all or part of the content of the above-mentioned method for analyzing the association relationship of mobile application software. The computer device specifically includes the following content:

[0253] A processor, a memory, a communication interface, and a bus; wherein the processor, the memory, and the communication interface communicate with each other via the bus; the communication interface is used to implement information transmission between related devices; the computer device can be a desktop computer, a tablet computer, a mobile terminal, etc., but this embodiment is not limited thereto. In this embodiment, the computer device can be implemented with reference to the embodiment of the method for analyzing the association relationship of mobile application software and the embodiment of the device for analyzing the association relationship of mobile application software, the contents of which are incorporated herein and repeated parts are not repeated.

[0254] Figure 8 1 is a schematic block diagram of the system structure of the computer device 1000 according to an embodiment of the present application. Figure 8 As shown, the computer device 1000 may include a central processor 1001 and a memory 1002; the memory 1002 is coupled to the central processor 1001. Figure 8 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0255] In one embodiment, the analysis function of the mobile application software association relationship can be integrated into the central processing unit 1001. The central processing unit 1001 can be configured to perform the following control:

[0256] Obtaining mobile application software samples and associated software development kit data from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining a feature clustering algorithm;

[0257] Extracting different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes, and developer entity attributes;

[0258] A multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and associations between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the associations include direct associations between different entities and indirect associations between different entities based on different attribute information;

[0259] Based on the multi-entity association graph, an entity relationship network of the mobile application software is generated; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

[0260] In another embodiment, the analysis device for the mobile application software association relationship can be configured separately from the central processing unit 1001. For example, the analysis device for the mobile application software association relationship can be configured as a chip connected to the central processing unit 1001, and the analysis function of the mobile application software association relationship can be realized through the control of the central processing unit.

[0261] like Figure 8 As shown, the computer device 1000 may further include: a communication module 1003, an input unit 1004, an audio processor 1005, a display 1006, and a power supply 1007. It is worth noting that the computer device 1000 does not necessarily have to include Figure 8 In addition, the computer device 1000 may also include all components shown in Figure 8 For components not shown, reference may be made to the prior art.

[0262] like Figure 8 As shown, the central processing unit 1001 is sometimes also referred to as a controller or an operation control unit, and may include a microprocessor or other processor device and / or logic device. The central processing unit 1001 receives inputs and controls the operations of various components of the computer device 1000 .

[0263] Memory 1002 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned device-related information and may also store programs that execute the relevant information. The CPU 1001 may execute the programs stored in memory 1002 to implement information storage or processing.

[0264] Input unit 1004 provides input to CPU 1001. Input unit 1004 may be, for example, a keypad or touch input device. Power supply 1007 is used to provide power to computer device 1000. Display 1006 is used to display objects such as images and text. This display may be, for example, an LCD display, but is not limited thereto.

[0265] The memory 1002 may be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), or SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 1002 may also be some other type of device. The memory 1002 includes a buffer memory 1021 (sometimes referred to as a buffer). The memory 1002 may include an application / function storage unit 1022 for storing application programs and function programs or processes used by the central processing unit 1001 to execute the operations of the computer device 1000.

[0266] The memory 1002 may also include a data storage unit 1023 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the computer device. The driver storage unit 1024 of the memory 1002 may include various driver programs for the computer device for communication functions and / or for executing other functions of the computer device (such as messaging applications, address book applications, etc.).

[0267] The communication module 1003 is a transmitter / receiver that sends and receives signals via the antenna 1008. The communication module (transmitter / receiver) 1003 is coupled to the central processor 1001 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0268] Based on different communication technologies, multiple communication modules 1003 can be provided in the same computer device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module (transmitter / receiver) 1003 is also coupled to a speaker 1009 and a microphone 1010 via an audio processor 1005 to provide audio output via the speaker 1009 and receive audio input from the microphone 1010, thereby implementing common telecommunication functions. The audio processor 1005 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 1005 is coupled to the central processing unit 1001, enabling local recording via the microphone 1010 and playback of stored audio via the speaker 1009.

[0269] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned method for analyzing the association relationship of mobile application software when executed by a processor.

[0270] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned method for analyzing the association relationship of mobile application software.

[0271] In an embodiment of the present invention, mobile application software samples and associated software development kit data are obtained from multiple software distribution platforms; wherein the mobile application software samples include installation package files and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software samples and combining with a feature clustering algorithm; different categories of attribute information are extracted from the mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes; a multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information; based on the multi-entity association graph, a Entity relationship network of mobile application software; the entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity. By obtaining data from multiple software distribution platforms, the diversity and comprehensiveness of data sources are ensured; by extracting attribute information of different categories, a wider range of attribute categories can be covered, so that the constructed knowledge graph can reflect more relationships between entities, solving the problem of incomplete knowledge graph construction, and introducing entities of more dimensions into the knowledge graph, enhancing its practicality in various application scenarios; by constructing a multi-entity association graph, multi-dimensional association analysis between mobile application software samples, software development toolkit data, software development operators and software distribution platforms is realized, and complex association networks are effectively identified; by generating an entity relationship network of mobile application software, it helps to identify and evaluate complex association relationships, and even those applications that have been reinforced and obfuscated can be effectively analyzed, improving the analysis ability and efficiency of mobile application software association relationships.

[0272] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0273] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0274] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0275] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0276] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for analyzing the association relationship of mobile application software, characterized in that: include: Obtaining mobile application software samples and associated software development kit data from multiple software distribution platforms; The mobile application software sample includes an installation package file and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software sample and combining it with a feature clustering algorithm; Extracting different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes, and developer entity attributes; A multi-entity association graph is constructed based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and associations between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the associations include direct associations between different entities and indirect associations between different entities based on different attribute information; Generating an entity relationship network of the mobile application software based on the multi-entity association graph; The entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

2. The method according to claim 1, wherein Extract different categories of attribute information from mobile application samples and SDK data, including: Parsing software attribute information from the metadata; the software attribute information includes: application name, version number, developer identification information and permission declaration information; Using a decompilation tool to parse the software development kit data to obtain information on code structure attributes; the code structure attributes include: function call relationships, class inheritance structure, and code complexity indicators; Perform security detection, permission usage analysis, vulnerability scanning, and code detection on the installation package file to obtain information on security detection attributes; the security detection attribute information includes: permission usage range information, software vulnerability information, and code risk information; The developer entity attribute information is extracted from the metadata; the developer entity attribute information includes: developer legal person information and developer enterprise information.

3. The method according to claim 1, wherein Also includes: Create direct relationships between different entities as follows: Confirm the software development kit data embedded in the application through code analysis, and establish a direct inclusion relationship between the mobile application software sample and the software development kit data; Based on the developer information in the metadata, a direct development relationship is established between the mobile application software sample and the software developer and operator; Based on the developer information in the software development kit data, a direct development relationship is established between the software development kit data and the software development operator; According to the mobile application software listing platform, a direct relationship between the mobile application software samples and the software distribution platform is established.

4. The method according to claim 1, wherein Also includes: Indirect associations between different entities based on different attribute information are established as follows: For multiple entities, when the software attributes of the multiple entities are the same, determining that there is an indirect relationship of shared information between the multiple entities; For multiple entities, when the developer entity attributes of the multiple entities are the same, it is determined that the same developer indirect relationship exists between the multiple entities.

5. The method according to claim 1, wherein Constructing a multi-entity association graph based on the attribute information includes: Assign corresponding unique identifiers to different entities; The resource description framework is adopted to build a knowledge graph with the unique identifiers of different entities as graph nodes and the association relationships between different entities as node relationships.

6. The method according to claim 1, wherein Generating an entity relationship network of the mobile application software based on the multi-entity association graph includes: Based on the multi-entity association graph, the Louvain algorithm is used to divide the node sets of different relationships and construct an entity relationship network centered on different entities for mobile application software.

7. The method according to claim 1, wherein Also includes: The entity's network risk assessment value is calculated using the following formula: Where h(C) represents the network risk assessment value of the software development operator set C; D represents the total number of software development operator entities in the software development operator set C; d represents the d-th software development operator entity in the software development operator set C; sum(risk_app d ) is the number of risky mobile application software samples associated with the d-th software development operator entity, sum(app d ) is the total number of mobile application software samples associated with the dth software development operator entity.

8. A device for analyzing the relationship between mobile application software, characterized in that: include: An information acquisition module, used to obtain mobile application software samples and associated software development kit data from multiple software distribution platforms; The mobile application software sample includes an installation package file and metadata, and the software development kit data is extracted by parsing the code structure of the mobile application software sample and combining it with a feature clustering algorithm; An attribute information extraction module is used to extract different categories of attribute information from mobile application software samples and software development kit data: the categories include software attributes, code structure attributes, security detection attributes and developer entity attributes; An association graph building module is configured to construct a multi-entity association graph based on the attribute information; the multi-entity association graph is a knowledge graph with different entities as graph nodes and the association relationships between different entities as node relationships; the entities include mobile application software samples, software development kit data, software development operators, and software distribution platforms; the association relationships include direct association relationships between different entities and indirect association relationships between different entities based on different attribute information; An entity relationship network generation module, configured to generate an entity relationship network of the mobile application software based on the multi-entity association graph; The entity relationship network is used to perform propagation path analysis on each entity and calculate the network risk assessment value of the entity.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images