Application detection method, electronic equipment and system

Abstract

The invention discloses an application detection method, electronic equipment and a system, relates to the technical field of electronic equipment, and can accurately detect the face changing risk of an application and improve the equipment safety. The method comprises the steps that in the application running process, a running interface of an application is displayed; under the condition that the similarity between the running interface of the application and the racking interface corresponding to the application is smaller than a first threshold value, first prompt information is presented, and the first prompt information is used for prompting a user that the application has the face changing risk. By adopting the method, the similarity between the running interface and the racking interface of the application is small, which means that the interface is changed after the application is racked, and the terminal determines that the application has a face changing risk according to the change. Therefore, even if the application adopts a confrontation mode such as an IP address, the terminal can still detect the face changing behavior of the application because the running interface is changed relative to the racking interface, so that the detection effect of the face changing application can be improved, and the equipment safety is further improved.

Description

Technical Field

[0001] The present application relates to the technical field of electronic equipment, and in particular to an application detection method, electronic equipment, and system. Background Art

[0002] Currently, some face-changing applications (APPs) exist. These applications can exhibit multiple behavior patterns and activate different functions or features under different operating conditions. For example, a face-changing application may pass app market review but subsequently perform malicious actions if certain conditions are met. This suggests that the existence of face-changing applications can lead to potential privacy leaks and low security. Summary of the Invention

[0003] An application detection method, electronic device, and system can improve the detection effect of face-changing applications and thereby enhance device security.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, an application detection method is provided, which can be applied to a terminal or a component (such as a chip) having or supporting terminal functions, and the method includes: during the running of the application, displaying the running interface of the application; when the similarity between the running interface of the application and the shelf interface corresponding to the application is less than a first threshold, presenting a first prompt information, wherein the first prompt information is used to prompt the user that the application has a risk of face change.

[0006] Using this method, if the similarity between the app's running interface and the app's launch interface is low, it means the interface has changed since the app was launched. Based on this, the terminal determines that the app has a risk of face-changing. This way, even if the app uses countermeasures such as IP address, the terminal can still detect the app's face-changing behavior because the running interface has changed compared to the launch interface. This improves the detection of face-changing apps and thus enhances device security.

[0007] In one possible design, the similarity between the running interface of the application and the corresponding shelf interface is less than a first threshold, including: the similarity between the first running interface of the application and the corresponding first shelf interface is less than the first threshold.

[0008] Alternatively, the similarity between the running interface of the application and the corresponding listing interface is less than a first threshold, including: the similarity between the N running interfaces of the application and the corresponding N listing interfaces is less than the first threshold, where N is an integer greater than 1.

[0009] By adopting this method, multiple running interfaces of the application are changed relative to the corresponding launch interface. The terminal can determine that the application has a face-changing risk, which can improve the accuracy of face-changing detection.

[0010] Exemplarily, there are multiple first running interfaces, such as interfaces A, B, C, and D, which are all first running interfaces. Running interface A corresponds to shelf interface A', running interface B corresponds to shelf interface B', running interface C corresponds to shelf interface C', and running interface D corresponds to shelf interface D'. When the similarity between the running interface A and the shelf interface A' of the application is less than the first threshold, the similarity between the running interface B and the shelf interface B' is less than the first threshold, the similarity between the running interface C and the shelf interface C' is less than the first threshold, and the similarity between the running interface D and the shelf interface D' is less than the first threshold, the terminal can determine that the application has a risk of face-changing.

[0011] In one possible design, the method further includes: comparing the similarity between the second running interface of the application and the corresponding second listing interface; the second running interface includes the first running interface.

[0012] Alternatively, the method further includes: comparing the similarities between the M running interfaces of the application and the corresponding M listing interfaces; the M running interfaces include the N running interfaces, M is a positive integer, and N is greater than a third threshold.

[0013] In one possible design, comparing the similarity between the second running interface of the application and the corresponding second shelf interface includes: comparing the similarity between the features of the second running interface and the features of the second shelf interface; wherein, the features of each second running interface are determined based on the information of the second running interface, and the features of each second shelf interface are determined based on the information of the second shelf interface; the information of the second running interface includes at least one of the following information: a screenshot of the second running interface, the text of the second running interface, the layout of the second running interface, or the interface call sequence of the second running interface; the information of the second shelf interface includes at least one of the following information: a screenshot of the second shelf interface, the text of the second shelf interface, the layout of the second shelf interface, or the interface call sequence of the second shelf interface.

[0014] For example, after the application is put on the shelf, the text of the interface may change, but the change of text does not mean a face change. For example, the product text of a shopping application may change frequently, but the interface has not been substantially modified and will not cause security risks. In addition, the interface layout and API call sequence of the application are usually unchanged. If they change, the application may have a face-changing behavior. Based on this, the terminal may not compare the features of the text of the interface. The terminal compares the similarity between the features of the screenshot of the running interface, the features of the layout, the features of the interface call sequence and the features of the screenshot of the shelf interface, the features of the layout, and the features of the interface call sequence. For example, the features of the screenshot of the running interface, the features of the layout, and the features of the interface call sequence can constitute a vector (which can be called a running feature), and the features of the screenshot of the shelf interface, the features of the layout, and the features of the interface call sequence can constitute a vector (which can be called a shelf feature). The terminal can compare the similarity between the running features and the shelf features of the application.

[0015] The operation characteristics may include more or fewer characteristics, and similarly, the listing characteristics may include more or fewer characteristics. As long as the operation characteristics and the listing characteristics can be compared to determine whether the application has substantially changed its interface after being listed, it will be sufficient.

[0016] By adopting this method, the information of the interface can be converted into corresponding features, which can reduce redundant information and reduce storage and transmission consumption.

[0017] In a possible design, the method further includes: when the risk level of the application is greater than a second threshold, obtaining characteristics of the application's listing interface from the server.

[0018] This method, on the one hand, can capture the features of a high-risk app's launch interface. This helps determine whether the high-risk app carries a risk of face-changing based on the features of the launch interface and the features of the high-risk app's runtime interface, thereby reducing the security risks of high-risk apps. Furthermore, it eliminates the need to capture the features of the launch interface of low-risk apps, reducing transmission overhead.

[0019] In a possible design, obtaining the characteristics of the application's launch interface from the server includes: obtaining the characteristics of the application's launch interface from the server during the process of downloading the application.

[0020] In a possible design, obtaining the characteristics of the application's launch interface from the server includes: obtaining the characteristics of the application's launch interface from the server during the running of the application.

[0021] In one possible design, the method further includes: obtaining a classifier from a server, the classifier being used to identify whether an application is a risky application; the training sample of the classifier includes features of the listing interfaces of P applications, where P is an integer greater than 1; and during the process of running the application, inputting the features of the running interface of the application into the classifier, and the classifier identifying whether the application is a risky application.

[0022] Optionally, the training samples of the classifier may also include features of the running interface of the risk application.

[0023] Optionally, the P applications include risk applications.

[0024] In a possible design, it further includes: when the application is a risky application, presenting second prompt information, wherein the second prompt information is used to prompt the user that the application has a security risk.

[0025] Optionally, the method further includes: obtaining information of the running interface of the application during the running of the application.

[0026] In one possible design, the feature of the running interface is that the information of the running interface is input into the model, and the vector feature is output by the model; the feature of the listing interface is that the information of the listing interface is input into the model, and the vector feature is output by the model.

[0027] In a second aspect, an application detection method is provided, which can be applied to a server or a component (such as a chip) that has or supports server functions. The method may include: obtaining characteristics of the application's shelf interface; sending the characteristics of the application's shelf interface to a terminal; the characteristics of the application's shelf interface and the characteristics of the running interface corresponding to the application are used to determine whether the application has a risk of face change.

[0028] In one possible design, the characteristics of each of the listing interfaces are determined based on the information of the listing interface; the information of the listing interface includes at least one of the following information: a screenshot of the listing interface, the text of the listing interface, the layout of the listing interface, or the interface call sequence of the listing interface.

[0029] In one possible design, the method further includes: training a classifier; the classifier is used to identify whether an application is a risky application; the training samples of the classifier include features of the listing interfaces of P applications, where P is an integer greater than 1; and sending the classifier to the terminal.

[0030] In a third aspect, the present application provides an application detection device, including a functional module, unit, or means for executing a method as described in any possible design of any of the above aspects of the present application. The module may be implemented by software or hardware, or a combination of software and hardware. The device may include a processing unit and a communication unit, without limitation.

[0031] In a fourth aspect, the technical solution of the present application provides an application detection device, comprising: a processor configured to execute any of the methods designed in any of the above aspects.

[0032] Optionally, the device further includes the memory and / or communication interface.

[0033] The communication interface is coupled to the processor, and is used to input and / or output information.

[0034] The memory is used to store computer programs, and the processor is configured to execute any of the above-mentioned methods of any design, which can be implemented as: executing the computer program stored in the memory to execute any of the above-mentioned methods of any design.

[0035] Alternatively, the processor may be a hardware-implemented circuit, such as an artificial intelligence (AI) processor, to increase operating speed. This application does not limit the specific implementation of the processor.

[0036] Optionally, the application detection device may be a complete device, or a module in the device, such as a chip.

[0037] In a fifth aspect, the technical solution of the present application provides a computer-readable storage medium, including computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes any possible design method in any of the above aspects.

[0038] In a sixth aspect, the technical solution of the present application provides a computer program product, which, when running on an electronic device, enables the electronic device to execute any possible design method in any of the above aspects.

[0039] In a seventh aspect, the technical solution of the present application provides a circuit system (or chip system), the circuit system including a processing circuit, the processing circuit configured to perform any of the possible design methods of any of the above aspects. The processing circuit can be implemented as a corresponding circuit component, such as one or more processors. Another example is a processor and memory. Another example is a processor and a transceiver.

[0040] In an eighth aspect, an electronic device is provided, comprising: a display screen, a processor and a memory, wherein the display screen and the memory are coupled to the processor, the memory is used to store program code, the program code includes instructions, and the processor reads the instructions from the memory so that the electronic device executes the method described in any one of the above aspects and any one of the designs therein.

[0041] In the ninth aspect, the present application provides a chip system comprising at least one processor and at least one interface circuit, wherein the at least one interface circuit is used to perform transceiver functions and send instructions to the at least one processor. When the at least one processor executes the instructions, the at least one processor executes the method described in the first aspect above and any one of the designs therein.

[0042] In a tenth aspect, the technical solution of the present application provides an application detection system, which includes a terminal and a server in any possible design of any of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Schematic diagram of application detection scenarios provided for related technologies;

[0044] Figure 2 、 Figure 3 A schematic diagram of the application detection architecture provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the architecture of an electronic device provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the interface provided in an embodiment of the present application;

[0047] Figure 6 A flow chart of the application detection method provided in an embodiment of the present application;

[0048] Figure 7 、 Figure 8 A schematic diagram of the interface provided in an embodiment of the present application;

[0049] Figure 9 A schematic diagram of a scenario for generating a feature vector according to an embodiment of the present application;

[0050] Figure 10 、 Figure 11 A flow chart of the application detection method provided in an embodiment of the present application;

[0051] Figure 12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0052] Figure 13 A schematic structural diagram of a chip system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In the description of this application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in this application is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0054] In the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, a and b, a and c, b and c, a, b, and c, where a, b, and c can be single or plural.

[0055] In addition, to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first" and "second" do not limit the quantity or execution order, and the words "first" and "second" do not necessarily mean different.

[0056] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information in the technical solutions of the embodiments of this application are in compliance with relevant laws and regulations and do not violate public order and good morals. For example, in the technical solutions of the embodiments of this application, the processing of user personal information is performed with the user's authorization, which is explained here and will not be repeated below.

[0057] Face-changing apps may contain one or more normal functions, as well as one or more hidden, potentially malicious, deeper functions. These functions may be activated when certain conditions are met, effectively implementing face-changing behavior. For example, a face-changing app may determine whether to provide specific functions or services for a device based on device information such as the device model, operating system version, and hardware configuration, or optimize application execution efficiency based on the device's performance. Alternatively, a face-changing app may determine whether to adjust its behavior to implement hidden functions based on the user's geographic location or the device's Internet Protocol (IP) address range. Alternatively, a face-changing app may activate hidden functions at specific times or time periods. Alternatively, a face-changing app may trigger hidden functions based on user behavior patterns or usage habits. Alternatively, a face-changing app may activate hidden functions when connected to a specific server or when specific network conditions are met. Alternatively, a face-changing app may activate hidden functions based on user characteristics such as age, gender, and interests. Alternatively, a face-changing app may activate hidden functions based on instructions from a server.

[0058] For example, a face-changing application performs hidden functions at night, providing a high-risk operation interface that may cause financial losses to users.

[0059] In some examples, the face-changing application can implement the face-changing behavior by executing dynamic code or Webview.

[0060] Currently, the security testing methods for face-changing applications include static analysis and dynamic analysis. Static analysis is also called static testing, while dynamic analysis is also called dynamic testing.

[0061] For static analysis, the server analyzes the target application's source code or binary files during the release process to detect potential security vulnerabilities. For example, the server obtains the target application's data flow and control flow and analyzes them using taint analysis techniques to generate static analysis results.

[0062] For dynamic analysis methods, during the target application launch process, the server simulates the target application's operating environment using an emulator or a real device and runs the target application in that environment. The server can also simulate user operations to evaluate the target application's behavior and responses to detect potential vulnerabilities. For example, the server configures a dynamic detection operating environment and uses a dynamic control traversal tool to execute a fixed sequence of operation events to obtain dynamic detection results. The device can output the detection results of the target application based on the static analysis results and / or dynamic detection results.

[0063] In some examples, after the target application is launched, the server may also regularly perform static analysis and dynamic analysis on the target application to determine whether the target application is a face-changing application.

[0064] While current application detection methods can identify some face-changing apps, their accuracy needs to be improved. For example, a face-changing app might use IP address rules to perform face-changing operations within certain IP address ranges but not within others, thus engaging in IP address manipulation. It's difficult for servers to determine the IP address ranges within which a face-changing app performs face-changing operations, making it highly likely that they won't be able to detect the application's face-changing behavior.

[0065] For another example, face-changing applications have model-based confrontation behaviors. Specifically, face-changing applications can adjust the behavior of the application based on the user's device model, operating system version, screen resolution and other information. For another example, face-changing applications have crowd-based confrontation behaviors. Specifically, face-changing applications can analyze users' personal information, behavior patterns, social network relationships and other data, divide users into different groups, and display different application interfaces or provide different functions for different groups. These confrontation behaviors are very complex and difficult to predict, and it is difficult for the server to detect the face-changing behaviors implemented by the face-changing application. Figure 1 An example of the process from application launch to application adversarial detection is shown.

[0066] It can be seen that face-changing applications may not have any problems during the launch stage, but once they are launched, face-changing applications may evade or resist detection through adversarial behaviors such as IP addresses, regions, models, and crowds, affecting the security of users using devices.

[0067] Based on this, an embodiment of the present application provides an application detection method. After an application is released, the terminal can compare the application's operating characteristics with its release characteristics. If the operating characteristics of the application differ significantly from the release characteristics, the terminal can determine that the application has changed its face after being released. In this way, even if the application uses countermeasures such as IP address, the terminal can still detect the application's face-changing behavior because the operating characteristics have changed compared to the release characteristics, which can improve the detection effect of face-changing applications and thus enhance device security.

[0068] For example, Figure 2 FIG. 1 shows a schematic diagram of the architecture of a communication system to which an application detection method is applied according to an embodiment of the present application. Figure 2 As shown, the communication system includes a terminal device 201 and a server 202, etc.

[0069] Among them, the server 202 can be a server for providing security detection services for applications. For example, the server extracts the listing features of the target application during the listing phase of the target application. For another example, during the running phase of the target application, the server provides the listing features of the application to the terminal device 201, so that the terminal device 201 compares the listing features of the application with the running features of the target application, and then determines whether the target application is a face-changing application. The specific implementation of feature comparison can be found in the following text. Listing features refer to the application interface features generated during the listing phase, which can characterize the interface characteristics of the application during the listing phase. Running features refer to the application interface features generated during the running phase, which can characterize the interface characteristics of the application during the running phase.

[0070] In this article, the launch phase can also be referred to as the launch detection phase, with no limitation to the name. The operational characteristics can also be referred to as the runtime characteristics, with no limitation to the name.

[0071] Optionally, the server 202 may be a device or server with computing capabilities, such as a cloud server or a network server, and may be a single server, a server cluster consisting of multiple servers, or a cloud computing service center.

[0072] The terminal device 201 can be any device with an application installed. The terminal can be used to extract the running characteristics of the target application during the running phase of the target application and compare the listing characteristics obtained from the server with the running characteristics of the target application to identify the face-changing application.

[0073] Exemplarily, the terminal device 201 may include, but is not limited to, a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an artificial intelligence (AI) device, a wearable device, an in-vehicle device, a smart home device, and / or a smart city device. Optionally, the terminal device 201 may be a fixed device or a portable device. The embodiments of the present application do not impose any particular restrictions on the specific type of the terminal device.

[0074] Optionally, the terminal device 201 and the server 202 may be connected via wired communication technology and / or wireless communication technology. The wireless communication technology includes, but is not limited to, at least one of the following: wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Zigbee, frequency modulation (FM), infrared (IR), and wide area networks (WANs) switched via relay devices.

[0075] Exemplarily, when the wireless communication technology is the above-mentioned wide area network, the wireless communication technology can be a third-generation wireless telephone technology (3G) network, a fourth-generation mobile communication technology (4G) network, a fifth-generation mobile communication technology (5G) network, a future evolved public land mobile network (PLMN) or the Internet, etc.

[0076] Figure 3 Another architecture example of a communication system is shown. Figure 3 The server can deploy a simulator or a real device. For example, a simulator can be software. For example, a real device can be a hardware unit, module, or device. The server can simulate the device hardware and operating system operating environment using a simulator or a real device, allowing the target application to be run and tested within this operating environment. This operating environment, which simulates real user devices and usage scenarios, is called a test environment. The following example mainly uses "running and testing the target application using a simulator."

[0077] Still Figure 3 The server runs the target application through the simulator and can obtain one or more of the following information: a screenshot of the launch interface, the interface text of the launch interface, the layout information of the launch interface, or the interface call sequence of the launch interface. The launch interface of the application refers to the interface of the application during the launch stage.

[0078] A screenshot of an interface can also be called a picture of the interface, an image of the interface, or simply the interface, with no limit on the name.

[0079] Layout information: This refers to the layout structure corresponding to the interface, which records the hierarchical relationship of interface elements. For example, the layout structure of the current homepage is a tree data structure. For example, this layout information can be in XML or JSON format. As a possible implementation method, when running the application in the above test environment, the simulator can obtain the layout information of the application interface through the application framework.

[0080] The application framework is also called the runtime framework or application execution framework. For example, the application framework in some systems is called Application Framework, while that in Hongmeng OS is called ARKUI.

[0081] An interface call sequence, also known as an application programming interface (API) call sequence, refers to the system APIs that are called during the application's execution to display the corresponding interface or implement certain functions. The interface call sequence records the order in which the application calls the APIs during the display of the interface.

[0082] An API call sequence, also known as an API call set (without limitation), may include one or more APIs called by an application. The simulator can record these API call sequences. As one possible implementation, in the aforementioned test environment, the simulator can obtain the API call sequence through the application framework.

[0083] For example, the interface screenshots include: screenshots of the homepage of the application and screenshots of the first-level interface. The homepage can also be called the main page.

[0084] Exemplarily, the interface text is the text contained in the above interface screenshot. As a possible implementation, the simulator can recognize the text in the interface screenshot through optical character recognition (OCR).

[0085] As a possible implementation, Figure 3 ,The simulator can input interface screenshots, layout information, interface call sequences, and interface text into the model, and the model will output the corresponding listing features of each interface.

[0086] Exemplarily, the application's listed features are vectorized representations of information. Listed features can also be referred to as the application's listed embedding, listed feature vectors, listed package features, or listed feature libraries. Exemplarily, the listed embedding is a fixed-length, low-dimensional, dense vector. This vector representation can capture the semantic relationships between inputs, ensuring that similar inputs have similar representations in the vector space.

[0087] Still Figure 3 , after the application is put on the shelf, the terminal can download and install the target application from the application market. The terminal can provide a model execution environment, and the terminal can run the target application in the model execution environment. Exemplarily, the model execution environment runs on a graphics processing unit (GPU) and / or a neural-network processing unit (NPU). In the process of running the target application, the terminal can obtain one or more of the following operating characteristics of the target application: an interface screenshot of the running interface, the interface text of the running interface, the layout information of the running interface, or the interface call sequence of the running interface. For an introduction to the interface screenshots, interface text, layout information, and interface call sequence of the running interface and how to obtain them, please refer to the relevant content of the listing interface and will not be repeated here.

[0088] As a possible implementation method, Figure 3 The terminal can input the model with screenshots of the running interface, layout information, interface call sequence, and interface text. The model then outputs the running characteristics of the corresponding interface of the target application. For an introduction to the running characteristics and how to obtain them, please refer to the relevant content of the listed characteristics, which will not be repeated here.

[0089] Afterwards, the terminal can input the listing characteristics and operation characteristics of the target application into the comparison model, which will compare the similarity between the listing characteristics and the operation characteristics and output the comparison results. In some examples, if the similarity between the listing characteristics and the operation characteristics of the target application is high, it means that the interface of the target application has not changed after being launched, and the terminal determines that the target application has not changed its face. Conversely, if the similarity between the listing characteristics and the operation characteristics of the target application is low, it means that the interface of the target application has changed after being launched, and the terminal determines that the target application has changed its face.

[0090] Subsequently, app market reviewers can review apps for security issues, such as compliance and privacy concerns. For example, reviewers can determine the app's security based on the server's security testing results.

[0091] I understand. Figure 2 、 Figure 3 This is a simplified diagram for ease of understanding only. In actual application, Figure 2 、 Figure 3 The communication system shown may also include other devices, such as other terminal devices.

[0092] For example, Figure 4 FIG1 shows a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may be the terminal mentioned above. Figure 4As shown, the electronic device 300 may include a processor 110, a memory 120, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a button 180, a display screen 190, etc.

[0093] The processor 110 may include one or more processing units, for example, an application processor (AP), a modem processor, a GPU, an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or an NPU. The different processing units may be independent devices or integrated into one or more processors.

[0094] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0095] Processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in processor 110 is a cache memory. This memory can store instructions or data that have just been used or are being recycled by processor 110. If processor 110 needs to use the same instruction or data again, it can directly retrieve it from the memory. This avoids duplicate accesses, reduces processor 110 latency, and thus improves system efficiency.

[0096] In some embodiments of the present application, taking the electronic device 300 as a terminal as an example, the processor 110 can be used to compare the similarity between the running interface of the application and the shelf interface of the application, and determine whether the application has a risk of face-changing based on the similarity.

[0097] In some embodiments, the processor 110 may include one or more interfaces, such as a USB interface 130 .

[0098] The charging management module 140 is configured to receive charging input from a charger. While charging the battery 142 , the charging management module 140 can also provide power to the electronic device through the power management module 141 .

[0099] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to provide power to the processor 110, the memory 120, the display 190, and the wireless communication module 160.

[0100] The wireless communication function of the electronic device 300 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0101] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 300 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.

[0102] The mobile communication module 150 can provide wireless communication solutions including 2G / 3G / 4G / 5G applied on the electronic device 300.

[0103] The wireless communication module 160 can provide wireless communication solutions for application on the electronic device 300, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), Star Flash, global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared technology (IR), etc.

[0104] In some embodiments, antenna 1 of electronic device 300 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, so that electronic device 300 can communicate with a network and other devices through wireless communication technology. Wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, star flash, GNSS, WLAN, NFC, FM, and / or IR technology, etc. GNSS may include the global positioning system (GPS), the global navigation satellite system (GLONASS), the Beidou navigation satellite system (BDS), the quasi-zenith satellite system (QZSS) and / or the satellite based augmentation system (SBAS).

[0105] In some embodiments of the present application, taking the electronic device 300 as a mobile phone as an example, when the mobile phone is running an application, the mobile phone can obtain the features of the application's launch interface from the server via the mobile communication module 150 or the wireless communication module 160. The mobile phone can compare the similarity between the features of the application's launch interface and the features of the application's running interface, and determine whether the application is a face-changing application based on the similarity.

[0106] The display screen 190 is used to display images, videos, etc. The display screen 190 includes a display panel. Taking the electronic device 300 as a terminal as an example, the terminal can display a first prompt message through the display screen 190, and the first prompt message is used to prompt the user that the application has a risk of face change.

[0107] The memory 120 can be used to store computer executable program code, and the executable program code includes instructions. The memory 120 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function, etc. The data storage area can store data created during the use of the electronic device 300, etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 300 by running instructions stored in the memory 120 and / or instructions stored in a memory provided in the processor.

[0108] The audio module 170 is used to convert digital audio information into analog audio signal output, and also to convert analog audio input into digital audio signal. The audio module 170 can also be used to encode and decode audio signals.

[0109] The buttons 180 include a power button, a volume button, etc. The buttons 180 may be mechanical buttons or touch buttons. The electronic device 300 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 300.

[0110] Herein, the server may include a processor. The server may also include a memory and a communication module. The introduction of the processor, memory, and communication module can be found above and will not be repeated here.

[0111] Figure 4 The illustrated structure does not constitute a specific limitation on the terminal or server. In other embodiments of the present application, the terminal or server may include more or fewer components than shown in the figure, or combine or separate certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0112] The technical solutions of the embodiments of the present application are described in detail below with reference to scenarios and examples.

[0113] In some embodiments, the terminal may run the target application and compare the running characteristics and the listing characteristics of the target application to identify whether the target application is a face-changing application.

[0114] For example: Take the target application as application y1, Figure 5As shown in (1), the terminal can display the interface 501 of the application market. In response to the user clicking the "Install" button of application y1, the terminal downloads and installs application y1. After installing application y1, the terminal can run the application y1 and calculate the running characteristics of the running interface of application y1. The terminal can also obtain the listing characteristics of the listing interface of application y1 from the server. For example, the terminal calculates Figure 5 The operation characteristics of the home page interface 502 shown in (2) and the ... Figure 5 The terminal can also calculate the running characteristics of other detected interfaces, such as Figure 5 (2) shows the operating characteristics of the first-level interface labeled xxx, the operating characteristics of the first-level interface labeled yyy, and the operating characteristics of the first-level interface labeled "My". Accordingly, the terminal can obtain the listing characteristics of the corresponding detected interfaces from the server, such as obtaining the listing characteristics of the first-level interface labeled xxx, the listing characteristics of the first-level interface labeled yyy, and the listing characteristics of the first-level interface labeled "My". The terminal can compare the listing characteristics and operating characteristics of application y1 based on this.

[0115] In some examples, the terminal compares the listing characteristics and operation characteristics of application y1, which can be implemented as follows: the terminal determines Figure 5 The operating characteristics of the home page interface 502 shown in (2) are the same as Figure 5 The similarity between the listing features of the home page interface 503 shown in (3) is low, which means that after application y1 is listed, application y1 changes the home page interface during the user's use of application y1, and there is a face-changing behavior with security risks. The terminal can also compare the similarity between the operating features of other detected interfaces and the listing features. For example, the similarity between the operating features of each other first-level interface and the listing features is compared. If application y1 changes more detected interfaces after being listed, the terminal can determine that application y1 is a face-changing application based on this.

[0116] In other examples, after comparing the listing features and operation features of application y1, the terminal determines that the similarity between the operation features and the listing features of the detected interface is high, which means that the detected interface of application y1 has not been changed after it was put on the shelf, and there is no face-changing behavior that poses a security risk. The terminal can therefore determine that application y1 is not a face-changing application.

[0117] For example, Figure 6 A schematic diagram of a process flow of an application detection method provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the method may include the following steps:

[0118] S101, during the application listing phase, the server obtains the application listing interface information.

[0119] As a possible implementation, developers can submit their applications for listing through the app market portal or API. After receiving the application, the app market server can perform security checks on the application, such as those for privacy concerns, viruses, content compliance, power consumption, and performance. Applications that don't meet these requirements can be rejected by the server and sent to the developer for revision.

[0120] The security detection process may include dynamic analysis. During the dynamic analysis process, the server can automatically execute all functions of the application through the testing tool, determine the operation status of the application, and record any abnormal behavior or errors of the application. During the operation of the application, the server can traverse the application interface through a real machine or simulator. During the dynamic analysis process, the server can obtain and record one or more of the following listing interface information of the application: a screenshot of the listing interface, the text of the listing interface, the layout information of the listing interface, or the interface call sequence of the listing interface. For example, the server obtains screenshot information of the listing interface through dynamic analysis. Subsequently, when the text of the listing interface is needed, the server can obtain the text through OCR.

[0121] The launch interface may include the homepage and first-level interface of the application during the launch phase. Optionally, given the deep interface layers of hidden functions in face-changing applications, the server may also capture and record screenshots of second-level, third-level, and other interfaces to detect the face-changing application's face-changing behavior on deeper interfaces. This is not limited. For example, a second-level interface is the interface accessed from the homepage interface.

[0122] As a possible implementation method, the server may also obtain and record the paths of each listing interface, such as the path of the home page and the path of the first-level interface.

[0123] For example, after dynamic analysis, the server can obtain the following information:

[0124] {

[0125] Path 1 of Shelf Interface 1: {screenshot of Shelf Interface 1, text of Shelf Interface 1, layout of Shelf Interface 1, API call sequence of Shelf Interface 1}

[0126] Path 2 of Shelf Interface 2: {screenshot of Shelf Interface 2, text of Shelf Interface 2, layout of Shelf Interface 2, API call sequence of Shelf Interface 2}

[0127] Path 3 of Shelf Interface 3: {Screenshot of Shelf Interface 3, Text of Shelf Interface 3, Layout of Shelf Interface 3, API Call Sequence of Shelf Interface 3}

[0128] Path 4 of listing interface 4: {screenshot of listing interface 4, text of listing interface 4, layout of listing interface 4, API call sequence of listing interface 4}

[0129] …}

[0130] For example, the screenshot of the shelf interface 1 is as follows: Figure 5 As shown in (3). Path 1 of the shelf interface 1 is homepage / page / index. Figure 7 , the text in the listing interface 1 includes: xxxx, payment, yy1... Among them, the text in the listing interface 1 is marked in light gray.

[0131] For example, the layout of the shelf interface 1 is Figure 8 The tree data structure shown in (1). Column 503 in the tree data structure corresponds to Figure 8 The “payment” icon in the listing interface 1 shown in (2).

[0132] For example, during the application running process, the following APIs are called to display the listing interface 1:

[0133] AbilityDelegatorRegistry.getAbilityDelegator()

[0134] AbilityDelegatorRegistry.getArguments()

[0135] abilityDelegator.startAbility()

[0136] …

[0137] As a possible implementation method, the server may store information of the application listing interface.

[0138] As a possible implementation method, the application can be put on the application market after passing the security test.

[0139] S102: The server obtains application listing features based on the information on the listing interface.

[0140] As a possible implementation, the server may encode one or more pieces of information from the launch interface to extract feature information from the application launch interface and obtain the application launch features. For example, the server may convert the launch interface information into a feature vector. For example, the server may input the launch interface information into a pre-trained AI algorithm to obtain the feature vector.

[0141] Taking into account that the screenshots of the listing interface are in picture format, which takes up a large amount of storage space and is computationally complex, the server can vectorize the screenshots of the listing interface to reduce the storage space occupied and the computational complexity. For example, the vectorization method can be a convolutional neural network (CNN) method. The server can convert the screenshots of the listing interface into a fixed-length feature vector through a combination of convolutional layers, pooling layers, and fully connected layers in CNN. The feature vector can capture the key high-level semantic information of the screenshot. For another example, the server can use a deep learning model to extract features of the screenshot, such as a visual geometry group model (VGG), a ResNet model, an Inception model, and the like. The deep learning model is, for example, pre-trained with a large data set. For another example, Figure 9 The server can also convert the screenshot of the listing interface into a corresponding feature vector using a pre-trained masked autoencoder (MAE). Alternatively, the server can use other AI models to convert the screenshot of the listing interface into a corresponding feature vector.

[0142] For example, the server can obtain the vector output by the layer before the fully connected layer of the above model and use this vector as the feature vector of the screenshot, which can represent the screenshot. In this way, the server can convert the screenshot into a feature vector through corresponding methods, significantly reducing the redundant information of the screenshot.

[0143] For example, the server can also convert the text on the product listing interface into corresponding feature vectors using a pre-trained word embedding model. Word embedding models can be, but are not limited to, Word2Vec, GloVe, FastText, or Bert. For example, the text "Attachment 1 km, quality restaurant, coffee and milk tea, group dinner, delicious boutique restaurant..." is converted into the following feature vector:

[0144] tensor([[[-0.3024,0.3087,-0.8989,...,0.9185,-0.2070,0.2339],

[0145] [-0.1675,0.8403,-0.6591,...,-0.3065,-0.7560,-0.1686],

[0146] [0.4785,0.5022,0.1371,...,0.3834,-0.0758,-0.7355],

[0147] [0.5819,0.1774,-0.7730,...,-0.0341,0.0499,-0.3812],

[0148] [0.4661,0.7347,-0.5661,...,-0.2218,-0.1496,0.1043],

[0149] [0.1340,0.5956,-0.7074,...,1.9568,0.0031,0.2969]…]]).

[0150] Exemplarily, the server may use the layout information of the listing interface as the feature information of the listing interface. Alternatively, the server may convert the layout information of the listing interface into a corresponding feature vector, and use the feature vector as the feature information of the listing interface. For example, converting a tree data structure into a feature vector can be implemented as follows: converting the nodes and edges in the tree into corresponding numerical vectors. The converted numerical vectors can be conveniently used in machine learning models. For example, a tree data structure is converted into the corresponding following feature vector: [0.1, 0.2, 0.3, ..., 0.9, 1.0].

[0151] Exemplarily, the server may also convert the application's API call sequence into a corresponding feature vector. For example, the server may use a method similar to natural language processing to obtain a feature vector corresponding to the API call sequence. In a specific processing example, the server may pre-process the called API, such as serializing it, to obtain an API call sequence. For example, to display a certain interface, 10 APIs need to be called. The 10 APIs include an API for obtaining device information, an API for storing files, and an API for saving images. The server may sort these 10 APIs to obtain the API call sequence for the interface.

[0152] The server can input the processed API call sequence into the selected word embedding model, which generates the corresponding feature vector. For example, the word embedding model can be Word2Vec, GloVe, or a context-aware embedding model, without limitation. The context-aware embedding model is, for example, BERT.

[0153] The feature information of any two of the screenshots, text, layout, and API call sequences of the calculation interface can use the same or different models without restriction.

[0154] As a possible implementation, after obtaining feature vectors for the screenshot of the listing interface, the text in the listing interface, the layout of the listing interface, and the API call sequence of the listing interface, the server can concatenate the above multiple feature vectors to form a single vector. For example, the following listing features of the application are obtained:

[0155] {

[0156] Path 1 of Shelf Interface 1: Feature information [[Feature information of screenshot of Shelf Interface 1], [Feature information of text of Shelf Interface 1], [Feature information of layout of Shelf Interface 1], [Feature information of API call sequence of Shelf Interface 1]]

[0157] Path 2 of Shelf Interface 2: Feature information [[Feature information of the screenshot of Shelf Interface 2], [Feature information of the text of Shelf Interface 2], [Feature information of the layout of Shelf Interface 2], [Feature information of the API call sequence of Shelf Interface 2]]

[0158] Path 3 of Shelf Interface 3: Feature information [[Feature information of the screenshot of Shelf Interface 3], [Feature information of the text of Shelf Interface 3], [Feature information of the layout of Shelf Interface 3], [Feature information of the API call sequence of Shelf Interface 3]]

[0159] …}.

[0160] As described above, the listing features of an application include the listing features of multiple listing interfaces.

[0161] In the above example, the listing characteristics include the characteristics of the screenshot of the listing interface, the characteristics of the text in the listing interface, the characteristics of the layout of the listing interface, and the characteristics of the API call sequence of the listing interface. In other embodiments, the listing characteristics may also include only the characteristics of the screenshot of the listing interface. Alternatively, the listing characteristics may include the characteristics of the screenshot of the listing interface and at least one of the other three characteristics.

[0162] In some embodiments, the server may also use other methods to calculate the above-mentioned listing features, which are not limited.

[0163] S103: Listing features of the server storage application.

[0164] S104: The terminal installs the application.

[0165] For example, the user downloads and installs the application through an application market or the like.

[0166] S105. The terminal determines whether the risk level of the application is high. If the risk level of the application is low, the terminal ends the process. If the risk level of the application is high, the terminal executes the following S106.

[0167] It is understood that after installing an application, the terminal may adopt different strategies based on the application's risk level. As one possible implementation method, after installing an application, the terminal determines whether to enable face change detection for the application based on the application's risk level. For high-risk applications, the terminal may continue to perform subsequent steps to detect whether the application is a face change application. Conversely, for low-risk applications, the terminal may skip the face change detection step. For example, for high-trust applications such as instant messaging applications and consulting applications, the terminal may skip the face change detection step.

[0168] As a possible implementation, the terminal may be configured with a whitelist or blacklist, with the whitelist including low-risk applications and the blacklist including high-risk applications. A high risk level may refer to a risk level greater than a second threshold. For example, the whitelist may include applications with a large number of installations, while the blacklist may include applications with a small number of installations.

[0169] S106: The terminal obtains the listing characteristics of the application.

[0170] As one possible implementation, for high-risk apps, after the app is installed, the terminal can request the app's listing characteristics from the server. In response to the terminal's request, the server can send the listing characteristics to the terminal. The terminal can then download the listing characteristics. Exemplarily, the listing characteristics are in a vectorized representation format and are relatively small in size.

[0171] For example, the server contains features of a screenshot of the listing interface, features of the text in the listing interface, features of the layout of the listing interface, and features of the API call sequence of the listing interface, and the terminal downloads these four listing features from the server. For another example, the server contains features of a screenshot of the listing interface, and the terminal downloads the features of the screenshot of the listing interface from the server.

[0172] S107: The terminal runs the application and obtains information about the running interface of the application.

[0173] While an application is running, the terminal can obtain screenshots, text, layout, and API call sequences of the current running interface based on the application interface the terminal enters. For example, when an application is running and first enters the homepage, the terminal can obtain a screenshot of the homepage, the text on the homepage, the API call sequence for the homepage, and the layout of the homepage. Subsequently, the terminal enters running interface A of the application and obtains a screenshot of running interface A, the text on running interface A, the API call sequence for running interface A, and the layout of running interface A.

[0174] For example, after the application's homepage is rendered, the terminal can retrieve screenshots of the application's various running interfaces from the GPU buffer. For example, when the terminal enters a new running interface, the application framework can retrieve a screenshot of that running interface from the GPU buffer. This way, the screenshot can be retrieved from the GPU buffer, significantly reducing the impact on system performance.

[0175] Exemplarily, while obtaining the screenshot of the running interface, the terminal can obtain the layout of the running interface through the application framework.

[0176] For example, while obtaining the screenshot of the running interface, the terminal can obtain the API call sequence of the running interface through the application framework. For example, the API call sequence of the running interface is consistent with the API call sequence of the shelf interface.

[0177] For example, after obtaining a screenshot of the running interface, the API call sequence, and the layout, the terminal can use OCR to recognize the text of the running interface. The above method of obtaining the API call sequence, layout, and text of the running interface is only an example. The terminal can also use other methods to obtain the information of the running interface, and the timing of obtaining each information is not limited.

[0178] Optionally, the terminal may store information of the running interface of the application.

[0179] S108: The terminal calculates the running characteristics of the application based on the information of the running interface.

[0180] As a possible implementation, the terminal can use a vectorization algorithm to convert the runtime interface information into the application's runtime characteristics. For example, the terminal inputs the runtime interface information into a model, which then outputs the application's runtime characteristics. For example, this model uses the same vectorization algorithm as the server's model used to calculate the listing characteristics.

[0181] For example, the terminal uses the corresponding AI model to calculate the feature vectors of the screenshots, text, API call sequence, and layout of the running interface, and then stitches these feature vectors into the application's running characteristics. The specific implementation process can be referred to the relevant content of the server's calculation of the listing characteristics, which will not be repeated here.

[0182] Optionally, the terminal may store the running characteristics of the application.

[0183] S109 , the terminal compares the similarity between the listing characteristics of the application and the running characteristics of the application. If the similarity is high, the terminal ends the process; if the similarity is low, the terminal continues to execute the following step S110 .

[0184] Among them, the similarity represents the degree of similarity between the listing characteristics and the operation characteristics.

[0185] As a possible implementation, the terminal may calculate the cross entropy between the listing features of the listing interface and the running features of the running interface. The cross entropy may represent the similarity between the listing features of the listing interface and the running features of the running interface. As a possible implementation, the terminal may directly calculate the cosine similarity between the listing features of the listing interface and the running features of the running interface.

[0186] For example, the listing features of listing interface 1 are as follows: {Path 1 of listing interface 1: Feature information [[Feature information of the screenshot of listing interface 1], [Feature information of the text of listing interface 1], [Feature information of the layout of listing interface 1], [Feature information of the API call sequence of listing interface 1]]}. The terminal can calculate the cross entropy between the listing features and the running features of the corresponding running interface. Similarly, the terminal can compare the listing features of other listing interfaces with the running features of the corresponding running interfaces to determine the degree of similarity between the listing interface and the corresponding running interface.

[0187] In the embodiments of the present application, if the degree of similarity between the launch interface and the operational interface is low, the launch interface and the operational interface can be referred to as face-changing interfaces. Conversely, if the degree of similarity between the launch interface and the operational interface is low, the launch interface and the operational interface can be referred to as non-face-changing interfaces. For example, if the degree of similarity between the homepage during the launch phase and the homepage during the operational phase is low, the homepage can be referred to as a face-changing interface.

[0188] As a possible implementation, a similarity greater than or equal to a similarity threshold may be considered high. Conversely, a similarity less than the similarity threshold may be considered low. The phrase "similarity greater than or equal to the similarity threshold" may also be understood or replaced by "similarity greater than the similarity threshold."

[0189] As one possible implementation, the terminal compares the similarity between the listing features of M listing screens and the operational features of the corresponding M operational screens. If the similarity between the listing features of more than N listing screens and the operational features of the corresponding N operational screens exceeds a similarity threshold, the terminal determines that the similarity between the listing features and the operational features of the application is high. Both M and N are positive integers.

[0190] Alternatively, the terminal compares the similarity between the listing features of the M listing interfaces and the running features of the corresponding M running interfaces. If the similarity between the listing features of the listing interfaces that are higher than the ratio threshold and the running features of the corresponding N running interfaces is higher than the similarity threshold, the terminal determines that the similarity between the listing features and the running features of the application is high. That is, when the non-face-changing interfaces in the M interfaces are higher than a certain proportion, the terminal can determine that the similarity between the listing features and the running features of the application is high, and the application has no face-changing risk, and the terminal can end this detection process. On the contrary, if the number of face-changing interfaces is large, the terminal can determine that the similarity between the listing features and the running features of the application is low, and the application may have face-changing behavior, and the terminal can continue to execute the following step S110.

[0191] For example, M is 5 and N is 3. Among the five launch screens, the similarity between the launch features of four (or more than three) launch screens and the running features of the corresponding running screens exceeds the similarity threshold. This means that these four launch screens have not been modified since the application was launched, or have been modified without affecting security.

[0192] In the above, the terminal compares the features of the screenshots, text features, API call sequence features, and layout features of the interface in the running stage and the shelf stage as an example. In other embodiments, the terminal can also directly compare the API call sequence, layout, and text of the interface in the running stage and the shelf stage, and compare the features of the screenshots of the interface in the running stage and the shelf stage. That is, the API call sequence, layout, and text may not be vectorized.

[0193] For example, taking a shopping app as an example, the products displayed in the app may change, so the screenshot of the app's running interface may differ from the screenshot of the listing interface. However, other features of the shopping app may remain unchanged, such as the layout of the homepage, which still includes the search box and product-related buttons. Another example is the homepage API call sequence. In this paper, by comparing multiple features of the listing interface and the running interface, we can prevent misidentification of app face changes and improve the accuracy of face change detection.

[0194] In some embodiments, the terminal may also calculate the similarity through an AI model without limitation.

[0195] S110: The terminal presents a prompt message, which is used to remind the user that the application has a risk of face-changing.

[0196] If the similarity between the application's listing characteristics and its running characteristics is low, it means that the running interface of the application has been changed after it was launched, and the terminal can determine that the application has a risk of face-changing. The terminal can present a prompt message to remind the user that the application has a risk of face-changing. In this way, the user can choose to exit, uninstall or close the application based on the prompt message to improve device security. For example, if Figure 5 (2), the terminal may display a prompt message as shown in 504 in the operation interface 502. The prompt message may also be in other forms, such as other texts, other UI styles, without limitation. For another example, the terminal may also present the prompt message in the form of voice playback, without limitation.

[0197] Prompt information, also known as warning information, the name is not limited.

[0198] Optionally, for applications that pose a risk of face-changing, the terminal can also prompt users to mark and report them.

[0199] Optionally, for applications with a risk of face-changing, the terminal may report the application's operating characteristics and / or the application's operating interface information to the server. Optionally, the terminal may also report one or more of the following information to the server: the application package of the application, the model of the terminal, the IP address of the terminal, the IP address segment of the terminal, or the area where the terminal is located. Accordingly, the server can obtain data reported by multiple terminals and perform cluster analysis based on these data. If the application has face-changing behavior, such as changing the operating interface (face-changing) in different areas, changing the face for different models, or changing the face for different IP addresses, the server can determine that the application is a face-changing application. The server can remove the application from the shelves, or guide the user to uninstall the application, or perform other operations to reduce security risks.

[0200] The embodiment of the present application also provides an application detection method, and the terminal can use a classifier to determine risky applications to improve device security. Risky applications are applications that pose security risks. For example, a certain type of risky application may cause property safety issues, and such risky applications may be called property risk applications. Property risk applications include but are not limited to providing functions such as false shopping consumption, online dating and shopping, etc. For another example, a certain type of risky application may cause the user's privacy to be leaked, and such risky applications may be called privacy risk applications. For example Figure 10 An example process of this method is shown in FIG. Figure 10 , the method may include:

[0201] S201. The server obtains information of the launch interfaces of P applications.

[0202] Wherein, P is a positive integer.

[0203] For each of the P applications, the server may adopt the above-mentioned method to obtain the information of the listing interface of the application. For example, refer to step S101 above.

[0204] For example, the P applications include risky applications and non-risky applications. The server can obtain information about the listing interfaces of the P applications through dynamic analysis.

[0205] S202: The server obtains listing features of the P applications based on information of the listing interfaces of the P applications.

[0206] As a possible implementation, the server may use an AI algorithm to extract listing features of each of the P applications. For example, refer to step S102 above.

[0207] S203: The server trains a classifier based on the listing features of P applications.

[0208] As one possible implementation, the server trains a classifier based on the listing characteristics of P apps. Alternatively, the server can combine the listing characteristics of P apps with annotation information to train the classifier. The annotation information is used to label each of the P apps as a risky app. The listing characteristics of the P apps serve as training samples for the classifier.

[0209] For example, the server inputs training samples and annotation information into a model, trains the model, and generates a classifier. Later, the classifier can identify whether an application is a risky application based on its characteristics. For example, the server uses the listing characteristics of 100 applications as training samples, where applications 1-10 are labeled as risky applications. The server can input the listing characteristics and annotation information of these 100 applications into the model for training.

[0210] In this article, the classifier can also be called a classification model, with no limitation on the name.

[0211] As a possible implementation method, the server may update the classifier. For example, the server may obtain more training samples and use the more training samples to train the classifier to improve the recognition accuracy of the classifier.

[0212] In some embodiments, the server can train a classifier to identify multiple risky applications. For example, the server uses the listing characteristics of 100 applications as training samples, where applications 1-5 are classified as property risk applications and applications 6-10 are classified as privacy risk applications. Applications 1-10 are uniformly labeled as risky applications. The server can input the listing characteristics and labeling information of these 100 applications into the model for training.

[0213] In other embodiments, the server can train a classifier for each risky application. For example, the server might use the listing characteristics of 100 applications as training samples, where applications 1-5 are property risk applications and applications 6-10 are privacy risk applications. This allows for targeted identification of specific types of risky software, improving recognition accuracy.

[0214] The server can input the listing features and labeling information of these 100 applications into a training model to obtain Classifier 1, which is used to identify property risk applications. Applications 1-5 are labeled as property risk applications, and applications 6-100 are labeled as non-property risk applications.

[0215] The server can input the listing features and annotation information of these 100 applications into the model for training to obtain Classifier 2, which is used to identify privacy risk applications. Among them, the annotation information of applications 6-10 is: privacy risk application, and the annotation information of applications 1-5 and 11-100 is: non-privacy risk application.

[0216] Using the above method, the server can use the listing features of multiple applications as input to train the classifier, without having to train a classifier for each application separately.

[0217] In some embodiments, the server may also train a classifier based on the operational characteristics of risky applications. For example, the server may use the listing characteristics of the P applications described above, as well as the operational characteristics of known risky applications, as training samples to train the classifier. For example, the operational characteristics of known risky applications may be reported to the server by the terminal, or the server may identify risky applications based on historical data. In this way, a classifier trained using the operational characteristics of risky applications can identify applications with similar characteristics to risky applications.

[0218] S204: The terminal installs the application.

[0219] For implementation of this step, please refer to S104.

[0220] S205. The terminal determines whether the risk level of the application is high. If the risk level of the application is low, the terminal ends the process. If the risk level of the application is high, the terminal continues to execute the following step S206.

[0221] For the implementation of this step, please refer to S105.

[0222] S206: The terminal obtains a classifier.

[0223] Exemplarily, the terminal downloads the latest classifier from the server.

[0224] Corresponding to a solution in which one classifier can identify multiple risk applications, the terminal can download the classifier from the server.

[0225] Corresponding to the solution where each classifier identifies its corresponding risk application, the terminal can download the corresponding classifier from the server. For example, if the terminal wants to verify whether an application is a property risk application, the terminal downloads the classifier for identifying property risk applications from the server.

[0226] S207: The terminal runs the application and obtains information about the application's running interface.

[0227] For implementation of this step, please refer to S107.

[0228] S208: The terminal calculates the running characteristics of the application based on the information of the running interface.

[0229] For implementation of this step, please refer to S108.

[0230] S209: The terminal uses the classifier to determine whether it is a risky application. If so, the terminal executes S210; if not, the terminal ends the process.

[0231] As a possible implementation, the terminal can input the application's running features into a classifier, which then determines whether the application poses a security risk and outputs a recognition result. For example, while the terminal is running the application, the terminal inputs the features of the application's running interface into the classifier, which then determines whether the application is a risky application.

[0232] For example, application 11 performs well in the listing stage without any abnormalities, and the server lists application 11 normally. Subsequently, the terminal downloads, installs, and runs application 11, and inputs the running characteristics of application 11 into the classifier. In some examples, the running characteristics of application 11 are similar to the listing characteristics of risky applications, and the recognition result output by the classifier is: application 11 is a risky application. This means that application 11 may have face-changing behavior during the running stage, making the running characteristics of application 11 similar to those of risky applications. For example, the text of application 11 is similar to that of risky applications, such as text involving sensitive information such as property. For another example, the API call sequence of application 11 is similar to that of risky applications, and the layout of application 11 is similar to that of risky applications.

[0233] S210: The terminal presents prompt information.

[0234] For the implementation of this step, reference may be made to S110. For example, the terminal may display a second prompt message indicating that "this application is a risky application".

[0235] Figure 11 Another process example of the solution of an embodiment of the present application is shown.

[0236] S301 : During the process of running an application on a terminal, the running interface of the application is displayed.

[0237] S302: When the similarity between the running interface of the application and the listing interface corresponding to the application is less than a first threshold, the terminal presents a first prompt message, which is used to prompt the user that the application has a risk of face change.

[0238] For the specific implementation of S302, please refer to other related contents of this article, such as Figure 6 Some steps in the process shown determine the similarity between the running interface of the application and the corresponding listing interface of the application, and accordingly prompt the user that the application has the risk of face-changing. They will not be repeated here.

[0239] As a possible implementation method, the similarity between the running interface of the application and the corresponding shelf interface is less than the first threshold, including: the similarity between the first running interface of the application and the corresponding first shelf interface is less than the first threshold. Or, the similarity between the running interface of the application and the corresponding shelf interface is less than the first threshold, including: the similarity between the N running interfaces of the application and the corresponding N shelf interfaces is less than the first threshold, and N is a positive integer. For example, when the difference between a running interface of an application and the corresponding shelf interface is large, the terminal can quickly determine that the application has a face-changing risk. For another example, when the difference between multiple running interfaces of an application and the corresponding shelf interface is large, the terminal can determine that the application has a face-changing risk, which can improve the recognition accuracy of face-changing applications.

[0240] In some examples, N is greater than a second threshold. Thus, if a number of interfaces greater than the second threshold are changed after the application is launched, the terminal can determine that the application has a risk of face-changing, thereby avoiding misrecognition caused by mismatching a small number of interfaces and improving the recognition accuracy of face-changing applications.

[0241] In some embodiments, the method further includes comparing the similarity between a second running interface of the application and a corresponding second launch interface; the second running interface includes the first running interface. Exemplarily, there are multiple second running interfaces. For example, if the similarity between five running interfaces of the application and the corresponding launch interface is compared, and the similarity between four running interfaces and the corresponding launch interface is less than a first threshold, the terminal may determine that the application is at risk of face-changing.

[0242] Alternatively, the method may further include comparing the similarities between M running interfaces of the application and M corresponding launch interfaces; the M running interfaces include N running interfaces, where M is a positive integer. For example, if the similarities between the M running interfaces and the corresponding launch interfaces are compared, and if a relatively large number (greater than a third threshold) of the interfaces have changed since launch, the terminal may determine that the application is at risk of face change. In this way, the accuracy of face change detection can be improved.

[0243] As a possible implementation method, comparing the similarity between the second running interface of the application and the corresponding second shelf interface includes: comparing the similarity between the features of the second running interface and the features of the second shelf interface; wherein the features of each second running interface are determined based on the information of the second running interface, and the features of each second shelf interface are determined based on the information of the second shelf interface; the information of the second running interface includes at least one of the following information: a screenshot of the second running interface, the text of the second running interface, the layout of the second running interface, or the interface call sequence of the second running interface; the information of the second shelf interface includes at least one of the following information: a screenshot of the second shelf interface, the text of the second shelf interface, the layout of the second shelf interface, or the interface call sequence of the second shelf interface. For a detailed introduction to the shelf interface information and the running interface information, please refer to the above and will not be repeated here.

[0244] In some embodiments, such as Figure 11 , the method may further include: S401, the terminal obtains the characteristics of the application's listing interface from the server. As a possible implementation method, the terminal obtains the characteristics of the application's listing interface from the server during the process of downloading the application. For example, the server determines that the application has a high risk level. In response to the terminal's request to download the high-risk application, the server sends the installation package and the application's listing characteristics to the terminal. Alternatively, the terminal obtains the characteristics of the application's listing interface from the server during the process of running the application. For example, the terminal determines that the application has a high risk level and requests the server for the application's listing characteristics.

[0245] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of method. It is understandable that, in order to realize the above functions, the electronic device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in this application, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer-driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present application.

[0246] The present application is an embodiment that can divide the functional modules of the electronic device according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0247] like Figure 12 , which is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 1300 can be used to implement the methods performed by the electronic devices described in the above method embodiments. Exemplarily, the electronic device 1300 may include a processing unit 1301 and a communication unit 1302. Optionally, if the electronic device is used to implement the methods performed by the terminal described in the above method embodiments, the electronic device may further include a display unit 1303.

[0248] As a possible example, taking the electronic device 1300 as a server, the processing unit 1301 is used to support the electronic device 1300 to execute Figures 1 to 11 The processing function of any one of the servers, the communication unit 1302, is used to support the electronic device 1300 to perform Figures 1 to 11 The display unit 1303 is used to support the electronic device 1300 to execute Figures 1 to 11 The display function of any of the servers described above.

[0249] As another possible example, taking the electronic device 1300 as a terminal, the processing unit 1301 is configured to support the electronic device 1300 in executing Figures 1 to 11 The processing function of any terminal, the communication unit 1302, is used to support the electronic device 1300 to perform Figures 1 to 11 The display unit 1303 is used to support the electronic device 1300 to perform Figures 1 to 11 The display function of any one of the terminals.

[0250] Optional, Figure 12 The electronic device 1300 shown may further include a storage unit ( Figure 12 (not shown), the storage unit stores a program or instruction. When the processing unit 1301 executes the program or instruction, Figure 12 The electronic device 1300 shown can execute the method described in the above method embodiment.

[0251] Figure 12 The technical effects of the electronic device 1300 shown can refer to the technical effects described in the above method embodiment, and will not be repeated here. Figure 12 The processing unit 1301 involved in the electronic device 1300 shown can be implemented by a processor or processor-related circuit components, such as a processor or processing module. The communication unit 1302 can be implemented by a transceiver or transceiver-related circuit components, such as a transceiver or transceiver module. The display unit 1303 can be implemented by display-related components.

[0252] The present application also provides a chip system. Figure 13 As shown, the chip system includes at least one processor 1401 and at least one interface circuit 1402. The processor 1401 and the interface circuit 1402 can be interconnected via lines. For example, the interface circuit 1402 can be used to receive signals from other devices. For another example, the interface circuit 1402 can be used to send signals to other devices (such as the processor 1401). Exemplarily, the interface circuit 1402 can read instructions stored in the memory and send the instructions to the processor 1401. When the instructions are executed by the processor 1401, the electronic device can execute the various steps performed by the electronic device in the above embodiment. Of course, the chip system can also include other discrete devices, which is not specifically limited in the embodiments of the present application.

[0253] Optionally, there may be one or more processors in the chip system. The processor may be implemented in hardware or software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented in software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0254] Optionally, the memory in the chip system may be one or more. The memory may be integrated with the processor or may be provided separately from the processor, which is not limited in this application. For example, the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on different chips. The embodiments of this application do not specifically limit the type of memory or the configuration of the memory and the processor.

[0255] Exemplarily, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD) or other integrated chips.

[0256] It should be understood that each step in the above method embodiment can be completed by hardware integrated logic circuits in a processor or by software instructions. The method steps disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or by a combination of hardware and software modules in a processor.

[0257] An embodiment of the present application further provides a computer storage medium, in which computer instructions are stored. When the computer instructions are executed on an electronic device, the electronic device executes the method described in the above method embodiment.

[0258] An embodiment of the present application provides a computer program product, which includes: a computer program or instructions, which, when executed on a computer, causes the computer to execute the method described in the above method embodiment.

[0259] In addition, an embodiment of the present application also provides a device, which can specifically be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory to enable the device to execute the methods in the above-mentioned method embodiments.

[0260] Among them, the electronic device, computer storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here.

[0261] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0262] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The various embodiments can be combined with each other or referenced to each other without conflict. The device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0263] Units described as separate components may or may not be physically separate, and components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0264] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0265] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0266] The above content is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. An application detection method, characterized in that: The method comprises: During the running of the application, the running interface of the application is displayed; When the similarity between the running interface of the application and the listing interface corresponding to the application is less than a first threshold, a first prompt information is presented, where the first prompt information is used to prompt the user that the application has a risk of face-changing.

2. The method according to claim 1, characterized in that The similarity between the running interface of the application and the corresponding launch interface is less than a first threshold, including: the similarity between the first running interface of the application and the corresponding first launch interface is less than the first threshold.

3. The method according to claim 2, characterized in that The method further comprises: Compare the similarity between the second running interface of the application and the corresponding second launch interface; the second running interface includes the first running interface.

4. The method according to claim 3, characterized in that The comparing the similarity between the second running interface of the application and the corresponding second launch interface includes: Comparing similarities between features of the second operation interface and features of the second listing interface; Among them, the characteristics of each second running interface are determined based on the information of the second running interface, and the characteristics of each second shelf interface are determined based on the information of the second shelf interface; the information of the second running interface includes at least one of the following information: a screenshot of the second running interface, the text of the second running interface, the layout of the second running interface, or the interface call sequence of the second running interface; the information of the second shelf interface includes at least one of the following information: a screenshot of the second shelf interface, the text of the second shelf interface, the layout of the second shelf interface, or the interface call sequence of the second shelf interface.

5. The method according to any one of claims 1 to 4, characterized in that Also includes: When the risk level of the application is greater than a second threshold, characteristics of the application listing interface are obtained from the server.

6. The method according to claim 5, characterized in that The acquiring of the characteristics of the application listing interface from the server includes: During the process of downloading the application, characteristics of the application's shelf interface are obtained from the server.

7. The method according to claim 5, characterized in that Obtaining features of the application's launch interface from the server includes: During the running of the application, characteristics of the application's launch interface are obtained from the server.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Obtaining a classifier from a server, the classifier being used to identify whether an application is a risky application; a training sample for the classifier includes features of P application listing interfaces, where P is an integer greater than 1; During the running of the application, the features of the running interface of the application are input into the classifier, and the classifier identifies whether the application is a risky application.

9. The method according to claim 8, characterized in that Also includes: In the case that the application is a risky application, second prompt information is presented, where the second prompt information is used to prompt the user that the application has a security risk.

10. An application detection method, characterized in that: The method comprises: Get the features of the application's launch interface; The characteristics of the application's launch interface are sent to the terminal; the characteristics of the application's launch interface and the characteristics of the application's corresponding running interface are used to determine whether the application has a risk of face-changing.

11. The method according to claim 10, characterized in that The characteristics of each listing interface are determined based on the information of the listing interface; the information of the listing interface includes at least one of the following information: a screenshot of the listing interface, the text of the listing interface, the layout of the listing interface, or the interface call sequence of the listing interface.

12. The method according to claim 10 or 11, characterized in that The method further comprises: Training a classifier; the classifier is used to identify whether an application is a risky application; the training samples of the classifier include features of P application listing interfaces, where P is an integer greater than 1; The classifier is sent to the terminal.

13. A computer-readable storage medium, characterized in that The method comprises a program or an instruction. When the program or the instruction is executed, the method according to any one of claims 1 to 9 is implemented, or the method according to any one of claims 10 to 12 is implemented.

14. A computer program product, characterized in that The computer program product comprises a program or an instruction, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 9 or the method according to any one of claims 10 to 12.

15. A chip, characterized in that: The method comprises a unit or module for executing the method according to any one of claims 1 to 9, or a unit or module for executing the method according to any one of claims 10 to 12.

16. A chip system, characterized in that: The chip system includes a processing circuit, and the processing circuit is configured to execute the method according to any one of claims 1 to 9, or execute the method according to any one of claims 10 to 12.

17. An electronic device, characterized in that: The electronic device includes a processor and a memory; The memory is used to store computer-executable instructions. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory to enable the electronic device to execute the method as claimed in any one of claims 1 to 9, or execute the method as claimed in any one of claims 10 to 12.

18. An application detection system, characterized in that: The system includes a terminal for implementing the method according to any one of claims 1 to 9 and a server for implementing the method according to any one of claims 10 to 12.

Images