Abnormal mobile application determining method, device, apparatus and medium

Abstract

Embodiments of the application disclose an abnormal mobile application determination method, device, equipment and medium, and relate to the technical field of artificial intelligence. The method comprises: determining candidate application data of a corresponding candidate application according to a candidate application package; determining entity dimension features under an entity dimension according to the candidate application data; determining an entity dimension hypergraph under a corresponding entity dimension according to the entity dimension features and a dimension matching strategy, and determining an entity fusion hypergraph according to the entity dimension hypergraph; determining dimension hyperedge weights in the entity dimension hypergraph, and determining fusion hyperedge weights in the entity fusion hypergraph; inputting the entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weights and the fusion hyperedge weights into an application set feature recognition model to obtain set feature data of each application set; and determining an abnormal application program according to the set feature data and a preset abnormal application determination strategy. The accuracy of the determined abnormal mobile application program is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology, and in particular to a method, apparatus, device and medium for determining abnormal mobile applications. Background Technology

[0002] With the development and popularization of the internet, apps (mobile applications) have permeated people's lives, providing users with various conveniences. However, this has also brought about cybersecurity issues caused by abnormal mobile applications. Therefore, accurately identifying abnormal mobile applications is crucial. Summary of the Invention

[0003] This invention provides a method, apparatus, device, and medium for identifying abnormal mobile applications, in order to improve the accuracy of identifying abnormal mobile applications.

[0004] According to one aspect of the present invention, a method for determining an abnormal mobile application is provided, comprising:

[0005] Obtain candidate application packages for candidate applications, and determine candidate application data for the corresponding candidate applications based on the candidate application packages;

[0006] Based on the candidate application data, the entity dimension features of the corresponding candidate application are determined in the entity dimension; wherein, the entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension and resource interaction interface dimension;

[0007] Based on the entity dimension features and the preset dimension matching strategy, determine the entity dimension hypergraph under the corresponding entity dimension, and determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension.

[0008] Determine the dimensional hyperedge weights of each entity dimensional hyperedge in the entity dimensional hypergraph, and determine the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph.

[0009] The entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weights and the fusion hyperedge weights are input into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph.

[0010] Based on the set of feature data and the preset abnormal application determination strategy, abnormal applications are determined from the candidate applications.

[0011] According to another aspect of the present invention, an anomalous mobile application determination device is provided, comprising:

[0012] The candidate application data determination module is used to obtain the candidate application package of the candidate application and determine the candidate application data of the corresponding candidate application based on the candidate application package.

[0013] The entity dimension feature determination module is used to determine the entity dimension features of the corresponding candidate application under the entity dimension based on the candidate application data; wherein, the entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension and resource interaction interface dimension;

[0014] The hypergraph determination module is used to determine the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy, and to determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension.

[0015] The hyperedge weight determination module is used to determine the dimensional hyperedge weight of each entity dimension hyperedge in the entity dimension hypergraph, and to determine the fusion hyperedge weight of each entity fusion hyperedge in the entity fusion hypergraph.

[0016] The set feature data determination module is used to input the entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weight and the fusion hyperedge weight into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph.

[0017] An abnormal application determination module is used to determine abnormal applications from the candidate applications based on the set of feature data and a preset abnormal application determination strategy.

[0018] According to another aspect of the present invention, an electronic device is provided, comprising:

[0019] One or more processors;

[0020] Memory, used to store one or more programs;

[0021] When one or more programs are executed by one or more processors, the one or more processors are able to execute any of the abnormal mobile application determination methods provided in the embodiments of the present invention.

[0022] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute any of the abnormal mobile application determination methods provided in the embodiments of the present invention.

[0023] This invention provides a scheme for identifying abnormal mobile applications. The scheme involves obtaining candidate application packages of candidate applications and determining candidate application data for each candidate application based on these packages. Based on the candidate application data, it determines the entity dimension features of each candidate application within the entity dimension. The entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension, and resource interaction interface dimension. Based on the entity dimension features and a preset dimension matching strategy, it determines the entity dimension hypergraph for each entity dimension and, based on the entity dimension hypergraph, determines the entity fusion hypergraph. It then determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into a trained application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data and a preset abnormal application identification strategy, it identifies abnormal applications from the candidate applications. The above scheme introduces an entity dimension to determine entity dimension hypergraphs under different entity dimensions, as well as entity fusion hypergraphs that integrate multiple entity dimensions. It determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into the application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data, abnormal applications are identified, achieving multi-dimensional identification of abnormal mobile applications and improving the accuracy of identified abnormal mobile applications. Furthermore, in this embodiment, by using the set feature data of application sets to identify abnormal applications, it simultaneously determines whether candidate applications belonging to the same application set are abnormal applications, improving the efficiency and comprehensiveness of identified abnormal applications.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1This is a flowchart of a method for determining an abnormal mobile application provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a flowchart of a method for determining an abnormal mobile application provided in Embodiment 2 of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of an abnormal mobile application determination device provided in Embodiment 4 of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of an electronic device that implements a method for determining abnormal mobile applications, as provided in Embodiment 5 of the present invention. Detailed Implementation

[0030] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0031] HGNN (Hypergraph Neural Network) is a neural network model capable of processing hypergraph structured data, capturing high-order relationships between multiple entities; APP (Application) specifically refers to the mobile application file to be analyzed; IDF (Inverse Document Frequency) measures the rarity of an entity globally; HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) is a hierarchical density-based spatial clustering algorithm for noisy applications, used to cluster the embedding vectors of APP nodes to classify anomalous application sets; IOC (Indicator of Compromise) can include anomalous domains, IP addresses, certificates, etc., used to identify evidence of network attacks or anomalous behavior; CT logs (Certificate Transparency) Logs (Certificate Transparency Log) record information about issued digital certificates and are used to verify the legitimacy of certificates; Static APK: refers to the application installation package (.apk file) in a non-running state, used in this embodiment to extract static data such as package name, SHA256 hash, code features, and permission declarations; Dynamic Sandbox: a virtual system that simulates a real running environment, used in this embodiment to capture network requests, file operations, and SMS (Short Messaging) during APP runtime. Dynamic data such as Service (Short Message Service) behavior is used to solve the problem of feature extraction failure in dynamic scenarios; Frida dynamic instrumentation: a cross-platform dynamic instrumentation tool, used in this embodiment to crack abnormal APPs with packing / dynamic key encryption, hooking the target decryption function to obtain clear strings (such as backend domain names) or dynamic keys in memory; Jaccard similarity: measures the ratio of the intersection to the union of two sets; a word embedding model that converts text strings into low-dimensional dense vectors, pre-trained based on an abnormal domain name corpus (dimension 128) in this embodiment, used to calculate the semantic similarity of domain names; CIDR: classless inter-domain routing format, used in this embodiment for IP address standardization (such as merging IPv4 into C segment: 192.168.1.5→192.168.1).0 / 24, IPv6 merged into / 64 segment), reducing IP redundancy; PCA dimensionality reduction: Principal Component Analysis, a data dimensionality reduction algorithm, used in this embodiment to reduce the resource interaction behavior vector (resource interaction interface type + interval encoding of resource interaction quantity) from high dimension to 50 dimension, adapting to K-Means clustering SHA input; K-Means clustering: Distance-based unsupervised clustering algorithm, used in this embodiment to cluster the multimodal features (code, infrastructure, payment behavior) of novel abnormal APPs, identifying potential collaboration patterns to generate new hyperedge rules; Sensitive API: Refers to application programming interfaces that may involve abnormal behavior, typical examples in this embodiment include SMS sending and resource interaction interface calls are used to extract risk characteristics of the APP; Set confidence: an indicator that quantifies the reliability of set partitioning (value ranges from 0-100), calculated in this embodiment using min(100, average superedge weight × 20), used to evaluate the credibility of the set results; Domain name registration information database, containing registrant, registration time, contact information, etc., used in this embodiment for infrastructure risk assessment (e.g., anonymously registered domain names are high-risk); Abnormal certificate: a digital certificate that can issue multiple subdomains, a high-risk certificate type in this embodiment, often reused by abnormal application sets to issue multiple APP certificates, used for the identification of key entity dimension features.

[0032] Example 1

[0033] Figure 1 This is a flowchart of an abnormal mobile application determination method provided in Embodiment 1 of the present invention. This embodiment can be applied to situations where an abnormal mobile application is determined. The method can be executed by an abnormal mobile application determination device, which can be implemented in software and / or hardware and can be configured in an electronic device that carries the abnormal mobile application determination function.

[0034] See Figure 1 The method for identifying abnormal mobile applications, as shown, includes:

[0035] S110. Obtain the candidate application package of the candidate application, and determine the candidate application data of the corresponding candidate application based on the candidate application package.

[0036] Here, "candidate application" refers to a mobile application that requires anomaly detection. "Candidate application package" refers to the installation package of a candidate application. "Candidate application data" refers to the data required for anomaly detection of the candidate application. For example, candidate application data includes application attribute data, application runtime data, and application compensation data.

[0037] Application attribute data refers to the basic attribute data of the candidate application. Application attribute data can be understood as the static data of the candidate application. It can be directly obtained from the candidate application package. For example, application attribute data may include file metadata, code characteristics, permission declarations, string constants, and third-party library information. File metadata may include the candidate application's package name, version number, and SHA256 hash (i.e., the candidate application's hash value). Code characteristics may include the candidate application's sensitive API (Application Programming Interface) call sequence and control flow graph. String constants may include the candidate application's backend domain name and resource interaction links. Third-party library information can be understood as the component information of third parties associated with the candidate application.

[0038] Application runtime data refers to the data generated during the runtime of candidate applications. It can be understood as the dynamic data of the candidate applications. Based on a dynamic sandbox, the runtime environment of the corresponding candidate applications can be simulated according to the candidate application packages to obtain their runtime logs. The data in these logs constitutes the application runtime data. For example, application runtime data may include network request data, file operation data, system call sequences, message sending data, and GUI (Graphical User Interface) operation flow data. Network request data may include domain names, IP (Internet Protocol) addresses, ports, and transmission protocols (such as Hypertext Transfer Security Protocol). File operation data may include read / write path data. System call sequences can be understood as the underlying runtime logic of the candidate applications. Message sending data may include SMS messages and phone call content. GUI operation flow data may include interface navigation records of the candidate applications.

[0039] It should be noted that the domain name, Internet Protocol address, and certificate of the candidate application are present in both the application attribute data and the application runtime data.

[0040] Application compensation data can be understood as supplementary data to application attribute data and application runtime data. For example, application compensation data can be determined based on information associated with candidate applications obtained from external sources. For instance, it can be determined based on abnormal domains, IP reputation scores, domain reputation scores, domain registration information (including registrant, registration time, and contact information), and certificate information (including issuer, validity period, and fingerprint) in GT logs (Certificate Transparency Logs) stored in a preset application database to identify matching domain names, IPs, and certificates in the candidate application data. If the IP reputation score of any Internet Protocol address is greater than or equal to a preset IP reputation threshold, then the label of that Internet Protocol address is determined to be abnormal. This embodiment of the invention does not limit the size of the preset IP reputation threshold; it can be set by technicians based on experience or needs, or determined repeatedly through numerous experiments. For example, the preset IP reputation threshold can be 8. The preset application database can be used to store data associated with previous mobile applications.

[0041] S120. Based on the candidate application data, determine the entity dimension features of the corresponding candidate application under the entity dimension.

[0042] The entity dimension can be understood as the entity categories used to construct the hypergraph. For example, the entity dimension includes the application dimension, infrastructure dimension, resource interaction direction dimension, text pattern dimension, and resource interaction interface dimension.

[0043] The application dimension can be understood as the application categories of candidate applications used to build the hypergraph. The infrastructure dimension can be understood as the infrastructure categories under the candidate applications used to build the hypergraph. The resource interaction direction dimension can be understood as the resource interaction direction categories under the candidate applications used to build the hypergraph. The text pattern dimension can be understood as the text pattern categories under the candidate applications used to build the hypergraph. The resource interaction interface dimension can be understood as the resource interaction interface categories used to build the hypergraph.

[0044] Among them, entity dimension features refer to features under the entity dimension.

[0045] For example, for any candidate application's candidate application data, entity dimension features under different entity dimensions are extracted from the candidate application data of that candidate application.

[0046] In an optional embodiment, the method further includes: preprocessing the candidate application data; and accordingly, determining the entity dimension features of the corresponding candidate application in the entity dimension based on the candidate application data, including: determining the entity dimension features of the corresponding candidate application in the entity dimension based on the preprocessed candidate application data.

[0047] For example, preprocessing may include data cleaning, data standardization, and data relationship determination. Among these, data cleaning refers to cleaning the candidate application data to remove invalid, repetitive, and noisy data, such as unparsed Internet protocols and identical network requests generated by multiple runs of the same candidate application.

[0048] Data standardization refers to the categorization of candidate application data. For example, for any Internet Protocol address (IPA) in the candidate application data, an aggregation algorithm is used to merge the IPA into the corresponding IPA address group; for any domain name in the candidate application data, the primary domain name is extracted and appended to the corresponding domain name; for any application programming interface (API) in the candidate application data, APIs with similar functions are categorized, and a category mapping table for APIs is constructed. The category mapping table can be used to classify and store APIs. An IPA address group refers to a combination of IPA addresses belonging to the same category.

[0049] Specifically, data relationship determination can be used to characterize and determine the relationships between data in candidate applications within the same candidate application. For example, data relationship determination may include domain name relationship determination and resource interaction interface relationship determination. Domain name relationship determination can be used to characterize and determine the association between domain names in any candidate application. Resource interaction interface relationship determination can be used to characterize and determine the association between resource interaction interfaces and resource interaction platforms in any candidate application.

[0050] For example, for any candidate application's domain name, based on a preset static domain name table, the domain names under that candidate application are divided into static domain names and dynamic domain names; based on the static and dynamic domain names, the relationships between the domain names under that candidate application are determined. Here, the preset static domain name table refers to a pre-set table that can be used to store static domain names. Static domain names refer to domain names under the candidate application that remain unchanged. Dynamic domain names refer to domain names under the candidate application that change.

[0051] For example, the similarity between domains under the candidate application can be determined based on the following formula:

[0052] ;

[0053] ;

[0054] Here, Jaccard represents the character-level similarity of the domain names under the candidate application; S static This represents the set of static domain names under this candidate application; S dynamicThis represents the set of dynamic domain names under the candidate application; CosSim represents the semantic similarity of the domain names under the candidate application; Vec static This represents the set of static domain name vectors for the candidate application; Vec dynamic This represents the set of dynamic domain name vectors for the candidate application.

[0055] It should be noted that before determining the relationships between domains under this candidate application, static domains and dynamic domains need to be encoded separately.

[0056] It should be noted that, in this embodiment of the invention, the static domain names under the candidate application are aggregated into a set to obtain a static domain name set; similarly, the dynamic domain names under the candidate application are aggregated into a set to obtain a dynamic domain name set. The static domain names in the static domain name set under the candidate application are vectorized to obtain a set of static domain name vectors; similarly, the dynamic domain names in the dynamic domain name set under the candidate application are vectorized to obtain a set of dynamic domain name vectors.

[0057] Furthermore, if Jaccard is greater than or equal to a preset character similarity threshold, or CosSim is greater than or equal to a preset semantic similarity threshold, then a strong association is determined for the domain name under the candidate application, and a strongly associated tag is added to the corresponding candidate application; otherwise, a weakly associated tag is added to the corresponding candidate application, or manual review is performed. This embodiment of the invention does not limit the size of the preset character similarity threshold and / or the preset semantic similarity threshold; these can be set by technicians based on experience or needs, or determined repeatedly through numerous experiments. For example, the preset character similarity threshold can be 0.8, and the preset semantic similarity threshold can be 0.85.

[0058] For example, resource interaction interface relationships can be determined based on the following methods: For any candidate application's resource interaction interface identifier, it can be obtained by hashing the resource interaction QR code identifier under that candidate application (e.g., by performing a SHA256 hash on the resource interaction QR code); for the candidate application's resource interaction platform, the resource interaction platform corresponding to the corresponding resource interaction interface can be determined by the type of the resource interaction protocol under that candidate application; a correspondence is generated including the application identifier of the candidate application, the resource interaction interface identifier under the candidate application, and the resource interaction platform under the candidate application. The application identifier can be used to uniquely identify the candidate application, and the application identifier can be a SHA256 hash of the candidate application. The resource interaction interface identifier can be used to uniquely identify the resource interaction interface. The resource interaction QR code identifier can be used to uniquely identify the resource interaction QR code. The resource interaction QR code can be used for resource interaction. A resource interaction interface refers to an interface used for resource interaction. A resource interaction platform refers to a platform used for resource interaction.

[0059] Understandably, by preprocessing the candidate application data, the entity dimension features of the corresponding candidate application under the entity dimension can be determined based on the preprocessed candidate application data, thereby improving the accuracy of the determined entity dimension features.

[0060] S130. Based on the entity dimension features and the preset dimension matching strategy, determine the entity dimension hypergraph under the corresponding entity dimension, and determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension.

[0061] The dimension matching strategy refers to a pre-defined strategy used to construct the entity dimension hypergraph. The entity dimension hypergraph can be used to represent the relationships between candidate applications under any entity dimension. The entity fusion hypergraph can represent the relationships between candidate applications.

[0062] For example, based on a preset fusion hypergraph construction strategy, an entity fusion hypergraph can be determined according to the entity dimension hypergraphs under different entity dimensions. Here, the fusion hypergraph construction strategy refers to a pre-set strategy used to determine the entity fusion hypergraph.

[0063] Specifically, the final aggregated entity fusion hypergraph can be determined based on the entity dimension hypergraphs of candidate applications under different entity dimensions.

[0064] S140. Determine the dimensional hyperedge weights of each entity dimensional hyperedge in the entity dimensional hypergraph, and determine the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph.

[0065] In this context, an entity-dimensional hyperedge refers to a hyperedge in the entity-dimensional hypergraph. The dimensional hyperedge weight can be used to quantify the association strength between nodes in each dimension of the corresponding entity-dimensional hyperedge. A dimensional node is a node in the entity-dimensional hypergraph. Similarly, an entity-fused hyperedge refers to a hyperedge in the entity-fused hypergraph. The fused hyperedge weight can be used to quantify the association strength between nodes in the entity-fused hyperedge. A fused node is a node in the entity-fused hypergraph.

[0066] S150. Input the entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weight, and fusion hyperedge weight into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph.

[0067] The application set feature recognition model can be used to determine the set feature data of any application set in the entity fusion hypergraph. An application set refers to a collection of candidate applications that are located under the same entity fusion hyperedge in the entity fusion hypergraph. Set feature data refers to the key set features of the application set. For example, the set feature data refers to the entity dimensions on which fusion nodes within the same entity fusion hyperedge in the entity fusion hypergraph are associated, and the values ​​of those associated entity dimensions.

[0068] For example, the application set feature recognition model outputs not only set feature data but also set source data for the application set. This set source data refers to the data obtained by summarizing the feature data associated with candidate applications within the application set. The set source data can be used to trace the source of abnormal applications within an abnormal application set.

[0069] For example, set feature data is determined as follows: for any entity dimension feature, determine the dimension feature association data associated with that entity dimension feature in the entity fusion hypergraph; determine the feature score of that entity dimension feature based on the dimension feature association data; and determine whether that entity dimension feature is set feature data based on the feature score. The feature score can be used to quantify the importance of the entity dimension feature in the corresponding application set. Dimension feature association data refers to the data associated with that entity dimension feature in the entity fusion hypergraph. For example, the dimension feature association data may include the set of entity fusion hyperedges containing that entity dimension feature in the entity fusion hypergraph, the fusion hyperedge weights of the entity fusion hyperedges in the aforementioned set, the total number of all entity dimension features associated with the entity fusion hyperedges in the aforementioned set, and the number of entity dimension features with application dimensions in the entity fusion hyperedges in the aforementioned set.

[0070] For example, the total number of all entity dimension features associated with the entity fusion hyperedge in the aforementioned set can be understood as the number of all entity dimension features in the information represented by any entity fusion hyperedge in the aforementioned set. Similarly, the number of entity dimension features with application dimension in the entity fusion hyperedge in the aforementioned set can be understood as the number of entity dimension features with application dimension in the information represented by any entity fusion hyperedge in the aforementioned set.

[0071] For example, for any set of applications, if the fusion nodes in the set of applications have three identical entity dimension features under the same application dimension (such as the same package name, the same version number, and the same permission declaration), the same domain name, and the same resource interaction interface, then the information represented by the entity fusion hyperedge corresponding to the application set can include the entity dimension features under the 3 application dimensions + 1 domain name + 1 resource interaction interface; at this time, the total number of all entity dimension features associated with the entity fusion hyperedge corresponding to the application set is 3 + 1 + 1 = 5; at this time, the number of entity dimension features under the application dimension in the entity fusion hyperedge corresponding to the application set is 3.

[0072] For example, for any set of applications, if the fusion nodes in the set of applications have three identical domain names and one identical resource interaction interface, then the information represented by the entity fusion hyperedge corresponding to the set of applications can include 3 domain names + 1 resource interaction interface; at this time, the total number of all entity dimension features associated with the entity fusion hyperedge corresponding to the set of applications is 3 + 1 = 4; at this time, the number of entity dimension features under the application dimension in the entity fusion hyperedge corresponding to the set of applications is the default value of 1.

[0073] For example, the feature score for any entity dimension feature can be determined based on the following formula:

[0074] ;

[0075] Where Centrality(g) represents the feature score of entity dimension feature g; M g Denotes the set of entity fusion hyperedges that contain entity-dimensional features g in the entity fusion hypergraph; e represents M. g In the context of M, the entity fusion hyperedge e is represented; W(e) represents the fusion hyperedge weight of entity fusion hyperedge e; |M e | represents the total number of entity dimension features associated with the entity fusion hyperedge e; Ne represents the number of entity dimension features with application dimension in the entity fusion hyperedge e.

[0076] For example, the purpose of determining the feature score of an entity dimension feature is to quantify the centrality of that entity dimension feature within the application set. The feature score represents the pivotal nature of the corresponding entity dimension feature within the application set's relational network. Through feature scoring, critical infrastructure or key candidate applications can be identified, providing feedback on collaboration patterns and core risks within the application set, thereby guiding tracing and regulation.

[0077] For example, g represents the entity dimension feature to be evaluated, encompassing all types of entity dimension features in the hypergraph, including entity dimension features under the application dimension (such as package name, version number, sensitive API call sequence, permission declaration, etc.), entity dimension features under the infrastructure dimension (such as domain name, Internet Protocol address, digital certificate), entity dimension features under the resource interaction direction dimension (such as resource interaction account), and entity dimension features under the resource interaction interface dimension (such as resource interaction platform), etc. These entity dimension features are not limited to entity dimension features under the application dimension, because the operation of the anomalous application set depends on the collaboration of the application dimension + infrastructure dimension + resource interaction channel (including resource interaction direction dimension and resource interaction interface dimension). Entity dimension features under non-application dimensions (such as core domain name, resource interaction account) are often key to the anomalous application set, and therefore become important objects of centrality evaluation.

[0078] For example, M g M is the set of all entity fusion hyperedges containing entity dimension features g, and its data comes from the output of the hypergraph construction module. For example, if the domain name g exists simultaneously in an entity fusion hyperedge with entity dimension features of 3 application dimensions + domain name g + 1 Internet Protocol address, and an entity fusion hyperedge with entity dimension features of 2 application dimensions + domain name g + 1 resource interaction interface, then these two entity fusion hyperedges together constitute M. g M g Its function is to cover all associated scenarios of entity dimension feature g, ensuring that centrality calculation does not miss the role of entity dimension feature in different collaborative relationships, thereby fully reflecting the coreness of entity dimension feature g.

[0079] For example, W(e) represents the weight of the entity fusion hyperedge e. Essentially, W(e) reflects the association strength of the entity fusion hyperedge e: the higher the weight, the closer the collaborative relationship represented by the entity fusion hyperedge (e.g., the weight of a fusion hyperedge sharing rare certificates is higher than the weight of a fusion hyperedge sharing common domain names), and therefore the greater its contribution to the centrality of the entity dimension feature g. For instance, if the weight of entity fusion hyperedge e is 6.8, its contribution to the centrality of the entity dimension feature g is much higher than that of an entity fusion hyperedge with a weight of 2.1.

[0080] For example, |M e| represents the total number of entity dimension features associated with the entity fusion hyperedge e. This can be obtained during the hypergraph construction phase by counting the number of all entity dimension features associated with the entity fusion hyperedge. It covers five dimensions: application, infrastructure, resource interaction direction, text pattern, and resource interaction interface. Specifically, it counts the number of all non-repeating entity dimension features in the information represented by the entity fusion hyperedge e (including entity dimension features under the application dimension, domain name, internet protocol address, resource interaction account, text cluster center, etc.). For example, if the information represented by the entity fusion hyperedge e contains 2 entity dimension features under the application dimension + 1 domain name (infrastructure dimension) + 1 resource interaction account (resource interaction direction dimension) + 1 utterance cluster center (text pattern dimension), then |Me| = 2 + 1 + 1 + 1 = 5 (because there are no entity dimension features under the resource interaction interface dimension, they are not included). |M e | This reflects the coverage of the entity fusion hyperedge e: the more entity dimension features it covers, the wider the range of entities connected by the entity fusion hyperedge, the more prominent the hub role of the entity dimension feature g in this multi-entity collaborative network, and therefore the greater its contribution to centrality.

[0081] For example, Ne represents the number of entity dimension features under the application dimension in the entity fusion hyperedge e. This can be obtained during the hypergraph construction phase by counting the number of entity dimension features under the application dimension included in the information represented by the entity fusion hyperedge e. For example, if the information represented by the entity fusion hyperedge e contains 3 entity dimension features under the application dimension, then Ne=3. The core role of Ne is to avoid interference from entity dimension features under non-application dimensions in the centrality calculation: since the direct carrier of abnormal application activity is the mobile application, if the number of entity dimension features under the application dimension in the entity fusion hyperedge e is small (e.g., only 1 entity dimension feature under the application dimension + multiple domain names under the infrastructure dimension), it indicates that the entity fusion hyperedge e has a weak correlation with the abnormal application behavior. In this case, dividing by Ne reduces the centrality contribution of the entity fusion hyperedge e to the domain name, ensuring that the centrality score always focuses on the core entities supporting the operation of abnormal applications, rather than entities with low correlation to abnormal application behavior.

[0082] It should be noted that if the entity fusion hyperedge e is a pure non-application dimension hyperedge, that is, the information represented by the entity fusion hyperedge e does not include the entity dimension features under the application dimension, such as if the information represented by the entity fusion hyperedge e only includes 3 domain names + 2 Internet protocol addresses, then the value of Ne corresponding to the entity fusion hyperedge e is determined to be the default value of 1.

[0083] Optionally, set feature data is determined from entity dimension features based on feature scores and a preset feature score threshold. This embodiment of the invention does not impose any limitation on the size of the preset feature score threshold; it can be set by a technician based on experience or needs, or determined through extensive adaptation and repeated testing.

[0084] For example, for any entity dimension feature, if the feature score of the entity dimension feature is greater than or equal to a preset feature score threshold, then the entity dimension feature is used as set feature data; if the feature score of the entity dimension feature is less than the preset feature score threshold, then the entity dimension feature is prohibited from being used as set feature data.

[0085] Alternatively, the entity dimension features can be sorted according to their feature scores; and the set feature data can be determined from the entity dimension features based on the sorting results and a preset feature ratio. This embodiment of the invention does not impose any limitation on the size of the preset feature ratio; it can be set by technicians based on experience or needs, or determined through extensive experimentation.

[0086] For example, the top 20% of entity dimensions with the largest values ​​in the ranking results can be used as set feature data.

[0087] In an optional embodiment, the application ensemble feature recognition model is trained as follows: Historical dimensional hypergraphs, historical fused hypergraphs, and historical hyperedge weights of historical applications are obtained, and reference hyperedges are determined from the historical hyperedges in the historical dimensional hypergraphs and historical fused hypergraphs based on a preset hyperedge ratio; the historical hyperedge weights of the reference hyperedges are processed to obtain reference hyperedge weights; the historical hyperedge weights of the historical dimensional hypergraph, historical fused hypergraph, and non-reference hyperedges, as well as the reference hyperedge weights, are input into the constructed application ensemble feature recognition model to obtain the hyperedge prediction weights of the reference hyperedges; the model loss value of the application ensemble feature recognition model is determined based on the historical hyperedge weights and hyperedge prediction weights of the reference hyperedges, and the application ensemble feature recognition model is trained based on the model loss value.

[0088] Here, "historical application" refers to previous mobile applications. "Historical Dimension Hypergraph" refers to the hypergraph of historical applications across different entity dimensions. "Historical Fusion Hypergraph" refers to the fused hypergraph determined based on the historical Dimension Hypergraph. "Historical Hyperedge Weight" refers to the weight of each historical hyperedge in the historical Dimension Hypergraph and the historical Fusion Hypergraph. "Historical Hyperedge" refers to the hyperedge in the historical Dimension Hypergraph and the historical Fusion Hypergraph.

[0089] In this embodiment of the invention, the size of the preset hyperedge ratio is not limited. It can be set by technicians based on experience or needs, or determined through repeated experiments. For example, the preset hyperedge ratio can be 20%, that is, 20% of the historical hyperedges are used as reference hyperedges, and the remaining 80% of the historical hyperedges are used as non-reference hyperedges.

[0090] Here, reference hyperedges refer to historical hyperedges that require processing. Reference hyperedge weights refer to the processed weights of historical hyperedges. Non-reference hyperedges refer to historical hyperedges that do not require processing. Hyperedge prediction weights refer to the weights of reference hyperedges predicted based on the applied ensemble feature recognition model.

[0091] Here, the model loss value refers to the loss value of the model when applying set features to identify the model.

[0092] Understandably, by determining a reference hyperedge based on a preset hyperedge ratio and processing the historical hyperedge weights of the reference hyperedge, the reference hyperedge weights are obtained. The historical hyperedge weights of the historical dimensional hypergraph, the historical fused hypergraph, the historical hyperedge weights of the non-reference hyperedges, and the reference hyperedge weights of the reference hyperedges are then input into the constructed application set feature recognition model to obtain the hyperedge prediction weights of the reference hyperedges. Finally, based on the historical hyperedge weights and the hyperedge prediction weights of the reference hyperedges, the model loss value is obtained, which improves the accuracy of the determined model loss value and thus improves the accuracy of training the application set feature recognition model based on the model loss value.

[0093] In one optional embodiment, the historical hyperedge weights of the reference hyperedge are processed to obtain the reference hyperedge weights of the reference hyperedge, including: processing the historical hyperedge weights of the reference hyperedge based on a preset weight reset strategy to obtain the reference hyperedge weights of the reference hyperedge.

[0094] The preset weight reset strategy refers to a pre-set strategy used to reset the weights of historical hyperedges. For example, the preset weight reset strategy could be to reset the weights of historical hyperedges to 0.

[0095] Understandably, by processing the historical hyperedge weights of the reference hyperedge according to the preset weight reset strategy, the reference hyperedge weights of the reference hyperedge are obtained, thus improving the accuracy of the reference hyperedge weights.

[0096] S160. Based on the set feature data and the preset abnormal application determination strategy, determine the abnormal application from the candidate applications.

[0097] The abnormal application identification strategy refers to a pre-set strategy that can be used to identify abnormal mobile applications. An abnormal application is a mobile application that is not performing properly.

[0098] Specifically, based on the set feature data corresponding to each application set in the entity fusion hypergraph and the abnormal application determination strategy, an abnormal application set is determined from the application sets; candidate applications in the abnormal application set are then identified as abnormal applications. Here, the abnormal application set refers to the set of applications containing abnormal applications.

[0099] Furthermore, based on the source data of the abnormal application set, abnormal applications in the abnormal application set can be managed and controlled.

[0100] This invention provides a scheme for identifying abnormal mobile applications. The scheme involves obtaining candidate application packages of candidate applications and determining candidate application data for each candidate application based on these packages. Based on the candidate application data, it determines the entity dimension features of each candidate application within the entity dimension. The entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension, and resource interaction interface dimension. Based on the entity dimension features and a preset dimension matching strategy, it determines the entity dimension hypergraph for each entity dimension and, based on the entity dimension hypergraph, determines the entity fusion hypergraph. It then determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into a trained application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data and a preset abnormal application identification strategy, it identifies abnormal applications from the candidate applications. The above scheme introduces an entity dimension to determine entity dimension hypergraphs under different entity dimensions, as well as entity fusion hypergraphs that integrate multiple entity dimensions. It determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into the application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data, abnormal applications are identified, achieving multi-dimensional identification of abnormal mobile applications and improving the accuracy of identified abnormal mobile applications. Furthermore, in this embodiment, by using the set feature data of application sets to identify abnormal applications, it simultaneously determines whether candidate applications belonging to the same application set are abnormal applications, improving the efficiency and comprehensiveness of identified abnormal applications.

[0101] Example 2

[0102] Figure 2This is a flowchart of an abnormal mobile application determination method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment further adds the operation of "determining whether the entity dimension is a similarity determination dimension for any entity dimension; wherein the similarity determination dimension includes application dimension and text pattern dimension," and refines the operation of "determining the entity dimension hypergraph under the corresponding entity dimension according to the entity dimension features and the preset dimension matching strategy" to "if so, determine the node similarity of each dimension node under the entity dimension according to the entity dimension features; determine the node association relationship between each dimension node under the entity dimension according to the node similarity and the preset dimension similarity threshold under the entity dimension; determine the entity dimension hypergraph under the entity dimension according to the node association relationship," thereby improving the entity dimension hypergraph determination mechanism. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments.

[0103] See Figure 2 The method for identifying abnormal mobile applications, as shown, includes:

[0104] S210. Obtain the candidate application package of the candidate application, and determine the candidate application data of the corresponding candidate application based on the candidate application package.

[0105] S220. Based on the candidate application data, determine the entity dimension features of the corresponding candidate application under the entity dimension.

[0106] The entity dimension includes the application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension, and resource interaction interface dimension.

[0107] S230. For any entity dimension, determine whether the entity dimension is a similarity determination dimension.

[0108] The similarity determination dimension refers to the entity dimension used to determine similarity. For example, the similarity determination dimension may include the application dimension and the text pattern dimension.

[0109] S240. If so, then determine the node similarity of each node in the entity dimension based on the entity dimension features of that entity dimension.

[0110] Here, a dimensional node refers to a node in the entity dimensional hypergraph. Node similarity can be used to quantify the degree of similarity between any two dimensional nodes.

[0111] S250. Based on the node similarity and the preset dimension similarity threshold under the entity dimension, determine the node association relationship between nodes in each dimension under the entity dimension.

[0112] In this embodiment of the invention, the size of the preset dimension similarity threshold is not limited. It can be set by technicians based on experience or needs, or determined through repeated experiments. For example, if the entity dimension is an application dimension, the preset dimension similarity threshold is a preset application similarity threshold, which can be 0.85; if the entity dimension is a text pattern dimension, the preset dimension similarity threshold is a preset text similarity threshold, which can be 0.8.

[0113] In this context, node association refers to the relationships between nodes in different dimensions of a hypergraph belonging to the same entity dimension. For example, node association can be either strong or weak.

[0114] For example, node associations with node similarity greater than or equal to a preset dimensional similarity threshold are considered strong node associations; node associations with node similarity less than the preset dimensional similarity threshold are considered weak node associations.

[0115] S260. Based on the node association relationship, determine the entity dimension hypergraph under the entity dimension, and based on the entity dimension hypergraph under the entity dimension, determine the entity fusion hypergraph.

[0116] Specifically, entity dimension nodes with strong node associations are grouped into the same entity dimension hyperedge to obtain the entity dimension hypergraph under that entity dimension; based on the entity dimension hypergraphs under different entity dimensions, the entity fusion hypergraph is determined.

[0117] For example, regarding the application dimension, the entity dimension features can include sensitive API call sequences. Based on the sensitive API call sequences of any two candidate applications, the node similarity between the application nodes of the two candidate applications under the application dimension is determined. If the node similarity is greater than 0.85, the application nodes of the two candidate applications are assigned to the same entity dimension hyperedge. Specifically, the sensitive API call sequences of any two candidate applications are encoded, and based on the encoded sensitive API call sequences, the node similarity between the application nodes of the two candidate applications under the application dimension is determined. For example, TF-IDF (Term Frequency-Inverse Document Frequency) encoding can be used. Application nodes refer to dimension nodes under the application dimension.

[0118] For example, regarding the text pattern dimension, the entity dimension features can include information transmission data. Based on the information transmission data of any two candidate applications, the node similarity between the text nodes of the two candidate applications under the text pattern dimension is determined. If the node similarity is greater than or equal to 0.8, the text nodes of the two candidate applications are assigned to the same entity dimension hyperedge. Specifically, word vector encoding is performed on the information transmission data of any two candidate applications. Based on the encoded information transmission data, the node similarity between the text nodes of the two candidate applications under the text pattern dimension is determined. For example, the information transmission data can include UI (User Interface) text and communication strings, etc. For example, a word embedding model can be used to encode the information transmission data using word vectors. A text node refers to a dimension node under the text pattern dimension.

[0119] S270. Determine the dimensional hyperedge weights of each entity dimensional hyperedge in the entity dimensional hypergraph, and determine the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph.

[0120] In an optional embodiment, the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph are determined, including: for any entity dimension hyperedge, determining the number of dimension nodes within the entity dimension hyperedge and determining the importance of the dimension nodes within the entity dimension hyperedge; and determining the dimension hyperedge weights of the entity dimension hyperedge based on the number of dimension nodes and the importance of the dimension nodes.

[0121] Here, the number of dimension nodes refers to the number of dimension nodes within any entity's dimension hyperedge. Dimension node importance can be understood as the inverse document frequency of a dimension node, and can be used to measure the rarity of a dimension node globally.

[0122] For example, the importance of a dimension node v in any entity dimension hyperedge can be determined based on the following formula:

[0123] ;

[0124] Where IDF(v) represents the importance of dimension node v; N represents the total number of dimension nodes in the entity dimension hypergraph containing dimension node v; n v This represents the number of entity dimension hyperedges that contain dimension node v in the entity dimension hypergraph.

[0125] Furthermore, the weight of the hyperedge of this entity dimension is determined based on the following formula:

[0126] ;

[0127] Where W(He) represents the weight of the hyperedge of the entity dimension; |He| represents the number of nodes in the hyperedge of the entity dimension; and He represents the nodes in the hyperedge of the entity dimension.

[0128] Understandably, by determining the dimensional hyperedge weights of corresponding entity dimensions based on the number and importance of dimensional nodes, the accuracy of the determined dimensional hyperedge weights is improved.

[0129] The advantage of introducing dimensional hyperedge weights in this embodiment of the invention is that it gives higher weights to dimensional hyperedges that connect niche entities (such as rare certificates and low-frequency IPs) and multiple nodes, thus highlighting the hidden connections between dimensional nodes.

[0130] It should be noted that the process of determining the weight of the entity fusion hyperedge in this embodiment of the invention is the same as the process of determining the weight of the dimension hyperedge. Specifically, for any entity fusion hyperedge, the number of fusion nodes within the entity fusion hyperedge is determined, and the importance of the fusion nodes within the entity fusion hyperedge is determined; based on the number of fusion nodes and the importance of the fusion nodes, the weight of the entity fusion hyperedge is determined.

[0131] The number of fused nodes refers to the number of fused nodes within any entity's fused hyperedge. The importance of fused nodes can be understood as the inverse document frequency of fused nodes, which can be used to measure the rarity of fused nodes globally.

[0132] S280. Input the entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights and fusion hyperedge weights into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph.

[0133] S290. Based on the set feature data and the preset abnormal application determination strategy, determine the abnormal application from the candidate applications.

[0134] This invention provides a scheme for identifying abnormal mobile applications. By adding a similarity-determining dimension for any entity dimension, it determines whether that entity dimension is a similarity-determining dimension. The similarity-determining dimension includes application dimension and text pattern dimension operations. Based on entity dimension features and a preset dimension matching strategy, it determines the entity dimension hypergraph operation for that entity dimension. Specifically, if the entity dimension is a similarity-determining dimension, it determines the node similarity of each dimension node based on the entity dimension features; based on the node similarity and a preset dimension similarity threshold, it determines the node association relationships between each dimension node; and based on the node association relationships, it determines the entity dimension hypergraph for that entity dimension, thus improving the entity dimension hypergraph determination mechanism. In this scheme, if the entity dimension is a similarity-determining dimension, it determines the node similarity of each dimension node based on the entity dimension features, determines the node association relationships based on the node similarity and the preset dimension similarity threshold, and finally determines the entity dimension graph based on the node association relationships, improving the accuracy and comprehensiveness of the determined entity dimension graph.

[0135] Based on the above technical solution, if any entity dimension is not a similarity-determining dimension, then grouping is performed based on entity dimension features to determine the entity dimension graph under that entity dimension. In an optional embodiment, determining the entity dimension hypergraph under the corresponding entity dimension according to entity dimension features and a preset dimension matching strategy includes: if not, grouping the dimension nodes under that entity dimension according to the entity dimension features to obtain dimension node groups; determining the number of group nodes in the dimension node groups, and determining the entity dimension graph under that entity dimension according to the number of group nodes and a preset dimension node number threshold.

[0136] In this context, a dimension node group refers to a combination of dimension nodes with the same characteristics. The number of group nodes refers to the number of dimension nodes in any given dimension node group. This embodiment of the invention does not impose any limitation on the size of the preset threshold for the number of dimension nodes; it can be set by technicians based on experience or needs, or determined through extensive experimentation. For example, the preset threshold for the number of dimension nodes can be 2.

[0137] For example, regarding the infrastructure dimension, the entity dimension features can include the hash value of the main domain name, the Internet Protocol address group (IPA address group), and the certificate fingerprint. Based on the hash value of the main domain name, the IPA address group, and the certificate fingerprint of each candidate application, infrastructure nodes are grouped into infrastructure node groups. Infrastructure nodes in an infrastructure node group whose number of nodes is greater than or equal to a preset threshold for the number of dimension nodes are assigned to the same entity dimension hyperedge. Specifically, infrastructure nodes with the same hash value of the main domain name, the same IPA address group, and the same certificate fingerprint are assigned to the same infrastructure node group. An infrastructure node refers to a dimension node within the infrastructure dimension. An infrastructure node group refers to a combination of infrastructure nodes.

[0138] For example, regarding the resource interaction direction dimension, the entity dimension features can include resource interaction account identifiers. Based on the resource interaction account identifiers of each candidate application, resource direction nodes are grouped to obtain resource direction node groups. Resource direction nodes in a resource direction node group whose number of nodes is greater than or equal to a preset threshold for the number of dimension nodes are grouped into the same entity dimension hyperedge. Specifically, resource direction nodes with the same resource interaction account identifier are grouped into the same resource direction node group. The resource interaction account identifier can be used to uniquely identify the resource interaction account. A resource direction node refers to a dimension node under the resource interaction direction dimension. A resource direction node group refers to a combination of resource direction nodes.

[0139] For example, regarding the resource interaction interface dimension, the entity dimension features can include resource interaction interface identifiers (obtainable through the correspondence between application identifiers, resource interaction interface identifiers, and resource interaction platforms). Based on the resource interaction interface identifiers of each candidate application, resource interface nodes are grouped to obtain resource interface node groups. Resource interface nodes in a resource interface node group whose number of nodes is greater than or equal to a preset threshold for the number of dimension nodes are grouped into the same entity dimension hyperedge. Specifically, resource interface nodes with the same resource interaction interface identifier are grouped into the same resource interface node group. A resource interface node refers to a dimension node under the resource interaction interface dimension. A resource interface node group refers to a combination of resource interface nodes.

[0140] Understandably, for entity dimensions with non-similarity determination, the nodes of each dimension under the entity dimension are grouped according to the entity dimension features to obtain dimension node groups; the entity dimension graph under the entity dimension is determined based on the number of group nodes of the dimension node group and the preset threshold for the number of dimension nodes, thereby improving the accuracy and comprehensiveness of the determined entity dimension graph.

[0141] Example 3

[0142] This invention provides an optional example based on the above embodiments. It should be noted that for parts not described in detail in this invention's embodiments, please refer to the descriptions in other embodiments.

[0143] Existing technologies are ineffective in addressing the large-scale, organized, and infrastructure-sharing ecosystem of modern anomalous apps, lacking the ability to deeply analyze the core concept of "teams." There is an urgent need for a new technological approach capable of directly representing and analyzing diverse relationships. The purpose of this invention is to overcome the shortcomings of existing technologies and provide a method and system for mining anomalous application sets based on hypergraph neural networks and self-supervised learning. Its core objectives are: Precise and in-depth data mining: Breaking through the limitations of traditional binary relationships, it deeply mines the hidden high-order relationships between abnormal apps and between apps and infrastructure, accurately identifying latent abnormal application sets; Automated intelligent analysis: Utilizing self-supervised learning technology, it designs training tasks that do not require manual annotation, reducing reliance on the experience of technical personnel and achieving automation and intelligence in the mining of abnormal application sets; Dynamic knowledge construction: It constructs a dynamically evolving anomaly ecosystem hypergraph knowledge base, storing not only entities and their binary relationships but also complex group relationships, providing support for anomaly tracing, intelligence generation, and situational awareness; Dynamic scenario adaptation: Breaking through the limitations of static analysis, it solves the problem of feature extraction failure in dynamic scenarios such as abnormal app protection, dynamic key encryption, and domain name mutation, ensuring the integrity and accuracy of multi-source data features; Improved combat efficiency: The output can be directly used for evidence collection, providing network tracking clues for network regulatory agencies, assisting network regulatory agencies in merging and correlating events, constructing profiles of abnormal application sets, and improving the efficiency and accuracy of combating network security issues.

[0144] This invention relates to the fields of network security, artificial intelligence, and data mining, and particularly to a method and system for mining anomalous application sets based on Hypergraph Neural Network (HGNN) and self-supervised learning. This method is used to automatically identify, associate, and mine potential anomalous application sets and their infrastructure networks from massive amounts of mobile application data, and to construct a dynamically evolving anomalous app knowledge base. It aims to address the shortcomings of existing technologies in detecting and analyzing large-scale, organized network anomalies.

[0145] The abnormal app (i.e., mobile application) identification system provided in this invention aims to automatically and intelligently uncover the team networks behind abnormal apps through hypergraph modeling and deep learning. It goes beyond feature extraction from single apps; it analyzes the associated attributes and characteristics of batches of apps. Its core workflow covers a complete closed loop from data input to intelligence output.

[0146] For example, the abnormal app identification system includes a data source and preprocessing module, a hypergraph construction module, a model learning module, and an analysis and application module. The data source and preprocessing module can be used for the collection, cleaning, and standardization of multi-source heterogeneous data, providing high-quality and standardized data input for subsequent analysis. Specifically, the data source and preprocessing module can be used for APK static analysis (i.e., determining application attribute data), dynamic sandbox operation (i.e., determining application runtime data), external intelligence (i.e., determining application compensation data), and data cleaning, deobfuscation, and standardization (i.e., preprocessing candidate application data).

[0147] For example, the hypergraph building module is used to construct a semantically rich hypergraph structure G from flat entity relationship data. h =(V,E,W). (V is the set of nodes, E is the set of hyperedges, and W is the set of hyperedge weights). Specifically, the hypergraph construction module is used to extract entities from the preprocessed candidate application data (i.e., determine the entity dimension features under the entity dimension), generate hyperedges based on the multi-rule engine (i.e., determine the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy, and determine the entity fusion hypergraph), and calculate weights based on strength and rarity IDF (i.e., determine the dimension hyperedge weights and fusion hyperedge weights).

[0148] For example, the model learning module employs a Hypergraph Neural Network (HGNN) to learn node embeddings through an innovative self-supervised learning task, laying the foundation for team data mining. Specifically, the model learning module is used to construct the Hypergraph Neural Network (i.e., apply ensemble feature recognition model), perform self-supervised training through a hyperedge weight prediction task, and generate entity embedding vectors (i.e., determine the model's input data).

[0149] For example, data preprocessing in the model learning module: randomly select 15%-20% of the hyperedges from the weighted hypergraph, reset their weights to 0 (marked as weights to be predicted), and retain the remaining hyperedge weights as supervision signals, that is, reset the historical hyperedge weights of the reference hyperedges to 0 to obtain the reference hyperedge weights, and use the historical hyperedge weights of the non-reference hyperedges as supervision signals; the structure of the ensemble feature recognition model can be implemented based on PyTorch Geometric (a graph neural network based on PyTorch), which includes 2 layers of hypergraph convolutional layers, ReLU (Rectified Linear Unit) activation function, and Dropout layer (dropout rate=0.5).

[0150] For example, the weights of the historical dimension hypergraph, the historical fusion hypergraph, the historical hyperedge weights of the non-reference hyperedge, and the reference hyperedge weights of the reference hyperedge are input into the constructed application set feature recognition model. The application set feature recognition model can first initialize the features of the nodes in the historical dimension hypergraph and the historical fusion hypergraph, then propagate forward to calculate the feature representation of each hyperedge and update the node features according to the adjacent hyperedges; output the hyperedge prediction weights; determine the model loss value based on the historical hyperedge weights of the reference hyperedge and the hyperedge prediction weights; determine whether the model loss value has converged. If it has, save the finally learned node embedding vector (i.e., the model training is complete); if not, backpropagate the error and optimize the model parameters.

[0151] For example, model optimization: using the Adam optimizer (learning rate 0.001), with the mean squared error (MSE) between the predicted weights and the true weights as the loss function (i.e. the model loss value), iterative training is performed until the loss converges (if the MSE on the validation set does not decrease for 5 consecutive rounds, the training is stopped early).

[0152] For example, the preset hyperedge ratio can be determined through the following experiment: Obtain 1000 abnormal mobile applications, corresponding to 1200 hyperedges; Evaluation metrics: validation set MSE loss, precision / recall after node embedding clustering; Test 4 sets of hyperedge ratios (10% / 15% / 20% / 25%), with each set of experiments repeated 3 times and the average value taken; The preset hyperedge ratio of 20% results in the lowest MSE loss and the best clustering performance, so the default preset hyperedge ratio is determined to be 20%.

[0153] For example, the analytics application module is used to perform downstream analysis tasks based on the learned node embeddings, ultimately producing actionable intelligence. Specifically, the analytics application module can be used for cluster analysis, application set partitioning and profiling, identification of key nodes, and visualization and report generation.

[0154] For example, team discovery: Algorithm selection: HDBSCAN (a density-based hierarchical clustering algorithm) density clustering algorithm is adopted, with parameters configured as min_cluster_size=3 (minimum size of the application set to ensure the organization of the application set), min_samples=5 (minimum number of samples for core points to reduce noise interference), and metric="euclidean" (Euclidean distance to measure the similarity of embedded vectors); Output: Automatically partitioned abnormal team clusters, i.e., abnormal application sets. Comparative analysis with traditional methods (i.e., identifying abnormal mobile applications based on domain name sharing): This embodiment of the invention discovers two more hidden abnormal application sets. These abnormal application sets are captured by the hypergraph model through implicit associations such as shared rare certificates and similar code structures, resulting in a significant improvement in recall.

[0155] For example, we compute the eigenvector centrality (i.e., set feature data) of all fused nodes in the entity fusion hypergraph. In the hypergraph embedding space, the entity-dimensional features that are associated with multiple teams are set feature data.

[0156] For example, aggregate feature data may include critical infrastructure (such as CDN domains that provide services for more than 3 application aggregates), critical certificates (issuers of abnormal cards who can issue certificates for multiple abnormal applications), and critical resource interaction accounts (resource aggregation accounts for multiple application aggregates), and be labeled with risk levels (high / medium / low).

[0157] This invention, centered on the core objective of anomaly application set mining, is geared towards network regulatory agencies. It constructs a complete technical process encompassing data input, preprocessing, hypergraph modeling, self-supervised learning, cluster analysis, and intelligence output. For example, the abnormal app identification system includes the following layers: Data layer: Collection and preprocessing of multi-source heterogeneous data (static APKs, dynamic sandbox logs, external intelligence) provides standardized entity features for subsequent hypergraph construction, solving the problems of excessive noise and disordered formatting in the original data; Modeling layer: The hypergraph construction module upgrades traditional binary relationships to multi-entity higher-order associations through entity extraction, hyperedge generation, and weight calculation, directly matching the collaborative patterns of shared infrastructure, code, and resources of the abnormal application set, breaking through the limitations of traditional knowledge graphs; Learning layer: A self-supervised task based on hyperedge weight prediction allows the application set feature recognition model to learn association patterns without manual annotation, and the output node embedding vectors provide semantic feature support for downstream clustering, achieving automated feature learning; Application layer: Clustering mining of abnormal application sets and feature vector centrality identification of key nodes ultimately outputs actionable intelligence.

[0158] For example, the entity dimension features included in the dimension nodes of the entity dimension hypergraph under different entity dimensions are as follows: When the entity type is an application node (i.e., a node in the entity dimension hypergraph under the application dimension), the identifier field can be the application identifier (i.e., SHA256 hash), and the corresponding core attributes can include package name, version number, risk score based on static features, and data source, etc.; When the entity type is an infrastructure node (i.e., a node in the entity dimension hypergraph under the infrastructure dimension), the identifier field can include the primary domain name hash, Internet Protocol address group, and certificate fingerprint. Correspondingly, in the core attributes, the domain name can include the domain name reputation score and registration time, the Internet Protocol address can include the blacklist label (which can be determined based on a preset IP blacklist database) and the place of origin (i.e., physical address), and the certificate can include the issuer and validity period; When the entity type is a resource direction node (i.e., a node in the resource interaction direction dimension), the identifier field can include the application identifier (i.e., a node in the resource interaction direction dimension), the identifier field can include the application identifier (i.e., a node in the application ... When the entity type is a text node (i.e., a node in the entity dimension hypergraph under the text pattern dimension), the identifier field can be the resource interaction account identifier, and the corresponding core attributes can include the organization where the resource interaction account is located, the type of resource interaction account (individual or enterprise), and the associated resource interaction interface, etc. When the entity type is a text node (i.e., a node in the entity dimension hypergraph under the resource interaction interface dimension), the identifier field can be the cluster center hash (which can be determined based on the information sent data), and the corresponding core attributes can include abnormal dialogue content, semantic tags, and the number of matched APPs, etc. When the entity type is a resource interface node (i.e., a node in the entity dimension hypergraph under the resource interaction interface dimension), the identifier field can be the SHA256 hash of the resource interaction QR code, or the SHA256 hash of the resource target organization identifier, and the corresponding core attributes can include the resource interaction platform, the number of associated APPs, the most recent resource interaction time, and the range of resource interaction volume, etc. The IP blacklist database refers to a pre-set database that can be used to store abnormal IP addresses. The resource flow to organization identifier can uniquely identify the identity of the resource target organization. The resource target organization can represent the destination of resource transfer during the resource interaction process. For example, the resource target organization identifier can be a merchant number.

[0159] In this embodiment of the invention, the risk score based on static features can be determined as follows: Abnormal attribute data is determined based on the application attribute data of any candidate application; different abnormal attribute data are weighted and scored to obtain an initial risk score for the abnormal attribute data; then, according to abnormal attribute matching rules, the feature scores of the corresponding matched abnormal attribute data in the initial risk score are added to obtain the final risk score. Here, abnormal attribute data refers to application attribute data that exhibits abnormalities. Abnormal attribute data may include sensitive API call sequences, abnormal permission declarations, abnormal string constants, abnormal third-party libraries, and abnormal metadata, etc.

[0160] For example, based on a pre-defined exception API library, the APIs associated with any candidate application can be filtered to obtain exception APIs and generate a sensitive API call sequence. The pre-defined exception API library can be used to store sensitive APIs (i.e., exception APIs).

[0161] For example, the mining and updating of dimension matching strategies includes: New data triggering: When an abnormal APP determines that the system has access to new abnormal APP data (such as an APP appearing for the first time within 3 months), strategy mining is automatically triggered; Feature clustering: K-Means clustering is performed on the features of new APPs (code, infrastructure, resource interaction interfaces, etc.) (K value is adaptive according to the number of APPs, such as K=10 for 500 APPs) to identify potential new collaboration patterns; Multimodal feature fusion clustering methods include: Code feature vector: TF-IDF encoding of API call sequences (100 dimensions); Infrastructure set: One-hot encoding of domain names / Internet Protocol addresses / certificates (based on a global entity library); Resource interaction behavior vector: Range encoding of resource interaction interface type + resource interaction quantity, reduced to 50 dimensions using PCA and then input into the K-Means clustering model; Strategy generation: Common associations are extracted from the clustered feature clusters (such as 5 APPs sharing the same AI dialogue interface), and new dimension matching strategies (JSON format) are automatically generated; Manual review and deployment: New dimension matching strategies are pushed to security analysts for review. After approval, they are automatically added to the strategy library and take effect without restarting the system. The strategy library can be used to store dimension matching strategies.

[0162] For example, the common association determination logic is as follows: if ≥60% of the apps in a cluster meet any of the following conditions, a new dimension matching strategy will be generated: sharing the same new infrastructure (such as the first appearance of a Content Delivery Network (CDN) domain name); calling the same new API sequence; using the same wording template (i.e., node similarity > 0.9).

[0163] It should be noted that the dimension matching strategy in this embodiment of the invention can be supplemented with a device fingerprint sharing strategy (i.e., multiple candidate applications obtain consistent device fingerprints) and a promotion channel sharing rule (i.e., multiple candidate applications are downloaded through the same promotion link), adapting to the collaborative mode of novel abnormal application sets. The application set feature recognition model in this embodiment of the invention can employ a hypergraph attention network, strengthening the influence of key hyperedges on node embedding through an attention mechanism, further improving clustering accuracy; the self-supervised task can be replaced with a node type prediction task (predicting which node belongs to a candidate application / domain / IP), suitable for scenarios where entity type annotations are missing. Application scenario expansion: In addition to abnormal application set mining, it can be adapted to abnormal software family identification (such as identifying abnormal software families sharing code / infrastructure) and abnormal financial APP association analysis.

[0164] For example, a hyperedge generation method based on a multi-rule engine: particularly the infrastructure sharing strategy (i.e., the strategy for generating entity-dimensional hypergraphs under the infrastructure dimension) and the code sharing strategy (i.e., the strategy for generating application-dimensional hypergraphs under the application dimension), which makes the high-order associations of multiple entities explicit through cosine similarity and the threshold of the number of shared entities; a hyperedge weight calculation method: combining the weighted formula of the number of associated entities (log(1+|He|)) and entity rarity (IDF(v)) to quantify the association strength; a self-supervised training method based on hyperedge weight prediction: in the application set feature recognition model, by randomly masking hyperedge weights, predicting weights, and optimizing model parameters, unlabeled node embedding learning is achieved; a mining process for abnormal application sets that integrates hypergraph embedding and HDBSCAN: by clustering node embedding vectors and combining feature vector centrality to identify key nodes, a complete technical link from hypergraph modeling to intelligence output is formed.

[0165] For example, the abnormal mobile application identification method provided in this embodiment of the invention has the following innovations: Data model innovation: It introduces a hypergraph model into the field of abnormal mobile application analysis for the first time, breaking through the limitations of traditional knowledge graph binary relations, directly representing high-order collaborative relationships among multiple entities, eliminating the need for indirect reasoning, and improving the efficiency of association analysis; Algorithm innovation: It designs a self-supervised training task based on hyperedge weight prediction, enabling the application set feature recognition model to autonomously learn deep patterns of abnormal application sets without manual annotation, achieving a high level of automated analysis; Process innovation: It forms an end-to-end innovative process of data preprocessing → hypergraph construction → self-supervised learning → cluster mining → intelligence output, realizing automated mapping and mining from micro-features to macro-application sets; Evaluation system innovation: It proposes a hyperedge dynamic weight calculation formula combining association strength and entity rarity, accurately quantifying the importance of association relationships and avoiding the omission of hidden application sets with niche entity associations.

[0166] The method for identifying anomalous mobile applications provided in this invention significantly enhances its detection capabilities: it can uncover latent application sets that traditional methods cannot identify (such as application sets sharing rare certificates or similar code structures), increasing the recall rate from 60% to 95%, thus eradicating anomalous application sets completely; it revolutionarily improves analysis efficiency: avoiding inefficient binary relation traversal, it directly performs high-order analysis, shortening risk response time from several days to several hours; it greatly improves interpretability: the hypergraph model intuitively displays the internal structure and relationships of the application set, facilitating understanding, verification, and decision-making by security analysts; it has adaptive evolution capabilities: the self-supervised learning mechanism supports incremental training, and when new data (such as new anomalous language or infrastructure) is added, the application set feature recognition model can quickly learn new patterns without retraining the entire dataset, exhibiting long-term viability; and it yields high output value: the output application set profiles and key node lists can be directly used by network regulatory agencies for event merging and network blocking, improving the accuracy of strikes.

[0167] Example 4

[0168] Figure 3 This is a schematic diagram of an abnormal mobile application determination device provided in Embodiment 4 of the present invention. This embodiment is applicable to situations where abnormal mobile applications are determined. The method can be executed by the abnormal mobile application determination device, which can be implemented in software and / or hardware and can be configured in an electronic device that carries the abnormal mobile application determination function.

[0169] like Figure 3 As shown, the device includes: a candidate application data determination module 310, an entity dimension feature determination module 320, a hypergraph determination module 330, a hyperedge weight determination module 340, a set feature data determination module 350, and an abnormal application determination module 360. Among them,

[0170] The candidate application data determination module 310 is used to obtain the candidate application package of the candidate application and determine the candidate application data of the corresponding candidate application based on the candidate application package.

[0171] The entity dimension feature determination module 320 is used to determine the entity dimension features of the corresponding candidate application under the entity dimension based on the candidate application data; wherein, the entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension and resource interaction interface dimension;

[0172] The hypergraph determination module 330 is used to determine the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy, and to determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension.

[0173] The hyperedge weight determination module 340 is used to determine the dimensional hyperedge weight of each entity dimension hyperedge in the entity dimension hypergraph, and to determine the fusion hyperedge weight of each entity fusion hyperedge in the entity fusion hypergraph.

[0174] The set feature data determination module 350 is used to input the entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weight and the fusion hyperedge weight into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph.

[0175] The abnormal application determination module 360 ​​is used to determine abnormal applications from the candidate applications based on the set of feature data and a preset abnormal application determination strategy.

[0176] This invention provides a scheme for identifying abnormal mobile applications. The scheme involves obtaining candidate application packages of candidate applications and determining candidate application data for each candidate application based on these packages. Based on the candidate application data, it determines the entity dimension features of each candidate application within the entity dimension. The entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text mode dimension, and resource interaction interface dimension. Based on the entity dimension features and a preset dimension matching strategy, it determines the entity dimension hypergraph for each entity dimension and, based on the entity dimension hypergraph, determines the entity fusion hypergraph. It then determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into a trained application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data and a preset abnormal application identification strategy, it identifies abnormal applications from the candidate applications. The above scheme introduces an entity dimension to determine entity dimension hypergraphs under different entity dimensions, as well as entity fusion hypergraphs that integrate multiple entity dimensions. It determines the dimension hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph and the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, entity fusion hypergraph, dimension hyperedge weights, and fusion hyperedge weights are input into the application set feature recognition model to obtain set feature data for each application set in the entity fusion hypergraph. Finally, based on the set feature data, abnormal applications are identified, achieving multi-dimensional identification of abnormal mobile applications and improving the accuracy of identified abnormal mobile applications. Furthermore, in this embodiment, by using the set feature data of application sets to identify abnormal applications, it simultaneously determines whether candidate applications belonging to the same application set are abnormal applications, improving the efficiency and comprehensiveness of identified abnormal applications.

[0177] Optionally, the device further includes:

[0178] The similarity determination dimension determination module is used to determine whether any entity dimension is a similarity determination dimension; wherein, the similarity determination dimension includes application dimension and text pattern dimension;

[0179] Accordingly, the hypergraph determination module 330 includes:

[0180] The node similarity determination unit is used to determine the node similarity of each node in the entity dimension based on the entity dimension features in the entity dimension if the condition is met.

[0181] The node association relationship determination unit is used to determine the node association relationship between nodes in each dimension under the entity dimension based on the node similarity and a preset dimension similarity threshold under the entity dimension.

[0182] The first hypergraph determination unit is used to determine the entity dimension hypergraph under the entity dimension based on the node association relationship.

[0183] Optionally, the hypergraph determination module 330 includes:

[0184] The dimension node group determination unit is used to group the dimension nodes of the entity dimension according to the entity dimension characteristics of the entity dimension, if not otherwise, to obtain the dimension node group.

[0185] The second hypergraph determination unit is used to determine the number of group nodes of the dimension nodes in the dimension node group, and to determine the entity dimension graph under the entity dimension based on the number of group nodes and a preset dimension node number threshold.

[0186] Optionally, the hyperedge weight determination module 340 includes:

[0187] The dimension node importance determination unit is used to determine the number of dimension nodes within the dimension hyperedge of any entity dimension, and to determine the importance of the dimension nodes within the dimension hyperedge of the entity dimension.

[0188] The dimension hyperedge weight determination unit is used to determine the dimension hyperedge weight of the entity based on the number of dimension nodes and the importance of the dimension nodes.

[0189] Optionally, the application set feature recognition model is trained based on the following device:

[0190] The reference hyperedge determination module is used to obtain the historical dimension hypergraph, historical fusion hypergraph and historical hyperedge weight of the historical application, and determine the reference hyperedge from the historical hyperedges in the historical dimension hypergraph and the historical fusion hypergraph based on a preset hyperedge ratio.

[0191] The reference hyperedge weight determination module is used to process the historical hyperedge weights of the reference hyperedge to obtain the reference hyperedge weight.

[0192] The hyperedge prediction weight determination module is used to input the historical dimension hypergraph, the historical fusion hypergraph, the historical hyperedge weight of the non-reference hyperedge, and the reference hyperedge weight of the reference hyperedge into the constructed application set feature recognition model to obtain the hyperedge prediction weight of the reference hyperedge.

[0193] The model training module is used to determine the model loss value of the application set feature recognition model based on the historical hyperedge weights and the predicted hyperedge weights of the reference hyperedge, and to train the application set feature recognition model based on the model loss value.

[0194] Optionally, the reference hyperedge weight determination module includes:

[0195] The reference hyperedge weight determination unit is used to process the historical hyperedge weights of the reference hyperedge based on a preset weight reset strategy to obtain the reference hyperedge weight.

[0196] Optionally, the device further includes:

[0197] A data preprocessing module is used to preprocess the candidate application data;

[0198] Accordingly, the entity dimension feature determination module 320 includes:

[0199] The entity dimension feature determination unit is used to determine the entity dimension features of the corresponding candidate application in the entity dimension based on the preprocessed candidate application data.

[0200] The abnormal mobile application determination device provided in the embodiments of the present invention can execute the abnormal mobile application determination method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each abnormal mobile application determination method.

[0201] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision and disclosure of candidate application packages, historical dimension hypergraphs, historical fusion hypergraphs and historical hyperedge weights, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0202] Example 5

[0203] Figure 4This is a schematic diagram of an electronic device that implements a method for determining anomalies in a mobile application, as provided in Embodiment 5 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0204] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0205] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0206] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the anomaly mobile application determination method.

[0207] In some embodiments, the abnormal mobile application determination method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal mobile application determination method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the abnormal mobile application determination method by any other suitable means (e.g., by means of firmware).

[0208] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0209] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0210] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0211] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0212] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0213] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0214] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0215] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying abnormal mobile applications, characterized in that, include: Obtain candidate application packages for candidate applications, and determine candidate application data for the corresponding candidate applications based on the candidate application packages; Based on the candidate application data, the entity dimension features of the corresponding candidate applications are determined under the entity dimension. The entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text pattern dimension, and resource interaction interface dimension. The entity dimension features under the application dimension include package name, version number, sensitive API call sequence, and permission declaration. The entity dimension features under the infrastructure dimension include domain name, Internet Protocol address, and digital certificate. The entity dimension features under the resource interaction direction dimension include resource interaction account identifier. The text pattern dimension is the text pattern category under the candidate applications used to construct the hypergraph. The entity dimension features under the resource interaction interface dimension include resource interaction interface identifier. Based on the entity dimension features and the preset dimension matching strategy, determine the entity dimension hypergraph under the corresponding entity dimension, and determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension. Determine the dimensional hyperedge weights of each entity dimensional hyperedge in the entity dimensional hypergraph, and determine the fusion hyperedge weights of each entity fusion hyperedge in the entity fusion hypergraph. The entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weights and the fusion hyperedge weights are input into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph. Based on the set of feature data and the preset abnormal application determination strategy, abnormal applications are determined from the candidate applications; The step of determining the dimensional hyperedge weights of each entity dimension hyperedge in the entity dimension hypergraph includes: For any entity dimension hyperedge, determine the number of dimension nodes within the entity dimension hyperedge and determine the importance of the dimension nodes within the entity dimension hyperedge; wherein, the number of dimension nodes refers to the number of dimension nodes within any entity dimension hyperedge; and the importance of the dimension nodes is used to measure the rarity of the dimension nodes in the global scope. The dimensional hyperedge weight of the entity is determined based on the number of dimensional nodes and the importance of the dimensional nodes. The method further includes: For any entity dimension feature, determine the dimension feature association data associated with that entity dimension feature in the entity fusion hypergraph; Based on the associated data of the dimensional features, the feature score of the entity dimensional feature is determined; wherein, the feature score is used to quantify the importance and centrality of the entity dimensional feature in the corresponding application set, so as to identify critical infrastructure or main candidate applications, provide feedback on the collaboration mode and risk core within the application set, and guide tracing and supervision. Based on the feature score, determine whether the entity dimension feature is set feature data.

2. The method according to claim 1, characterized in that, The method further includes: For any entity dimension, determine whether that entity dimension is a similarity determination dimension; wherein, the similarity determination dimension includes application dimension and text pattern dimension; Accordingly, determining the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy includes: If so, then determine the node similarity of each node in the entity dimension based on the entity dimension features under that entity dimension; Based on the node similarity and the preset dimension similarity threshold under the entity dimension, the node association relationship between nodes in each dimension under the entity dimension is determined; Based on the node associations, determine the entity dimension hypergraph under this entity dimension.

3. The method according to claim 2, characterized in that, The step of determining the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy includes: If not, then based on the entity dimension characteristics under that entity dimension, group the dimension nodes under that entity dimension to obtain dimension node groups; Determine the number of group nodes in the dimension node group, and determine the entity dimension hypergraph under the entity dimension based on the number of group nodes and a preset dimension node number threshold.

4. The method according to claim 1, characterized in that, The application set feature recognition model is trained based on the following method: Obtain the historical dimension hypergraph, historical fusion hypergraph, and historical hyperedge weights of the historical application, and determine the reference hyperedge from the historical hyperedges in the historical dimension hypergraph and the historical fusion hypergraph based on a preset hyperedge ratio; The historical hyperedge weights of the reference hyperedge are processed to obtain the reference hyperedge weights. The historical dimension hypergraph, the historical fusion hypergraph, the historical hyperedge weights of the non-reference hyperedges, and the reference hyperedge weights of the reference hyperedges are input into the constructed application set feature recognition model to obtain the hyperedge prediction weights of the reference hyperedges. Based on the historical hyperedge weights of the reference hyperedge and the predicted hyperedge weights, the model loss value of the application set feature recognition model is determined, and the application set feature recognition model is trained based on the model loss value.

5. The method according to claim 4, characterized in that, The process of processing the historical hyperedge weights of the reference hyperedge to obtain the reference hyperedge weights includes: Based on a preset weight reset strategy, the historical weights of the reference hyperedge are processed to obtain the reference hyperedge weight.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: The candidate application data is preprocessed; Accordingly, determining the entity dimension features of the corresponding candidate application in the entity dimension based on the candidate application data includes: Based on the preprocessed candidate application data, determine the entity dimension features of the corresponding candidate application in the entity dimension.

7. An anomalous mobile application identification device, characterized in that, include: The candidate application data determination module is used to obtain the candidate application package of the candidate application and determine the candidate application data of the corresponding candidate application based on the candidate application package. The entity dimension feature determination module is used to determine the entity dimension features of the corresponding candidate application under the entity dimension based on the candidate application data. The entity dimension includes application dimension, infrastructure dimension, resource interaction direction dimension, text pattern dimension, and resource interaction interface dimension. The entity dimension features under the application dimension include package name, version number, sensitive API call sequence, and permission declaration. The entity dimension features under the infrastructure dimension include domain name, Internet Protocol address, and digital certificate. The entity dimension features under the resource interaction direction dimension include resource interaction account identifier. The text pattern dimension is the text pattern category under the candidate application used to construct the hypergraph. The entity dimension features under the resource interaction interface dimension include resource interaction interface identifier. The hypergraph determination module is used to determine the entity dimension hypergraph under the corresponding entity dimension based on the entity dimension features and the preset dimension matching strategy, and to determine the entity fusion hypergraph based on the entity dimension hypergraph under the entity dimension. The hyperedge weight determination module is used to determine the dimensional hyperedge weight of each entity dimension hyperedge in the entity dimension hypergraph, and to determine the fusion hyperedge weight of each entity fusion hyperedge in the entity fusion hypergraph. The set feature data determination module is used to input the entity dimension hypergraph, the entity fusion hypergraph, the dimension hyperedge weight and the fusion hyperedge weight into the trained application set feature recognition model to obtain the set feature data of each application set in the entity fusion hypergraph. An abnormal application determination module is used to determine abnormal applications from the candidate applications based on the set of feature data and a preset abnormal application determination strategy. The hyperedge weight determination module includes: The dimension node importance determination unit is used to determine the number of dimension nodes within any entity dimension hyperedge and the importance of the dimension nodes within that entity dimension hyperedge, for any given entity dimension hyperedge; wherein, the number of dimension nodes refers to the number of dimension nodes within any given entity dimension hyperedge; and the importance of the dimension node is used to measure the rarity of the dimension node in the global scope. The dimension hyperedge weight determination unit is used to determine the dimension hyperedge weight of the entity based on the number of dimension nodes and the importance of the dimension nodes. The device further includes: The dimension feature association data determination module is used to determine the dimension feature association data associated with any entity dimension feature in the entity fusion hypergraph. The feature scoring determination module is used to determine the feature score of the entity dimension feature based on the associated data of the dimension feature; wherein, the feature score is used to quantify the importance and centrality of the entity dimension feature in the corresponding application set, so as to identify critical infrastructure or main candidate applications, provide feedback on the collaboration mode and risk core within the application set, and guide the tracing and supervision. The set feature data judgment module is used to determine whether the entity dimension feature is set feature data based on the feature score.

8. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement an abnormal mobile application determination method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements an abnormal mobile application determination method as described in any one of claims 1-6.

Images