SDK behavior consistency comparison method, related device and computer storage medium

Abstract

The application provides an SDK behavior consistency comparison method, related device and computer storage medium, function names and calling parameters in behavior information of each interface call are embedded in linkage as a whole semantic unit, a uniform coding vector of the behavior information is formed, an actual behavior sequence of the SDK is constructed in the order of time stamps, an embedding matrix of shared parameters, a first structure transformation matrix and a second structure transformation matrix are used to adjust data of the actual behavior sequence of the SDK and the expected behavior sequence of the SDK to the same dimension, and a structured deviation score between the two is calculated, so that comprehensive similarity calculation between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK is realized, fine-grained differences in the SDK behavior track are captured more comprehensively, and a higher-precision technical basis is provided for SDK security and compliance judgment.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an SDK behavior consistency comparison method, related apparatus, and computer storage medium. Background Technology

[0002] As the number of SDKs integrated into mobile applications continues to increase, platforms face growing challenges in managing the behavior of these SDKs. Whether an SDK strictly adheres to platform policies during operation, and whether there are unauthorized calls or behavioral drifts, is often difficult to accurately determine through traditional permission management or blacklist / whitelist mechanisms. In particular, some SDKs may appear to have legitimate call paths, but in actual operation, they may exhibit hidden issues such as parameter abuse and abnormal call timing, further complicating platform security and compliance management. Summary of the Invention

[0003] In view of this, the present invention provides an SDK behavior consistency comparison method, related device and computer storage medium, which can more comprehensively understand the actual behavior of the SDK, thereby determining whether it is consistent with the expected behavior of the server-side SDK.

[0004] The first aspect of this invention provides an SDK behavior consistency comparison method, comprising:

[0005] During SDK operation, the behavior information of interface calls is acquired in real time; the behavior information includes function name, timestamp, and call parameters.

[0006] For each interface call's behavior information, a unified encoding vector for the behavior information is constructed based on the function name and call parameters;

[0007] Based on the timestamp order, the unified encoding vectors of all the behavioral information are sorted to construct the actual behavior sequence of the SDK;

[0008] The actual behavior sequence and the expected behavior sequence of the SDK are respectively input into the embedding network for encoding to obtain a first vector and a second vector; wherein, the expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information;

[0009] Based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix, a structured deviation score is determined between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK; wherein, the first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension;

[0010] Consistency comparison results are generated based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0011] Optionally, the calling parameters are divided into numerical parameters and enumerated parameters. For each interface call, a unified encoding vector of the behavior information is constructed based on the function name and the calling parameters, including:

[0012] The function name is mapped to a first dense vector using a first dynamic embedding matrix;

[0013] For each numerical parameter, the numerical parameter is normalized to obtain a normalized numerical vector;

[0014] For each enumerated parameter, the enumerated parameter is mapped to a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type;

[0015] A unified encoding vector is generated based on the first dense vector, the normalized numerical vector, and the second dense vector.

[0016] Optionally, determining the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix includes:

[0017] The first target vector is determined based on the first vector and the first structural transformation matrix;

[0018] The second target vector is determined based on the second vector and the second structural transformation matrix;

[0019] The distance between the first target vector and the second target vector is used as a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0020] Optionally, after sorting the unified encoding vectors of all the behavioral information based on timestamps to construct the actual behavioral sequence of the SDK, the method further includes:

[0021] When new interface call behavior information is obtained, a unified encoding vector of the new behavior information is constructed based on the function name and call parameters in the new interface call behavior information;

[0022] The unified encoding vector of the new behavioral information is added to the actual behavioral sequence of the SDK.

[0023] Optionally, the SDK behavior consistency comparison method further includes:

[0024] Construct a training sample set; wherein the training sample set includes multiple training sample data; wherein the training sample data includes historical behavior information of the interface calls of the training sample SDK, the expected behavior sequence of the training sample SDK, and the true consistency comparison results;

[0025] For each API call's historical behavior information, a historical behavior sequence of the training sample SDK is constructed.

[0026] The historical behavior sequence and the expected behavior sequence of the training sample SDK are respectively input into the embedding network for encoding to obtain the first sample vector and the second sample vector;

[0027] Based on the first sample vector, the second sample vector, the first structural transformation matrix, and the second structural transformation matrix, a structured deviation score is determined between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK.

[0028] A prediction consistency comparison result is generated based on the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK;

[0029] Based on the error between the predicted consistency comparison result and the true consistency comparison result, the embedding network, the first structure transformation matrix, the second structure transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type are adjusted until the error between the predicted consistency comparison result and the true consistency comparison result reaches the preset convergence condition.

[0030] Optionally, after generating the consistency comparison result based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK, the method further includes:

[0031] A deviation log is generated based on the consistency comparison results;

[0032] The deviation logs are uploaded to the server; the server determines the adjustment plan based on the deviation logs.

[0033] A second aspect of the present invention provides an SDK behavior consistency comparison device, comprising:

[0034] The behavior information acquisition unit is used to acquire the behavior information of interface calls in real time during SDK operation; wherein, the behavior information includes function name, timestamp and call parameters;

[0035] A unified encoding vector construction unit is used to construct a unified encoding vector for the behavior information of each interface call based on the function name and call parameters.

[0036] The behavior sequence construction unit is used to sort the unified encoding vector of all the behavior information based on the timestamp order to construct the actual behavior sequence of the SDK;

[0037] An encoding unit is used to input the actual behavior sequence and the expected behavior sequence of the SDK into the embedding network for encoding, respectively, to obtain a first vector and a second vector; wherein, the expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information;

[0038] A deviation scoring unit is used to determine a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix; wherein the first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension;

[0039] The generation unit is used to generate a consistency comparison result based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0040] Optionally, the calling parameters are divided into numerical parameters and enumerated parameters, and the unified encoding vector construction unit includes:

[0041] The first mapping unit is used to map the function name to a first dense vector using a first dynamic embedding matrix;

[0042] A normalization unit is used to normalize the numerical parameter for each numerical parameter to obtain a normalized numerical vector;

[0043] The second mapping unit is used to map each enumeration parameter into a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type.

[0044] A unified coding vector construction subunit is used to generate a unified coding vector based on the first dense vector, the normalized numerical vector, and the second dense vector.

[0045] Optionally, the deviation scoring unit includes:

[0046] The first vector transformation unit is used to determine the first target vector based on the first vector and the first structure transformation matrix;

[0047] The second vector transformation unit is used to determine the second target vector based on the second vector and the second structure transformation matrix;

[0048] The deviation scoring subunit is used to use the distance between the first target vector and the second target vector as a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0049] Optionally, the SDK behavior consistency comparison device further includes:

[0050] The unified encoding vector construction unit is also used to construct a unified encoding vector for the new behavior information based on the function name and call parameters in the new interface call behavior information when the behavior information of the new interface call is obtained.

[0051] An adding unit is used to add the unified encoding vector of the new behavioral information to the actual behavioral sequence of the SDK.

[0052] Optionally, the SDK behavior consistency comparison device further includes:

[0053] A training sample set construction unit is used to construct a training sample set; wherein, the training sample set includes multiple training sample data; wherein, the training sample data includes historical behavior information of the interface calls of the training sample SDK, the expected behavior sequence of the training sample SDK, and the true consistency comparison results;

[0054] The unified encoding vector construction unit is also used to construct a unified encoding vector for the historical behavior information of each interface call based on the function name and call parameters in the historical behavior information.

[0055] The behavior sequence construction unit is also used to sort the unified encoding vectors of all the historical behavior information based on the order of historical timestamps, and construct the historical behavior sequence of the training sample SDK.

[0056] The encoding unit is further configured to input the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK into the embedding network for encoding, respectively, to obtain the first sample vector and the second sample vector;

[0057] The deviation scoring unit is further configured to determine a structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK based on the first sample vector, the second sample vector, the first structural transformation matrix, and the second structural transformation matrix.

[0058] The generation unit is also used to generate a prediction consistency comparison result based on the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK;

[0059] The adjustment unit is used to adjust the embedding network, the first structure transformation matrix, the second structure transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type based on the error between the predicted consistency comparison result and the true consistency comparison result, until the error between the predicted consistency comparison result and the true consistency comparison result reaches a preset convergence condition.

[0060] Optionally, the SDK behavior consistency comparison device further includes:

[0061] A deviation log generation unit is used to generate a deviation log based on the consistency comparison result;

[0062] An upload unit is used to upload the deviation log to the server; wherein the server determines an adjustment plan based on the deviation log.

[0063] A third aspect of the present invention provides an electronic device, comprising:

[0064] One or more processors;

[0065] A storage device on which one or more programs are stored;

[0066] When the one or more programs are executed by the one or more processors, the one or more processors implement the SDK behavior consistency comparison method as described in any one of the first aspects.

[0067] A fourth aspect of the present invention provides a computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the SDK behavior consistency comparison method as described in any one of the first aspects.

[0068] As can be seen from the above scheme, the present invention provides an SDK behavior consistency comparison method, related device, and computer storage medium. By embedding the function name and call parameters in the behavior information of each interface call in a linked manner as a whole semantic unit, they together constitute a unified encoding vector of behavior information. The actual behavior sequence of the SDK is constructed according to the timestamp order. By using the embedding matrix of shared parameters and the pre-trained first and second structure transformation matrices, the data of the actual behavior sequence and the expected behavior sequence of the SDK are adjusted to the same dimension to calculate the structured deviation score between the two. This realizes the comprehensive similarity calculation between the actual behavior sequence and the expected behavior sequence of the SDK, and more comprehensively captures the fine-grained differences of the SDK behavior trajectory, providing a more accurate technical foundation for SDK security and compliance judgment. Attached Figure Description

[0069] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0070] Figure 1 A flowchart of an SDK behavior consistency comparison method provided in this embodiment of the invention;

[0071] Figure 2 A flowchart of a method for constructing a unified encoding vector for behavioral information is provided in another embodiment of the present invention;

[0072] Figure 3 Another embodiment of the present invention provides a flowchart for determining a structured bias scoring method;

[0073] Figure 4 A flowchart of a parameter training method provided in another embodiment of the present invention;

[0074] Figure 5 A schematic diagram of an SDK behavior consistency comparison device provided in another embodiment of the present invention;

[0075] Figure 6 A schematic diagram of an electronic device implementing an SDK behavior consistency comparison method is provided in another embodiment of the present invention. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0078] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0079] It should be noted that the concepts of "first" and "second" mentioned in this invention are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0080] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0081] First, the technical terms appearing in this invention will be explained:

[0082] SDK stands for Software Development Kit, which is generally a collection of development tools used by software engineers to create application software for specific software packages, software frameworks, hardware platforms, operating systems, etc.

[0083] API: Application Programming Interface (API) is a set of predefined functions designed to provide applications and developers with the ability to access a set of routines based on certain software or hardware, without needing to access the source code or understand the details of the internal workings.

[0084] With the development of the mobile ecosystem, third-party SDKs have become an indispensable part of application development, undertaking a large amount of business logic such as data collection, user behavior analysis, ad push, and location navigation. However, since these SDKs are provided by external developers, platform providers can often only understand their general capabilities through static information such as configuration files and permission declarations, making it difficult to obtain the details of their behavior during actual operation on the terminal.

[0085] Currently, industry-wide SDK behavior control primarily focuses on three methods: first, static review based on permission scope, such as checking whether the SDK requests sensitive permissions; second, intercepting and analyzing call behavior at runtime through sandboxes or proxy mechanisms; and third, maintaining blacklists and whitelists to block SDKs with historical risks. While these methods improve security to some extent, they still have the following limitations:

[0086] Coarse-grained: Most reviews are based on permissions or API lists, making it difficult to determine whether the SDK follows the "behavioral flow" set by the platform;

[0087] Lack of structure: Invocation order, parameter changes, and invocation frequency are often treated in isolation, failing to form a holistic view of the behavior;

[0088] Delayed response: Most solutions rely on manual configuration and review, making it impossible to respond automatically to behavior drift in a timely manner;

[0089] The comparison method is too simple: existing consistency detection methods mostly use single-dimensional analysis such as sequence matching and frequency thresholds, which can easily miss situations where "the call is reasonable but the parameters are abused".

[0090] Therefore, embodiments of the present invention provide an SDK behavior consistency comparison method, such as... Figure 1 As shown, the specific steps include:

[0091] S101. During SDK operation, obtain real-time information on interface call behavior.

[0092] The behavioral information includes the function name, timestamp, and call parameters. Call parameters include, but are not limited to, the parameters passed each time the function is called (such as numeric types, symbolic types, etc.) and the call result (success, failure, exception, etc.), which are not limited here.

[0093] In the specific implementation of this invention, the behavior information of SDK interface calls can be intercepted through hooks, instrumentation, proxies, etc., which are not limited here.

[0094] For example, when getLocation() is called, the system records its accuracy parameters and the call time, storing it as: "API:getLocation,Parameters:{accuracy:50},Timestamp:1721890001456".

[0095] S102. For the behavior information of each interface call, construct a unified encoding vector of the behavior information based on the function name and call parameters.

[0096] In the specific implementation of this invention, the function name and call parameters in the behavior information of each interface call are embedded together as a whole semantic unit to form a unified encoding vector of behavior information.

[0097] Optionally, in another embodiment of the present invention, the calling parameters are divided into numerical parameters and enumerated parameters. One implementation of step S102 is as follows: Figure 2 As shown, it includes:

[0098] S201. Use the first dynamic embedding matrix to map the function name to the first dense vector.

[0099] Each function name is treated as a discrete symbol. First, an index is created in the predefined set of function names, and then it is mapped to a dense vector space of fixed dimension by looking up a table.

[0100] Specifically, maintain a first dynamic embedding matrix. ,in It is the size of the set of function names. It is the vector dimension. For a given function name... Its vector representation is:

[0101] ;in yes Index in the set of function names.

[0102] It is important to emphasize that the first dynamic embedding matrix is ​​not statically defined, but rather learned gradually during pre-training. It is adjusted along with the embedding network, the first structural transformation matrix, the second structural transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type, all participating in gradient updates. This approach automatically adjusts the position of the function name in the vector space, enabling it to work with parameter features and context sequences to form an expression with behavioral semantic discriminativeness.

[0103] Furthermore, for cases where function names have format variations (such as getLocation and getLocation_v2), the system can also employ character-level or word-level embedding strategies. For example, the function name can be decomposed into character or word fragments and then fed into a lightweight encoder network (such as LSTM or CNN) to obtain a dense representation of the function name.

[0104] ;

[0105] This approach is particularly suitable for handling function calls with inconsistent naming conventions, similar structures, but slightly different semantics, further enhancing the model's ability to express and generalize the semantics of function names.

[0106] The construction of the function name vector in this invention is not merely a static table lookup; more importantly, it serves as a trainable feature representation throughout the entire behavior comparison task, participating in the optimization of the behavior consistency scoring process. This dynamic, data-driven embedding method is completely different from the fixed encoding or static matching strategies in traditional methods.

[0107] S202. For each numerical parameter, normalize the numerical parameter to obtain a normalized numerical vector.

[0108] Specifically, we first analyze the range of values ​​for the numerical parameters, and then use a linear normalization method to map them to... Range. For example, for a parameter "accuracy", its business value range is... When the actual collected value is When, its normalized representation is:

[0109] ;

[0110] The normalization method used in this invention can preserve the relative magnitude and differences of numerical features, facilitating effective neural network modeling. If the parameters are multi-dimensional numerical or have multiple subfields, each dimension is normalized separately and then concatenated to form a complete numerical vector.

[0111] S203. For each enumeration parameter, the enumeration parameter is mapped to a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type.

[0112] Specifically, since the enumeration parameters are discrete variables (such as "mode":"high", "type":"network"), this invention uses an embedding method to represent them as dense vectors. Specifically, an embedding matrix is ​​constructed for each enumeration type. ,in It is the total number of values ​​that can be enumerated. It is an embedding dimension. The index of a certain enumeration value (such as "high") in the set is... Its embedding vector is:

[0113] ;

[0114] The embedding matrix participates in parameter updates during model training, making semantically similar enumeration values ​​closer together in the embedding space, which helps the model capture subtle differences in parameter behavior.

[0115] S204. Generate a unified coding vector based on the first dense vector, the normalized numerical vector, and the second dense vector.

[0116] First, encode the numerical parameters. Encoding of enumeration type parameters The parameters of this function call are concatenated to form a unified representation:

[0117] ;

[0118] Subsequently, the parameter feature vector is embedded in the function name. Together, they form a complete representation of the behavioral elements:

[0119] ;

[0120] This vector This refers to the uniformly encoded function call representation unit, i.e., the uniformly encoded vector, which participates in model modeling as part of the input sequence. Since the first dynamic embedding matrix, the normalized parameters, and the second dynamic embedding matrix corresponding to the enumeration type in the above encoding process are all trainable modules, they are jointly optimized through gradient descent during training to ensure that the final uniformly encoded vector representation can reflect the behavioral semantics and bias features of the function call in the context.

[0121] For example, a function call might be:

[0122] getLocation(accuracy=50,mode="high");

[0123] "accuracy" is a numerical parameter, and its value range is set to [value range missing]. "mode" is an enumerated parameter, which can take the values ​​"low", "medium", and "high", and is numbered 0, 1, and 2 in the system, respectively.

[0124] First, normalize the value of accuracy=50:

[0125] ;

[0126] Then, an embedding lookup is performed on mode="high". Assuming the system uses an embedding dimension of 4, the lookup result is:

[0127] ;

[0128] By concatenating these two codes, we obtain the parameter vector representation of the call:

[0129] ;

[0130] Suppose the function name getLocation is mapped to a vector via an embedding function:

[0131] ;

[0132] Finally, the complete unified coding vector is:

[0133] ;

[0134] S103. Based on the timestamp order, sort the unified encoding vector of all behavioral information to construct the actual behavioral sequence of the SDK.

[0135] Specifically, all the unified coding vectors are sorted according to their timestamps to obtain the actual behavior sequence of the SDK. :

[0136] ;in The behavior sequence structure represents the number of interface calls while preserving the function name, call parameters, and timing.

[0137] In the specific implementation of this invention, when new interface call behavior information is obtained, a unified encoding vector of the new behavior information is constructed based on the function name and call parameters in the new interface call behavior information; then, the unified encoding vector of the new behavior information is added to the actual behavior sequence of the SDK.

[0138] Of course, the actual behavior sequence of the SDK can also be updated periodically using a set time window; this is not limited here.

[0139] Therefore, if the SDK experiences frequent parameter changes or abnormal call frequency within a certain period of time, the system will be able to capture these changes in a short time and provide the latest behavioral data for subsequent comparisons.

[0140] In the specific implementation of this invention, the client stores the collected behavioral data in a local cache for use in subsequent comparison processes. The storage format is typically a structured log file or database record, and the saved data includes: the function name, parameters, and timestamp of each interface call; the call order and time interval, for time-series analysis.

[0141] To ensure efficient access and processing, the system uses a standard database or file storage format to enable rapid retrieval and loading during the comparison phase.

[0142] In the specific implementation of this invention, the actual behavior sequence of the SDK and the expected behavior sequence of the SDK may have structural problems such as missing calls, redundancy, and order drift. Therefore, before comparing the actual behavior sequence of the SDK and the expected behavior sequence of the SDK, this invention also provides the following mechanisms: using a unified encoding rule to maintain the consistency of vector dimensions; inserting padding vectors for missing behaviors; and using masking to mark redundant behaviors to avoid interfering with the scoring.

[0143] S104. Input the actual behavior sequence of the SDK and the expected behavior sequence of the SDK into the embedding network for encoding to obtain the first vector and the second vector.

[0144] The expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information.

[0145] In the specific implementation of this invention, when a new version of the SDK is received, the server first generates a corresponding expected behavior sequence based on the SDK version information and requirement information. The expected behavior sequence defines not only the SDK's call order, parameter range, and timing control, but also frequency limits and other special constraints during SDK execution. The expected behavior sequence can serve as a "preset track" for SDK operation.

[0146] Specifically, the process of constructing the expected behavior sequence is as follows: First, the order of key interface calls during SDK execution is defined, such as from SDK initialization (init) to data upload (sendData), ensuring that the SDK executes the expected steps sequentially. For sensitive SDK interfaces (such as location or data upload interfaces), the server specifies allowed parameter ranges. For example, the getLocation API is only allowed to have a precision parameter not exceeding 100 meters; exceeding this limit is considered a deviation. To ensure reasonable timing during SDK execution, the server defines time interval requirements for certain interfaces. For example, the init interface must have at least a 3-second interval with subsequent interfaces to avoid excessively frequent calls. To control SDK resource consumption, the server also specifies call frequency limits for certain sensitive interfaces. For example, getLocation can be called a maximum of 10 times per minute; exceeding this frequency will be considered an anomaly.

[0147] Of course, for security reasons, the expected behavior sequence of the SDK can be digitally signed before it is distributed to the server, and this is not limited here.

[0148] Specifically, the expected sequence of behaviors of the SDK is hashed and digitally signed using the platform's private key. The generated signature credential ensures that the model is not tampered with during transmission, and the client can verify the model using the public key.

[0149] The digital signature process is as follows:

[0150] ;

[0151] in, To perform hash calculations on the original model text; To use the platform's private key for signing; Sign the generated model.

[0152] The generated, signed behavioral model will be sent to the client along with the signature. Upon receiving the model, the client will verify it using the platform's public key to ensure the model's legitimacy and the trustworthiness of its source.

[0153] In the specific implementation of this invention, the server generates different expected behavior models for each SDK version and assigns a version number and timestamp to each model for easy version management and historical querying. When the platform needs to update the behavior model (e.g., modifying the frequency limit of an interface, updating the parameter range, etc.), the server regenerates a new model and digitally signs it. The client compares its own version with the latest model signed by the server to ensure that it always runs on the behavior track approved by the platform.

[0154] The embedded network used in this invention It is an end-to-end trainable sequence encoder that performs semantic modeling and compressed representation of complete behavior sequences (including the actual behavior sequence of the SDK and the expected behavior sequence of the SDK), and outputs a fixed-dimensional vector to represent the overall features of the behavior trajectory.

[0155] The embedded network itself can adopt different depth structures, including but not limited to recurrent neural networks (such as Bi-LSTM), Transformer encoders (global modeling without sequence offset), etc., which are not limited here.

[0156] Specifically, ;in , These represent the actual behavior sequence of the SDK. Expected behavior sequence of the SDK The results of expression within the same semantic space.

[0157] Regardless of the encoder structure used, the final generated first vector Both are fixed-dimensional behavioral sequence representations, used to correspond to the second vector of the server-side model. Structural distance alignment is performed. Since all embedding layer and encoder parameters are optimized synchronously during training, this representation can not only express the order of actions, but also capture the combinational logic and parameter semantic changes between functions.

[0158] The encoder can be flexibly configured based on the computational resources and sequence complexity of the actual system. During training, the encoder network continuously adjusts its parameters based on feedback from the target bias scoring function, thereby enhancing its sensitivity to anomalous behavior patterns.

[0159] S105. Based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix, determine the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0160] The first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension.

[0161] Optionally, in another embodiment of the present invention, one implementation of step S105 is as follows: Figure 3 As shown, it includes:

[0162] S301. Determine the first target vector based on the first vector and the first structural transformation matrix.

[0163] Specifically, the first target vector can be determined using the following formula:

[0164] ;in, Let be the first vector. This is the first structural transformation matrix.

[0165] S302. Determine the second target vector based on the second vector and the second structural transformation matrix.

[0166] Specifically, the second target vector can be determined using the following formula:

[0167] ;in, For the second vector, This is the second structural transformation matrix.

[0168] S303. The distance between the first target vector and the second target vector is used as the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0169] Specifically, the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK can be determined using the following formula. :

[0170] .

[0171] S106. Generate consistency comparison results based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0172] In practical applications of this invention, the consistency between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK can be directly determined based on a set scoring threshold. Alternatively, the structured deviation score between the two can be normalized using a nonlinear function to output the final consistency score.

[0173] ;

[0174] in, The Sigmoid function is used to map distance values ​​to... Interval.

[0175] Then, based on the set scoring threshold, it is directly determined whether the actual behavior sequence of the SDK is consistent with the expected behavior sequence of the SDK.

[0176] It should be emphasized that, in the specific implementation of this invention, the specific training methods for the embedding network, the first structural transformation matrix, the second structural transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type are as follows: Figure 4 As shown, it includes:

[0177] S401. Construct a training sample set.

[0178] The training sample set includes multiple training sample data; the training sample data includes historical behavior information of the interface calls of the training sample SDK, the expected behavior sequence of the training sample SDK, and the true consistency comparison results.

[0179] S402. For the historical behavior information of each interface call, construct the historical behavior sequence of the training sample SDK.

[0180] The specific implementation of step S402 can be found in steps S102 and S103, and will not be repeated here.

[0181] S403. Input the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK into the embedding network for encoding to obtain the first sample vector and the second sample vector.

[0182] The specific implementation of step S403 can be found in step S104, and will not be repeated here.

[0183] S404. Based on the first sample vector, the second sample vector, the first structural transformation matrix, and the second structural transformation matrix, determine the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK.

[0184] The specific implementation of step S404 can be found in step S105, and will not be repeated here.

[0185] S405. Generate prediction consistency comparison results based on the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK.

[0186] The specific implementation of step S405 can be found in step S106, and will not be repeated here.

[0187] S406. Based on the error between the predicted consistency comparison result and the true consistency comparison result, adjust the embedding network, the first structure transformation matrix, the second structure transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type until the error between the predicted consistency comparison result and the true consistency comparison result reaches the preset convergence condition.

[0188] Specifically, backpropagation learning is used to adjust the embedding network, the first structural transformation matrix, the second structural transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type, thereby achieving dynamic optimization and adaptive expression updates during training. Therefore, this invention essentially belongs to a learnable contrastive structure scoring mechanism, which differs from traditional cosine similarity or simple distance functions.

[0189] For example, if certain function names frequently appear in abnormal behavior sequences in the training samples, this invention will automatically adjust the position of their embedding vectors to align them with "abnormal patterns" in the embedding space, thereby improving the ability to identify potential risky behaviors. Similarly, parameter embeddings will also adjust their numerical spatial distribution, making parameter values ​​outside the expected range more easily identified as deviations by this invention. Unlike the static word vectors used in existing technologies (such as Word2Vec or GloVe), this invention does not rely on manually set rules but trains multiple parameters together and updates them synchronously through error backpropagation. Therefore, the feature representation of behavioral elements possesses trainability and context adaptability, enabling it to more accurately capture the semantic relationship between function names and calling parameters.

[0190] Optionally, in another embodiment of the present invention, after generating a consistency comparison result based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK, one implementation of the SDK behavior consistency comparison method further includes:

[0191] Deviation logs are generated based on the consistency comparison results and uploaded to the server; the server then determines the adjustment plan based on the deviation logs.

[0192] The deviation log includes deviation type, function name, call parameters, and timing, etc., which are not limited here.

[0193] For example: the order of some interface calls in the SDK does not match the expected sequence of behavior; parameter deviation: the parameters of some interface calls in the SDK exceed the valid range predefined by the server; timing deviation: the time interval between interface calls fails to meet the minimum latency requirement; frequency deviation: the frequency of some interface calls exceeds the limit defined by the server.

[0194] In the specific implementation of this invention, the degree of deviation can be determined and the deviation can be classified based on the difference between the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK and a preset threshold.

[0195] For example: Minor deviations (such as slight parameter offsets or minor time interval deviations): These deviations do not affect the normal operation of the SDK, but they still need to be recorded and the developer notified. The system will pop up a warning message prompting the developer to check the SDK settings and allow the SDK to continue running. Moderate deviations (such as slightly exceeding the call frequency limit): These deviations may have a minor impact on system resources. The system will limit the frequency of calls to this interface or increase the cooldown time, and require the developer to optimize the SDK settings. Severe deviations (such as incorrect function call order or significantly exceeding the frequency limit): These deviations may cause application instability or security risks. The system will immediately suspend some or all functions of the SDK, prompt the user to take further action, and send the problem report to the server for analysis.

[0196] In the specific implementation of this invention, for security reasons, deviation logs will be encrypted and stored, and uploaded to the server periodically or as needed for analysis and strategy optimization.

[0197] The server generates adjustment plans based on the received deviation logs, such as: updating or optimizing the expected behavior sequence of the SDK based on deviation data, adjusting parameter ranges, call order, timing requirements, etc.; strategy adjustment: if certain SDK behavior patterns generally cause deviations, the server may need to adjust relevant strategies, such as modifying call frequency limits or timing requirements; SDK update reminder: the server can trigger update reminders through the client, requiring developers to upgrade the SDK to a more compliant version.

[0198] As can be seen from the above scheme, the present invention provides an SDK behavior consistency comparison method. By embedding the function name and call parameters in the behavior information of each interface call in a linked manner as a whole semantic unit, they together form a unified encoding vector of behavior information. The actual behavior sequence of the SDK is constructed according to the timestamp order. By using the embedding matrix of shared parameters and the pre-trained first and second structure transformation matrices, the data of the actual behavior sequence and the expected behavior sequence of the SDK are adjusted to the same dimension to calculate the structured deviation score between the two. This realizes the comprehensive similarity calculation between the actual behavior sequence and the expected behavior sequence of the SDK, and more comprehensively captures the fine-grained differences of the SDK behavior trajectory, providing a more accurate technical foundation for SDK security and compliance judgment.

[0199] Another embodiment of the present invention provides an SDK behavior consistency comparison device, such as... Figure 5 As shown, it specifically includes:

[0200] The behavior information acquisition unit 501 is used to acquire the behavior information of interface calls in real time during the SDK operation.

[0201] The behavioral information includes the function name, timestamp, and call parameters.

[0202] The unified encoding vector construction unit 502 is used to construct a unified encoding vector for the behavior information of each interface call based on the function name and call parameters.

[0203] Optionally, in another embodiment of the present invention, one implementation of the unified coding vector construction unit 502 includes:

[0204] The first mapping unit is used to map function names to first dense vectors using the first dynamic embedding matrix.

[0205] The normalization unit is used to normalize the numerical parameters for each numerical parameter to obtain a normalized numerical vector.

[0206] The second mapping unit is used to map each enumeration parameter into a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type.

[0207] A unified coding vector construction subunit is used to generate a unified coding vector based on a first dense vector, a normalized numerical vector, and a second dense vector.

[0208] For details on the specific operation of the units disclosed in the above embodiments of the present invention, please refer to the corresponding method embodiments, such as... Figure 2 As shown, it will not be elaborated further here.

[0209] The behavior sequence construction unit 503 is used to sort the unified encoding vector of all behavior information based on the timestamp order to construct the actual behavior sequence of the SDK.

[0210] The encoding unit 504 is used to input the actual behavior sequence of the SDK and the expected behavior sequence of the SDK into the embedding network for encoding to obtain the first vector and the second vector.

[0211] The expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information.

[0212] The deviation scoring unit 505 is used to determine the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix.

[0213] The first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension.

[0214] Optionally, in another embodiment of the present invention, one implementation of the deviation scoring unit 505 includes:

[0215] The first vector transformation unit is used to determine the first target vector based on the first vector and the first structure transformation matrix.

[0216] The second vector transformation unit is used to determine the second target vector based on the second vector and the second structural transformation matrix.

[0217] The deviation scoring subunit is used to use the distance between the first target vector and the second target vector as a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0218] For details on the specific operation of the units disclosed in the above embodiments of the present invention, please refer to the corresponding method embodiments, such as... Figure 3 As shown, it will not be elaborated further here.

[0219] The generation unit 506 is used to generate consistency comparison results based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

[0220] For details on the specific operation of the units disclosed in the above embodiments of the present invention, please refer to the corresponding method embodiments, such as... Figure 1 As shown, it will not be elaborated further here.

[0221] Optionally, in another embodiment of the present invention, one implementation of the SDK behavior consistency comparison device further includes:

[0222] The unified encoding vector construction unit is also used to construct a unified encoding vector for new behavior information based on the function name and call parameters in the behavior information of new interface calls when new interface call behavior information is obtained.

[0223] Adding units are used to add a unified encoding vector of new behavioral information to the actual behavioral sequence of the SDK.

[0224] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0225] Optionally, in another embodiment of the present invention, one implementation of the SDK behavior consistency comparison device further includes:

[0226] Training sample set construction unit, used to construct the training sample set.

[0227] The training sample set includes multiple training sample data sets. These training sample data sets include historical behavior information of the training sample SDK's interface calls, expected behavior sequences of the training sample SDK, and true consistency comparison results.

[0228] The unified encoding vector construction unit is also used to construct a unified encoding vector for the historical behavior information of each interface call based on the function name and call parameters in the historical behavior information.

[0229] The behavior sequence construction unit is also used to sort the unified encoding vector of all historical behavior information based on the order of historical timestamps, and construct the historical behavior sequence of the training sample SDK.

[0230] The encoding unit is also used to input the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK into the embedding network for encoding, to obtain the first sample vector and the second sample vector.

[0231] The bias scoring unit is also used to determine the structured bias score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK based on the first sample vector, the second sample vector, the first structural transformation matrix, and the second structural transformation matrix.

[0232] The generation unit is also used to generate prediction consistency comparison results based on the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK.

[0233] The adjustment unit is used to adjust the embedding network, the first structure transformation matrix, the second structure transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type based on the error between the predicted consistency comparison result and the true consistency comparison result, until the error between the predicted consistency comparison result and the true consistency comparison result reaches the preset convergence condition.

[0234] For details on the specific operation of the units disclosed in the above embodiments of the present invention, please refer to the corresponding method embodiments, such as... Figure 4 As shown, it will not be elaborated further here.

[0235] Optionally, in another embodiment of the present invention, one implementation of the SDK behavior consistency comparison device further includes:

[0236] The deviation log generation unit is used to generate deviation logs based on the consistency comparison results.

[0237] The upload unit is used to upload deviation logs to the server.

[0238] The server determines the adjustment plan based on the deviation log.

[0239] The specific working process of the units disclosed in the above embodiments of the present invention can be found in the corresponding method embodiments, and will not be repeated here.

[0240] As can be seen from the above scheme, the present invention provides an SDK behavior consistency comparison device. By embedding the function name and call parameters in the behavior information of each interface call in a linked manner as a whole semantic unit, they together form a unified encoding vector of behavior information. The actual behavior sequence of the SDK is constructed according to the timestamp order. By using the embedding matrix of shared parameters and the pre-trained first structure transformation matrix and second structure transformation matrix, the data of the actual behavior sequence of the SDK and the expected behavior sequence of the SDK are adjusted to the same dimension to calculate the structured deviation score between the two. This realizes the comprehensive similarity calculation between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK, and more comprehensively captures the fine-grained differences of the SDK behavior trajectory, providing a more accurate technical foundation for SDK security and compliance judgment.

[0241] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0242] Another embodiment of the present invention provides an electronic device, such as... Figure 6 As shown, it includes:

[0243] One or more processors 601.

[0244] Storage device 602, on which one or more programs are stored.

[0245] When the one or more programs are executed by the one or more processors 601, the one or more processors 601 implement the SDK behavior consistency comparison method as described in the above embodiments.

[0246] Another embodiment of the present invention provides a computer storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the SDK behavior consistency comparison method as described in the above embodiments.

[0247] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0248] It should be noted that the computer-readable medium described above in this invention can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0249] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0250] Another embodiment of the present invention provides a computer program product, which, when executed, is used to perform the above-described SDK behavior consistency comparison method.

[0251] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments of the present invention.

[0252] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in this invention is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely exemplary forms for implementing the invention.

[0253] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of the invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0254] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions in this invention.

Claims

1. A method for comparing SDK behavior consistency, characterized in that, include: During SDK operation, the behavior information of interface calls is acquired in real time; the behavior information includes function name, timestamp, and call parameters. For each interface call's behavior information, a unified encoding vector for the behavior information is constructed based on the function name and call parameters; Based on the timestamp order, the unified encoding vectors of all the behavioral information are sorted to construct the actual behavior sequence of the SDK; The actual behavior sequence and the expected behavior sequence of the SDK are respectively input into the embedding network for encoding to obtain a first vector and a second vector; wherein, the expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information; Based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix, a structured deviation score is determined between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK; wherein, the first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension; Consistency comparison results are generated based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

2. The SDK behavior consistency comparison method according to claim 1, characterized in that, The calling parameters are divided into numerical parameters and enumerated parameters. For each interface call, a unified encoding vector of the behavior information is constructed based on the function name and calling parameters, including: The function name is mapped to a first dense vector using a first dynamic embedding matrix; For each numerical parameter, the numerical parameter is normalized to obtain a normalized numerical vector; For each enumerated parameter, the enumerated parameter is mapped to a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type; A unified encoding vector is generated based on the first dense vector, the normalized numerical vector, and the second dense vector.

3. The SDK behavior consistency comparison method according to claim 1, characterized in that, The step of determining the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK based on the first vector, the second vector, the first structure transformation matrix, and the second structure transformation matrix includes: The first target vector is determined based on the first vector and the first structural transformation matrix; The second target vector is determined based on the second vector and the second structural transformation matrix; The distance between the first target vector and the second target vector is used as a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

4. The SDK behavior consistency comparison method according to claim 1, characterized in that, After sorting the unified encoding vectors of all the behavioral information based on timestamps to construct the actual behavioral sequence of the SDK, the method further includes: When new interface call behavior information is obtained, a unified encoding vector of the new behavior information is constructed based on the function name and call parameters in the new interface call behavior information; The unified encoding vector of the new behavioral information is added to the actual behavioral sequence of the SDK.

5. The SDK behavior consistency comparison method according to claim 2, characterized in that, Also includes: Construct a training sample set; wherein the training sample set includes multiple training sample data; wherein the training sample data includes historical behavior information of the interface calls of the training sample SDK, the expected behavior sequence of the training sample SDK, and the true consistency comparison results; For each API call's historical behavior information, a historical behavior sequence of the training sample SDK is constructed. The historical behavior sequence and the expected behavior sequence of the training sample SDK are respectively input into the embedding network for encoding to obtain the first sample vector and the second sample vector; Based on the first sample vector, the second sample vector, the first structural transformation matrix, and the second structural transformation matrix, a structured deviation score is determined between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK. A prediction consistency comparison result is generated based on the structured deviation score between the historical behavior sequence of the training sample SDK and the expected behavior sequence of the training sample SDK; Based on the error between the predicted consistency comparison result and the true consistency comparison result, the embedding network, the first structure transformation matrix, the second structure transformation matrix, the first dynamic embedding matrix, and the second dynamic embedding matrix corresponding to the enumeration type are adjusted until the error between the predicted consistency comparison result and the true consistency comparison result reaches the preset convergence condition.

6. The SDK behavior consistency comparison method according to claim 1, characterized in that, After generating a consistency comparison result based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK, the method further includes: A deviation log is generated based on the consistency comparison results; The deviation logs are uploaded to the server; the server determines the adjustment plan based on the deviation logs.

7. An SDK behavior consistency comparison device, characterized in that, include: The behavior information acquisition unit is used to acquire the behavior information of interface calls in real time during SDK operation; wherein, the behavior information includes function name, timestamp and call parameters; A unified encoding vector construction unit is used to construct a unified encoding vector for the behavior information of each interface call based on the function name and call parameters. The behavior sequence construction unit is used to sort the unified encoding vector of all the behavior information based on the timestamp order to construct the actual behavior sequence of the SDK; An encoding unit is used to input the actual behavior sequence and the expected behavior sequence of the SDK into the embedding network for encoding, respectively, to obtain a first vector and a second vector; wherein, the expected behavior sequence of the SDK is generated by the server based on the SDK version information and requirement information; A deviation scoring unit is used to determine a structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK based on the first vector, the second vector, the first structural transformation matrix, and the second structural transformation matrix; wherein the first structural transformation matrix and the second structural transformation matrix are used to adjust the first vector and the second vector to the same dimension; The generation unit is used to generate a consistency comparison result based on the structured deviation score between the actual behavior sequence of the SDK and the expected behavior sequence of the SDK.

8. The SDK behavior consistency comparison device according to claim 7, characterized in that, The calling parameters are divided into numerical parameters and enumerated parameters. The unified encoding vector construction unit includes: The first mapping unit is used to map the function name to a first dense vector using a first dynamic embedding matrix; A normalization unit is used to normalize the numerical parameter for each numerical parameter to obtain a normalized numerical vector; The second mapping unit is used to map each enumeration parameter into a second dense vector using the second dynamic embedding matrix corresponding to the enumeration type. A unified coding vector construction subunit is used to generate a unified coding vector based on the first dense vector, the normalized numerical vector, and the second dense vector.

9. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the SDK behavior consistency comparison method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that, It stores a computer program, wherein the computer program, when executed by a processor, implements the SDK behavior consistency comparison method as described in any one of claims 1 to 6.

Images