Fraud-related application detection method and device based on flow behavior analysis, medium and program product

Abstract

The invention provides a fraud-related application detection method and device based on flow behavior analysis, a medium and a program product, and the method comprises the steps: carrying out the deep packet detection analysis of the current network downloading flow, comparing an application sample obtained through analysis with a preset white list and a black list, and screening out a missed to-be-detected sample; running a to-be-tested sample in a sandbox environment, collecting an interface image, extracting text features, and inputting a fraud-related classification model to judge whether the application program is a fraud-related application program or not; the method comprises the following steps: performing deep packet detection analysis on current network use traffic, extracting multi-dimensional behavior characteristics such as a terminal identifier, an application use frequency and an active time period, performing coding and scaling processing to form a fraud-related feature vector, and inputting a random forest detection model to judge whether a terminal has a fraud-related application use behavior or not. According to the method, through complementary fusion of content feature and behavior feature detection links, full-process identification of fraud-related applications in downloading and using stages is realized, and the coverage rate, the accuracy rate and the real-time performance of fraud-related detection are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, device, medium, and program product for detecting fraudulent applications based on traffic behavior analysis. Background Technology

[0002] With the rapid development of the internet, online fraud methods are constantly evolving, and the number of fraudulent applications and encrypted chat scams has surged. To prevent internet fraud, telecom operators and public security departments have widely deployed fraudulent application detection systems to identify risks in network traffic and application samples.

[0003] Currently, the detection of fraudulent applications mainly employs static identification methods based on blacklists and feature libraries. For example, it compares application samples carried in download traffic using preset domain name, IP blacklists, or application package name features; or it matches application interface text using manually constructed keyword rules to determine its risk attributes. However, these methods have significant shortcomings: firstly, for unknown applications appearing for the first time or variant applications with the same source but different shells, the system struggles to identify them promptly because they are not included in the blacklist; secondly, keyword matching methods can only perform shallow character searches, lacking contextual semantic understanding capabilities, and are easily circumvented by text obfuscation, interface spoofing, and other methods.

[0004] Therefore, existing fraudulent application detection technologies generally lack a joint analysis mechanism for application sample content features and user behavior features, and also lack systematic feature engineering and model building for multi-dimensional features. This results in insufficient generalization and adversarial capabilities of the detection models, making it difficult to cope with rapidly evolving fraudulent methods. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this application provides a method, device, medium, and program product for detecting fraudulent applications based on traffic behavior analysis. This addresses the problem that existing technologies lack comprehensive modeling and joint analysis of the multi-dimensional characteristics of fraudulent applications, making it difficult to effectively distinguish between normal chat behavior and fraudulent chat behavior, resulting in low accuracy and high false negative rate in identifying fraudulent applications.

[0006] To achieve the above objectives and other advantages, some embodiments of this application provide the following aspects:

[0007] In a first aspect, some embodiments of this application provide a method for detecting fraudulent applications based on traffic behavior analysis, including:

[0008] Deep packet inspection and analysis are performed on the download traffic of the live network. The obtained application samples are compared with the preset whitelist and blacklist to filter out the application samples that do not match the features.

[0009] The application sample under test is dynamically run in a sandbox environment, and interface images are collected during the running process. The interface images are then processed by optical character recognition and natural language processing to obtain text features.

[0010] The text features are matched with a preset database of fraudulent keywords. If a match is found, the application sample to be tested is identified as a fraudulent application. The text features are then input into a pre-trained fraudulent classification model. Based on the classification results output by the fraudulent classification model, it is determined whether the application sample to be tested is a fraudulent application.

[0011] Applications identified as fraudulent will be added to a fraudulent application database, and download leads for fraudulent applications will be generated.

[0012] Secondly, some embodiments of this application also provide a method for detecting fraudulent applications based on traffic behavior analysis, including:

[0013] Perform deep packet inspection and parsing on the traffic used in the live network to obtain user behavior data;

[0014] Multi-dimensional behavioral features are extracted from the user behavior data. These multi-dimensional behavioral features include: numerical features obtained based on terminal identification, number of applications used, usage duration and frequency; classification features determined based on application type; time series features obtained based on usage activity statistics at different time periods; and spatial features obtained based on location information clustering.

[0015] The multi-dimensional behavioral features are encoded and scaled to form a fraud-related feature vector;

[0016] The fraud-related feature vector is input into a pre-trained fraud detection model, and the output of the fraud detection model is used to determine whether the corresponding terminal has engaged in fraudulent application usage.

[0017] When it is determined that there is fraudulent application usage, fraud clues containing terminal identifier and application identifier are output.

[0018] Thirdly, some embodiments of this application also provide an electronic device, the electronic device comprising:

[0019] One or more processors; and a memory storing computer program instructions that, when executed, cause the processors to perform the fraudulent application detection method based on traffic behavior analysis as described above.

[0020] Fourthly, some embodiments of this application also provide a computer-readable storage medium having a computer program and / or instructions stored thereon, which, when executed by a processor, implement the fraudulent application detection method based on traffic behavior analysis as described above.

[0021] Fifthly, some embodiments of this application also provide a computer program product, including a computer program and / or instructions, which, when executed by a processor, implement the fraudulent application detection method based on traffic behavior analysis as described above.

[0022] Compared with existing technologies, the solution provided in this application introduces a content feature detection link based on deep packet inspection and parsing, optical character recognition, and natural language processing during the download stage. The extracted interface text features are input into a fraud classification model for identification. This enables sandbox dynamic operation and interface text recognition of application samples from unknown sources during the application download process, accurately identifying fraudulent keyword features at the text content level. This allows for early interception of disguised and variant fraudulent applications, effectively reducing the risk of fraudulent applications landing on the terminal side. Simultaneously, by introducing a behavioral feature detection link during the usage stage, deep packet inspection and parsing of existing network traffic extracts multi-dimensional behavioral features such as terminal identification, application usage frequency, active time periods, and geographical location clustering. This allows for the identification of installed and running fraudulent applications from the perspective of user behavior patterns, improving the detection rate of concealed fraudulent applications such as encrypted chat and remote control applications. Through the complementary fusion of content feature detection and behavioral feature detection, this application can achieve full-process identification of fraudulent applications in the two key stages of the application lifecycle: download and usage, significantly improving the coverage, accuracy, and real-time performance of fraud detection. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other implementation methods can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is one of the flowcharts illustrating a method for detecting fraudulent applications based on traffic behavior analysis provided in this application embodiment;

[0025] Figure 2 This is a schematic diagram of the processing flow during the download stage of a method for detecting fraudulent applications based on traffic behavior analysis provided in an embodiment of this application;

[0026] Figure 3A schematic diagram of the content feature detection process during the download stage of a method for detecting fraudulent applications based on traffic behavior analysis, provided in an embodiment of this application;

[0027] Figure 4 This is a second schematic flowchart of a method for detecting fraudulent applications based on traffic behavior analysis provided in this application embodiment;

[0028] Figure 5 This is a schematic diagram of the processing flow during the use phase of a method for detecting fraudulent applications based on traffic behavior analysis provided in this application embodiment;

[0029] Figure 6 This is a system flowchart of a method for detecting fraudulent applications based on traffic behavior analysis provided in an embodiment of this application;

[0030] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] The following terms are used in this document.

[0033] Deep Packet Inspection (DPI) is a fine-grained traffic analysis technique that operates at higher levels of the network protocol stack. It can perform in-depth content inspection and analysis on each data packet transmitted over the network. DPI can not only identify the network layer and transport layer header information of data packets, but also parse the application layer payload content, including download protocol type, application identifier, session identifier, etc.

[0034] Optical Character Recognition (OCR) is a computer technology that converts text content in image form into editable and searchable text data. It is widely used in document digitization, automated data input, image understanding, and artificial intelligence.

[0035] Natural Language Processing (NLP) refers to the techniques used to process text data, such as word segmentation, part-of-speech tagging, entity recognition, and feature extraction, to transform the recognized interface text into structured feature data.

[0036] Support Vector Machine (SVM) is a supervised learning model primarily used for classification and regression analysis. It achieves strong generalization ability and robustness by finding the optimal hyperplane in the feature space to separate data points of different classes with maximum spacing.

[0037] Random forest is a supervised classification algorithm based on ensemble learning, primarily used for classification and regression tasks. It improves the accuracy and stability of the model by constructing multiple decision trees and combining their predictions. Compared to a single decision tree, random forest effectively reduces the risk of overfitting and performs well when handling high-dimensional data and missing values.

[0038] First Embodiment

[0039] The first embodiment of this application relates to a method for detecting fraudulent applications based on traffic behavior analysis, referring to... Figure 1 , Figure 2 As shown, the method may include the following steps:

[0040] Step A1: Perform deep packet inspection and analysis on the download traffic of the live network, and compare the obtained application samples with the preset whitelist and blacklist to filter out the application samples to be tested that do not match the features.

[0041] In this embodiment, step A1 specifically includes:

[0042] Step A101: Perform deep packet inspection and parsing on the data packets in the live network download traffic to identify the download protocol type and application download request, and reassemble the data packets belonging to the same download session in sequence to restore the complete application installation package file.

[0043] DPI (Deep Processing) technology can perform seven-layer deep parsing on data packets transmitted in the network, including but not limited to the IP header, TCP / UDP header, and their payload content. In this embodiment, the DPI parsing module is deployed on the core network side, such as the core network element (User Plane Function, UPF) responsible for data forwarding in the 5G core network architecture or the core network element (Packet Gateway, PGW) egress node in the 4G core network architecture, for real-time mirroring of download-type network traffic. Through DPI parsing, the download protocol type (such as HTTP, HTTPS, FTP, etc.) and application download requests (such as *.apk, *.ipa file download requests) of each data packet can be identified.

[0044] During parsing, data packets belonging to the same download session (identifiable by the five-tuple information <source IP, destination IP, source port, destination port, and transport protocol>) are reassembled in chronological order to recover the complete application installation package file. Specifically, after session identification, the DPI parsing module allocates an independent buffer queue for each session, sorting and caching the data packets in the session by TCP sequence number or data packet timestamp to prevent out-of-order delivery due to network jitter. After sorting, the payload content of each data packet in the session is concatenated in sequence, removing duplicate fragments and protocol header fields to obtain a continuous data byte stream. For HTTP-based transmissions, the concatenation length can be controlled by combining the Content-Length field or chunked transmission field in the response header. For HTTPS-based encrypted transmissions, plaintext content can be obtained by combining TLS / SSL man-in-the-middle decryption technology, provided it is legally deployed in the operator's core network. After the data stream splicing is completed, the file length field or response end flag in the protocol message is used to determine whether the data stream splicing is complete. The file integrity is verified by calculating the SHA-256 or MD5 hash value to ensure that no packet loss or damage has occurred. Finally, the reconstructed application installation package file is output, and its session identifier and download source address are recorded together as the parsed application sample to provide a basis for the detection process.

[0045] Step A102: Extract at least one of the following characteristic information from the application installation package file: package name, digital signature, hash value, or download source address, and use the application installation package file and its characteristic information as the parsed application sample.

[0046] To facilitate subsequent sandbox detection and feature comparison, this embodiment performs static feature extraction processing on the complete application installation package file after data packet reassembly. Specifically, firstly, the metadata of the installation package file is parsed, and basic identification information such as the application package name and version number is extracted according to the file format type (e.g., apk or ipa file). Secondly, the developer signing certificate embedded in the installation package is parsed to obtain digital signature information, such as extracting the .RSA signature file from the META-INF directory of the apk file and parsing out signature elements such as the issuer, public key digest, and validity period, which are used to identify the publishing entity of the application. Then, a hash check value such as SHA-256 or MD5 is calculated for the entire installation package file to generate a unique content fingerprint. In addition, the download source address of the application (e.g., Uniform ResourceLocator, domain name information in the URL) can also be recorded for source tracing analysis.

[0047] The extracted package name, digital signature, hash value, and download source address are collectively referred to as the static feature information of the application. This installation package file and its corresponding static feature information are stored as a parsed application sample in a sample database. This database is used to compare the sample with pre-stored feature information in whitelists and blacklists, enabling rapid identification of known trusted applications and known fraudulent applications, and providing executable file samples for dynamic sandbox detection.

[0048] Step A103: Match the application sample with the pre-stored feature information in the whitelist and blacklist.

[0049] Both the whitelist and blacklist are pre-built databases of characteristic information, regularly updated and maintained by the operations management system. The whitelist includes application signing packages released from official app stores such as the Android app market and the Apple App Store, application installation packages released through internal enterprise review, and applications released through other certified and trusted channels. Its characteristic information includes package name, developer signing certificate, SHA-256 / MD5 hash value, and download source domain name, used to characterize a trusted source. The blacklist, on the other hand, includes fraudulent applications investigated by public security authorities, fraudulent samples provided by third-party security organizations, and historical applications identified as fraudulent by the operator's self-developed detection system. Its characteristic information also includes package name, signing certificate, hash value, and download source domain name, used to identify applications confirmed to be fraudulent.

[0050] During the comparison, the feature matching module matches the static feature information of the parsed application sample with the feature entries stored in the whitelist and blacklist databases one by one. When the sample's package name matches the whitelist entry and the public key digest of the signature certificate matches, the sample is determined to be a trusted application. When the sample's hash value or download source domain name matches the blacklist entry, the sample is determined to be a known fraudulent application. If no whitelist or blacklist entry is matched, the sample is marked as an unknown source sample and enters the sandbox dynamic running analysis process.

[0051] This feature matching process enables rapid separation of known trustworthy samples and known fraudulent samples during the download stage, significantly reducing the number of samples required for subsequent sandbox analysis and improving the processing efficiency of the detection system.

[0052] If it matches the whitelist, proceed to step A104;

[0053] Step A104: The application sample is determined to be a trusted application, and the fraudulent application detection process is terminated. At this point, the application is considered a safe source and will not proceed to the subsequent dynamic fraud detection process.

[0054] If it matches the blacklist, proceed to step A105;

[0055] Step A105: Send a blocking command to terminate data transmission for the corresponding download session.

[0056] The DPI (Distributed Pointer Interface) resolution module deployed on the operator's core network sends blocking commands to the access control device to forcibly terminate the data transmission of the current download session. Specifically, when the DPI resolution module performs feature matching on the application layer load of the download session, if it detects that the packet name, digital signature, SHA-256 / MD5 hash value, or download source domain name matches a blacklist entry, it immediately generates a blocking policy rule. It encapsulates the five-tuple information of the download session (source IP, destination IP, source port, destination port, and transport protocol) into the blocking command and sends it to the access control device through a control interface (e.g., based on NETCONF, OpenFlow, or the operator's self-developed southbound control interface). The access control device, which can be a UPF, PGW, or border firewall in the core network, immediately updates its local forwarding policy upon receiving the blocking command. It adds the download data stream with the corresponding five-tuple to the blocking list and directly discards or resets the connection for subsequent data packets of the session (e.g., by sending a TCP RST packet), thereby terminating the continued transmission of the download session.

[0057] If neither the whitelist nor the blacklist is matched, proceed to step A106;

[0058] Step A106: Identify the corresponding application sample as the application sample to be tested. This indicates that the source of this type of sample is unknown and it will be dynamically analyzed in a sandbox environment in subsequent steps to further identify potential fraudulent features.

[0059] Step A2: Run the application sample under test dynamically in a sandbox environment, collect interface images during the running process, and perform optical character recognition and natural language processing on the interface images to obtain text features.

[0060] Reference Figure 3 As shown, the test application samples (including Android application installation packages in APK format and iOS application installation packages in IPA format) selected in step A1 are loaded into a preset sandbox environment for dynamic execution in step A2. The sandbox environment can be built using virtual machines or container virtualization to isolate applications from unknown sources and prevent potential malicious code from affecting the real terminal environment. During runtime, the sandbox fully simulates the terminal operating system, network access environment, and user interaction interface, allowing the test application samples to start, load pages, request resources, and display advertisements according to real-world usage scenarios, thereby fully exposing their runtime behavior and interface presentation.

[0061] During dynamic operation, the sandbox system periodically or based on interface change events captures screenshots of the application's interface rendering as a data source for content analysis. For the acquired interface images, optical character recognition (OCR) technology is first used to detect areas containing text, and then character recognition is performed on these areas to extract structured text data. For example, when the interface contains phrases such as "low-interest loan," "simple approval," "no collateral required," and "maximum loan amount of 200,000," the OCR module will output this content as a string.

[0062] Subsequently, natural language processing techniques were used to process the extracted text data, specifically including: text cleaning: removing HTML tags, redundant symbols, emojis, and other irrelevant characters; word segmentation: dividing continuous Chinese strings into basic lexical units, for example, "low-interest loan" was segmented into "low interest" and "loan"; part-of-speech tagging: labeling each word with grammatical attributes, for example, "low interest" is an adjective phrase and "loan" is a noun phrase; feature extraction: based on the word segmentation and part-of-speech tagging results, semantic features such as word frequency, named entities, and keywords were extracted to form text features.

[0063] Step A3: Match the text features with the preset fraud-related keyword database. If a match is found, the application sample to be tested is identified as a fraud-related application. The text features are then input into the pre-trained fraud classification model. Based on the classification results output by the fraud classification model, it is determined whether the application sample to be tested is a fraud-related application.

[0064] Based on the text features obtained in step A2, step A3 further executes a dual judgment mechanism based on keyword matching and support vector machine (SVM) classification model to identify the fraudulent attributes of the application sample under test.

[0065] Specifically, the text features, processed through optical character recognition and natural language processing and marked with words and parts of speech, are first matched against a predefined database of fraudulent keywords. This database is continuously maintained and updated by the operations management system based on previously detected fraudulent samples. Typical keywords include "loan," "low interest," "high return," "gambling," "pornography," "brushing," "counterfeiting," and "instant payment." If the text features contain keywords that are identical or similar to those in the database, it is considered a match for fraudulent keywords, and the corresponding application sample is directly identified as a fraudulent application, enabling rapid interception of typical fraudulent content.

[0066] If the text features do not match the keyword database, they can be input into a pre-trained fraud classification model. The model will then output a category determination based on the classification rules learned during training. If the model outputs a specific fraud category, the tested application sample will be classified as a fraudulent application. For example, if the text features contain terms such as "low interest" or "loan," the fraud classification model can classify the tested app sample as a "loan fraud" app based on the decision boundary learned during training.

[0067] By combining keyword matching with model inference, this embodiment can not only quickly identify applications containing typical fraudulent keywords, but also identify disguised and variant fraudulent texts that circumvent explicit keywords. It takes into account both the efficient identification of explicit fraudulent texts and the accurate identification of hidden fraudulent texts, thereby achieving automated and accurate classification of fraudulent applications and significantly improving the comprehensiveness, coverage and accuracy of detection.

[0068] In this embodiment, the fraud classification model is a support vector machine classification model, which is obtained by supervised training on historical application samples that have been labeled as fraudulent. The supervised training includes: obtaining training text feature vectors from the interface text of the historical application samples through optical character recognition and natural language processing; standardizing the training text feature vectors; and training a support vector machine classifier based on the training text feature vectors and the corresponding category labels to construct a classification hyperplane for distinguishing specific fraud categories.

[0069] The fraud classification model preferably employs a Support Vector Machine (SVM) model, which is built through supervised training on historical application samples labeled as fraudulent. This model is used to automatically classify and determine the text content of the interface of the application under test. Specifically, during the model training phase, a dataset of historical application samples containing category labels is first collected. Each sample is accompanied by interface text content processed by optical character recognition and natural language processing. The collected interface text is then subjected to Chinese word segmentation, part-of-speech tagging, and stop word cleanup to extract multi-dimensional text features, including word frequency, part-of-speech, and named entities. These text features are encoded into numerical feature vectors for use as model input.

[0070] To avoid bias in training results due to inconsistencies in the dimensions of different features, the text feature vectors are standardized before training. Specifically, the original value of each feature is subtracted from its mean in the training set and divided by its standard deviation, ensuring that each feature value has zero mean and unit variance. This improves the model's ability to uniformly perceive features at different scales. Subsequently, the standardized training text feature vectors and their corresponding category labels (e.g., specific fraud-related categories such as "loan fraud," "pornographic nude chat," "counterfeiting," and "gambling") are input into an SVM classifier for supervised training. The SVM classifier learns the discrimination boundary of various text samples by finding the optimal classification hyperplane in the high-dimensional feature space that maximizes the margin between samples of different categories, thus achieving accurate differentiation of text features of different fraud-related categories.

[0071] Because SVM classifiers possess strong few-shot learning and generalization capabilities, they maintain stable classification performance even in scenarios with limited training samples and high feature dimensionality. Furthermore, SVM classifiers are well-suited to high-dimensional sparse features (such as text feature vectors extracted by OCR and NLP), effectively handling the large amount of redundant and noisy features present in textual data. In addition, SVM classifiers have clear mathematical optimization objectives and interpretable support vector decision boundaries, making them easier to analyze and optimize compared to complex models such as deep neural networks, thus reducing model deployment and maintenance costs. Therefore, they are suitable for fraud-related text classification scenarios with high feature dimensionality, significant class boundary differences, but relatively limited sample size, helping to improve the accuracy and robustness of fraud detection in this embodiment.

[0072] Step A4: Store the applications identified as fraudulent in the fraudulent application database and output download clues for the fraudulent applications.

[0073] The relevant information of the fraudulent application is stored in a pre-defined fraudulent application database for centralized management. This database can be deployed in an operations management system or security monitoring platform for long-term storage and management of confirmed fraudulent application samples and their characteristic metadata. The stored information may include, but is not limited to:

[0074] Static characteristics of the application, such as package name, digital signature, hash value (such as SHA-256 checksum), download source address (URL or domain name), version number, etc.

[0075] Application content features, such as screenshots taken during sandbox operation, text features obtained through optical character recognition and natural language processing, and keyword matching;

[0076] The judgment result information, such as the judgment time, judgment model version, hit rules or classification results, etc.

[0077] Simultaneously, clues to fraudulent application downloads will be generated and output to the operation and supervision platform to assist in subsequent network control and law enforcement evidence collection. These clues may include: a five-tuple of download session information (source IP, destination IP, source port, destination port, and transport protocol), a download timestamp, a download terminal device identifier, and corresponding application characteristic information, used to uniquely locate the source and download path of the fraudulent application.

[0078] By storing samples of fraudulent applications in a fraudulent application database for archiving and simultaneously outputting download clues to the regulatory platform, it is possible to achieve evidence collection and traceability of fraudulent applications and a closed-loop flow of clues. This not only supports the dynamic updating of the blacklist but also provides a complete chain of evidence to support subsequent fraud handling and criminal prosecution.

[0079] Second Embodiment

[0080] The second embodiment of this application relates to a method for detecting fraudulent applications based on traffic behavior analysis, referring to... Figure 4 , Figure 5 As shown, the method may include the following steps:

[0081] Step B1: Perform deep packet inspection and parsing on the traffic used on the live network to obtain user behavior data.

[0082] The DPI (Data Interference Point) parsing module deployed on the core network side analyzes the raw data packets transmitted on the live network, identifies traffic data from different application sessions, and collects usage records for various applications. For clarity, the following uses encrypted chat apps and remote control apps as examples: First, based on the five-tuple information of the data packets (source IP, destination IP, source port, destination port, and transport protocol), data packets belonging to the same session are aggregated to identify the application type corresponding to each session. For example, some data traffic is identified as encrypted chat app sessions, while other data traffic is identified as remote control app sessions. For each identified session, relevant basic usage information is extracted to construct raw user behavior data. This includes: terminal identification information such as IMEI, IMSI, and user account ID; usage statistics such as application usage duration, frequency, and data transmission volume; and location and time information such as the geographical location signaling of the session and the time period of the session. This information constitutes a basic profile of user behavior, which can be used for multi-dimensional behavioral feature extraction and fraud detection model determination.

[0083] It should be noted that the above examples of encrypted chat apps and remote control apps are for ease of understanding only. This embodiment is also applicable to other types of applications, and their traffic session data can be collected and feature extracted in the same way for unified input into the fraud detection model for judgment.

[0084] Step B2: Extract multi-dimensional behavioral features from user behavior data. These multi-dimensional behavioral features include: numerical features obtained based on terminal identification, number of applications used, usage duration, and usage frequency; classification features determined based on application type; time series features obtained based on usage activity statistics at different times; and spatial features obtained based on location information clustering.

[0085] After acquiring the raw user behavior data, the system performs feature processing to extract the following four categories of multi-dimensional behavioral features:

[0086] Numerical characteristics: such as the number of encrypted chat apps used by a certain terminal (same IMEI number) within a set time window (e.g., the last 7 days or 30 days), the cumulative usage time (usage_time), and the usage frequency.

[0087] Classification features: such as the application type of the current session (chat, remote control, etc.), or whether a remote control behavior flag (remote_control) has been detected.

[0088] Time series characteristics: such as statistical analysis of activity levels in different hours of the day (activity_morning, etc.) to form a behavioral time distribution curve.

[0089] Spatial characteristics: such as location clustering indicators (location_cluster) formed by using clustering algorithms to count the number of users’ permanent locations and switching frequency based on location signaling in session records.

[0090] Step B3: Encode and scale the multi-dimensional behavioral features to form a fraud-related feature vector.

[0091] In this embodiment, step B3 specifically includes:

[0092] Step B301: Encode the categorical features in the multi-dimensional behavioral features using one-hot encoding;

[0093] Step B302: The numerical features in the multi-dimensional behavioral features are scaled using a standardization method. The scaling process includes subtracting the mean of the numerical features from the original feature values ​​and dividing by the standard deviation of the numerical features to make the numerical features have zero mean and unit variance.

[0094] Since the multi-dimensional behavioral features extracted from user behavior data include both categorical and numerical features, their original representations differ in terms of value range, data type, and unit of measurement. Directly inputting them into the model can lead to training convergence difficulties or even classification bias. Therefore, unified encoding and scaling processing are required first.

[0095] Specifically, for fields belonging to categorical features (such as application type, whether a remote control application is used), this embodiment uses one-hot encoding for encoding conversion. One-hot encoding assigns an independent binary bit to each possible categorical value, converting the original discrete categorical variable into a sparse numerical vector. For example, when the "app_type" feature has three categories, APP1, APP2, and APP3, the original data are APP1, APP2, and APP3, respectively; after one-hot encoding, it is converted to: APP1:[1,0,0]; APP2:[0,1,0]; APP3:[0,0,1].

[0096] One-hot encoding expands each class into a separate dimension, ensuring that each class is equally spaced and weighted in the numerical space. This guarantees that the model treats each feature class equally, without assigning higher weights to any particular class due to numerical differences. The feature matrix after one-hot encoding is sparse and mutually exclusive, which is beneficial for classification models (such as random forest models) to accurately distinguish between different categories of features during feature selection and partitioning, improving the model's generalization ability and robustness under high-dimensional sparse feature conditions.

[0097] For fields that are numerical features, such as the number of encrypted chat apps used by a terminal within a set time window (num_apps), cumulative usage time (usage_time), usage frequency, and daily activity (activity_morning), this embodiment uses a standardization method for scaling to eliminate the differences in units between different numerical features. Specifically, the mean μ and standard deviation σ of each numerical feature in the training set are calculated, and then each feature value x is standardized as follows:

[0098]

[0099] in, These are the standardized eigenvalues. These are the original eigenvalues. The mean of this feature. This represents the standard deviation of the feature. The standardized eigenvalues ​​are... It will have zero mean (mean≈0) and unit variance (variance≈1), so that all numerical features are within the same scale range, avoiding the problem that some features have too large a weight during model training due to differences in feature dimensions, which interferes with the model's learning effect.

[0100] For example, after the above encoding and normalization scaling processes, the following sample data can be obtained:

[0101] IMEI num_apps usage_time app_type_1 app_type_2 remote_control activity_morning location_cluster category 123 5 120 1 0 0 0.8 3 fraud 456 2 45 0 1 1 0.2 1 normal

[0102] Through the above steps B301 and B302, this embodiment can uniformly convert the original multi-source heterogeneous behavioral features into continuous, equal-scale numerical vector representations, thereby forming the fraud-related feature vectors required for subsequent model determination.

[0103] Step B4: Input the fraud-related feature vector into the pre-trained fraud detection model, and determine whether the corresponding terminal has engaged in fraudulent application usage based on the output of the fraud detection model.

[0104] In this embodiment, the fraud detection model adopts a random forest model, and the training process of the random forest model includes:

[0105] Construct a training set and set the parameters of the random forest. The training set consists of historical user behavior data of applications labeled as fraudulent. After feature extraction, encoding and scaling, it forms feature vectors with ground truth labels.

[0106] Each decision tree in the random forest model is constructed as follows:

[0107] The same number of samples as the original training set are randomly drawn from the training set with replacement to form a training subset of the decision tree;

[0108] A predetermined number of features are randomly selected from all input features in the training set to form a candidate feature set;

[0109] Based on the training subset and candidate feature set, a decision tree algorithm is used to recursively construct a decision tree starting from the root node. At each node, the optimal feature and the splitting threshold are selected from the candidate feature set to split the samples of that node. The samples of each child node are then split based on the optimal feature and the splitting threshold selected from the candidate feature set until the preset stopping condition is met.

[0110] Multiple decision trees constructed based on training subsets and candidate feature sets are integrated to form a random forest model.

[0111] Specifically, in the model training phase, the training set needs to be constructed first: the system collects historical user behavior data containing different category tags such as "loan fraud," "pornographic nude chat," and "gambling," with each sample data accompanied by a ground truth label indicating whether it involves fraud. Multi-dimensional feature extraction (including numerical features, categorical features, time-series features, and spatial features) is performed on the raw behavioral data, followed by one-hot encoding and standardization scaling to obtain a set of labeled feature vectors as the training set.

[0112] Next, set the core parameters of the random forest, including: n_estimators (number of trees), for example, set to 100; max_depth (maximum depth of a single tree), for example, set to None to indicate no depth limit; min_samples_split (minimum number of samples required for splitting), for example, set to 2; min_samples_leaf (minimum number of samples in a leaf node), for example, set to 1; and max_features (maximum number of features that can be used per decision tree), which can be set according to empirical values ​​such as sqrt (total number of features).

[0113] When building each decision tree in the random forest model, perform the following steps:

[0114] (1) Bootstrap sampling: Randomly select samples with replacement from the training set in an amount equal to that of the original training set to form a training subset of the decision tree;

[0115] (2) Random feature selection: Randomly select a preset number (m) of features from all input features in the training set to form a candidate feature set. For example, when m=2, feature combinations such as {num_apps,app_type_1} or {usage_time,remote_control} may be selected.

[0116] (3) Recursive construction of decision tree: Based on the training subset and candidate feature set, the tree is recursively constructed starting from the root node. At each node, the algorithm selects the optimal feature and its splitting threshold from the candidate feature set to split the samples of that node, and continues to perform the same feature selection and splitting operation on each of the resulting child nodes until the preset stopping condition is reached (such as the number of node samples being less than min_samples_split, the tree depth reaching max_depth, or the node purity meeting the requirements).

[0117] (4) Integration: Repeat the above process to construct multiple decision trees with different structures, and integrate the decision trees to form a random forest model.

[0118] After training, the model's structured parameters (including node splitting features, splitting thresholds, and leaf node category outputs for each tree) will be fixed for use in the online inference phase. During inference, fraud-related feature vectors extracted from user behavior data in real-time traffic are input into the trained random forest model. Each decision tree independently outputs a classification result (e.g., "fraudulent" or "normal"). The random forest aggregates the results from all trees through majority voting to determine whether the terminal is using fraudulent applications; alternatively, it can output a fraud probability score, where a probability higher than a threshold indicates a risk of fraud.

[0119] In this embodiment, after forming the random forest model, the method further includes:

[0120] Based on historical user behavior data of applications labeled with different fraudulent behavior categories, a classification training sample set with category labels is formed after feature extraction, encoding and scaling.

[0121] The classification training sample sets are input into the random forest model to update the parameters, thereby retraining the random forest model and forming fraud detection models for identifying different categories of fraudulent behavior based on the random forest model.

[0122] In this embodiment, after constructing and deploying the general random forest fraud detection model, the model can be fine-tuned based on labeled samples of different fraudulent behavior categories to derive a dedicated detection model for specific fraudulent scenarios. Specifically, historical user behavior data containing labels for different fraudulent behavior categories (such as "fraudulent den", "multiple numbers on one device", "remote control via private chat") is first collected. These sample data are obtained by combining manual judgment, case clues, and operational monitoring results. Each sample data is accompanied by a feature vector representation after multi-dimensional feature extraction (including numerical features, classification features, time series features, and spatial features), one-hot encoding, and standardized scaling, and includes the corresponding fraudulent category label, forming a classification training sample set.

[0123] Subsequently, the aforementioned classification training sample sets are grouped according to fraud-related categories and input into the already constructed general random forest model for retraining. Specifically, while retaining the original model tree structure and parameters, the node splitting thresholds, feature weight distributions, and voting weights of each decision tree can be updated through iterative training, enabling the model to finely fit the discrimination boundary for specific category samples. Alternatively, based on the feature importance ranking results of the original model, the latest sample data related to the current category can be added, some decision trees can be retrained, and the old trees in the ensemble forest can be replaced to improve the model's classification accuracy and recall for this type of sample.

[0124] Through the above retraining process, specialized detection models applicable to different categories of fraudulent behavior can be formed based on the general fraud detection model. For example, there is a "density detection model" for detecting the concentrated use of terminals by gangs, a "one-device-multiple-accounts detection model" for identifying the abnormal behavior of frequently switching multiple accounts on the same terminal, and a "secret chat remote control detection model" for identifying concealed fraudulent behaviors such as encrypted chat and remote control.

[0125] These dedicated detection models can be deployed and run independently, each receiving user behavior feature vector input and outputting fraud risk assessment results for its respective category. They can also continuously update model parameters based on actual performance, thereby improving the ability to identify different types of fraudulent behavior and the overall detection coverage.

[0126] Figure 6 The system flowchart of a fraudulent application detection method based on traffic behavior analysis provided in this application embodiment illustrates the offline training and online prediction process of the model.

[0127] Figure 6 In the middle, the left side shows the offline training process: The system first collects historical fraud case data containing different types of fraudulent behavior tags such as "loan fraud," "sexual nude chat," and "gambling," then uses a data mining platform to extract sample features (including numerical features, classification features, time series features, spatial features, etc.), and uses the random forest algorithm to build a fraud detection model. After the model is trained, a model file conforming to the PMML (Predictive Model Markup Language) standard format is generated.

[0128] The right side shows the online prediction process: Upon receiving real-time user behavior data, the system uses its decision engine to call the deployed fraud detection model (via WebAPI). Based on the input user behavior feature vector, it performs model matching, indicator evaluation, and intelligent decision-making, thereby outputting a fraud prediction result. The prediction result may include classification results (determining whether it is fraudulent and its category) and clustering results (grouping unknown samples into similar behavior groups for early warning analysis) to assist in the comprehensive assessment of fraud risk.

[0129] After the fraud detection model is deployed online, the system can continuously validate the model based on the comparison between the judgment results output by the model during actual operation and the real labels obtained from subsequent verification. The validation results are used as feedback information for dynamic optimization of model parameters. The system can statistically analyze the model's predictions of true positives, true negatives, false positives, and false negatives for new samples to evaluate the current model's performance in terms of accuracy, recall, and other performance metrics. When the system finds that the model has a high false positive rate on a certain type of sample, it can retrain and update the model by adjusting the hyperparameters of the random forest model (such as the number of trees n_estimators, maximum depth max_depth, minimum number of sample splits min_samples_split, and number of feature selections max_features), or by supplementing with the latest confirmed fraud samples, rebalancing the distribution of training data, and optimizing feature extraction and weight allocation. The above-mentioned continuous parameter tuning mechanism based on validation results can effectively improve the detection performance and generalization ability of the model on historical and new samples, avoid the model from failing due to overfitting, enable the model to adapt to the constantly evolving characteristics of fraudulent behavior in the long term, and achieve continuous optimization of fraud detection effect.

[0130] Through the aforementioned offline training and online prediction linkage mechanism, this embodiment realizes a closed-loop process from model learning from historical samples to online real-time inference, taking into account both model accuracy and runtime efficiency, and can efficiently identify fraudulent applications without affecting the response performance of business systems.

[0131] Step B5: When it is determined that there is fraudulent application usage behavior, output fraud clues containing terminal identifier and application identifier.

[0132] When the fraud detection model determines that a terminal is using a fraudulent application, it generates and outputs corresponding fraud clues for subsequent coordinated response systems to issue alerts and intercept the fraud. The fraud clues include at least a terminal identifier and an application identifier, and may also include auxiliary information such as a detection timestamp, model confidence level, and behavioral feature summary to facilitate tracking and policy decisions by the operations management system. The generated fraud clues can be sent to collaborative response modules such as outbound call alerts, SMS alerts, and network access control via a reporting interface, enabling real-time alerts for fraudulent terminals and coordinated protection measures such as blocking or forcibly uninstalling fraudulent applications. Through this approach, this embodiment can achieve precise location and rapid coordinated response of suspicious terminals and applications after detecting fraudulent application usage, significantly improving the timeliness and effectiveness of fraud prevention and control.

[0133] In summary, this application, by introducing a content feature detection link based on deep packet inspection and parsing, optical character recognition, and natural language processing during the download stage, inputs the extracted interface text features into a fraud classification model for identification. This enables sandbox dynamic operation and interface text recognition of application samples from unknown sources during the application download process, accurately identifying fraudulent keyword features at the text content level. This allows for early interception of disguised and variant fraudulent applications, effectively reducing the risk of fraudulent applications landing on the terminal side. Simultaneously, by introducing a behavioral feature detection link during the usage stage, deep packet inspection and parsing of existing network traffic extracts multi-dimensional behavioral features such as terminal identification, application usage frequency, active time periods, and geographical location clustering. This allows for the identification of installed and running fraudulent applications from the perspective of user behavior patterns, improving the detection rate of concealed fraudulent applications such as encrypted chat and remote control applications. Through the complementary fusion of content feature detection and behavioral feature detection, this application can achieve full-process identification of fraudulent applications in the two key stages of the application lifecycle: download and usage, significantly improving the coverage, accuracy, and real-time performance of fraud detection.

[0134] To support the implementation of the fraudulent application detection method based on traffic behavior analysis described in this embodiment, the anti-fraud traffic behavior analysis system deployed on the operator's core network has constructed a complete environment for fraudulent behavior analysis and sample feature support. On the behavior feature side, the current user behavior analysis feature library covers mainstream high-risk application categories, including 61 banking apps, 14 remote conferencing apps, 36 private chat apps, and 2 VoIP apps. Combined with DPI deep analysis technology, real-time monitoring of user behavior based on 4G / 5G networks can be achieved. The monitoring scope covers high-risk apps such as private chat, remote control, and financial apps, and supports correlation analysis with behavior records from communication applications such as FaceTime to construct a multi-dimensional user profile model.

[0135] On the content feature side, the system has the capability to independently detect and analyze fraudulent apps. It can filter app download traffic based on a whitelist, extract static features and perform fraudulent feature matching detection on unknown or suspicious APK files, and load suspicious samples into a sandbox environment for dynamic operation monitoring, obtaining dynamic behavior information such as screenshots of their running interface, communication addresses, and API calls. It can complete more than 3,000 application sample detection tasks per month. At the same time, it also has the capability to independently analyze fraudulent websites. It can filter normal websites through a whitelist, use crawlers to capture snapshot pages of unregistered websites and extract features such as source code and keywords for fraudulent feature matching detection, with a monthly detection volume of more than 100,000.

[0136] On the handling side, the system has built a closed-loop handling capability for fraudulent apps and websites: it supports real-time blocking of app download URLs to cut off the spread of fraudulent apps; it supports correlation analysis of the server location and communication information of fraudulent apps and websites, and flexibly generates handling strategies, which are then distributed through network devices such as UPF, PGW, or border firewalls to quickly block access to fraudulent apps and websites. The system provides a management interface for the distribution list of blocking strategies, supporting the addition, deletion, modification, and query of distributed strategies, and can provide real-time statistics on blocking execution and fraudulent clue reporting, presenting strategy distribution records, number of block hits, and handling effectiveness in a chart-based visualization, providing operators with traceable and quantifiable closed-loop governance support.

[0137] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0138] Furthermore, some embodiments of this application also provide an electronic device. The electronic device can be various forms of digital computer, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, etc. The electronic device can also be various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices.

[0139] The electronic device includes: one or more processors; and a memory storing computer program instructions, which, when executed, cause the processor to perform a method for detecting fraudulent applications based on traffic behavior analysis as provided in any one or more of the above embodiments. Figure 7An exemplary structural diagram of the electronic device is disclosed. The electronic device includes one or more processors 1101, a memory 1102, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In some other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations. The components, their connections and relationships, and their functions shown herein are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0140] The electronic device may further include an input device 1103 and an output device 1104. The processor 1101, memory 1102, input device 1103, and output device 1104 may be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0141] Input device 1103 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the electronic device, such as a touch screen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 1104 may include a display device, auxiliary lighting device (e.g., LED), and haptic feedback device (e.g., vibration motor). The display device may include, but is not limited to, a liquid crystal display, a light-emitting diode display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0142] To provide interaction with the user, the electronic device can be a computer. The computer has: a display device (e.g., a cathode ray tube or LCD monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback); and input from the user can be received in any form (e.g., voice input or tactile input).

[0143] In this embodiment, a computer-readable medium stores a computer program / instructions, which, when executed by a processor, implement a method for detecting fraudulent applications based on traffic behavior analysis provided in any one or more of the above embodiments. The computer-readable medium may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more computer-readable instructions.

[0144] The memory 1102 can serve as a non-transitory computer-readable storage medium, used to store non-transitory software programs, non-transitory computer-executable programs, and modules. The processor 1101 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions, and modules stored in the memory 1102, thereby implementing the program instructions / modules corresponding to the methods provided in any one or more of the embodiments described above in this application.

[0145] The memory 1102 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 1102 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1102 may optionally include memory remotely located relative to the processor 1101, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0146] It should be noted that the computer-readable medium described in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0147] Computer-readable media include permanent and non-permanent, removable and non-removable media, which can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory, static random access memory, dynamic random access memory, other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, read-only optical discs, digital versatile optical discs or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0148] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0149] In the above embodiments, all or part of the implementation can be achieved through software, hardware, firmware, or any combination thereof. For example, it can be implemented using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of this application can be executed by a processor to implement the above steps or functions. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drives, floppy disks, and similar devices. In addition, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0150] The computer program product provided in this application includes one or more computer programs / instructions. When executed by a processor, these computer programs / instructions generate, in whole or in part, the processes or functions described in this application. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0151] The flowcharts or block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-specific system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0152] The scope of this application is defined by the appended claims rather than the foregoing description, and is therefore intended to encompass all variations falling within the meaning and scope of equivalents of the claims. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a device claim may also be implemented by a single unit or device in software or hardware. Terms such as "first," "second," etc., are used only for distinguishing descriptions and do not indicate any particular order, nor should they be construed as indicating or implying relative importance.

[0153] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily made by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims, and the above embodiments should be regarded as exemplary and non-limiting.

Claims

1. A method for detecting fraudulent applications based on traffic behavior analysis, characterized in that, include: Deep packet inspection and analysis are performed on the download traffic of the live network. The obtained application samples are compared with the preset whitelist and blacklist to filter out the application samples that do not match the features. The application sample under test is dynamically run in a sandbox environment, and interface images are collected during the running process. The interface images are then processed by optical character recognition and natural language processing to obtain text features. The text features are matched with a preset database of fraudulent keywords. If a match is found, the application sample to be tested is identified as a fraudulent application. The text features are then input into a pre-trained fraudulent classification model. Based on the classification results output by the fraudulent classification model, it is determined whether the application sample to be tested is a fraudulent application. Applications identified as fraudulent will be added to a fraudulent application database, and download leads for fraudulent applications will be generated.

2. The method for detecting fraudulent applications based on traffic behavior analysis according to claim 1, characterized in that, The fraud classification model is a support vector machine classification model, which is obtained by supervised training on historical application samples that have been labeled as fraudulent. The supervised training includes: obtaining training text feature vectors from the interface text of the historical application samples through optical character recognition and natural language processing; standardizing the training text feature vectors; and training a support vector machine classifier based on the training text feature vectors and the corresponding category labels to construct a classification hyperplane for distinguishing specific fraud categories.

3. The method for detecting fraudulent applications based on traffic behavior analysis according to claim 1, characterized in that, The step of performing deep packet inspection and parsing on the download traffic of the existing network, and comparing the parsed application samples with preset whitelists and blacklists to filter out the application samples to be tested that do not match the features, includes: Deep packet inspection and parsing are performed on the data packets in the live network download traffic to identify the download protocol type and application download request, and data packets belonging to the same download session are reassembled in sequence to restore the complete application installation package file; Extract at least one of the following characteristic information from the application installation package file: package name, digital signature, hash value, or download source address; and use the application installation package file and its characteristic information as the parsed application sample. The application sample is matched with the pre-stored feature information in the whitelist and blacklist; If it matches the whitelist, the application sample is determined to be a trusted application and the fraudulent application detection process is terminated. If it matches the blacklist, a blocking command is sent to terminate the data transmission of the corresponding download session; If no match is found in the whitelist and blacklist, the corresponding application sample will be identified as the application sample to be tested.

4. A method for detecting fraudulent applications based on traffic behavior analysis, characterized in that, include: Perform deep packet inspection and parsing on the traffic used in the live network to obtain user behavior data; Multi-dimensional behavioral features are extracted from the user behavior data. These multi-dimensional behavioral features include: numerical features obtained based on terminal identification, number of applications used, usage duration and frequency; classification features determined based on application type; time series features obtained based on usage activity statistics at different time periods; and spatial features obtained based on location information clustering. The multi-dimensional behavioral features are encoded and scaled to form a fraud-related feature vector; The fraud-related feature vector is input into a pre-trained fraud detection model, and the output of the fraud detection model is used to determine whether the corresponding terminal has engaged in fraudulent application usage. When it is determined that there is fraudulent application usage, fraud clues containing terminal identifier and application identifier are output.

5. The method for detecting fraudulent applications based on traffic behavior analysis according to claim 4, characterized in that, The fraud detection model employs a random forest model, and the training process of the random forest model includes: A training set is constructed, and the parameters of the random forest are set. The training set consists of historical user behavior data of applications that have been labeled as fraudulent. After feature extraction, encoding and scaling, feature vectors with truth labels are formed. Constructing each decision tree in the random forest model includes: The same number of samples as the original training set are randomly drawn with replacement from the training set to form a training subset of the decision tree; A predetermined number of features are randomly selected from all input features in the training set to form a candidate feature set; Based on the training subset and the candidate feature set, a decision tree is recursively constructed from the root node using a decision tree algorithm. At each node, the optimal feature and the splitting threshold are selected from the candidate feature set to split the samples of that node. The samples of each child node are then split based on the optimal feature and the splitting threshold selected from the candidate feature set until a preset stopping condition is met. The multiple decision trees constructed based on the training subset and the candidate feature set are integrated to form the random forest model.

6. The method for detecting fraudulent applications based on traffic behavior analysis according to claim 5, characterized in that, After forming the random forest model, the following is also included: Based on historical user behavior data of applications labeled with different fraudulent behavior categories, a classification training sample set with category labels is formed after feature extraction, encoding and scaling. The classification training sample set is input into the random forest model for parameter update, so as to retrain the random forest model and thus form a fraud detection model for identifying different fraud-related behavior categories based on the random forest model.

7. The method for detecting fraudulent applications based on traffic behavior analysis according to claim 4, characterized in that, The step of encoding and scaling the multi-dimensional behavioral features to form a fraud-related feature vector includes: The categorical features in the multi-dimensional behavioral features are encoded using one-hot encoding. The numerical features in the multi-dimensional behavioral features are scaled using a standardization method. The scaling process includes subtracting the mean of the numerical features from their original feature values ​​and dividing by the standard deviation of the numerical features, so that the numerical features have zero mean and unit variance.

8. An electronic device, characterized in that, The electronic device includes: One or more processors; and a memory storing computer program instructions, which, when executed, cause the processors to perform the fraudulent application detection method based on traffic behavior analysis as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program and / or instructions stored thereon, characterized in that, When the computer program and / or instructions are executed by the processor, they implement the fraudulent application detection method based on traffic behavior analysis as described in any one of claims 1-7.

10. A computer program product comprising a computer program and / or instructions, characterized in that, When the computer program and / or instructions are executed by the processor, they implement the fraudulent application detection method based on traffic behavior analysis as described in any one of claims 1-7.

Images