Automatic malicious advertisement identification method and system based on LLM Agent

Abstract

The invention provides an LLM Agent-based malicious advertisement automatic identification method and system, and the method comprises the steps: generating prompt words based on a user task instruction, a current page state and a knowledge base, inputting the LLM Agent to generate a page operation sequence, and enabling the sequence to comprise the current and potential page states and the jump logic thereof; executing a page operation sequence to simulate page jump, and screening advertisement pages through domain name features and request parameters based on HTTP traffic; sDK metadata, permission information, redirection links and advertisement images are collected for advertisement pages, structured cue words are constructed, LLM is input to conduct association analysis on the four types of data, and a diagnosis report containing malicious behavior classification, risk levels and repair suggestions is obtained. Whether a current advertisement is malicious or not is comprehensively judged through dynamic UI exploration and analysis of an advertisement SDK, permission information, a redirection link and an advertisement image, and a basis is provided for mobile application security assessment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a malicious advertisement automatic identification method and system based on LLM Agent. BACKGROUND

[0002] Mobile advertising, as the core business model in the mobile application ecosystem, realizes commercial monetization by embedding in multi-field applications such as news, video, and games. Its essence is to push marketing content to users through the application interface in an interactive form. With the accelerated development of the global mobile application ecosystem, the scale of mobile advertising continues to expand, and has become an indispensable part of the Internet industry pattern.

[0003] However, this rapidly developing field is facing severe challenges: malicious advertising exists in abusive behavior, not only damaging the credibility and effectiveness of advertising, but also leading users to face direct risks such as privacy leakage and property loss. The advertising review mechanism gradually exposes problems of insufficient automation efficiency and weak recognition ability of new fraud methods when dealing with such problems.

[0004] The current mainstream malicious advertising detection method mainly relies on static and dynamic analysis and content detection technology: static analysis analyzes the characteristics of third-party advertising libraries through reverse engineering, dynamic analysis monitors the behavior patterns during the running of the advertisement, and content analysis focuses on textual semantics, visual materials, and other concrete information. However, these methods have significant defects: on the one hand, traditional machine learning algorithms have low automation in semantic analysis and visual feature extraction, resulting in low detection efficiency; on the other hand, in the face of constantly updated disguising methods and variable forms of malicious advertising, existing methods are difficult to achieve accurate identification, and cannot meet the real-time and accuracy requirements of the mobile advertising ecosystem for security detection. SUMMARY

[0005] To solve the above problems, the present application proposes a malicious advertisement automatic identification method and system based on LLM Agent, which comprehensively judges whether the current advertisement is malicious by analyzing the advertising SDK, permission information, redirection link, and advertising image through dynamic UI exploration. At the same time, it also generates a structured report containing malicious behavior classification, risk level, and repair suggestions, providing a basis for mobile application security evaluation.

[0006] To achieve the above purpose, the present application adopts the following technical solutions: In a first aspect, the present application provides a malicious advertisement automatic identification method based on LLM Agent, comprising: generating prompt words based on user task instructions, current page state, and knowledge base, inputting LLM Agent to generate page operation sequences, the sequences containing current and potential page states and their jump logic; The page operation sequence generated by the LLM Agent is used for simulating page jumps, synchronously intercepting HTTP traffic, and screening advertisement pages through domain name features and request parameters. The SDK metadata, permission information, redirection links, and advertisement images of the advertisement pages are collected, structured prompt words are constructed, the four types of data are analyzed by the LLM Agent, and a diagnosis report containing malicious behavior classification, risk level, and repair suggestions is obtained.

[0007] In a second aspect, the present application provides an LLM Agent-based malicious advertisement automatic identification system, comprising: The page acquisition module is configured to generate prompt words based on user task instructions, current page states, and a knowledge base, input the LLM Agent to generate a page operation sequence, and the sequence contains current and potential page states and their jump logic. The page screening module is configured to simulate page jumps by executing the page operation sequence, synchronously intercept HTTP traffic, and screen advertisement pages through domain name features and request parameters. The identification module is configured to collect SDK metadata, permission information, redirection links, and advertisement images of the advertisement pages, construct structured prompt words, input the LLM Agent for correlation analysis of the four types of data, and obtain a diagnosis report containing malicious behavior classification, risk level, and repair suggestions.

[0008] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the steps of the LLM Agent-based malicious advertisement automatic identification method of the first aspect.

[0009] In a fourth aspect, the present application provides a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the steps of the LLM Agent-based malicious advertisement automatic identification method of the first aspect.

[0010] Compared with the prior art, the present application has the following advantages: (1) The present application generates a page operation sequence with the help of the LLM Agent, which can dynamically simulate user interaction and potential jump logic, break through the limitations of static identification, and cover complex page jump scenarios. Combined with HTTP traffic interception and domain name and parameter screening, the present application can accurately locate advertisement pages and reduce invalid analysis. By integrating multi-dimensional data such as SDK metadata and permission information, the present application can realize the integrated output of malicious behavior classification, risk level evaluation, and repair suggestions through LLM Agent correlation analysis, which not only reduces the cost of manual intervention, but also improves the identification depth and interpretability, providing comprehensive support for the rapid disposal of malicious advertisements and being suitable for dynamic network advertising environments.

[0011] (2) The application simulates user operation behavior, dynamically tracks state changes of the page in the jump process, and constructs a complete page jump track chain. This dynamic simulation method can mine the malicious advertisement propagation path hidden behind complex jump logic, comprehensively and deeply understand the entire life cycle of the advertisement, and greatly improve the detection ability of malicious advertisements, especially the advertisements with strong camouflage.

[0012] (3) The application locates the advertisement by combining two traffic screening rules with HTTP hooks, which can effectively overcome the defects of the prior art. On the one hand, it solves the problem that the traditional static analysis only relies on decompilation to extract advertisement library features and cannot capture the advertisement traces in real-time network interaction. The HTTP hook can dynamically intercept the real traffic of the target application advertisement loading, avoiding the missed detection of malicious advertisements loaded dynamically by static analysis. On the other hand, compared with the single dimension of traffic screening in the prior art, two rules can greatly reduce the probability of misjudging normal network requests as advertisement traffic by screening from the domain / path and request parameter dimensions, accurately positioning the advertisement page, and laying a reliable foundation for subsequent in-depth analysis.

[0013] (4) The application constructs the prompt word by mining the SDK metadata, permission information, redirection link and advertisement image of the advertisement page, which can comprehensively and deeply cover the key features of the advertisement from different dimensions such as technology, permission, link and visual text. Based on them, the prompt word can provide rich, accurate and multi-dimensional information input for the LLM Agent, so that potential risks and illegal behaviors can be mined from more angles when analyzing the maliciousness of the advertisement, greatly improving the accuracy, comprehensiveness and delicacy of the judgment of the maliciousness of the advertisement, providing solid and diverse basis for subsequent report generation, and effectively assisting the accurate identification and judgment of malicious advertisements.

[0014] The advantages of the additional aspects of the application will be partially given in the following description, partially become obvious from the following description, or be understood through the practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0015] The drawings accompanying the specification of the application form part of the application and serve to provide further understanding of the application. The illustrative embodiments of the application and their description serve to explain the application without limiting it.

[0016] Figure 1 The main flowchart of a malicious advertisement automatic identification method based on an LLM Agent provided for the embodiments of the application; Figure 2 The detailed flowchart of a malicious advertisement automatic identification method based on an LLM Agent provided for the embodiments of the application; Figure 3A conceptual diagram of advertising content mining provided for embodiments of the present invention; Figure 4 A flowchart for generating an advertising malice diagnostic report provided in an embodiment of the present invention. Detailed Implementation

[0017] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0018] In existing technologies, malicious advertising detection relies on dynamic and static analysis and content detection techniques, which suffer from low automation, low efficiency, poor interpretability, and difficulty in dealing with the ever-evolving camouflage and variability of malicious advertising.

[0019] Based on this, the present invention constructs a complete technical logic system, which achieves effective detection of malicious advertisements through key steps such as accurately locating advertisement traces, deeply mining advertisement content, and scientifically determining whether advertisements have malicious attributes. First, dynamic UI exploration is used to analyze page views using the auxiliary functions of mobile device systems, simulate user interactions to construct UI transformation diagrams, and generate operation sequences using an LLM Agent to achieve automatic exploration. The advertisement UI is located by hooking the HTTP communication library through the Frida framework. Next, the advertisement content mining module uses an LLM Agent to collect advertisement SDK metadata, permission information, redirect links, and advertisement images, and analyzes them using the LLM Agent. Permission information covers static declarations, dynamic requests, and abnormal calls; redirect links are extracted using man-in-the-middle proxy technology and analyzed via the VirusTotal API; and advertisement images are evaluated using the GLM-4V model. Finally, the report generation module designs prompt templates and, combined with the LLM Agent analysis of four types of data, derives an evaluation result including malicious behavior classification, risk level, and remediation suggestions.

[0020] Example 1 like Figure 1 As shown, this embodiment discloses an automated method for identifying malicious advertisements based on an LLM agent, including the following steps: S1: Generate prompt words based on user task instructions, current page status and knowledge base, input LLM Agent to generate page operation sequence, the sequence includes current and potential page status and their jump logic; S2: Execute the page operation sequence to simulate page redirection, simultaneously intercept HTTP traffic, and filter advertising pages based on domain characteristics and request parameters; S3: Collect SDK metadata, permission information, redirect links, and ad images from the ad page, construct structured prompts, input them into the LLM Agent for correlation analysis of the four types of data, and obtain a diagnostic report that includes malicious behavior classification, risk level, and remediation suggestions.

[0021] Next, in combination with Figure 2 , a malicious advertisement automatic recognition method based on LLM Agent is disclosed in detail.

[0022] I. Dynamic UI exploration In S1, executable interface operation sequences are mined through dynamic UI exploration.

[0023] First, the target application UI interface is traversed to obtain a set of user page views. The target application is a specific application program that needs to be detected for malicious advertisements. It can be a web application in various mobile devices. Users usually perform various operations within these applications, and these applications may have malicious advertisements, affecting user experience and even causing security risks. Therefore, for the target application, the page view tree is parsed with the aid of the mobile device system's auxiliary function.

[0024] For example, the mobile device system's auxiliary function includes Android Accessibility Services, which plays a core role in helping users use the device more conveniently, and can also be used by developers for legal interface analysis scenarios. It can listen to system interface events (such as page switching and control interaction), parse the view tree structure of the current page, extract control IDs, class names, interaction attributes, and other key UI information. This embodiment utilizes this capability to realize page view parsing and UI state capture.

[0025] Among them, the Android interface is a tree structure composed of container controls (ViewGroup) and leaf controls (such as buttons and other Views). When the interface changes, such as window switching, the Android system generates Accessibility Event. With the user's authorization, the Android Accessibility Services obtain the current interface root node by listening to system interface events, and recursively traverse all child nodes to build a complete page view tree structure.

[0026] Based on this, by simulating user random click interaction, the interface window is switched, and the state transition relationship between key UI information such as ID, class name, and interaction attribute is dynamically captured. The application-specific interface jump logic is encoded as a UI transition graph (UTG): nodes represent UI states, and edges record state transition actions.

[0027] Among them, simulating user random click interaction can be achieved in the following way: first, obtain all interactive controls (such as buttons, input boxes, etc.) in the current page view tree, then use random sampling method to select one or more interactive controls for simulated click operation.

[0028] When random clicking interaction is performed, each click triggers a change in page state, and the UI transition graph (UTG) records this state transition relationship. For example, the initial page state is node A, and after randomly clicking a button, the page jumps to a new state. At this time, a new node is added in the UTG from node A to the new node (representing the new UI state), and the edge is marked as this click operation. Through a large number of random clicking interactions, the nodes and edges in the UTG can be continuously enriched, thereby completely presenting the jump logic of the application interface and achieving coverage of the interface traversal track.

[0029] Further, the UTG nodes are traversed, the application task unit and operation logic are identified through semantic analysis, and finally the induced task knowledge is stored in the knowledge base.

[0030] Among them, the task unit refers to a specific goal that a user can complete through application interface interaction, which corresponds to a group of associated UI states and transitions in the UTG to realize the core function. The operation logic refers to the interactive steps, condition judgments, and state dependency relationships that depend on the completion of a certain task unit, which is the process of realizing the task unit and can include multiple state transition operations.

[0031] It should be understood that semantic analysis and identification can be realized by those skilled in the art, for example, the semantic role labeling method in natural language processing (NLP) can be used to analyze the text description related to application operation and identify action subjects, actions, and action objects, etc., to determine the task unit; or a deep learning model such as a model based on Transformer can be used to train the interactive logic text of UI elements, so that the model can automatically identify the operation logic therein, such as determining under what conditions to execute a certain interactive step. This embodiment will not be repeated here.

[0032] The user input task instruction such as "explore all secondary views of the current application" and the current page state and knowledge base information are obtained, the sensitive data is cleaned by the privacy filter, and the prompt generator guides the LLM Agent to generate a page operation sequence including the current and potential page states and their jump logic based on the current UI state, task instruction semantics, and knowledge base information, and to infer the subsequent operation content.

[0033] Among them, the current UI state provides information such as the elements that can be operated on the current interface and the layout of the interface, and the page operation sequence needs to determine the object to be operated in the first step or subsequent steps according to the actual situation of the current interface; the task instruction semantics clearly specifies the goal that the user wants to achieve, and the page operation sequence will plan specific operation steps around this goal; the knowledge base stores the previously induced task knowledge, including the operation logic of different task units and the UI state transition relationship, etc., thereby providing the page operation sequence with referenceable operation processes and rules.

[0034] For example, if the current UI state is displayed in the main interface of the application, there are multiple function entry controls, the task instruction is to explore all secondary views, and the knowledge base records the operation logic for entering different secondary views from different function entries in the main interface, then the generated page operation sequence will sequentially operate on each function entry control in the main interface to achieve the goal of exploring all secondary views.

[0035] The task executor parses the LLM Agent output into a UI operation sequence executable by the simulator to realize UI automatic exploration.

[0036] In this embodiment, the process of traversing the UI covers the exploration of various interfaces of the application, including interfaces that may contain advertisements. Through comprehensive UI exploration, the timing and location of the appearance of the advertisement page can be more accurately captured, and the subsequent HTTP hook mechanism can be more efficiently positioned to locate the advertisement UI.

[0037] Unlike the static direct interception of pop-up advertisements in conventional techniques, which relies on stack names or content matching, this dynamic simulation jump in the embodiment has a "tracing" nature. It can actively explore the potential relationship between pages during the application running process, thereby constructing a comprehensive page jump map. This helps to avoid being confused by malicious advertisements with strong disguises, as malicious advertisements often hide their true intentions through complex jump logic. However, the embodiment can expose these hidden jump paths through dynamic simulation, more accurately locating the source and propagation path of malicious advertisements.

[0038] In S2, the advertisement UI is located, and the Frida framework hooks the HTTP communication library of the target application to intercept network data packets generated by mobile device system calls.

[0039] The target application hooked in this step is the corresponding object of the page operation sequence generated in S1. When S1 performs the page operation sequence simulation jump, all operations are carried out around the target application, and the HTTP traffic generated by the target application when performing the sequence of page jump actions is also intercepted synchronously in this step, ensuring that the page operation and traffic monitoring are directed at the same detection object.

[0040] Among them, Frida is a cross-platform dynamic instrumentation framework that supports Android, iOS, Windows and other mobile device systems. Its core feature is that it can "hook" (Hook) the functions, methods or system calls of the application by injecting code without recompiling the target application, and it can monitor or modify its runtime behavior in real time.

[0041] In this embodiment, the Frida framework is used to hook the HTTP communication library of the target application. That is, by injecting code, it intercepts the HTTP / HTTPS network requests and responses initiated by the application at runtime (such as network communication when the advertising SDK loads ads), thereby capturing ad-related traffic data and locating the ad UI by combining features such as domain name and request parameters. In addition, it can also be used to bypass the SSL certificate verification of some applications (such as SSL Pinning) to ensure that encrypted ad traffic can be completely parsed.

[0042] For traffic analysis, the study filters ad-related traffic based on two rules: (1) Initial screening is performed using domain name keywords (such as “ads.” and “track.”) and path regular expressions (such as “ / ad / ”).

[0043] (2) Accurately identify the ad SDK connection by combining request parameter characteristics (such as "utm_source=ad"). Once a match is found, immediately record the current ad page and its network traffic.

[0044] In this embodiment, by intercepting the HTTP communication of the target application page and filtering the advertising-related traffic, once an advertising SDK connection or advertising content request is matched, the corresponding application interface is immediately recorded. This links the advertising communication behavior at the network layer with the application's UI interface, enabling precise positioning of the advertising page and providing a clear target object for subsequent advertising content mining (such as SDK analysis, permission detection, etc.).

[0045] II. Content Mining of Advertising Components In S3, the ad content mining module collects the following four types of ad content, such as Figure 3 As shown: S2 simulates target application page redirects by executing page operation sequences, intercepts HTTP traffic, and filters out advertising pages, only completing the localization of malicious ads. Furthermore, existing technologies, relying solely on static analysis of ad library features, dynamic monitoring of single behavioral patterns, or isolated analysis of content information, are insufficient to fully penetrate the disguise of malicious ads—some malicious ads evade detection by tampering with SDK identifiers, hiding abnormal permission calls, and nesting multiple layers of redirect links.

[0046] Therefore, based on the precise location of the advertising page in S2, this embodiment further collects four types of core data from the advertising page: SDK metadata, permission information, redirect links, and advertising images. This not only specifically addresses the problems of existing technologies having only one detection dimension and weak anti-spoofing capabilities, but also achieves a logical connection from finding the advertisement to deeply analyzing its attributes, providing complete data support for subsequent LLM Agent correlation analysis to determine maliciousness. Specifically: (1) Advertising SDK metadata mining Use application decompilation tools to repeatedly compile the target application installation package and extract its application configuration files. It's important to clarify that the target application installation package includes advertising pages. The target application installation package is a collection of files containing the application's complete functionality, interface system, and resource configuration. Advertising pages are specific interfaces (such as pop-up ads, embedded ads, etc.) that are displayed during the application's operation by calling advertising-related resources; in other words, advertising pages are an integral part of the target application installation package's functional modules.

[0047] The application configuration file declares tags related to in-app ad loading. By parsing this XML file, the text content and tag attributes are extracted, and the parsed data is then converted into natural language descriptions. A Large Language Model Agent (LLM Agent) is used to analyze the tag information and related software package names and functions, ultimately determining whether the software development kit (SDK) used by the ads has been certified by mainstream application distribution platforms. The analysis results are stored in JSON file format, providing structured data support for subsequent research.

[0048] For example, in an Android system, APKTool is used to repeatedly compile the target APK and extract its AndroidManifest.xml file. AndroidManifest.xml declares tags related to in-app ad loading. The XML file is parsed to extract text content and tag attributes. The parsed data is then converted into a natural language description. An LLM Agent is used to analyze the tag information and related package name functions. Ultimately, it can be determined whether the SDK used by the ads has been certified by Google Play. The analysis results are stored in JSON file format, providing structured data support for subsequent research.

[0049] In this embodiment, configuration files are extracted by decompiling the ad page to accurately obtain SDK-related tag information that the ad page depends on for loading. This solves the problem in existing technologies that only analyze the surface content of the ad page in isolation and are difficult to trace SDK compliance. By using an LLM Agent to analyze the SDK authentication status, it not only provides key evidence for determining the malicious attributes of the ad page, but also lays the foundation for subsequent correlation analysis of other ad data (such as permissions and redirect links) with the structured data storage results, thereby improving the depth and accuracy of malicious ad detection.

[0050] (2) Access control information mining The process involves parsing ad permission requests through a multi-stage workflow. First, the application package management interface of the mobile device system is used to extract the static permissions declared in the application configuration file, ensuring coverage of all pre-declared permission sets. Second, a complete list of runtime permissions for the application is obtained through device system commands. Combined with permission protection levels and permission group affiliation, the complete set of permissions already acquired by the application is collected. In the dynamic monitoring phase, activity management and application operation logs are captured using a device system log capture tool, recording system permission pop-up trigger events and user authorization status, enabling real-time tracking of runtime permission requests.

[0051] For example, in the Android system, ad permission requests are parsed through a multi-stage process. First, the Android system's `PackageManager` interface is used to extract the static permissions declared by the application in AndroidManifest.xml, ensuring that all pre-declared permission sets are covered. Second, the `adb shell dumpsys package` command is used to obtain the complete list of permissions at runtime for the application. Combining the `ProtectionLevel` permission (which distinguishes between `normal` and `dangerous` permissions) and permission group affiliation (such as the `CONTACTS` permission group), the complete set of permissions already obtained by the app is collected.

[0052] During the dynamic monitoring phase, `adb logcat` is used to capture `ActivityManager` and `AppOps` logs, recording system permission pop-up trigger events and user authorization status, thus enabling real-time tracking of runtime permission requests.

[0053] Furthermore, to address the possibility of malicious ads bypassing static permissions through reflection, the system captures SecurityException stack traces to reverse engineer and locate undeclared or unauthorized sensitive API calls, supplementing the detection of illegal permission behaviors missed by static analysis. Finally, statically declared permissions (including ordinary / dangerous permission categories), dynamic permission request records, and undeclared permission call information located by exception stack traces are transmitted to the LLM Agent to analyze the legality of permission claims and requests. The analysis results are stored in JSON file format, providing structured data support for subsequent research.

[0054] In existing technologies, malicious ad detection suffers from problems such as incomplete static declaration coverage, untimely dynamic tracking, and easy omission of illegal permission behaviors in permission analysis. This embodiment adopts a multi-stage process, first extracting application static permissions, then obtaining full runtime permissions, dynamically monitoring permission requests, and capturing abnormal stack traces to locate illegal permission calls, thus comprehensively covering all dimensions of permission analysis. Transmitting this permission information to an LLM Agent for legality analysis improves the comprehensiveness and real-time nature of permission analysis, and provides more accurate structured data for subsequent malicious ad detection, effectively overcoming the shortcomings of existing technologies.

[0055] (3) Redirect link mining By deploying a man-in-the-middle proxy server, configuring certificates in the simulator environment, and triggering dynamic packet capture to obtain advertising communication traffic in conjunction with UI event callbacks, the traffic is exported as HAR format and then the redirection Uniform Resource Locator (URL) is extracted according to the ICANN specification. The application programming interface is then called to analyze the maliciousness of the URL and generate structured results, thereby realizing the extraction and malicious detection of redirection links within the advertisement.

[0056] This study employs man-in-the-middle proxy traffic analysis, deploying Charles Proxy as a proxy server to extract and parse redirect links within advertisements. First, the Charles root certificate is installed and trusted in the emulator environment, establishing an HTTPS decryption channel. Addressing the trust restrictions on user certificates in Android 7.0+ systems, the target application's `network_security_config.xml` file is modified via reverse engineering to implant a system-level certificate, ensuring complete parsing of TLS / SSL traffic. During the dynamic packet capture phase, this embodiment automatically triggers traffic capture by listening for application UI event callbacks (such as ad clicks and page redirects), acquiring real-time HTTP / HTTPS bidirectional communication data. For encrypted redirects using SSL pinning, code injection using the Frida framework dynamically bypasses verification. After exporting the raw traffic data to HAR format, regular expressions are constructed according to ICANN domain name specifications to extract potential redirect URLs from response headers and messages, generating a standardized set. Finally, the VirusTotal API is called to analyze URL malice, generating JSON results containing indicators such as domain reputation and malicious tags, providing structured data support for subsequent research.

[0057] Among them, VirusTotal API is the application programming interface (API) provided by the VirusTotal platform. VirusTotal itself is an online security analysis platform that aggregates the detection engines of dozens of antivirus software vendors and security organizations around the world, and can perform malicious scanning on network entities such as files, URLs, and IPs.

[0058] In this embodiment, the VirusTotal API is used to analyze the redirect links of advertisements. Specifically, the extracted advertisement redirect URLs are submitted to the VirusTotal platform through this API, and the platform returns multi-engine detection results (such as whether they are marked as malicious links, phishing links, virus distribution links, etc.). This allows for a quick determination of the security of the redirect links and provides a basis for identifying the malice of advertisements.

[0059] Existing technologies for detecting ad redirect links often suffer from missed or false positives due to issues such as unparseable encrypted traffic, delayed packet capture, non-standard URL extraction, and limited malice assessment. This embodiment bypasses encryption restrictions through man-in-the-middle proxy and certificate configuration, precisely triggers packet capture via UI event callbacks, extracts URLs according to ICANN specifications, and utilizes the multi-engine VirusTotal API for malice analysis. It solves the problems of encrypted redirects and system certificate limitations while avoiding issues of untimely traffic capture and disorganized URL extraction, providing a more comprehensive and accurate basis for malicious ad identification and compensating for the shortcomings of existing technologies in terms of detection dimensions and efficiency.

[0060] (4) Advertising image mining The GLM-4V multimodal artificial intelligence model is used to achieve intelligent identification and analysis of advertising content. The GLM-4V API is invoked to read locally stored JPG files and upload them. To guide the model in performing accurate analysis, this embodiment includes structured prompts in the request body, explicitly requiring it to comprehensively evaluate the compliance of advertising content from three key dimensions (icon elements, image features, and embedded text).

[0061] In this embodiment, ad content mining involves collecting four core data categories from the ad page: SDK metadata, permission information, redirect links, and ad images. This lays a crucial foundation for subsequently building structured prompt word templates and accurately identifying malicious ads. Existing technologies for detecting ad images are mostly limited to single visual features and rely on manually defined rules, making it difficult to comprehensively assess compliance. This embodiment employs the multimodal model GLM-4V, analyzing from three dimensions: icons, image features, and embedded text. Structured prompt instructions further ensure accurate analysis. This effectively solves the problems of traditional methods being limited in scope, automation, and accuracy, providing a more comprehensive image-level basis for determining ad malice.

[0062] III. Report Generation The data from various dimensions of content mining in comprehensive advertising composition is used to help users judge the maliciousness of advertisements, such as... Figure 4As shown. The purpose of constructing the prompt template is to uncover deeper potential behavioral information behind various dimensions of information, and to determine whether the advertisement is malicious through analysis and reasoning by an LLM Agent. The prompt template consists of the following four parts: (1) Model configuration: The purpose is to define the role and tasks of the LLM Agent so that it can clearly understand the goals and requirements of the task and be able to perform analysis based on data such as SDK metadata, permission information, redirect links and advertising images of the advertising page.

[0063] (2) Task specifications: Clearly inform the LLM Agent how to use the SDK metadata, permission information, redirect links and advertising images of the advertising page to gradually generate a diagnostic report.

[0064] (3) Terminology definition: Helps the LLM Agent understand the proprietary terminology used in the template so as to more accurately parse the SDK metadata, permission information, redirect links and ad image related content of the ad page.

[0065] (4) Output standard: The template will specify the report format generated by the LLM Agent to ensure that the report is concise and accurate, avoids irrelevant information or redundant content, and clearly presents the results obtained from the analysis of SDK metadata, permission information, redirect links and advertising images based on the advertising page.

[0066] As one implementation method, this embodiment was validated on 30,000 applications in the Androzoo dataset, identifying 1,537 malicious ads from 14,971 ad samples, involving 925 apps. Of these, 37 apps were identified by Virusotal as containing malware. After manual verification, the actual number of malicious ad samples was confirmed to be 1,524. This embodiment achieved performance of 99.61% in Acc, 96.30% in Pre, 100% in Rec, and 98.11% in F1 score, demonstrating extremely high accuracy and robustness in the malicious ad identification task, and exhibiting excellent overall detection capabilities.

[0067] Comparative analysis with relevant studies shows that this embodiment exhibits significant advantages in terms of metrics: its recall rate reaches 100%, achieving complete capture of malicious ads with zero missed detections; its precision (99.15%) and accuracy (99.91%) are high, effectively balancing the risk of false positives. In contrast, the comparative methods all have obvious shortcomings. MadLife suffers from a large number of missed detections; AdRamber's accuracy decreases due to misclassification of normal ads; MadDroid and ADGPE fail to achieve a good balance between accuracy and coverage, resulting in limited overall performance. The superior performance of this embodiment is due to its multi-dimensional feature collection and LLM Agent discrimination framework, which achieves both accurate differentiation between normal and malicious ads to control false positives and comprehensive capture of real malicious samples.

[0068] Furthermore, this embodiment proposes an automated UI exploration method for mobile applications that integrates an LLM Agent with HTTP, improving the accuracy of ad recognition. The average single-page dwell time is 5.9 seconds, and 268 ads were successfully identified. Simultaneously, this embodiment achieves the highest ad coverage by exploring only an average of 9 pages. This is because it utilizes LLMAgent for semantic analysis, prioritizing the exploration of high-value areas and avoiding redundant paths, thereby discovering more ads within the same timeframe. The efficiency of this embodiment lies in translating the semantic understanding advantages of the LLM Agent into improved testing efficiency, reducing invalid page visits through dynamic path allocation strategies, and ultimately achieving an optimal solution in balancing exploration efficiency and ad coverage.

[0069] In summary, this embodiment significantly outperforms existing comparative methods in terms of accuracy of ad detection, completeness of malicious sample coverage, and overall performance, providing a better solution for malicious ad detection.

[0070] Example 2 This embodiment provides an automated malicious advertising identification system based on an LLM agent, including: The page acquisition module is configured to generate prompt words based on user task instructions, current page status and knowledge base, and input the LLM Agent to generate a page operation sequence, the sequence of which includes the current and potential page status and its jump logic; The page filtering module is configured to execute a sequence of page operations to simulate page redirection, simultaneously intercept HTTP traffic, and filter advertising pages based on domain characteristics and request parameters. The identification module is configured to collect SDK metadata, permission information, redirect links, and advertising images from the advertising page, construct structured prompts, input them into the LLM Agent for correlation analysis of the four types of data, and obtain a diagnostic report that includes malicious behavior classification, risk level, and remediation suggestions.

[0071] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the LLM Agent-based automated malicious advertising identification method described in Embodiment 1 above.

[0072] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the method for automated identification of malicious advertisements based on an LLM Agent as described in Embodiment 1 above.

[0073] The steps or modules involved in Embodiments 2 to 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for automated identification of malicious advertisements based on LLM Agents, characterized in that, include: Based on user task instructions, current page status, and knowledge base, prompt words are generated. The LLM Agent is then input to generate a page operation sequence, which includes the current and potential page statuses and their jump logic. Simulate page redirection by executing page operation sequences, simultaneously intercept HTTP traffic, and filter advertising pages based on domain characteristics and request parameters; The system collects SDK metadata, permission information, redirect links, and ad images from the ad page, constructs structured prompts, and inputs them into an LLM Agent for correlation analysis of the four types of data to obtain a diagnostic report that includes malicious behavior classification, risk level, and remediation suggestions.

2. The method for automated identification of malicious advertising based on LLM Agent as described in claim 1, characterized in that, The construction of the knowledge base specifically includes: Obtain the user's page view set and extract key page elements; obtain the state transition relationships between key page elements by simulating random user click interactions. The state transition relationship is encoded as a page transition graph; where nodes represent page states and edges represent jump logic; Based on semantic analysis, the task units and operation logic in the page transition graph are identified and stored as task knowledge in the knowledge base.

3. The method for automated identification of malicious advertising based on LLM Agent as described in claim 1, characterized in that, The jump logic refers to the state transition actions between page states.

4. The method for automated identification of malicious advertising based on LLM Agent as described in claim 1, characterized in that, The execution of the page operation sequence simulates page redirection and synchronously intercepts HTTP traffic, specifically including: The task executor parses the page operation sequence output by the LLM Agent and executes simulated click and page switching interactive actions in the simulator to achieve page navigation; It also hooks the target application's HTTP communication library through the Frida framework to intercept all network traffic data packets generated during the mobile operating system's calls. These data packets contain HTTP or HTTPS request and response data related to ad loading and interaction.

5. The method for automated identification of malicious advertising based on LLM Agent as described in claim 1, characterized in that, The filtering of advertising pages based on domain characteristics and request parameters specifically includes: The first matching condition, based on preset domain keywords and path regular expressions, initially filters out network traffic that is suspected to be related to advertising; The second matching condition is to match the network connection mode of the advertising SDK with the request parameter characteristics of the traffic after the initial screening. When traffic meets both matching conditions, the current page corresponding to that traffic is recorded as the advertising page, and its network traffic details are monitored.

6. The method for automated identification of malicious advertising based on LLM Agent as described in claim 1, characterized in that, The SDK metadata is used to identify advertising SDKs and analyze their legitimacy via HTTP hooking; The permission information is combined with static declarations and dynamic monitoring to detect unauthorized calls; the redirected links parse traffic to obtain URLs and assess malice; the advertising images are analyzed using a multimodal model to determine icon, image features, and text compliance.

7. An automated malicious advertising identification system based on an LLM agent, characterized in that, include: The page acquisition module is configured to generate prompt words based on user task instructions, current page status and knowledge base, and input the LLM Agent to generate a page operation sequence, the sequence of which includes the current and potential page status and its jump logic; The page filtering module is configured to execute a sequence of page operations to simulate page redirection, simultaneously intercept HTTP traffic, and filter advertising pages based on domain characteristics and request parameters. The identification module is configured to collect SDK metadata, permission information, redirect links, and advertising images from the advertising page, construct structured prompts, input them into the LLM Agent for correlation analysis of the four types of data, and obtain a diagnostic report that includes malicious behavior classification, risk level, and remediation suggestions.

8. The automated malicious advertising identification system based on LLM Agent as described in claim 7, characterized in that, The construction of the knowledge base specifically includes: Obtain the user's page view set and extract key page elements; obtain the state transition relationships between key page elements by simulating random user click interactions. The state transition relationship is encoded as a page transition graph; where nodes represent page states and edges represent jump logic; Based on semantic analysis, the task units and operation logic in the page transition graph are identified and stored as task knowledge in the knowledge base.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the method for automated identification of malicious advertisements based on an LLM Agent as described in any one of claims 1-6.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the method for automated identification of malicious advertisements based on an LLM Agent as described in any one of claims 1-6.

Images