Mobile application identifier counterfeit detection method and device based on multi-modal fusion

Abstract

The embodiment of the invention provides a mobile application identifier counterfeit detection method and device based on multi-modal fusion. The method is applied to the technical field of software security. The method comprises the steps of obtaining application identifiers and developer information of a to-be-detected application and a standard application; under the condition that the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application, preprocessing an application identifier of the to-be-detected application; performing rule feature extraction on the application identifier of the preprocessed to-be-detected application based on a predefined rule set to obtain a text type rule feature vector and an image type rule feature vector; inputting the extracted text class rule feature vector and the image class rule feature vector into a pre-trained multi-modal classification model for analysis and processing to obtain a text modal counterfeit probability and an image modal counterfeit probability of the to-be-detected application; weighted fusion processing is carried out on the text modal counterfeit probability and the image modal counterfeit probability to obtain a detection result, and the accuracy of counterfeit application detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, in particular to a mobile application identification impersonation detection method and device based on multi-modal fusion. BACKGROUND

[0002] Due to the openness and popularity of the Android system, impersonation applications on the mobile application platform are increasingly rampant. At present, a large number of impersonation applications imitate the appearance identification of popular genuine applications through high imitation, and use the user's visual habits and cognitive inertia for induced downloading, which not only seriously infringes the legitimate rights and interests of genuine application developers, causes user loss and economic loss, and has a long-term negative impact on brand reputation; and such impersonation applications are often implanted with malicious code, spyware or phishing modules, which directly threaten the personal privacy data security, account property security and device system security of users, and have become a major security risk source in the mobile Internet environment.

[0003] At present, the academic circles at home and abroad have carried out extensive and in-depth research on the detection of mobile application identification impersonation behavior, and the mainstream identification impersonation behavior detection methods can be divided into two categories: text feature-based detection methods and image feature-based detection methods.

[0004] However, the existing methods are mostly focused on single modal of text or image, and it is difficult to cope with the cross-modal combination impersonation strategy of attackers, resulting in high false negative rate. For example, if the attacker only impersonates the icon but makes the application name and package name significantly different from the genuine one, the text feature-based method will fail to capture the image impersonation traces; on the contrary, if the application name or package name is impersonated but the icon is significantly different from the genuine one, the image feature-based method will also miss the report due to the mismatch of text features. SUMMARY

[0005] The present application provides a mobile application identification impersonation detection method and device based on multi-modal fusion, to solve the problem of false negatives in mobile application identification impersonation detection in the existing methods in cross-dimensional scenarios.

[0006] In a first aspect, the present application provides a mobile application identification impersonation detection method based on multi-modal fusion, comprising:

[0007] Obtaining application information of a to-be-detected application and application information of a standard application, the application information of the to-be-detected application comprising: application identification and developer information of the to-be-detected application, the application information of the standard application comprising: application identification and developer information of the standard application, the application identification comprising: application name, package name and icon;

[0008] Judging whether the developer information of the to-be-detected application and the developer information of the standard application are completely identical;

[0009] In a case where the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application, the application identifier of the to-be-detected application is preprocessed;

[0010] The application identifier of the preprocessed to-be-detected application is subjected to rule feature extraction based on a predefined rule set, to obtain a text rule feature vector and an image rule feature vector;

[0011] The extracted text rule feature vector and image rule feature vector are respectively input into a pre-trained multi-modal classification model for analysis and processing, to obtain a text modal impersonation probability and an image modal impersonation probability of the to-be-detected application;

[0012] The text modal impersonation probability and the image modal impersonation probability of the to-be-detected application are subjected to weighted fusion processing, to obtain a detection result.

[0013] In a second aspect, the present application provides a mobile application identifier impersonation detection device based on multi-modal fusion, comprising:

[0014] An acquisition module is configured to acquire application information of a to-be-detected application and application information of a standard application, wherein the application information of the to-be-detected application comprises an application identifier and developer information of the to-be-detected application, the application information of the standard application comprises an application identifier and developer information of the standard application, and the application identifier comprises an application name, a package name, and an icon;

[0015] A judgment module is configured to judge whether the developer information of the to-be-detected application is completely consistent with the developer information of the standard application;

[0016] A processing module is configured to preprocess the application identifier of the to-be-detected application in a case where the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application;

[0017] The processing module is further configured to perform rule feature extraction on the preprocessed application identifier of the to-be-detected application based on a predefined rule set, to obtain a text rule feature vector and an image rule feature vector;

[0018] The processing module is further configured to input the extracted text rule feature vector and image rule feature vector into a pre-trained classification model for analysis and processing, to obtain a text modal impersonation probability and an image modal impersonation probability of the to-be-detected application;

[0019] The processing module is further configured to perform weighted fusion processing on the text modal impersonation probability and the image modal impersonation probability of the to-be-detected application, to obtain a detection result.

[0020] In a third aspect, the present application provides a mobile application identifier impersonation detection device based on multi-modal fusion, comprising:

[0021] Memory;

[0022] Processor;

[0023] The memory stores computer-executable instructions;

[0024] The processor executes the computer-executable instructions stored in the memory to implement the mobile application identity impersonation detection method based on multi-modal fusion as described in the first aspect and various possible implementation manners of the first aspect.

[0025] In a fourth aspect, the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the mobile application identity impersonation detection method based on multi-modal fusion as described in the first aspect and various possible implementation manners of the first aspect.

[0026] The present application provides a mobile application identity impersonation detection method and device based on multi-modal fusion. The method obtains the application identity and developer information of the application to be detected and the standard application; in the case that the developer information of the application to be detected and the developer information of the standard application are not completely consistent, the application identity of the application to be detected is preprocessed; based on a predefined rule set, the application identity of the preprocessed application to be detected is subjected to rule feature extraction to obtain a text rule feature vector and an image rule feature vector; the extracted text rule feature vector and image rule feature vector are input into a pre-trained multi-modal classification model for analysis and processing to obtain a text modal impersonation probability and an image modal impersonation probability of the application to be detected; the text modal impersonation probability and the image modal impersonation probability are subjected to weighted fusion processing to obtain a detection result, effectively breaking through the limitation of single feature detection, having good explainability and generalization ability, and being able to reliably solve the missed report problem of traditional methods for cross-dimension impersonation strategies. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0028] Figure 1 A flowchart of the mobile application identity impersonation detection method based on multi-modal fusion provided by the embodiments of the present application is shown;

[0029] Figure 2 A structural diagram of the mobile application identity impersonation detection device based on multi-modal fusion provided by the embodiments of the present application is shown;

[0030] Figure 3 A structural diagram of the mobile application identity impersonation detection device based on multi-modal fusion provided by the embodiments of the present application is shown.

[0031] The specific embodiments of the application have been shown by the above drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to restrict the scope of the inventive concept by any means, but to illustrate the inventive concept to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the application clearer, the technical solutions of the application will be described clearly and completely in combination with the drawings in the application. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0033] The terms "first", "second", "third", "fourth" and the like (if any) in the specification and claims of the application and the above drawings are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein.

[0034] In the embodiments of the application, the words "exemplary" or "for example" are used to mean example, instance, or illustration. Any embodiment or design presented as "exemplary" or "for example" in the application should not be interpreted as being more preferred or advantageous than other embodiments or designs. Rather, the use of "exemplary" or "for example" is intended to present concepts in a particular manner. It is to be understood that the embodiments described herein are merely exemplary and that only the claims have legal effect.

[0035] The technical solutions of the application and how the technical solutions of the application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the application will be described below in combination with the drawings.

[0036] Figure 1 A flowchart of a mobile application identification impersonation detection method based on multi-modal fusion provided by an embodiment of the application is shown in FIG. 1. As shown in FIG. 1, the mobile application identification impersonation detection method based on multi-modal fusion provided by the embodiment of the application comprises the following steps. Figure 1

[0037] S1: obtaining application information of a to-be-detected application and application information of a standard application, the application information of the to-be-detected application comprising application identification and developer information of the to-be-detected application, and the application information of the standard application comprising application identification and developer information of the standard application.

[0038] ​The application identifier includes an application name, a package name, and an icon.

[0039] It can be understood that the standard application is a genuine application corresponding to the to-be-detected application, and the application information of the standard application is the application identifier and the developer information of the genuine application. Obtaining the genuine application information is beneficial to subsequent steps of judging whether the to-be-detected application is a counterfeit application according to the genuine application information.

[0040] S2: judging whether the developer information of the to-be-detected application is completely consistent with the developer information of the standard application.

[0041] It can be understood that the consistency of the developer information refers to a process of verifying whether the to-be-detected application (such as a version downloaded by a user or a version obtained through a third-party channel) and the standard application (such as a version published by an official application store or a version provided by a developer website) are completely matched in terms of developer identifier, digital signature, metadata, and other key information.

[0042] In the case where the developer information of the to-be-detected application is completely consistent with the developer information of the standard application, the subsequent detection process can be skipped.

[0043] S3: in the case where the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application, preprocessing the application identifier of the to-be-detected application.

[0044] It can be understood that in the case where the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application, the application identifier of the to-be-detected application needs to be further detected. The preprocessing of the application identifier ensures that the formats of various types of identifier data are consistent, thereby providing standardized input for subsequent detection steps.

[0045] Specifically, the application name is normalized according to Unicode and the conversion between traditional Chinese and simplified Chinese is completed; the package name is divided into a sub-domain list according to “.” and the part with the first-level package name “com” is removed; and the icon is uniformly scaled to 256x256 pixels and the RGB channel is subjected to a normalization operation.

[0046] S4: performing rule feature extraction on the preprocessed application identifier of the to-be-detected application based on a predefined rule set to obtain a text rule feature vector and an image rule feature vector.

[0047] The predefined rule set includes an application name matching rule, an application package name matching rule, and an application icon matching rule.

[0048] Specifically, the rule feature extraction on the preprocessed application identifier of the to-be-detected application based on the predefined rule set to obtain the text rule feature vector and the image rule feature vector includes the following steps:

[0049] S41: match the application name of the to-be-detected application according to a predefined application name matching rule to obtain an application name matching result.

[0050] Specifically, matching the application name of the to-be-detected application according to the predefined application name matching rule to obtain the application name matching result includes the following steps:

[0051] S411: perform string comparison between the to-be-detected application name and the standard application name to determine whether the to-be-detected application name and the standard application name are completely identical, if yes, perform step S412, if not, perform step S413.

[0052] S412: all algorithms corresponding to the application name rules return a first output value.

[0053] The first output value is used to indicate a matching success.

[0054] For example, in the case where the to-be-detected application name and the standard application name are completely identical, all algorithms corresponding to the application name rules return true.

[0055] S413: detect the to-be-detected application name according to a predefined fuzzy matching rule,

[0056] The fuzzy matching rule includes: similar character matching, homophonic discrimination, and structural variation.

[0057] Specifically, the visual similarity of characters is compared through a Unicode similar character library (for example, “micro” and “sign”); the pronunciation consistency is analyzed by relying on a pinyin library; and the common variant patterns (such as adding a suffix “2.0” or inserting special characters, etc.) are matched by using a regular expression.

[0058] S414: when any fuzzy matching rule passes the detection, the algorithm corresponding to the corresponding application name rule returns the first output value, otherwise, a second output value is returned.

[0059] The second output value is used to indicate a matching failure.

[0060] S42: match the application package name of the to-be-detected application according to a predefined application package name matching rule to obtain an application package name matching result.

[0061] Specifically, matching the application package name of the to-be-detected application according to the predefined application package name matching rule to obtain the application package name matching result includes the following steps:

[0062] S421: perform consistency verification on the application package name of the to-be-detected application and the standard application package name.

[0063] S422: In the case of consistency verification, generate version conflict mark and send manual review prompt information.

[0064] It can be understood that if the application package name of the to-be-detected application and the standard application package name are completely consistent, the version conflict mark is generated and the process is terminated, triggering the manual review mechanism.

[0065] S423: In the case of consistency verification, the application package name of the to-be-detected application is subjected to character-level rule detection and structure-level rule detection.

[0066] It can be understood that if the application package name of the to-be-detected application and the standard application package name are inconsistent, character-level and structure-level rule detection is performed.

[0067] Specifically, the character-level rule detection first compares the differences in the application package name through a differential comparison algorithm, and records the addition, deletion, and replacement operations and their position distribution that meet the threshold condition.

[0068] Further, whether there is a similar character replacement is detected according to the following formula:

[0069]

[0070] wherein, is the character pair at the corresponding position of the to-be-detected application and the original application, is the confusion character mapping table, is the first output value, is the second output value;

[0071] If there is an addition or deletion behavior, the deleted characters are first completed and the added characters are removed, and then subsequent detection is performed.

[0072] The structure-level rule detection compares the number of subdomains of the package name to identify hierarchical changes, and parses the package name hierarchy into a syntax tree structure to further detect changes in the position of sibling subdomain nodes (such as a.b.c→a.c.b) and illegal node insertion.

[0073] S424: When the character-level rule detection and / or structure-level detection passes, the corresponding application name rule corresponds to the algorithm returning the first output value, otherwise, the second output value is returned.

[0074] S43: According to the pre-defined application icon matching rule, the application icon of the to-be-detected application is matched to obtain an application icon matching result.

[0075] Specifically, according to the pre-defined application icon matching rule, the application icon of the to-be-detected application is matched to obtain an application icon matching result, including the following steps:

[0076] S431: Calculate the local similarity of the application icon of the application to be detected and the standard application icon by the structural similarity index, determine whether the local similarity is greater than the preset similarity threshold, if yes, return the first output value, otherwise, return the second output value.

[0077] S432: Calculate the color difference between the application icon background color of the application to be detected and the standard application icon background color, determine whether the color difference is less than the preset color difference threshold, if yes, return the first output value, otherwise, return the second output value.

[0078] Specifically, the K-means clustering algorithm with k=3 is used to analyze the dominant color tone of the application icon of the detected application and the standard application icon in the HSV space, and the color difference between the detected application and the genuine application icon background color is calculated by the following formula:

[0079]

[0080] wherein, represents the color difference, represents the dominant color tone coordinate of the application icon of the detected application obtained by clustering in the HSV space, represents the dominant color tone coordinate of the standard application icon obtained by clustering in the HSV space.

[0081] S433: Locate the difference area by the adaptive threshold pixel difference method, and identify the new elements of the application icon to be detected. Perform key point geometric feature matching or Fourier-Mellin transform frequency domain analysis on the difference area or the new elements, determine whether the elements of the application icon to be detected have undergone geometric deformation, if yes, return the second output value, otherwise, return the first output value.

[0082] For example, the adaptive threshold pixel difference method is used to locate the difference area in the icon, or the additional closed contour is detected after excluding the core elements by contour analysis to identify the new elements. With the help of key point geometric verification or Fourier-Mellin transform analysis of frequency domain features, it is detected whether the icon elements have undergone geometric deformation such as flipping and rotating.

[0083] S434: Determine whether the text elements of the application icon to be detected have counterfeit behavior by the text positioning algorithm and optical character recognition, if yes, return the second output value, otherwise, return the first output value.

[0084] For example, the stroke width transform or maximum stable extreme value region text positioning algorithm is combined with optical character recognition to compare the edit distance or font features of the icon text to determine whether the text elements have counterfeit behavior.

[0085] S44: Generate a text rule feature vector according to the application name matching result and the application package name matching result, and generate an image rule feature vector according to the application icon matching result.

[0086] Specifically, for any one application name matching rule, if the corresponding application name rule algorithm returns the first output value, the feature of the application name rule algorithm at the corresponding feature position in the text type rule feature vector is represented as 1, and if the corresponding application name rule algorithm returns the second output value, the feature of the application name rule algorithm at the corresponding feature position in the text type rule feature vector is represented as 0; for any one application package name matching rule, if the corresponding application package name rule algorithm returns the first output value, the feature of the application package name rule algorithm at the corresponding feature position in the text type rule feature vector is represented as 1, and if the corresponding application package name rule algorithm returns the second output value, the feature of the application package name rule algorithm at the corresponding feature position in the text type rule feature vector is represented as 0. The generated text type rule feature vector is as follows:

[0087]

[0088]

[0089] wherein, represents the i-th text detection rule, the dimension is adjusted according to the number of rules, represents the name of the legal application package / name, represents the name of the application package to be detected, is an indicative function, defined as:

[0090]

[0091] Similarly, based on the application icon matching result, for each rule, if its corresponding algorithm output is the first output value, the feature position corresponding to the rule is 1, otherwise it is 0. Finally, an m-dimensional image type rule feature vector is generated.

[0092] S5: input the extracted text type rule feature vector and image type rule feature vector into the pre-trained multi-modal classification model for analysis and processing to obtain the text modal imitation probability and image modal imitation probability of the application to be detected.

[0093] wherein, the multi-modal classification model comprises: a text classification model and an image classification model, and the training process of the multi-modal classification model comprises:

[0094] A1: obtain an imitation application dataset and a legal application dataset, and label the obtained dataset, and divide the labeled dataset into a training set, a validation set and a test set according to a preset ratio.

[0095] ​A2: rule feature extraction is performed on the training set data based on a predefined rule set to obtain text rule features and image rule features.

[0096] In step A2, the process is similar to the above step S4 "rule feature extraction is performed on the application identifier of the preprocessed application to be detected based on a predefined rule set to obtain a text rule feature vector and an image rule feature vector", which will not be repeated here.

[0097] A3: input the text rule features into a logistic regression model for pre-training to obtain a text classification model.

[0098] The text classification model is used to output the text modal impersonation probability.

[0099] It can be understood that the text rule features are input into the logistic regression model, which aims to capture the linear correlation of binary features and directly output the discriminant weight of each text rule through the coefficient.

[0100] A4: input the image rule features into a Bernoulli naive Bayes model for pre-training to obtain an image classification model.

[0101] The image classification model is used to output the image modal impersonation probability.

[0102] It can be understood that the image rule features are input into the Bernoulli naive Bayes model, which focuses on the joint probability calculation of visual rules, for example, the synergistic probability when multiple rules such as "color impersonation" and "shape tampering" hit at the same time.

[0103] A5: according to the F1 score of the verification set, assign an initial weight, adjust the weight parameters of the multi-modal classification model through iterative training until the model converges or reaches the maximum number of iterations, and obtain a trained multi-modal classification model.

[0104] S6: perform weighted fusion processing on the text modal impersonation probability and the image modal impersonation probability of the application to be detected to obtain a detection result.

[0105] Specifically, the following formula is satisfied:

[0106]

[0107] wherein, the text modal weight is, the image modal weight is, the text modal impersonation probability is, the image modal impersonation probability is.

[0108] In an optional embodiment, the mobile application identifier impersonation detection method based on multi-modal fusion further comprises:

[0109] A user upload interface is designed to support uploading the name, package name and icon of a suspected counterfeit application. After manual review, the type of the counterfeit is determined and it is marked as "known rule hit" or "new type of counterfeit mode". For counterfeit samples that hit the known rules, their feature vectors and labels are included in the incremental training set, and the model parameters are updated using the Follow the Regularized Leader (FTRL) algorithm to achieve lightweight iteration. For samples of new types of counterfeit modes, first, the counterfeit detection rule library is expanded based on their features, and then the sample features are reconstructed. By updating the parameters corresponding to the new rules and combining the new and old mixed samples for 5 to 10 rounds of overall training, the synergistic optimization of new and old rules is achieved, thereby improving the coverage of the model for new types of counterfeit scenarios.

[0110] The mobile application identity counterfeit detection method based on multi-modal fusion provided by the embodiments of the present application extracts text dimension features such as application name and package name and image dimension features such as icons, independently models the text and image features, and realizes collaborative decision-making at the decision layer through dynamic weight fusion, thereby breaking through the dimension limitations of traditional single feature detection methods. In the face of cross-dimension counterfeit strategies adopted by attackers, comprehensive identification can be achieved through modal-specific accurate modeling and comprehensive decision-making, effectively solving the limited coverage and easy-to-miss problems caused by the dependence of existing methods on single features.

[0111] Figure 2 The structure diagram of the mobile application identity counterfeit detection device based on multi-modal fusion provided by the embodiments of the present application is shown. As shown in Figure 2 The mobile application identity counterfeit detection device 200 based on multi-modal fusion provided by the embodiments of the present application includes:

[0112] The acquisition module 201 is configured to acquire application information of a to-be-detected application and application information of a standard application, wherein the application information of the to-be-detected application includes application identity and developer information of the to-be-detected application, and the application information of the standard application includes application identity and developer information of the standard application, and the application identity includes application name, package name and icon.

[0113] The judgment module 202 is configured to judge whether the developer information of the to-be-detected application is completely consistent with the developer information of the standard application.

[0114] The processing module 203 is configured to, in the case that the developer information of the to-be-detected application is not completely consistent with the developer information of the standard application, pre-process the application identity of the to-be-detected application.

[0115] The processing module 203 is further configured to perform rule feature extraction on the pre-processed application identity of the to-be-detected application based on a pre-defined rule set, to obtain a text rule feature vector and an image rule feature vector.

[0116] The processing module 203 is further configured to input the extracted text rule feature vector and the image rule feature vector into a pre-trained classification model respectively for analysis and processing, to obtain a text modal impersonation probability and an image modal impersonation probability of the application to be detected.

[0117] The processing module 203 is further configured to perform weighted fusion processing on the text modal impersonation probability and the image modal impersonation probability of the application to be detected, to obtain a detection result.

[0118] The mobile application identification impersonation detection device based on multi-modal fusion provided in this embodiment can perform the mobile application identification impersonation detection method based on multi-modal fusion provided in the above method embodiments, and has similar implementation principles and technical effects. Therefore, no further description is given here.

[0119] Figure 3 A structural schematic diagram of the mobile application identification impersonation detection device based on multi-modal fusion provided in this embodiment is shown in FIG. 3. Figure 3 As shown in FIG. 3, the mobile application identification impersonation detection device based on multi-modal fusion provided in this embodiment includes a receiver 301, a transmitter 302, a processor 303, and a memory 304.

[0120] The receiver 301 is configured to receive instructions and data.

[0121] The transmitter 302 is configured to send instructions and data.

[0122] The memory 304 is configured to store computer execution instructions.

[0123] The processor 303 is configured to execute the computer execution instructions stored in the memory 304, to implement each step performed by the mobile application identification impersonation detection method based on multi-modal fusion in the above embodiments. For details, refer to the related description in the above mobile application identification impersonation detection method embodiment based on multi-modal fusion.

[0124] Optionally, the memory 304 can be independent or integrated with the processor 303.

[0125] When the memory 304 is independently arranged, the electronic device further includes a bus for connecting the memory 304 and the processor 303.

[0126] The embodiments of this application further provide a computer storage medium, which stores computer execution instructions. When the processor executes the computer execution instructions, the mobile application identification impersonation detection method based on multi-modal fusion performed by the mobile application identification impersonation detection device based on multi-modal fusion is implemented.

[0127] Those of ordinary skill in the art will realize and understand that all or certain steps in the methods disclosed above, the functional modules / units in the systems and devices can be implemented as software, firmware, hardware and appropriate combinations thereof. In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Certain physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software can be distributed on computer readable media, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Further, it is common knowledge to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.

[0128] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0129] It should be understood that the application is not limited to the precise construction that has been described above and illustrated in the accompanying drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the appended claims.

Claims

1. A method for detecting counterfeit mobile application identifiers based on multimodal fusion, characterized in that, The method includes: Obtain application information of the application to be tested and application information of the standard application. The application information of the application to be tested includes: the application identifier and developer information of the application to be tested. The application information of the standard application includes: the application identifier and developer information of the standard application. The application identifier includes: application name, package name and icon. Determine whether the developer information of the application under test is completely consistent with the developer information of the standard application; When the developer information of the application to be tested is not completely consistent with the developer information of the standard application, the application identifier of the application to be tested is preprocessed. Based on a predefined rule set, rule features are extracted from the application identifier of the preprocessed application to be detected to obtain text-type rule feature vectors and image-type rule feature vectors. The extracted text-based rule feature vectors and image-based rule feature vectors are input into a pre-trained multimodal classification model for analysis and processing to obtain the text modal spoofing probability and image modal spoofing probability of the application to be detected. The text modal spoofing probability and image modal spoofing probability of the application to be detected are weighted and fused to obtain the detection result.

2. The method according to claim 1, characterized in that, The predefined rule set includes: application name matching rules, application package name matching rules, and application icon matching rules. Based on the predefined rule set, rule features are extracted from the application identifier of the preprocessed application to be detected, resulting in text-based rule feature vectors and image-based rule feature vectors, including: The application name of the application to be tested is matched according to the predefined application name matching rules to obtain the application name matching result; the application package name of the application to be tested is matched according to the predefined application package name matching rules to obtain the application package name matching result; and the application icon of the application to be tested is matched according to the predefined application icon matching rules to obtain the application icon matching result. Text-based rule feature vectors are generated based on the application name matching results and the application package name matching results, while image-based rule feature vectors are generated based on the application icon matching results.

3. The method according to claim 2, characterized in that, The process of matching the application name of the application to be detected according to predefined application name matching rules to obtain the application name matching result includes: The name of the application to be detected is compared with the name of the standard application to determine whether the name of the application to be detected is completely consistent with the name of the standard application. If so, all application name rule algorithms will return a first output value, which is used to indicate a successful match; If not, the name of the application to be detected will be detected according to the predefined fuzzy matching rules, which include: matching of similar-looking characters, homophony discrimination, and structural variation; When any fuzzy matching rule passes the test, the corresponding application name rule algorithm returns the first output value; otherwise, it returns the second output value, which is used to indicate that the match failed.

4. The method according to claim 3, characterized in that, The process of matching the application package name of the application to be detected according to predefined application package name matching rules to obtain the application package name matching result includes: Perform a consistency check between the application package name of the application to be tested and the standard application package name; If the consistency check passes, a version conflict flag is generated and a manual review prompt message is sent. If the consistency check fails, perform character-level rule detection and structure-level rule detection on the application package name of the application to be tested. When character-level rule detection and / or structure-level detection pass, the corresponding application package name rule algorithm returns the first output value; otherwise, it returns the second output value.

5. The method according to claim 3, characterized in that, The process of matching the application icon of the application to be detected according to predefined application icon matching rules to obtain the application icon matching result includes: The local similarity between the application icon of the application to be detected and the standard application icon is calculated by the structural similarity index. It is then determined whether the local similarity is greater than the preset similarity threshold. If so, the first output value is returned; otherwise, the second output value is returned. Calculate the color difference between the background color of the application icon of the application to be tested and the background color of the standard application icon, and determine whether the color difference is less than the preset color difference threshold. If so, return the first output value; otherwise, return the second output value. The method of adaptive threshold pixel difference is used to locate the difference region and identify the new element of the application icon to be detected. The method of key point geometric feature matching or Fourier-Merlin transform frequency domain analysis is performed on the difference region or the new element to determine whether the element of the application icon to be detected has undergone geometric deformation. If so, the second output value is returned; otherwise, the first output value is returned. By using text localization algorithms and optical character recognition, it is determined whether the text elements of the app icon to be detected are counterfeited. If so, the second output value is returned; otherwise, the first output value is returned.

6. The method according to claim 4, characterized in that, The step of generating text-based rule feature vectors based on application name matching results and application package name matching results includes: For each rule, if the corresponding algorithm corresponds to the first output value, then the feature position corresponding to that rule is 1; if the corresponding algorithm corresponds to the second output value, then the feature position corresponding to that rule is 0.

7. The method according to claim 2, characterized in that, The multimodal classification model includes: a text classification model and an image classification model. The training process of the multimodal classification model includes: Obtain datasets of counterfeit and genuine applications, label the obtained datasets, and randomly divide the labeled datasets into training, validation, and test sets according to a preset ratio. Based on a predefined set of rules, rule features are extracted from the training set data to obtain text rule features and image rule features. Text rule features are input into a logistic regression model for pre-training to obtain a text classification model, which is used to output the text modality spoofing probability. The regular features of the image are input into the Bernoulli Naive Bayes model for pre-training to obtain an image classification model, which is used to output the image modality spoofing probability. Initial weights are assigned based on the F1 score of the validation set. The weight parameters of the multimodal classification model are adjusted by iteratively training the model until the model converges or reaches the maximum number of iterations, thus obtaining the trained multimodal classification model.

8. A mobile application identifier counterfeiting detection device based on multimodal fusion, characterized in that, The device includes: The acquisition module is used to acquire application information of the application to be tested and application information of the standard application. The application information of the application to be tested includes: the application identifier and developer information of the application to be tested. The application information of the standard application includes: the application identifier and developer information of the standard application. The application identifier includes: application name, package name and icon. The judgment module is used to determine whether the developer information of the application to be tested is completely consistent with the developer information of the standard application. The processing module is used to preprocess the application identifier of the application to be detected when the developer information of the application to be detected is not completely consistent with the developer information of the standard application. The processing module is also used to extract rule features from the application identifier of the preprocessed application to be detected based on a predefined rule set, so as to obtain text-type rule feature vectors and image-type rule feature vectors. The processing module is also used to input the extracted text-type rule feature vectors and image-type rule feature vectors into the pre-trained classification model for analysis and processing, so as to obtain the text modal spoofing probability and image modal spoofing probability of the application to be detected. The processing module is also used to perform weighted fusion processing on the text modal spoofing probability and image modal spoofing probability of the application to be detected, so as to obtain the detection result.

9. A mobile application identifier counterfeiting detection device based on multimodal fusion, characterized in that, The device includes: Memory; processor; The memory stores computer-executed instructions; The processor executes the computer execution instructions stored in the memory to implement the mobile application identifier spoofing detection method based on multimodal fusion as described in any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement the mobile application identifier spoofing detection method based on multimodal fusion as described in any one of claims 1-7.

Images