Application identification method and device based on LLM (Large Language Model)

Abstract

The embodiment of the invention provides an application identification method and device based on a large language model LLM, and the method comprises the steps: analyzing the feature similarity among a plurality of pieces of application data through the large language model LLM, classifying the application data according to the feature similarity, training a learning model based on the classified application data, and carrying out the recognition of the application data through the learning model. The applications of the same category in the multiple pieces of to-be-recognized application data are recognized. According to the method and the device, the problems that an existing model cannot be self-adapted when facing application data change, and when the application data changes part of feature data through application change, the model cannot correctly identify the application and needs a large amount of annotated data to train are solved, so that the purposes of accurately and self-adaptively identifying the application in the network and improving the application identification efficiency are achieved. The requirement for model updating is reduced, and the effect of training the model without a large amount of annotated data is achieved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of network operation and network security in the field of communication, in particular, to an application recognition method and device based on a large language model (LLM). BACKGROUND

[0002] With the rapid development of Internet applications, the phenomenon of frequent updates and name changes, icon changes and other identification changes of application programs (Apps) is becoming increasingly common, especially as malicious applications continue to increase, disguising themselves in this way to evade security detection and pose a serious security risk to users. The existing technology has the following limitations in dealing with application analysis and recognition:

[0003] 1. High-quality data dependency: models usually require a large amount of high-quality labeled data for training.

[0004] 2. Dynamic adaptability: application data is dynamic, and once the model is trained, its ability to adapt to new changes is limited, and it needs to be retrained regularly to maintain its effectiveness. SUMMARY

[0005] Embodiments of the present application provide an application recognition method and device based on a large language model (or large-scale language model) (Large Language Model, referred to as LLM) to at least solve the problem that the model in the related art cannot adapt when facing application data changes, and when the application data changes due to changes in the application, the model cannot correctly identify the application and requires a large amount of labeled data for training.

[0006] According to an embodiment of the present application, an application recognition method based on a large language model (LLM) is provided, comprising: analyzing the feature similarity between a plurality of application data by a large language model (LLM), and classifying the application data according to the feature similarity, training a learning model based on the classified application data to identify the same category of application in the plurality of application data to be identified.

[0007] According to another embodiment of the present application, an application recognition device based on a large language model (LLM) is provided, comprising: an analysis module for analyzing the feature similarity between a plurality of application data by a large language model (LLM), and classifying the application data according to the feature similarity, and an identification module for training a learning model based on the classified application data to identify the same category of application in the plurality of application data to be identified.

[0008] According to still another embodiment of the present application, a computer-readable storage medium is also provided, which stores a computer program, wherein the computer program is configured to execute the steps in any of the method embodiments described above when running.

[0009] According to still another embodiment of the present application, there is also provided an electronic device comprising a memory and a processor, the memory having stored therein a computer program, the processor being arranged to execute the computer program to perform the steps of any of the method embodiments described above.

[0010] According to still another embodiment of the present application, there is also provided a computer program product comprising a computer program which, when executed by a processor, performs the steps of any of the method embodiments described above.

[0011] By the present application, since the application data is summarized and classified by using the analysis capability of LLM on the data, the frequently changed applications are classified, and the classification results are used to train the model subsequently, so as to detect the same category of applications in multiple application data, the problem that the existing model cannot adapt when facing the change of application data can be solved, when the application data changes after the change of the application, the model cannot correctly identify the application, and a large amount of labeled data is required to train the model, thereby achieving the effects of accurately and adaptively identifying the application in the network, reducing the demand for model updating, and not requiring a large amount of labeled data to train the model. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 is a hardware structure block diagram of a computer terminal of an application recognition method based on a large language model LLM according to an embodiment of the present application;

[0013] Figure 2 is a flowchart of an application recognition method based on a large language model LLM according to an embodiment of the present application;

[0014] Figure 3 is another flowchart of an application recognition method based on a large language model LLM according to an embodiment of the present application;

[0015] Figure 4 is a schematic diagram of multi-modal data according to an embodiment of the present application;

[0016] Figure 5 is a schematic diagram of application analysis based on LLM according to an embodiment of the present application;

[0017] Figure 6 is a structure block diagram of an application recognition device based on a large language model LLM according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] Hereinafter, embodiments of the present application will be described in detail with reference to the accompanying drawings and in conjunction with embodiments.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0020] The methods and embodiments provided in this application can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for an application recognition method based on a Large Language Model (LLM) according to an embodiment of the present invention. Figure 1 As shown, a computer terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The computer terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, the computer terminal may also include components that are more complex than those described above. Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0021] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the application recognition method based on the Large Language Model (LLM) in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0022] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the computer terminal. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0023] This embodiment provides an application recognition method based on the Large Language Model (LLM) that runs on the aforementioned computer terminal. Figure 2 This is a flowchart of an application recognition method based on a large language model (LLM) according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0024] Step S202: Analyze the feature similarity between multiple application data using a large language model (LLM), and classify the application data based on feature similarity.

[0025] In this embodiment, key features of multiple application data can be extracted, and the feature similarity between key features can be compared. Application data with feature similarity greater than a threshold are classified into the same category. Key features include at least one of the following: keywords, visual elements, critical paths, and specific traffic segments in network traffic.

[0026] In this embodiment, when the application data is multimodal data, after extracting the key features of multiple application data, the key features that have dependencies between the modalities can be aggregated.

[0027] Step S204: Train a learning model based on the classified application data to identify applications of the same category in multiple application data to be identified.

[0028] In this implementation, an LLM can be trained using categorized application data to obtain a target LLM, and then the target LLM can be used to identify applications of the same category from multiple application data to be identified.

[0029] In this embodiment, the categorized application data can be labeled, and a learning model can be trained using the labeled application data to obtain a target learning model. This target learning model is then used to identify applications of the same category from multiple application data sets to be identified. It should be noted that, in this application, the learning model is not limited to machine learning models or deep learning models.

[0030] In one embodiment, before step S202, the method includes: collecting application data and training an LLM using the application data. The application data can be unimodal or multimodal, and includes at least one of the following: text data, image data, behavioral patterns, network traffic, and metadata; text data includes at least one of the following: application name and application description; image data includes at least one of the following: application icon and screenshot; behavioral patterns include at least one of the following: login behavior and function usage behavior; network traffic includes traffic transmitted during application use; and metadata includes at least one of the following: application version information, developer information, release date, installation package size, and application signature.

[0031] Through steps S202-S204 above, the feature similarity between multiple application data is analyzed using a Large Language Model (LLM), and the application data is classified according to feature similarity. A learning model is then trained based on the classified application data to identify applications of the same category among multiple application data sets to be identified. This solves the problems of existing technologies where models cannot adapt to changes in application data, where models cannot correctly identify applications when some feature data is altered due to application changes, and where a large amount of labeled data is required for training. Therefore, it achieves accurate and adaptive application identification in the network, reduces the need for model updates, and eliminates the need for a large amount of labeled data to train the model.

[0032] Figure 3 This is another flowchart of the application recognition method based on the Large Language Model (LLM) according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0033] Step S301, data collection. Figure 4 This is a schematic diagram of multimodal data according to an embodiment of the present invention, such as... Figure 4 As shown, the data includes text data (e.g., application name, application description), image data (e.g., application icon, screenshots), behavioral patterns (login behavior, function usage behavior), network traffic (traffic transmitted during application use), and metadata related to the app (e.g., application version information, developer information, release date, installation package size, application signature). To automate and improve the efficiency of data collection, methods such as web scraping, API calls, and network sniffing can be used to obtain relevant data, and a corresponding data collection system can be established.

[0034] Step S302: Extraction and analysis of application data. Figure 5 This is a schematic diagram of application analysis based on LLM according to an embodiment of the present invention, such as... Figure 5As shown, when using LLM to analyze application data, it is necessary to mine the feature similarities between different application data, and identify applications that may be from the same source based on feature similarity exceeding a threshold. This process involves in-depth analysis of multimodal data, including data from text, images, behavior, and network traffic.

[0035] Text data and metadata are used by LLM to identify common themes that may exist between different application data through techniques such as topic mining. For example, if multiple applications use similar keywords in their descriptions, such as vocabulary or sentence structure, it may suggest that they have similar sources or backgrounds.

[0036] Image data, LLM can use techniques such as image recognition and object detection to discover similarities in visual elements between different applications, such as similarities between icons and interface elements. If the icons or interface elements of multiple applications have similar design styles or structures, it may indicate that they have the same creator or origin.

[0037] Behavioral patterns and network traffic: By observing user login behavior, function usage behavior, and application data transmission behavior, it's possible to discover overlapping patterns or abnormal behaviors between different applications. Extracting critical paths and specific traffic segments within network traffic, the similarity of these key features may suggest that they belong to the same category of application.

[0038] By comprehensively utilizing LLM to analyze multimodal data, we can gain a more complete understanding of the similarities between different applications and group applications from the same source together. This in-depth analytical approach provides strong support for identifying and processing applications of the same category, thereby obtaining high-quality application identification datasets.

[0039] Step S303: Identify applications of the same category. The application data categorized in the above steps can be combined with specific application scenarios to identify applications of the same category, such as those in a carrier network. A carrier network is a complex network ecosystem, including core networks, access networks, and wireless networks, with a large number of users and devices connected. Within the carrier backbone network, it is necessary to monitor network traffic in real time, ensure network security, identify and block malicious applications of the same category (such as disguised applications), and provide value-added services to help users identify and prevent malicious applications of the same category (such as disguised applications), preventing malware intrusion and privacy leaks.

[0040] In carrier network scenarios, training models based on network traffic data can be used to identify collected network traffic data, thereby identifying applications of the same category (such as rebranded apps) and providing labels. The constructed analysis model can utilize machine learning, deep learning, or even LLM techniques to extract features and recognize patterns in network traffic data, thus achieving accurate identification of applications of the same category (such as rebranded apps).

[0041] First, a large amount of network traffic data is needed as a training set. This data can be derived from the high-quality application identification dataset obtained in the previous step. This data will be used to train a network traffic analysis model, which can utilize techniques such as machine learning, deep learning, or LLM to extract features and recognize patterns from the traffic data. During model building, the accuracy and robustness of the model also need to be considered. After training the model, it needs to be evaluated to ensure its performance meets expectations. For example, techniques such as cross-validation can be used to evaluate the model's performance, and performance metrics such as accuracy, recall, and F1 score can be calculated. By evaluating the model's performance, its feasibility and effectiveness in a real-world environment can be determined. It should be noted that in this application, the learning model is not limited to machine learning models, deep learning models, or LLM models.

[0042] Step S304, Application Deployment. The trained model is integrated into the actual application system for real-time identification of applications of the same category. The deployed identification system is monitored and maintained to ensure stable operation. Cloud computing technology and a distributed system architecture can be used to achieve efficient deployment and management of the identification model. Simultaneously, log monitoring and anomaly detection technologies are used to monitor the system's operating status in real time, promptly identifying and resolving potential problems to ensure system stability and reliability. This process fully utilizes network traffic data, ensuring network security and user privacy protection.

[0043] The above method can not only be applied to the identification of disguised apps, but also has the following applications:

[0044] 1) App Store Security Audit: App stores can use this method to conduct security audits and screenings of apps. By identifying apps of the same category, it can be ensured that all apps in the app store are safe and trustworthy, thereby improving user experience and the health of the app ecosystem.

[0045] 2) Network Security Protection: Enterprises and organizations can apply this method to their network security systems to identify and block potential malicious applications of the same type. This helps prevent malicious applications from entering the corporate network and protects sensitive data and system security.

[0046] 3) App Market Regulation: Governments or regulatory agencies can use this method to regulate and manage app markets. By identifying apps of the same category, the negative impact of malicious apps on users can be reduced, maintaining market order and protecting consumer rights.

[0047] 4) Malicious Behavior Detection: In addition to identifying malicious applications of the same category, it can also be used to detect other malicious behaviors within applications, such as malicious data collection and fraudulent activities. This helps to detect and address the security risks posed by malicious applications early.

[0048] This method not only has wide applications in application markets and enterprise network security, but also helps improve user experience, protect user privacy, maintain a healthy application ecosystem, enhance network security protection capabilities, and provide strong technical support for network operation and maintenance and supervision. The beneficial effects of this method are mainly reflected in the following aspects:

[0049] 1) In-depth multimodal data analysis: Utilize large language models (LLM) to deeply analyze the application's multimodal data, including metadata, behavioral patterns, network traffic, etc. This enables the identification system to capture the characteristics of the same category of applications from different dimensions, improving the comprehensiveness and accuracy of identification.

[0050] 2) Adaptive to traffic changes: Due to the adaptive learning capability of LLM, this method can cope with the continuous changes in traffic characteristics of the same type of application without frequent updates to recognition rules or model parameters, providing continuous adaptability and stability for the recognition system.

[0051] 3) Reduce false negatives: By training with high-quality traffic from applications of the same category, this method can more accurately identify traffic from applications of the same category, effectively reducing the false negative rate and improving the reliability of identification.

[0052] 4) Enhance the identification of applications of the same category that are concealed: For applications of the same category that are disguised using advanced techniques, LLM can learn the deep patterns and behavioral characteristics of traffic, revealing applications of the same category that are concealed, thus enhancing the depth and breadth of the identification system.

[0053] 5) Enhance user security awareness: For operators and government and enterprise users, it provides an efficient tool for identifying applications of the same category, which enhances users' confidence and satisfaction with network security.

[0054] Example 1

[0055] Applications based on LLM analysis and TextCNN for identifying the same category

[0056] 1) Data Collection: Acquire massive amounts of multimodal data from applications, including four types: specified text descriptions (metadata can be represented in text form), image data, behavioral patterns, and network traffic. Text descriptions include names, function descriptions, installation package certificates and signatures, installation package size descriptions, etc. Image data includes icons, screenshots of pages within the application, etc. Behavioral patterns include login methods, function usage behaviors, etc. Network traffic includes all traffic generated when the application is used. This data is stored in a database and categorized and organized by application name.

[0057] 2) LLM Feature Extraction: The collected data is analyzed using a multimodal LLM model. The LLM model extracts key features from various application data through analysis of this multimodal data, such as keywords in text, visual elements in images, critical paths in behavioral patterns, and specific traffic segments in network traffic.

[0058] 3) LLM Analysis: Multimodal LLM is used to compare the feature similarity between key features. Applications with feature similarity greater than a threshold are grouped into the same category, and key features with dependencies between modalities are aggregated. Through feature analysis and aggregation, the LLM model can identify the features of applications within the same category before and after changes, and aggregate and compare applications with similar feature behaviors to identify possible applications of the same category. The summarized application data is used as labels to annotate network traffic data.

[0059] 4) Model Training: Train the learning model using labeled network traffic data, such as a Convolutional Neural Network for Sentence Classification (TextCNN). Evaluate and optimize the trained model using cross-validation to ensure high accuracy and robustness when identifying applications of the same category.

[0060] 5) Application Deployment: The trained learning model is deployed to the operator's backbone network to monitor and analyze data traffic flowing through the network in real time. It should be noted that, in this application, the learning model is not limited to machine learning models or deep learning models.

[0061] Example 2

[0062] Identifying Applications of the Same Category Based on End-to-End LLM

[0063] 1) Data collection: Acquire massive amounts of multimodal data from applications, including four types: specified text descriptions (metadata can be represented in text form), image information, behavioral patterns, and network traffic. Text descriptions include names, function descriptions, installation package certificates and signatures, installation package size descriptions, etc. Image information includes icons, screenshots of pages within the application, etc. Behavioral patterns include login methods used by the application, the process of using application functions, etc. Network traffic includes all traffic generated when the application is used. This data is stored in a database and categorized and organized according to application names.

[0064] 2) Multimodal Data Analysis and Learning of the LLM Model: After data collection, the data is input into the LLM model for training. For example, key features of multiple application data are extracted, key features with dependencies between modalities are aggregated, and the feature similarity between key features is compared. Application data with feature similarity greater than a threshold are grouped into the same category. During training, the LLM model not only learns the feature information of each modality but also identifies data features before and after changes in the same category of applications. Specifically, through the analysis and learning of multimodal data, the LLM model can automatically summarize applications of the same category, laying the foundation for subsequent identification of applications of the same category. During training, large-scale parallel computing and distributed training techniques are employed to improve training efficiency and model performance. During validation, network traffic input is used for application identification verification.

[0065] 3) Model Deployment and Real-time Identification: After training the LLM model, it is deployed to the operator's backbone network to achieve real-time identification of network traffic. During deployment, the LLM model is embedded into the network monitoring system to monitor and analyze data traffic flowing through the network in real time. In the identification phase, efficient algorithms and data structures are used to quickly process and analyze network traffic data, improving the accuracy and efficiency of identification.

[0066] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0067] This embodiment also provides an application recognition device based on a Large Language Model (LLM), which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0068] Figure 6 This is a structural block diagram of an application recognition device based on a Large Language Model (LLM) according to an embodiment of the present invention, such as... Figure 6 As shown, the device 600 includes:

[0069] Analysis module 602 is used to analyze the feature similarity between multiple application data through large language model LLM, and classify the application data according to feature similarity;

[0070] The identification module 604 is used to train a learning model based on classification application data to identify applications of the same category in multiple application data to be identified.

[0071] In one embodiment, the device 600 includes:

[0072] The collection module is used to collect application data;

[0073] The training module is used to train the LLM using application data;

[0074] The application data can be unimodal or multimodal, and must include at least one of the following: text data, image data, behavioral patterns, network traffic, or metadata; text data must include at least one of the following: application name or application description; image data must include at least one of the following: application icon or screenshot; behavioral patterns must include at least one of the following: login behavior or function usage behavior; network traffic includes traffic transmitted during application use; and metadata must include at least one of the following: application version information, developer information, release date, installation package size, or application signature.

[0075] In one embodiment, the analysis module 602 includes:

[0076] The extraction submodule is used to extract key features from multiple application data, where the key features include at least one of the following: keywords, visual elements, critical paths, and specific traffic segments in network traffic.

[0077] The comparison submodule is used to compare the feature similarity between key features;

[0078] The classification submodule is used to classify application data with feature similarity greater than a threshold into the same category.

[0079] In one embodiment, the analysis module 602 includes:

[0080] Aggregation submodules are used to aggregate key features where dependencies exist between modalities.

[0081] In one embodiment, the identification module 604 includes:

[0082] The first training submodule is used to train the LLM using classified application data to obtain the target LLM;

[0083] The first identification submodule is used to identify applications of the same category in multiple application data to be identified through the target LLM.

[0084] In one embodiment, the identification module 604 includes:

[0085] The labeling submodule is used to label the categorized application data.

[0086] The second training submodule is used to train the learning model using labeled application data to obtain the target learning model;

[0087] The second identification submodule is used to identify applications of the same category from multiple application data sets to be identified using a target learning model. It should be noted that, in this application, the learning model is not limited to a machine learning model or a deep learning model.

[0088] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0089] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0090] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0091] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0092] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0093] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0094] Embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps in any of the above method embodiments.

[0095] Embodiments of the present invention also provide a computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the methods in various embodiments of the present application.

[0096] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0097] The above are merely preferred embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An application recognition method based on Large Language Model (LLM), characterized in that, include: The feature similarity between multiple application data is analyzed using a large language model (LLM), and the application data is classified according to the feature similarity. The learning model is trained based on the application data to identify applications of the same category in multiple application data sets to be identified.

2. The method according to claim 1, characterized in that, Prior to analyzing feature similarity between application data using a large language model (LLM), the method includes: Collect the application data; The LLM is trained using the application data. The application data can be unimodal or multimodal, and includes at least one of the following: text data, image data, behavioral patterns, network traffic, and metadata; the text data includes at least one of the following: application name and application description; the image data includes at least one of the following: application icon and screenshot; the behavioral patterns include at least one of the following: login behavior and function usage behavior; the network traffic includes traffic transmitted during application use; and the metadata includes at least one of the following: application version information, developer information, release date, installation package size, and application signature.

3. The method according to claim 1, characterized in that, The analysis of feature similarity among multiple application data using Large Language Modeling (LLM) and the classification of the application data based on the feature similarity include: Extract key features from the multiple application data, wherein the key features include at least one of the following: keywords, visual elements, critical paths, and specific traffic segments in network traffic; Compare the feature similarity between the key features; Application data with a feature similarity greater than a threshold are grouped into the same category.

4. The method according to claim 3, characterized in that, When the application data is multimodal data, after extracting key features from the multiple application data, the method includes: The key feature is the existence of dependencies between aggregated modes.

5. The method according to claim 1, characterized in that, Training a learning model based on the application data to identify applications of the same category in multiple application data sets to be identified includes: The LLM is trained using the application data of the classification to obtain the target LLM; The target LLM identifies applications of the same category from multiple application data to be identified.

6. The method according to claim 1, characterized in that, Training a learning model based on the application data to identify applications of the same category in multiple application data sets to be identified includes: Label the application data of the aforementioned categories; The application data with labeled tags is used to train a learning model to obtain the target learning model; The target learning model identifies applications of the same category from multiple application data sets to be identified.

7. An application recognition device based on Large Language Model (LLM), characterized in that, include: The analysis module is used to analyze the feature similarity between multiple application data through a large language model (LLM) and classify the application data according to the feature similarity. The identification module is used to train a learning model based on the classified application data to identify applications of the same category among multiple application data to be identified.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method described in any one of claims 1 to 6.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 6.

Images