Fraud-related APP detection method, device and equipment based on multi-modal features and fusion model

Abstract

The invention relates to a multi-modal feature and fusion model-based fraud-related APP detection method, device and equipment, and the method comprises the steps: generating a high-dimensional joint feature matrix based on a sample APP library through the extraction and fusion of dynamic and static features, and generating a detection recognition model through the multi-model training and fusion according to the high-dimensional joint feature matrix. And reasoning and classifying the suspected fraud-related APPs according to the detection and recognition model and the dynamic and static feature vectors, and generating a fraud-related APP judgment result. According to the method, the high-dimensional joint feature matrix is constructed by fusing the dynamic and static features, the limitation of insufficient single feature dimension is overcome, the behavior characteristics of the fraud-related APP are comprehensively described, an XGBoost and LSTM fusion model is adopted, structural features and a time sequence mode are considered, the detection accuracy and generalization ability are improved through vector splicing and secondary training, and the detection efficiency is improved. And an automatic assembly line from feature extraction to model reasoning is constructed, so that full-process closed-loop processing of fraud-related APP judgment is realized, and the detection efficiency and the systematization level are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of computer application technology, and in particular to a method, apparatus and equipment for detecting fraudulent apps based on multimodal features and fusion models. Background Technology

[0002] Currently, mobile internet applications have become the core vehicle for telecommunications fraud to transmit false information and steal funds from victims. Therefore, accurate detection and efficient interception of fraudulent apps have become a crucial link in curbing telecommunications fraud at its source. However, with the continuous evolution of fraud techniques, criminals commonly employ various covert technologies such as app hardening and shielding, dynamic loading, encrypted proxies, and disguised communication protocols to evade security detection. This poses a severe challenge to identification methods relying on single-dimensional features, urgently requiring a new approach to detection and identification capable of addressing emerging threats.

[0003] To address these challenges, existing detection technologies are mainly categorized into static and dynamic methods. Static detection involves decompiling the app's installation package to extract static features such as hard-coded domain names and IP addresses from its source code and configuration files, and then matching them against a known database of fraudulent samples. Dynamic detection, on the other hand, involves running the app in a sandbox environment and monitoring its network traffic and system behavior to analyze and extract dynamic features such as communication nodes and data packet sequences exposed during runtime. However, both traditional methods have significant limitations: static detection struggles to effectively detect apps that hide their communication features through techniques like obfuscation and dynamic loading, leading to feature extraction failures; dynamic detection is ineffective against apps that use high-strength encryption protocols or proxy techniques to hide their real traffic, rendering behavioral analysis ineffective. Furthermore, both methods heavily rely on the coverage and timeliness of fraudulent blacklists. When facing rapidly evolving and newly emerging fraudulent apps, the lag in database updates can easily result in missed detections.

[0004] Therefore, how to effectively integrate dynamic and static features to construct a more comprehensive behavioral profile, and introduce advanced machine learning models to reduce the dependence on fixed sample libraries, so as to achieve accurate identification of fraudulent apps that are more concealed and mutate faster, has become a core technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] This application provides a method for detecting fraudulent apps based on multimodal features and a fusion model, characterized by comprising: Based on the sample APP library, a high-dimensional joint feature matrix is ​​generated by extracting and fusing dynamic and static features; Based on the high-dimensional joint feature matrix, a detection and recognition model is generated through multi-model training and fusion. Based on the detection and identification model and dynamic and static feature vectors, suspected fraudulent apps are inferred and classified, and fraudulent app determination results are generated.

[0006] Optionally, the step of generating a high-dimensional joint feature matrix based on the sample APP library through the extraction and fusion of dynamic and static features includes: Based on the sample APP library, static analysis of the APP installation package is performed by using black samples and white samples in the sample library, and the source code, configuration files and resource files are parsed to obtain the static features of the APP. By installing and executing the sample app in a sandbox environment, user behavior is simulated and the network traffic generated is monitored to obtain the dynamic network behavior characteristics of the app. Based on the static features and dynamic network behavior features, a high-dimensional joint feature matrix for model training is generated through feature fusion methods.

[0007] Optionally, the step of generating a detection and recognition model based on a high-dimensional joint feature matrix through multi-model training and fusion includes: Based on the structured features in the feature library, the XGBoost model is trained to boost the decision tree and obtain the feature contribution vector. Based on the temporal features in the feature library, the hidden state representation of the sequence data by the LSTM model is obtained by training the LSTM model. Based on the generated feature contribution vector and hidden state representation, a fused detection and recognition model is generated through vector concatenation and secondary model training.

[0008] Optionally, the step of reasoning and classifying suspected fraudulent apps based on the detection and identification model and dynamic and static feature vectors to generate a fraudulent app determination result includes: For suspected fraudulent apps to be detected, static and dynamic extraction are performed to obtain the static and dynamic features of the suspected fraudulent apps; Based on the dynamic and static characteristics of suspected fraudulent apps, feature vectors of suspected fraudulent apps are generated through a feature fusion process. Based on the feature vectors of suspected fraudulent apps, the data is input into a pre-trained detection and identification model for reasoning and classification, generating the final determination result of whether an app is fraudulent.

[0009] Optionally, the step of generating a high-dimensional joint feature matrix for model training based on the static features and dynamic network behavior features using a feature fusion method includes: Based on the feature set such as domain name, IP, URL, and signature obtained from static extraction, static feature vectors are obtained through numerical and standardization processing. Based on the dynamically extracted set of network behavior features such as data packet length, number of packets, and arrival time interval, a dynamic feature vector is obtained through serialization and statistical feature extraction. Based on the static and dynamic feature vectors, a high-dimensional joint feature matrix that integrates static and dynamic information is generated through vector concatenation, where each row represents the feature vector of a sample APP.

[0010] Optionally, the step of generating a fused detection and recognition model based on the generated feature contribution vector and hidden state representation through vector concatenation and secondary model training includes: Based on the training of the XGBoost model on structured features, the feature contribution vector representing the importance of each feature is obtained by analyzing the internal decision-making process of the model. Based on the processing of temporal features by the LSTM model, the hidden state representation of the long-term dependency of the sequence data is obtained by reading the output of the LSTM hidden layer at the last time step. Based on the feature contribution vector and the hidden state representation, a fusion feature vector that integrates static importance and dynamic temporal sequence is formed through vector concatenation operation; By using the fused feature vector as input to perform secondary training on a fully connected layer classifier, a detection and recognition model that combines the advantages of XGBoost and LSTM is generated.

[0011] Optionally, the step of generating a feature vector for a suspected fraudulent app based on its dynamic and static features through a feature fusion process includes: Based on the suspected fraudulent apps to be detected, a set of static features is obtained through static analysis methods; By installing and executing the same suspected fraudulent app in a sandbox environment and monitoring the network traffic generated during its runtime, a set of dynamic network behavior characteristics can be obtained. Based on the obtained static feature set and dynamic network behavior feature set, standardized dynamic and static feature vectors of suspected fraudulent apps are generated through feature processing and vectorization processes that are completely consistent with the training phase.

[0012] This application also provides a fraud-related APP detection device based on multimodal features and a fusion model, characterized in that the device comprises: The feature processing module is used to generate a high-dimensional joint feature matrix based on the sample APP library by extracting and fusing dynamic and static features; The model training module is used to generate a detection and recognition model by training and fusing multiple models based on a high-dimensional joint feature matrix. The detection and identification module is used to reason and classify suspected fraudulent apps based on the detection and identification model and dynamic and static feature vectors, and generate a judgment result of fraudulent apps.

[0013] Optionally, the model training module further includes: The structured feature modeling module is used to obtain the feature contribution vector by training an XGBoost model based on the structured features in the high-dimensional joint feature matrix. The temporal feature modeling module is used to obtain the hidden state representation of the sequence data by training an LSTM model based on the temporal features in the high-dimensional joint feature matrix. The model fusion module is used to generate a fused detection and recognition model by vector concatenation and secondary training based on the feature contribution vector and the hidden state representation.

[0014] This application also provides an electronic device, characterized in that it is used to implement any of the aforementioned methods for detecting fraudulent apps based on multimodal features and fusion models, comprising: The processor is used to perform all computational tasks and implement a method for detecting fraudulent apps based on multimodal features and fusion models. Memory is used to store processor-executable instructions and statically stored data.

[0015] The beneficial effects of this application are as follows: By combining static decompilation and dynamic sandbox behavior simulation based on black sample and white sample libraries, static attributes such as domain name, IP, and URL are extracted and fused with dynamic network behavior features such as data packet sequence and load to generate a high-dimensional joint feature matrix. This solves the limitation of insufficient single feature dimension and achieves a comprehensive characterization of multi-dimensional and deep-level behavioral features of fraudulent APPs. Furthermore, by constructing a detection model that integrates XGBoost and LSTM, XGBoost is used to efficiently process structured features and output feature contribution, while LSTM is used to capture network traffic temporal patterns and long-term dependencies. Finally, the advantages of both are deeply integrated through vector concatenation and secondary training, solving the blind spots of single model detection and achieving a significant improvement in detection accuracy and generalization ability. Moreover, by constructing an automated pipeline from data collection, feature processing, model training to detection and recognition, dynamic and static feature extraction, fusion, and model inference are performed on suspected APPs in a manner consistent with the training phase, realizing full-process automation and efficient closed-loop from feature construction to fraud determination. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings required in the description of the embodiments or the prior art are briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0017] Figure 1 A flowchart illustrating a specific embodiment of the fraud-related APP detection method based on multimodal features and fusion models according to this application is shown. Figure 2 This paper illustrates the architecture of a fraud-related app detection method based on multimodal features and a fusion model according to a specific embodiment of this application. Figure 3 This diagram illustrates a block diagram of a fraud-related app detection device based on multimodal features and a fusion model, according to a specific embodiment of this application. Detailed Implementation

[0018] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0019] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0020] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0021] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0022] This application proposes a method for detecting fraudulent apps based on multimodal features and a fusion model, addressing the low detection accuracy and weak generalization ability of existing technologies that rely on single features or models. First, this application extracts the app's code and configuration features through static analysis, and then captures its runtime network behavior sequence features using dynamic sandbox monitoring. Feature fusion is then used to construct a high-dimensional joint feature matrix that comprehensively describes the app's behavior. Furthermore, a collaborative training and fusion mechanism between XGBoost and Long Short-Term Memory (LSTM) networks is designed. The XGBoost model is responsible for learning the contribution of structured features such as domain names and IP addresses, while the LSTM model is responsible for mining deep patterns of dynamic features such as packet arrival times. By concatenating the feature contribution vector output by XGBoost with the hidden state representation of LSTM and performing secondary training, a complementary fusion detection model is generated. The proposed method can effectively identify disguised and mutated fraudulent apps. While maintaining a low false positive rate, its detection accuracy and generalization ability are significantly better than traditional schemes based on single features or models, providing reliable technical support for efficient proactive prevention and control of fraudulent apps.

[0023] Example 1 like Figure 1 The diagram shown is a flowchart of a method for detecting fraudulent apps based on multimodal features and a fusion model, according to an embodiment of this application. The method specifically includes the following: S100, based on a sample APP library, generates a high-dimensional joint feature matrix through the extraction and fusion of dynamic and static features.

[0024] Specifically, based on the different attributes exposed by fraudulent apps at the code level and runtime network behavior level, a dual-source feature acquisition model combining static code and dynamic traffic is established. The static feature extraction process requires decompiling and deep analysis of the application installation packages in the sample library, systematically scanning their source code, manifest files, and resource components to extract a set of inherent static attributes, including certificate signatures, hard-coded domain names, preset IP addresses, interface URLs, and associated cloud service platforms. The dynamic feature extraction process requires installing and automatically running sample applications in a controlled sandbox environment, simulating real user interactions to activate their network communication behavior, and capturing temporal behavioral features such as network protocols, packet load, connection duration, transmission frequency, and packet size sequences generated during runtime through underlying traffic monitoring. Finally, a feature fusion method is used to align and concatenate the static attribute sets extracted from different dimensions with the dynamic behavior sequences, constructing a joint feature matrix that comprehensively describes the application's intrinsic attributes and extrinsic behavior, providing a high-dimensional data foundation for subsequent model training.

[0025] S200 generates a detection and recognition model based on a high-dimensional joint feature matrix through multi-model training and fusion.

[0026] Specifically, based on the structured attributes and temporal behavior patterns inherent in the joint feature matrix, a framework for heterogeneous model collaborative training and knowledge fusion is constructed. First, an XGBoost gradient boosting decision tree model is deployed, whose training objective focuses on processing static and non-temporally structured features in the feature matrix. Through its internal multi-round decision tree construction and optimization process, it learns the contribution of different features to the classification result and outputs a quantified feature importance vector. In parallel, a Long Short-Term Memory (LSTM) network model is deployed, whose training objective focuses on processing the dynamic network behavior temporal features in the feature matrix. It utilizes its unique gating mechanism to model variable-length sequence data to capture long-term dependencies such as packet arrival intervals and session cycle changes, and ultimately uses its hidden state as the dynamic behavior representation of the entire sequence. In the model fusion stage, the static feature contribution vector generated by XGBoost and the dynamic behavior hidden state representation generated by LSTM are concatenated to form a novel joint feature vector that integrates static saliency and dynamic temporality. This vector is then used to train the downstream classifier a second time, thereby generating a fusion detection model that combines the advantages of both models and has stronger discriminative capabilities.

[0027] S300 uses the detection and identification model and dynamic and static feature vectors to reason and classify suspected fraudulent apps, generating a fraudulent app determination result.

[0028] Specifically, based on the trained fusion detection model, an automated detection and classification pipeline for applications with unknown attributes is constructed. The pipeline applies the same feature acquisition procedure to suspected fraudulent applications as during the training phase. First, a static analysis engine parses the installation package file, extracting a set of static attributes identical to those in the training set. Then, the application is executed in a dynamic sandbox environment, triggering its network activity and monitoring and capturing the network behavior sequences generated during runtime. Subsequently, the feature processing engine standardizes and vectorizes the collected static and dynamic features according to a predefined process, and generates a standardized feature vector for the suspected application using the same feature fusion strategy. Finally, the detection inference engine inputs this feature vector into the loaded fusion detection model. Through its internal multi-layered calculations and logical judgments, the model outputs a classification probability value or binary classification result regarding whether the application is a fraudulent app, thus completing a fully automated, closed-loop detection and identification process from the initial application to the final security determination.

[0029] In summary, this application breaks through the traditional detection paradigm that relies on a single feature or model, and constructs a detection framework based on deep fusion of dynamic and static features. By systematically extracting static code features such as certificates, domain names, and IP addresses from the application installation package, and aligning and concatenating them with dynamic behavioral features such as network protocols, data traffic, and session timing captured in the sandbox environment, a high-dimensional joint feature matrix that can comprehensively characterize application behavior is generated. This dual-source feature fusion method overcomes the limitation of incomplete information from a single feature dimension, utilizing both the stability and prior knowledge of static features and capturing the real-time and covert nature of dynamic behavioral features, laying a solid data foundation for high-precision detection. Secondly, to address the effective utilization of heterogeneous features and model performance bottlenecks, a heterogeneous model fusion architecture combining XGBoost and LSTM is designed. This architecture fully leverages the advantages of XGBoost in processing structured static features, quantifying the discriminative contribution of each feature; at the same time, it utilizes the expertise of LSTM in mining temporal dynamic features to capture long-term dependency patterns in network behavior. Finally, by concatenating and retraining the output vectors of both, knowledge fusion of static saliency and dynamic temporality is achieved. This collaborative mechanism effectively solves the detection blind spots inherent in single models, resulting in a final fusion detection model that significantly outperforms traditional single models in both accuracy and generalization ability. Finally, a fully automated detection pipeline was constructed, encompassing feature extraction, model inference, and result determination. This pipeline implements a completely consistent dynamic and static feature collection, standardization, and fusion process for suspected fraudulent apps, ensuring consistency in the feature space. The generated feature vectors are then input into the fusion model for end-to-end inference and classification. This closed-loop design transforms the traditional fragmented analysis process, reliant on security expert experience, into an efficient and standardized automated workflow. This significantly improves the detection efficiency and response speed of fraudulent apps in large-scale environments, providing reliable technical support for building a proactive and intelligent mobile application security defense system.

[0030] As an optional implementation of this application, optionally, in step S100, based on the sample APP library, a high-dimensional joint feature matrix is ​​generated by extracting and fusing dynamic and static features, including: 110. Based on the sample APP library, static analysis of the APP installation package is performed using black and white samples in the sample library, and the source code, configuration files and resource files are parsed to obtain the static features of the APP.

[0031] Specifically, such as Figure 2As shown, after receiving the installation package file from the sample APP library, the static feature extraction module initiates a deep static parsing process to deconstruct the application's composition structure and extract its inherent attribute features. This process unpacks and decompiles installation packages in APK or IPA formats, restoring them to readable source code files, resource configuration files, and application manifest files. The feature extraction engine then systematically scans these files according to predefined feature categories. At the source code level, it identifies hard-coded network address information, including domain names, IP addresses, and interface URLs, through syntax analysis and pattern matching. At the manifest file level, it parses declared permission requests, component export status, and certificate signing information. At the resource file level, it extracts feature metadata such as icon hashes and string constants that can be used for identity recognition. The core of the parsing process lies in establishing a mapping between the application's static attributes and its potential behavioral intentions. By classifying and indexing feature elements scattered across different files, a structured static feature set is formed. This code-level static analysis method effectively captures the configuration features exposed by the application in its non-running state, providing fundamental feature input for subsequent fusion detection. After feature extraction is completed, the system normalizes and vectorizes the original feature values, converts string-type features such as domain names into numerical features, and eliminates the differences between different feature scales through standardization, ultimately generating a standardized static feature vector suitable for training machine learning models.

[0032] 120. By installing and executing the sample APP in a sandbox environment, user behavior is simulated and the network traffic generated is monitored to obtain the dynamic network behavior characteristics of the APP.

[0033] Specifically, such as Figure 2As shown, after deploying a sample app in an isolated sandbox environment, the dynamic behavior monitoring module initiates a multi-stage automated interaction and network traffic capture process to record the application's runtime behavior. The process begins with the automatic installation of the target application in a controlled virtual environment. It then simulates the core operation sequences of a real user through preset interaction scripts, including key behavioral scenarios such as application startup, interface clicks, account login, and data submission. During application execution, the network traffic monitoring component captures all generated network packets at the system's underlying layer and extracts multi-dimensional network behavior features using deep packet inspection (DPI) technology. These features include connection-level protocol type, target port, and session duration; packet-level payload content, packet size distribution, and transmission direction; and timing-level features such as packet arrival interval and burst traffic patterns. The key to the monitoring process is establishing a causal relationship between user interaction behavior and network communication activities. Timing alignment ensures that the captured network features accurately reflect the application's true behavioral intent triggered by specific operations. This dynamic feature extraction method based on runtime behavior can effectively identify malicious behavior patterns that only surface under specific conditions, especially threats that evade static detection through code obfuscation and other means. After capturing the raw traffic, the system performs feature engineering on the network data, segments and statistically analyzes the continuous traffic data by session, extracts statistical features such as frequency, mean, and variance, and performs feature hashing on the payload content to finally generate feature vectors that characterize the dynamic behavior of the application.

[0034] 130. Based on the static features and dynamic network behavior features, a high-dimensional joint feature matrix for model training is generated through a feature fusion method.

[0035] Specifically, such as Figure 2As shown, after receiving feature vectors from the static and dynamic analysis pipelines, the feature fusion module initiates a multi-source feature alignment and integration process to construct a joint feature representation that comprehensively describes the application's behavior. This process begins with a data preprocessing stage of the two feature sources, ensuring that the static and dynamic feature vectors are fully aligned in the sample dimension; that is, each application sample simultaneously possesses its corresponding static and dynamic feature sub-vectors. At the feature level, the system performs dimensionality checks and integrity verification on the static feature sub-vectors to ensure the complete extraction of key static attributes, including domain name, IP address, URL, and signature. Simultaneously, it performs quality assessment on the dynamic feature sub-vectors to ensure the accurate capture of network behavior features such as packet length, packet count, and arrival time interval. The core of the fusion process lies in merging feature vectors from two different sources but describing the same entity in the feature dimension through vector concatenation operations, forming a high-dimensional feature vector containing both static and dynamic information. This fusion strategy based on feature space expansion effectively overcomes the limitations of a single feature source, enabling the final feature representation to simultaneously include the application's inherent attributes and runtime behavioral characteristics, providing a richer and more comprehensive feature foundation for subsequent model training. After concatenating the feature vectors of a single sample, the system organizes all the sample feature vectors by row to construct a sample-feature two-dimensional matrix, where each row represents a complete feature description of an application and each column represents a specific feature dimension, ultimately generating a high-dimensional joint feature matrix for model training.

[0036] As an optional implementation of this application, optionally, in step S100, a detection and recognition model is generated based on the high-dimensional joint feature matrix through multi-model training and fusion, including: 210. Based on the structured features in the feature library, the XGBoost model is trained to gradient boost the decision tree to obtain the feature contribution vector.

[0037] Specifically, such as Figure 2As shown, after receiving structured feature data from the feature library, the XGBoost model training module initiates an ensemble learning process based on gradient boosting decision trees to model the non-linear relationship between features and classification targets. The process begins by partitioning the input feature matrix into training and validation sets, and initializing the parameters of the base learner. During model training, XGBoost constructs a sequence of decision trees through multiple iterations. The goal of each new tree is to fit the residual of the previous prediction result. This progressive optimization strategy continuously improves the model's prediction accuracy. The key to the training process lies in quantifying the contribution of each feature to the final classification decision by analyzing the frequency with which each feature is used for node splitting and the resulting gain changes during the model's internal decision-making process. Specifically, the system calculates the total gain value of each feature as a splitting node across all decision trees and normalizes these gain values ​​to obtain a numerical vector representing the relative importance of each feature. This feature contribution-based quantification method effectively identifies the key features most discriminative in distinguishing between fraudulent and legitimate apps, providing a filtered and weighted feature representation for subsequent model fusion. After the model training is completed, the system not only obtains an XGBoost classifier that can be used for prediction, but also obtains a contribution vector describing the importance of features. This vector will be used as a refined representation of static feature information and input into the subsequent fusion model.

[0038] 220. Based on the temporal features in the feature library, the hidden state representation of the sequence data by the LSTM model is obtained by training the LSTM model.

[0039] Specifically, such as Figure 2As shown, after receiving temporal feature data from the feature library, the LSTM model training module initiates a sequence modeling process based on a Long Short-Term Memory (LSTM) network to capture temporal dependency patterns in dynamic network behavior. The process begins with preprocessing the input temporal data, sequentially organizing the network behavior records of each application according to time steps to form sequence samples that can be processed by a recurrent neural network. During model training, the LSTM network uses its unique gating mechanism (input gate, forget gate, output gate) to control the flow of information and the updating of memory, enabling it to effectively learn long-term temporal dependencies. The core of the training process lies in progressively processing the input sequence through multiple layers of LSTM units, receiving the network behavior features (such as packet size, arrival interval, etc.) at each time step, and updating its internal cell states and hidden states. After processing the entire sequence, the system reads the hidden state output of the final layer of the LSTM at the last time step, using it as a compact and information-rich vector representation of the entire input sequence. This LSTM-based sequence encoding method can effectively capture complex temporal patterns in network behavior, such as periodic access and burst traffic, which are often key indicators for identifying the behavioral characteristics of fraudulent apps. After model training is completed, the system obtains an LSTM encoder that can encode variable-length behavioral sequences into fixed-dimensional vectors. The hidden state representations output by the encoder will be used as the deep representation of dynamic features for subsequent model fusion stages.

[0040] 230. Based on the generated feature contribution vector and hidden state representation, a fused detection and recognition model is generated through vector concatenation and secondary model training.

[0041] Specifically, such as Figure 2As shown, after receiving the feature contribution vector from the XGBoost model and the hidden state representation from the LSTM model, the model fusion module initiates a heterogeneous model knowledge integration process to build a more powerful fusion detection system. This process begins with dimensional alignment and normalization of the two input vectors to ensure they are within the same numerical scale for effective vector-level fusion. During the fusion phase, the system concatenates the feature contribution vector and the hidden state representation along the feature dimension, forming a joint feature vector that simultaneously contains static feature importance and dynamic temporal patterns. The core of the fusion process lies in achieving a complementary combination of XGBoost's advantages in structured feature processing and LSTM's advantages in sequence pattern recognition through this cross-model feature combination. The concatenated fusion feature vector is then input into a newly initialized fully connected neural network classifier for secondary training. This classifier learns how to optimally combine and weight the information provided by the two source models, ultimately generating a fusion detection model with overall performance superior to either single model. This hybrid architecture, based on feature-level fusion and model-level retraining, effectively enhances the detection system's adaptability to diverse fraud patterns while improving the model's generalization performance in the face of novel and evolving threats. After secondary training, the system obtains a final detection and recognition model that integrates dynamic and static feature analysis with the advantages of multiple models. This model will be deployed for practical fraud-related app detection tasks.

[0042] As an optional implementation of this application, optionally, in step S100, the suspected fraudulent APP is inferred and classified based on the detection and identification model and dynamic and static feature vectors to generate a fraudulent APP determination result, including: 310. For suspected fraudulent apps to be detected, perform static and dynamic extraction to obtain the static and dynamic features of the suspected fraudulent apps.

[0043] Specifically, such as Figure 2As shown, after receiving a suspected fraudulent APP installation package, the detection feature extraction module initiates a dual-channel feature acquisition process identical to the training phase to obtain comprehensive behavioral features of the application. This process performs two independent feature extraction tasks in parallel: static analysis and dynamic monitoring. In the static analysis channel, the system unpacks and decompiles the APP installation package, scanning the source code for hard-coded network addresses, parsing permission declarations and signature information in configuration files, and analyzing static attributes such as constant strings in resource files, according to predefined feature extraction rules. In the dynamic monitoring channel, the system installs and runs the target APP in an isolated sandbox environment, triggering its core functions through automated interactive scripts while simultaneously monitoring underlying network traffic and capturing runtime behavioral data including protocol type, target domain name, packet size sequence, and transmission timing characteristics. The key to the feature extraction process is ensuring consistency between the detection and training phases in feature extraction methods and content. This means using the same static parsing tools, the same dynamic interactive scripts, and the same network traffic parsing rules to ensure that the extracted features have the same semantic and distribution characteristics as the training data. This strict consistency requirement is a fundamental prerequisite for ensuring that the trained detection model maintains performance in practical applications. After feature extraction is completed, the system obtains a set of static features and a set of dynamic network behavior features for the suspected app. These two feature sets will be used as input data for subsequent feature fusion and model inference.

[0044] 320. Based on the dynamic and static characteristics of suspected fraudulent apps, a feature vector of the suspected fraudulent app is generated through a feature fusion process.

[0045] Specifically, such as Figure 2As shown, after receiving feature data from the static and dynamic analysis pipelines, the detection feature fusion module initiates a standardized feature engineering process to construct input feature vectors suitable for the trained detection model. This process strictly follows the feature processing specifications established during the training phase, including four key steps: feature cleaning, numerical conversion, standardization, and vector concatenation. In the feature cleaning phase, the system checks and processes missing and outlier values ​​to ensure the integrity of the feature data. In the numerical conversion phase, character-based features such as domain names and URLs are converted into numerical features using the same encoding dictionary. In the standardization phase, the mean-variance parameters calculated during training are used to standardize the feature values, eliminating feature scale differences. The core of the fusion process lies in completely replicating the feature processing pipeline during training to ensure that the feature representations of the detection samples are distributed in the same feature space as the training samples. After completing the independent processing of each feature, the system concatenates the static and dynamic feature sub-vectors according to the feature order and dimensions determined during training, generating a complete multimodal feature vector. This feature fusion strategy, which strictly adheres to the processing specifications during training, effectively avoids model performance degradation caused by feature distribution shifts, providing reliable feature input for subsequent accurate classification. The resulting standardized dynamic and static feature vectors will be used as input to the detection and recognition model for the final fraud determination.

[0046] 330. Based on the feature vectors of suspected fraudulent apps, the data is input into a pre-trained detection and identification model for reasoning and classification, generating the final determination result of whether an app is suspected of being fraudulent.

[0047] Specifically, such as Figure 2As shown, after receiving the standardized feature vector, the detection inference module initiates a multi-layered forward computation and decision-making process to perform the final determination of the fraudulent attribute. This process begins with the integrity verification and format conversion of the input feature vector, ensuring that its dimension, numerical range, and data format are completely consistent with those used in the training phase, and converting it into a high-dimensional tensor format that can be processed by the deep learning framework. In the model inference phase, the system inputs the feature tensor into the loaded fusion detection model. First, it processes the structured feature portion of the feature vector through its internal XGBoost derivative path, calculating the weighted contribution of each feature. Simultaneously, it processes the temporal feature portion through the LSTM derivative path, performing deep matching calculations for sequence patterns. The core of the inference process lies in the collaborative computation mechanism between the layers within the fusion model. The fully connected layer receives the fused representations from the two paths, performs nonlinear transformations through activation functions, and finally generates a numerical vector representing the classification probability at the output layer. After probability calculation, the system enters the decision analysis stage. This stage binarizes the probability values ​​output by the model based on a preset judgment threshold. When the probability value of a fraudulent category exceeds the set critical threshold, the system marks the application as a fraudulent app; otherwise, it marks it as a legitimate application. This threshold judgment mechanism is established based on performance tuning on the validation set during the training phase, ensuring an optimal balance between accuracy and recall in the classification decision. The computational path of the entire inference process completely replicates the forward propagation trajectory during model training, ensuring consistency between the detection logic and the training objective. After completing the initial judgment, the system also generates a corresponding confidence score, which is directly derived from the relative distance between the model's output probability value and the judgment threshold, providing a priority reference for subsequent manual review. Finally, the system packages the judgment result, its confidence score, key feature evidence, and other information into a structured detection report, completing a fully automated processing flow from the original application to security judgment. This inference mechanism based on a fusion model effectively utilizes the complex feature patterns and decision boundaries learned during the training phase to achieve accurate identification and classification of new types of fraudulent apps.

[0048] Example 2 Based on the same principles as the aforementioned methods, a fraud-related app detection device based on multimodal features and a fusion model is also proposed, see [link to relevant documentation]. Figure 3 A fraud-related app detection device 100 based on multimodal features and a fusion model, according to an embodiment of this disclosure, includes: The feature processing module 110 is used to generate a high-dimensional joint feature matrix based on the sample APP library by extracting and fusing dynamic and static features; The model training module 120 is used to generate a detection and recognition model based on the high-dimensional joint feature matrix through multi-model training and fusion. The detection and identification module 130 is used to reason and classify suspected fraudulent apps based on the detection and identification model and dynamic and static feature vectors, and generate a judgment result of fraudulent apps.

[0049] Optionally, the model training module 120 further includes: The structured feature modeling module 121 is used to obtain the feature contribution vector by training an XGBoost model based on the structured features in the high-dimensional joint feature matrix. The temporal feature modeling module 122 is used to obtain the hidden state representation of the sequence data by training an LSTM model based on the temporal features in the high-dimensional joint feature matrix. The model fusion module 123 is used to generate a fused detection and recognition model by vector concatenation and secondary training based on the feature contribution vector and the hidden state representation.

[0050] Obviously, those skilled in the art should understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Therefore, this application is not limited to any specific hardware and software combination.

[0051] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0052] Example 3 Furthermore, this application proposes an electronic device characterized by comprising the following components for implementing any of the aforementioned methods for detecting fraudulent apps based on multimodal features and fusion models: The processor is used to perform all computational tasks and implement a method for detecting fraudulent apps based on multimodal features and fusion models. Memory is used to store processor-executable instructions and statically stored data.

[0053] The electronic device of this disclosure includes a processor and a memory for storing processor-executable instructions. The processor is configured to implement any of the aforementioned fraudulent app detection methods based on multimodal features and fusion models when executing the executable instructions.

[0054] It should be noted that the number of processors can be one or more. Furthermore, the electronic device in this embodiment may also include input devices and output devices. The processor, memory, input devices, and output devices can be connected via a bus or other means, without specific limitations herein.

[0055] The memory, serving as a computer-readable storage medium for automated fault handling and self-learning methods for modules, can be used to store software programs, computer-executable programs, and various modules, such as the program or module corresponding to the fraudulent APP detection method based on multimodal features and fusion models in this disclosure. The processor executes various functional applications and data processing of the electronic device by running the software programs or modules stored in the memory.

[0056] Input devices can be used to receive input digital numbers or signals. These signals can be key signals related to user settings and function control of the device / terminal / server. Output devices can include display devices such as screens.

[0057] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting fraudulent apps based on multimodal features and a fusion model, characterized in that, include: Based on the sample APP library, a high-dimensional joint feature matrix is ​​generated by extracting and fusing dynamic and static features; Based on the high-dimensional joint feature matrix, a detection and recognition model is generated through multi-model training and fusion. Based on the detection and identification model and dynamic and static feature vectors, suspected fraudulent apps are inferred and classified, and fraudulent app determination results are generated.

2. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 1, characterized in that, The method, based on a sample APP library, generates a high-dimensional joint feature matrix through the extraction and fusion of dynamic and static features, including: Based on the sample APP library, static analysis of the APP installation package is performed by using black samples and white samples in the sample library, and the source code, configuration files and resource files are parsed to obtain the static features of the APP. By installing and executing the sample app in a sandbox environment, user behavior is simulated and the network traffic generated is monitored to obtain the dynamic network behavior characteristics of the app. Based on the static features and dynamic network behavior features, a high-dimensional joint feature matrix for model training is generated through feature fusion methods.

3. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 1, characterized in that, The step of generating a detection and recognition model based on a high-dimensional joint feature matrix through multi-model training and fusion includes: Based on the structured features in the feature library, the XGBoost model is trained to boost the decision tree and obtain the feature contribution vector. Based on the temporal features in the feature library, the hidden state representation of the sequence data by the LSTM model is obtained by training the LSTM model. Based on the generated feature contribution vector and hidden state representation, a fused detection and recognition model is generated through vector concatenation and secondary model training.

4. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 1, characterized in that, The process of reasoning and classifying suspected fraudulent apps based on the detection and identification model and dynamic and static feature vectors, and generating a fraudulent app determination result, includes: For suspected fraudulent apps to be detected, static and dynamic extraction are performed to obtain the static and dynamic features of the suspected fraudulent apps; Based on the dynamic and static characteristics of suspected fraudulent apps, feature vectors of suspected fraudulent apps are generated through a feature fusion process. Based on the feature vectors of suspected fraudulent apps, the data is input into a pre-trained detection and identification model for reasoning and classification, generating the final determination result of whether an app is fraudulent.

5. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 2, characterized in that, The step of generating a high-dimensional joint feature matrix for model training based on the static features and dynamic network behavior features through a feature fusion method includes: Based on the feature set such as domain name, IP, URL, and signature obtained from static extraction, static feature vectors are obtained through numerical and standardization processing. Based on the dynamically extracted set of network behavior features such as data packet length, number of packets, and arrival time interval, a dynamic feature vector is obtained through serialization and statistical feature extraction. Based on the static and dynamic feature vectors, a high-dimensional joint feature matrix that integrates static and dynamic information is generated through vector concatenation operations, where each row represents the feature vector of a sample APP.

6. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 3, characterized in that, The step of generating a fused detection and recognition model based on the generated feature contribution vector and hidden state representation through vector concatenation and secondary model training includes: Based on the training of the XGBoost model on structured features, the feature contribution vector representing the importance of each feature is obtained by analyzing the internal decision-making process of the model. Based on the processing of temporal features by the LSTM model, the hidden state representation of the long-term dependency of the sequence data is obtained by reading the output of the LSTM hidden layer at the last time step. Based on the feature contribution vector and the hidden state representation, a fusion feature vector that integrates static importance and dynamic temporal sequence is formed through vector concatenation operation; By using the fused feature vector as input to perform secondary training on a fully connected layer classifier, a detection and recognition model that combines the advantages of XGBoost and LSTM is generated.

7. The method for detecting fraudulent apps based on multimodal features and fusion models as described in claim 4, characterized in that, The process of generating feature vectors for suspected fraudulent apps through a feature fusion procedure, based on their dynamic and static characteristics, includes: Based on the suspected fraudulent apps to be detected, a set of static features is obtained through static analysis methods; By installing and executing the same suspected fraudulent app in a sandbox environment and monitoring the network traffic generated during its runtime, a set of dynamic network behavior characteristics can be obtained. Based on the obtained static feature set and dynamic network behavior feature set, standardized dynamic and static feature vectors of suspected fraudulent apps are generated through feature processing and vectorization processes that are completely consistent with the training phase.

8. A device for detecting fraudulent apps based on multimodal features and a fusion model, characterized in that, The device includes: The feature processing module is used to generate a high-dimensional joint feature matrix based on the sample APP library by extracting and fusing dynamic and static features; The model training module is used to generate a detection and recognition model by training and fusing multiple models based on a high-dimensional joint feature matrix. The detection and identification module is used to reason and classify suspected fraudulent apps based on the detection and identification model and dynamic and static feature vectors, and generate a judgment result of fraudulent apps.

9. The fraud-related APP detection device based on multimodal features and fusion model according to claim 8, characterized in that, The model training module also includes: The structured feature modeling module is used to obtain the feature contribution vector by training an XGBoost model based on the structured features in the high-dimensional joint feature matrix. The temporal feature modeling module is used to obtain the hidden state representation of the sequence data by training an LSTM model based on the temporal features in the high-dimensional joint feature matrix. The model fusion module is used to generate a fused detection and recognition model by vector concatenation and secondary training based on the feature contribution vector and the hidden state representation.

10. An electronic device, characterized in that, The method for detecting fraudulent apps based on multimodal features and fusion models as described in any one of claims 1 to 7 includes: The processor is used to perform all computational tasks and implement a method for detecting fraudulent apps based on multimodal features and fusion models. Memory is used to store processor-executable instructions and statically stored data.

Images