Application similarity detection method and device, equipment, storage medium and program product

Abstract

The invention provides an application similarity detection method and device, equipment, a storage medium and a program product. The method comprises the steps that multi-dimensional feature data of multiple to-be-detected applications is obtained, the multi-dimensional feature data comprises a first calling feature and a second calling feature, the first calling feature is used for indicating and calling a calling feature of a software development kit, and the second calling feature is used for indicating and calling a calling feature of a key interface; performing structured processing on the multi-dimensional feature data to obtain structured feature data; and inputting the structured feature data into a preset similarity detection model to output application similarity detection results of the plurality of to-be-detected applications. The application similarity detection efficiency is improved, and meanwhile the application similarity detection accuracy is guaranteed.

Description

Technical Field

[0001] This application relates to the field of similarity analysis technology, and in particular to an application similarity detection method, apparatus, equipment, storage medium, and program product. Background Technology

[0002] With the rapid development of the mobile internet, the number of applications has grown exponentially, playing a central role in users' daily lives. The booming application market has also made the need for similarity analysis in application security auditing increasingly urgent.

[0003] Currently, application similarity analysis mainly relies on manual line-by-line code review and analysis of call relationships.

[0004] However, existing technologies are characterized by high labor costs and low efficiency, making them unsuitable for the rapid testing needs of large-scale applications. Summary of the Invention

[0005] This application provides application similarity detection methods, apparatus, devices, storage media, and program products to improve the efficiency of application similarity detection.

[0006] Firstly, this application provides an application similarity detection method, including:

[0007] Acquire multidimensional feature data of multiple applications to be detected, wherein the multidimensional feature data includes a first call feature and a second call feature, wherein the first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface;

[0008] The multidimensional feature data is subjected to structured processing to obtain structured feature data;

[0009] The structured feature data is input into a preset similarity detection model to output the application similarity detection results of the multiple applications to be detected.

[0010] In one possible implementation, the multidimensional feature data further includes: metadata features; correspondingly, obtaining the multidimensional feature data of multiple applications to be detected includes: obtaining resource files of multiple applications to be detected, wherein the resource files include application manifest configuration files; performing distribution statistics on the resource files to obtain resource file features; parsing the application manifest configuration files to obtain application information features, wherein the application information features include multiple features among application basic information features, component list features, and permission declaration features; obtaining metadata features based on the resource file features and the application information features; performing static analysis on the multiple applications to be detected to obtain a complete method call graph of the multiple applications to be detected; generating a first call feature based on the complete method call graph; obtaining a list of key interfaces of the multiple applications to be detected; generating a second call feature based on the list of key interfaces and the complete method call graph; and determining the multidimensional feature data of the multiple applications to be detected based on the metadata features, the first call feature, and the second call feature.

[0011] In one possible implementation, the step of performing distribution statistics on the resource files to obtain resource file characteristics includes: calculating the proportion of the number of files of each file type in the resource files to the total number of files in the resource files, to obtain type distribution characteristics; calculating the proportion of the number of files in the resource files in multiple preset size ranges to the total number of files in the resource files, to obtain size distribution characteristics; and obtaining resource file characteristics based on the type distribution characteristics and the size distribution characteristics.

[0012] In one possible implementation, generating the first call feature based on the complete method call graph includes: obtaining a set of characteristic methods from a software development kit; identifying one or more characteristic method call subgraphs from the complete method call graph based on the set of characteristic methods; obtaining a caller set based on the one or more characteristic method call subgraphs; performing call behavior feature analysis on the caller set to obtain call frequency features and call distribution features; and generating the first call feature based on the call frequency features and call distribution features.

[0013] In one possible implementation, the complete method call graph includes a set of method nodes and a set of method call edges, wherein each method node in the set of method nodes represents a method, and the starting node of each method call edge in the set of method call edges represents the caller, and the ending node represents the callee. Accordingly, identifying one or more characteristic method call subgraphs from the complete method call graph based on the characteristic method set includes: traversing the characteristic methods in the set of characteristic methods, and performing the following steps for each traversed characteristic method to obtain one or more characteristic method call subgraphs: determining the corresponding method node from the set of method nodes based on the characteristic method; filtering out method call edges from the set of method call edges whose ending node is the corresponding method node to obtain a set of sub-method call edges; determining the sub-method node set based on the starting node and the corresponding method node in the set of sub-method call edges; and determining the characteristic method call subgraph based on the set of sub-method node sets and the set of sub-method call edges.

[0014] In one possible implementation, obtaining the caller set based on the one or more feature method call subgraphs includes: extracting callers from the set of sub-method call edges of the one or more feature method call subgraphs to obtain the caller set.

[0015] In one possible implementation, the step of performing call behavior feature analysis on the caller set to obtain call frequency features and call distribution features includes: counting the frequency of each caller in the caller set calling different feature methods to obtain a first frequency feature; counting the total frequency of each feature method in the feature method set being called by all callers in the caller set to obtain a second frequency feature; obtaining the call frequency feature based on the first frequency feature and the second frequency feature; obtaining the functional module and level to which each caller in the caller set belongs to obtain a first distribution feature; identifying callers in the caller set who call the same feature method to obtain a second distribution feature; and obtaining the call distribution feature based on the first distribution feature and the second distribution feature.

[0016] In one possible implementation, generating the second call feature based on the list of key interfaces and the complete method call graph includes: traversing each key interface in the list of key interfaces, obtaining the call relationship within the predicted layer of each key interface through a bidirectional breadth-first search based on the complete method call graph; generating one or more interface call subgraphs based on the call relationship; and generating the second call feature based on the one or more interface call subgraphs.

[0017] In one possible implementation, the training steps of the preset similarity detection model include: acquiring full similarity analysis data of multiple pre-labeled applications, wherein the multiple applications are applications with similar or dissimilar application similarity; constructing thought chain reasoning prompts based on the full similarity analysis data; and training a preset initial large model based on the thought chain reasoning prompts to obtain the preset similarity detection model.

[0018] In one possible implementation, the full dataset for similarity analysis includes structured feature data, feature construction reasoning process, and similarity comparison results.

[0019] Secondly, this application provides an application similarity detection device, comprising:

[0020] The acquisition module is used to acquire multidimensional feature data of multiple applications to be detected, wherein the multidimensional feature data includes a first call feature and a second call feature, wherein the first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface;

[0021] The processing module is used to perform structured processing on the multidimensional feature data to obtain structured feature data;

[0022] The detection module is used to input the structured feature data into a preset similarity detection model to output the application similarity detection results of the multiple applications to be detected.

[0023] Thirdly, this application provides an application similarity detection device, including: a memory and a processor;

[0024] The memory stores computer-executed instructions;

[0025] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0026] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible embodiments of the first aspect.

[0027] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0028] The application similarity detection method, apparatus, device, storage medium, and program product provided in this application automate similarity determination by inputting structured feature data into a preset similarity detection model, replacing manual experience-based judgment. Multi-dimensional features are extracted from multi-dimensional data such as software development kit (SDK) calls and key interface calls to comprehensively characterize the application's similarity features. This improves the efficiency of application similarity detection while ensuring its accuracy. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0030] Figure 1 This is a schematic diagram illustrating an application scenario for the application similarity detection method provided in the embodiments of this application;

[0031] Figure 2 A flowchart illustrating an application similarity detection method provided in one embodiment of this application;

[0032] Figure 3 A schematic diagram illustrating another application similarity detection method provided in an embodiment of this application;

[0033] Figure 4 This is a schematic diagram of the application similarity detection device provided in the embodiments of this application;

[0034] Figure 5 This is a schematic diagram of the structure of the application similarity detection device provided in the embodiments of this application.

[0035] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] Currently, application similarity detection mainly relies on manual analysis. Manual analysis requires reviewing code line by line and sorting out calls, resulting in high labor costs and low efficiency, making it difficult to meet the rapid detection needs of large-scale applications.

[0038] Starting from the limitations of existing technologies, the inventors gradually constructed the technical solution of this application: recognizing the shortcomings of traditional methods relying on manual intervention, while also acknowledging the advantages of large models in natural language understanding and reasoning, they proposed inputting simple feature data of the application into a pre-defined similarity detection model. Through contextual learning and thought chain reasoning of the pre-defined similarity detection model, they replaced manual experience-based judgment, achieving automated similarity determination. Further identifying the limitations of single features, they proposed extracting multi-dimensional features from multi-dimensional data such as Software Development Kit (SDK) calls and key interface calls to comprehensively characterize the application's similarity features. This improves the efficiency of application similarity detection while ensuring its accuracy.

[0039] Figure 1 This is a schematic diagram illustrating an application scenario for the application similarity detection method provided in the embodiments of this application, such as... Figure 1 As shown, the scene is a computer device, including: a receiving device 101, a processor 102 and a display device 103.

[0040] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the application similarity detection method. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0041] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, and can acquire multi-dimensional feature data of multiple applications to be detected.

[0042] The processor 102 can process multidimensional feature data of multiple applications to be detected in order to determine the application similarity detection results of multiple applications to be detected.

[0043] The display device 103 can be used to display the application similarity detection results of the above-mentioned multiple applications to be detected.

[0044] The display device can also be a touch screen, used to receive user commands while displaying the above content, so as to achieve interaction with the user.

[0045] It should be understood that the aforementioned processor can be implemented by reading instructions from memory and executing those instructions, or it can be implemented through chip circuitry.

[0046] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0047] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0048] Figure 2 This is a flowchart illustrating an application similarity detection method provided in one embodiment of this application. The execution entity of this embodiment can be... Figure 1 The computer equipment shown is not specifically limited in this embodiment. Figure 2 As shown, the method includes:

[0049] S201: Obtain multi-dimensional feature data of multiple applications to be detected, wherein the multi-dimensional feature data includes a first call feature and a second call feature, wherein the first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface.

[0050] The interface is the Application Programming Interface (API).

[0051] Optionally, the multidimensional feature data may also include metadata features.

[0052] Accordingly, multidimensional feature data of multiple applications to be tested is obtained, including: obtaining resource files of multiple applications to be tested, wherein the resource files include application manifest configuration files; performing distribution statistics on the resource files to obtain resource file features; parsing the application manifest configuration files to obtain application information features, wherein the application information features include multiple features among application basic information features, component list features, and permission declaration features; obtaining metadata features based on resource file features and application information features; performing static analysis on multiple applications to be tested to obtain complete method call graphs of multiple applications to be tested; generating first call features based on the complete method call graphs; obtaining a list of key interfaces of multiple applications to be tested; generating second call features based on the list of key interfaces and the complete method call graphs; and determining multidimensional feature data of multiple applications to be tested based on metadata features, first call features, and second call features.

[0053] By refining the steps for acquiring multi-dimensional feature data, a comprehensive characterization of the application is achieved. The combination of metadata features, first call features, and second call features significantly enhances anti-obfuscation capabilities. Furthermore, the high similarity between the software development kit's call patterns and key interface call chains reduces false positive and false negative rates.

[0054] Optionally, resource files of multiple applications to be tested can be obtained, including: unpacking the Android application installation packages (Android Package Kit, APK) of multiple applications to be tested using a decompilation tool to obtain resource files of multiple applications to be tested.

[0055] Optionally, the resource file type can include images, text, and application manifest configuration files. Image formats can include Portable Network Graphics (PNG) and Joint Photographic Experts Group (JPG), etc.; text can include string resources and configuration text, etc.

[0056] Optionally, the resource files are statistically analyzed to obtain resource file characteristics, including: calculating the proportion of the number of files of each file type in the resource files to the total number of files in the resource files to obtain type distribution characteristics; calculating the proportion of the number of files in the resource files in multiple preset size ranges to the total number of files in the resource files to obtain size distribution characteristics; and obtaining resource file characteristics based on type distribution characteristics and size distribution characteristics.

[0057] By integrating type distribution features and size distribution features, resource file features are obtained. From the two core dimensions of type proportion and size distribution, the overall structural pattern of application resource files is accurately characterized, providing efficient support for comparing resource features between different applications. It can quickly determine the similarity or difference of application resource structures and significantly reduce the computational cost of subsequent analysis.

[0058] Optionally, the formula for representing the type distribution characteristics is:

[0059]

[0060] In the formula, T represents the type distribution characteristics; This represents the proportion of the number of files of the i-th file type out of the total number of resource files, where i ranges from 1 to k. satisfy .

[0061] Optionally, the formula for representing the size distribution characteristics is:

[0062]

[0063] In the formula, S represents the size distribution characteristic; This represents the proportion of files in the j-th size range to the total number of resource files, where j ranges from 1 to n. satisfy .

[0064] The formula for representing the large and small intervals is:

[0065]

[0066] In the formula, and The boundary value within the size range represents the file size numerical value.

[0067] Optionally, the formula for representing resource file characteristics is:

[0068]

[0069] In the formula, R represents the characteristics of resource files; R represents the set of resource files.

[0070] The formula for representing a set of resource files is:

[0071]

[0072] In the formula, m is the number of resource files; This represents the attribute data of the h-th resource file, where h ranges from 1 to m. The attribute data includes the file type and file size.

[0073] Optionally, the formula for representing the application information features is:

[0074]

[0075] In the formula, I represents application information features; C represents application basic information features; P represents component list features; and P represents permission declaration features.

[0076] The formula for representing the basic information features is as follows:

[0077]

[0078] In the formula, This represents the basic information of the e-th application, where the value of e ranges from 1 to p.

[0079] The formula for representing the component list feature is as follows:

[0080]

[0081] In the formula, Let f represent the list of the f-th component, where f takes values ​​from 1 to q.

[0082] The formula for representing the permission declaration feature is as follows:

[0083]

[0084] In the formula, This represents the g-th permission declaration, where g can range from 1 to r.

[0085] Optionally, the representation formula for metadata features is:

[0086]

[0087] In the formula, Represents metadata characteristics.

[0088] Optionally, static analysis is performed on multiple applications to be tested to obtain a complete method call graph of the multiple applications to be tested, including: using a preset code analysis framework to perform static analysis on multiple applications to be tested to obtain a complete method call graph of the multiple applications to be tested.

[0089] Optionally, the default code analysis framework can be the Soot code analysis framework.

[0090] Optionally, the complete method call graph can be represented as follows:

[0091]

[0092] In the formula, G represents the complete method call graph; V represents the set of method nodes; and E represents the set of method call edges. .

[0093] Optionally, the method node set can be represented by the following formula:

[0094]

[0095] In the formula, Represents a method node; each method node represents a method, and z is the number of nodes in the complete method call graph.

[0096] Optionally, the formula for representing method call edges in the method call edge set is:

[0097]

[0098] In the formula, Indicates the starting node; Indicates the endpoint node.

[0099] Optionally, a first call feature is generated based on the complete method call graph, including: obtaining a set of characteristic methods of the software development kit; identifying one or more characteristic method call subgraphs from the complete method call graph based on the set of characteristic methods; obtaining a set of callers based on the one or more characteristic method call subgraphs; performing call behavior feature analysis on the caller set to obtain call frequency features and call distribution features; and generating the first call feature based on the call frequency features and call distribution features.

[0100] By extracting call frequency and call distribution features from the complete method call graph, complex inter-method call relationships can be transformed into quantifiable and structured core features, providing efficient data support for subsequent application similarity analysis and improving the efficiency of application similarity detection.

[0101] Optionally, the feature method set can be represented by the following formula:

[0102]

[0103] In the formula, Represents a set of feature methods; Let y represent the y-th feature method; y takes values ​​from 1 to t.

[0104] Optionally, the representation formula for the feature method call subgraph is:

[0105]

[0106] In the formula, G' represents the feature method call subgraph; V' represents the set of sub-method nodes; and E' represents the set of sub-method call edges.

[0107] Optionally, the complete method call graph includes a set of method nodes and a set of method call edges. Each method node in the set of method nodes represents a method, and the starting node of each method call edge in the set of method call edges represents the caller, while the ending node represents the callee.

[0108] Accordingly, based on the set of characteristic methods, one or more characteristic method call subgraphs are identified from the complete method call graph, including: traversing the characteristic methods in the set of characteristic methods, and performing the following steps for each traversed characteristic method to obtain one or more characteristic method call subgraphs: determining the corresponding method node from the set of method nodes based on the characteristic method; filtering out method call edges from the set of method call edges whose endpoint node is the corresponding method node to obtain a set of sub-method call edges; determining the set of sub-method nodes based on the starting node and the corresponding method node in the set of sub-method call edges; and determining the characteristic method call subgraph based on the set of sub-method nodes and the set of sub-method call edges.

[0109] Optionally, obtaining a caller set based on one or more feature method call subgraphs includes: extracting callers from the set of sub-method call edges of one or more feature method call subgraphs to obtain the caller set.

[0110] Optionally, the caller set can be represented by the following formula:

[0111]

[0112] In the formula, Caller represents the set of callers.

[0113] Optionally, the caller set is subjected to call behavior characteristic analysis to obtain call frequency characteristics and call distribution characteristics, including: counting the frequency of each caller in the caller set calling different characteristic methods to obtain a first frequency characteristic; counting the total frequency of each characteristic method in the characteristic method set being called by all callers in the caller set to obtain a second frequency characteristic; obtaining the call frequency characteristics based on the first frequency characteristics and the second frequency characteristics; obtaining the functional module and level to which each caller in the caller set belongs to obtain a first distribution characteristic; identifying callers in the caller set who call the same characteristic method to obtain a second distribution characteristic; and obtaining the call distribution characteristics based on the first distribution characteristics and the second distribution characteristics.

[0114] By statistically analyzing the frequency of calls to different feature methods by callers and the total frequency of calls to each feature method, combined with the functional modules and hierarchical affiliation of callers and the identification of callers of the same feature method, scattered calling behaviors are transformed into accurate and comprehensive structured features. This not only fully depicts the intensity pattern and distribution logic of calling behaviors, but also provides high-quality data support for subsequent similarity detection applications, effectively improving detection efficiency and accuracy.

[0115] Optionally, based on the list of key interfaces and the complete method call graph, a second call feature is generated, including: traversing each key interface in the list of key interfaces, obtaining the call relationship within the predicted layer of each key interface through bidirectional breadth-first search based on the complete method call graph; generating one or more interface call subgraphs based on the call relationship; and generating the second call feature based on one or more interface call subgraphs.

[0116] By accurately capturing upstream and downstream call relationships within the predicted layers of key interfaces through bidirectional breadth-first search, irrelevant nodes and links are effectively filtered out. Based on these call relationships, an interface call subgraph is generated, transforming complex global call logic into local structured features that focus on key interfaces. This provides accurate data support for application similarity detection and significantly improves the efficiency of similarity detection.

[0117] Among them, the key interface is the application programming interface provided by the operating system platform, which performs sensitive system operations such as reading system information, calling system devices, network communication, information encoding and information encryption in the application.

[0118] Optionally, the categories of key interfaces include device information acquisition, location information acquisition, network communication, data storage and sharing, encryption and encoding, process and service control, and permission checks and requests.

[0119] Optionally, each key interface in the key interface list is traversed, and the call relationship within the predicted layer is obtained by bidirectional breadth-first search based on the complete method call graph. This includes: traversing each key interface in the key interface list, and performing the following steps for each traversed key interface: determining the corresponding method node from the complete method call graph based on the key interface; performing an upward breadth-first search on the method node from the complete method call graph based on the predicted layer to obtain the upstream method node and the corresponding method call edge of the upstream method node; performing a downward breadth-first search on the method node from the complete method call graph based on the predicted layer to obtain the downstream method node and the corresponding method call edge of the downstream method node; and obtaining the call relationship within the predicted layer based on the upstream method node, the corresponding method call edge of the upstream method node, the downstream method node, and the corresponding method call edge of the downstream method node.

[0120] Optionally, based on the call relationship, one or more interface call subgraphs are generated, including: parsing the call relationship of each key interface to obtain upstream method nodes, method call edges corresponding to upstream method nodes, downstream method nodes, and method call edges corresponding to downstream method nodes; storing upstream method nodes and downstream method nodes in an interface node set; storing method call edges corresponding to upstream method nodes and downstream method nodes in an interface call edge set; and generating one or more interface call subgraphs based on the interface node set and the interface call edge set.

[0121] It should be noted that the number of prediction layers can be set according to the performance of the method execution subject (i.e., computer equipment), and this embodiment does not limit it.

[0122] S202: Perform structured processing on multidimensional feature data to obtain structured feature data.

[0123] Optionally, the multidimensional feature data can be structured according to a preset data format to obtain structured feature data.

[0124] Optionally, the default data format can be JSON.

[0125] S203: Input the structured feature data into the preset similarity detection model to output the application similarity detection results of multiple applications to be detected.

[0126] Optionally, the preset similarity detection model can be a large model.

[0127] The application similarity detection method provided in this application's embodiments automates similarity determination by inputting structured feature data into a preset similarity detection model, replacing manual experience-based judgment. It extracts multi-dimensional features from multi-dimensional data such as software development kit (SDK) calls and key interface calls, comprehensively characterizing the application's similarity features. This improves the efficiency of application similarity detection while ensuring its accuracy.

[0128] In one embodiment of this application, based on the above embodiments, a training step of a preset similarity detection model is further included, which is detailed as follows: obtaining full similarity analysis data of multiple pre-labeled applications, wherein the multiple applications are multiple applications with similar or dissimilar application similarity; constructing thought chain reasoning prompts based on the full similarity analysis data; training a preset initial large model based on the thought chain reasoning prompts to obtain a preset similarity detection model.

[0129] Optionally, the full dataset for similarity analysis includes structured feature data, feature construction reasoning process, and similarity comparison results.

[0130] Optionally, the feature construction reasoning process is used to indicate the construction reasoning process of structured feature data.

[0131] The application similarity detection method provided in this application enhances the large model's understanding of similarity judgment logic by constructing thought chain reasoning prompts.

[0132] Figure 3 This is a schematic diagram of another application similarity detection method provided in an embodiment of this application. For example... Figure 3 As shown, the method includes:

[0133] The Android application installation packages of multiple applications to be tested are unpacked using a decompilation tool to obtain the resource files of multiple applications to be tested, including the application manifest configuration file.

[0134] Based on resource files and application manifest configuration files, construct metadata features for multiple applications to be detected.

[0135] A pre-defined code analysis framework is used to perform static analysis on multiple applications to be tested, so as to obtain the complete method call graph of the applications to be tested.

[0136] Generate the first call feature based on the complete method call graph.

[0137] Obtain a list of key interfaces for multiple applications to be tested.

[0138] Based on the list of key interfaces and the complete method call graph, generate the second call feature.

[0139] Based on metadata features, first call features, and second call features, structured feature data of multiple applications to be detected are determined.

[0140] Based on the full dataset of similarity analysis of multiple pre-labeled applications, a thought chain reasoning prompt word is constructed; the initial large model is trained based on the thought chain reasoning prompt word to obtain the preset similarity detection model.

[0141] Structured feature data is input into a preset similarity detection model to perform application similarity detection, and application similarity detection results for multiple applications to be detected are output.

[0142] Figure 4 This is a schematic diagram of the application similarity detection device provided in the embodiments of this application, such as... Figure 4 As shown, the application similarity detection device provided in this embodiment includes: an acquisition module 401, a processing module 402, and a detection module 403.

[0143] The acquisition module 401 is used to acquire multidimensional feature data of multiple applications to be detected. The multidimensional feature data includes a first call feature and a second call feature. The first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface.

[0144] The processing module 402 is used to perform structured processing on the multidimensional feature data to obtain structured feature data;

[0145] The detection module 403 is used to input structured feature data into a preset similarity detection model to output application similarity detection results for multiple applications to be detected.

[0146] In one possible implementation, the multidimensional feature data further includes: metadata features; correspondingly, the acquisition module 401 is specifically used to: acquire resource files of multiple applications to be detected, wherein the resource files include application manifest configuration files; perform distribution statistics on the resource files to obtain resource file features; parse the application manifest configuration files to obtain application information features, wherein the application information features include multiple features among application basic information features, component list features, and permission declaration features; obtain metadata features based on the resource file features and application information features; perform static analysis on multiple applications to be detected to obtain a complete method call graph of multiple applications to be detected; generate a first call feature based on the complete method call graph; acquire a list of key interfaces of multiple applications to be detected; generate a second call feature based on the list of key interfaces and the complete method call graph; and determine the multidimensional feature data of multiple applications to be detected based on the metadata features, the first call feature, and the second call feature.

[0147] In one possible implementation, the acquisition module 401, when performing distribution statistics on resource files to obtain resource file characteristics, is specifically used to: count the proportion of the number of files of each file type in the resource files to the total number of files in the resource files, so as to obtain type distribution characteristics; count the proportion of the number of files in the resource files in multiple preset size ranges to the total number of files in the resource files, so as to obtain size distribution characteristics; and obtain resource file characteristics based on type distribution characteristics and size distribution characteristics.

[0148] In one possible implementation, the acquisition module 401, when generating the first call feature based on the complete method call graph, is specifically used to: acquire a set of characteristic methods of the software development kit; identify one or more characteristic method call subgraphs from the complete method call graph based on the set of characteristic methods; obtain a set of callers based on the one or more characteristic method call subgraphs; perform call behavior feature analysis on the caller set to obtain call frequency features and call distribution features; and generate the first call feature based on the call frequency features and call distribution features.

[0149] In one possible implementation, the complete method call graph includes a set of method nodes and a set of method call edges. Each method node in the set of method nodes represents a method, and the starting node of each method call edge in the set of method call edges represents the caller, while the ending node represents the callee. Accordingly, the acquisition module 401, when identifying one or more characteristic method call subgraphs from the complete method call graph based on the characteristic method set, specifically performs the following steps for each characteristic method: traversing the characteristic methods in the characteristic method set, and performing the following steps for each traversed characteristic method to obtain one or more characteristic method call subgraphs: determining the corresponding method node from the set of method nodes based on the characteristic method; filtering out method call edges whose ending node is the corresponding method node from the set of method call edges to obtain a set of sub-method call edges; determining the sub-method node set based on the starting node and the corresponding method node in the sub-method call edge set; and determining the characteristic method call subgraph based on the sub-method node set and the sub-method call edge set.

[0150] In one possible implementation, the acquisition module 401, when obtaining the caller set based on one or more feature method call subgraphs, is specifically used to: extract the callers from the sub-method call edge set of one or more feature method call subgraphs to obtain the caller set.

[0151] In one possible implementation, the acquisition module 401, when performing call behavior feature analysis on the caller set to obtain call frequency features and call distribution features, specifically performs the following: 1) 2) 3) 4) 5) 6) ...

[0152] In one possible implementation, the acquisition module 401, when generating the second call feature based on the key interface list and the complete method call graph, is specifically used to: traverse each key interface in the key interface list, obtain the call relationship within the predicted layer of each key interface through bidirectional breadth-first search based on the complete method call graph; generate one or more interface call subgraphs based on the call relationship; and generate the second call feature based on one or more interface call subgraphs.

[0153] In one possible implementation, the similarity detection device further includes:

[0154] The training module is used to acquire full similarity analysis data of multiple pre-labeled applications, where multiple applications are either similar or dissimilar; based on the full similarity analysis data, it constructs thought chain reasoning prompts; and trains a pre-set initial large model based on the thought chain reasoning prompts to obtain a pre-set similarity detection model.

[0155] In one possible implementation, the full dataset for similarity analysis includes structured feature data, feature construction reasoning processes, and similarity comparison results.

[0156] The application similarity detection device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0157] Figure 5 This is a schematic diagram of the structure of the application similarity detection device provided in an embodiment of this application. Figure 5 As shown, the application similarity detection device provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0158] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0159] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0160] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0161] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0162] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0163] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0164] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0165] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0166] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0167] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0168] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0169] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0170] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0171] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0172] Finally, it should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and alterations may be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for applying similarity detection, characterized in that, include: Acquire multidimensional feature data of multiple applications to be detected, wherein the multidimensional feature data includes a first call feature and a second call feature, wherein the first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface; The multidimensional feature data is subjected to structured processing to obtain structured feature data; The structured feature data is input into a preset similarity detection model to output the application similarity detection results of the multiple applications to be detected.

2. The method according to claim 1, characterized in that, The multidimensional feature data also includes: metadata features; Accordingly, acquiring multidimensional feature data of multiple applications to be detected includes: Obtain resource files for multiple applications to be tested, including application manifest configuration files; The resource files are statistically analyzed to obtain their characteristics; The application manifest configuration file is parsed to obtain application information features, wherein the application information features include multiple features from the following: application basic information features, component list features, and permission declaration features. Based on the resource file characteristics and the application information characteristics, metadata characteristics are obtained; Static analysis is performed on the multiple applications to be tested to obtain the complete method call graph of the multiple applications to be tested; Based on the complete method call graph, a first call feature is generated; Obtain a list of key interfaces for the multiple applications to be tested; Based on the key interface list and the complete method call graph, a second call feature is generated; Based on the metadata features, the first call features, and the second call features, multidimensional feature data of the multiple applications to be detected is determined.

3. The method according to claim 2, characterized in that, The distribution statistics of the resource files to obtain resource file characteristics include: The proportion of each file type in the resource files to the total number of files in the resource files is counted to obtain the type distribution characteristics; The proportion of the number of files in the resource files that fall within multiple preset size ranges is counted to the total number of files in the resource files, in order to obtain the size distribution characteristics; Based on the type distribution characteristics and the size distribution characteristics, the resource file characteristics are obtained.

4. The method according to claim 2, characterized in that, The step of generating the first call feature based on the complete method call graph includes: A set of methods for obtaining the characteristics of a software development kit; Based on the set of characteristic methods, identify one or more characteristic method call subgraphs from the complete method call graph; The caller set is obtained by calling the subgraph based on one or more of the feature methods; The caller set is subjected to call behavior characteristic analysis to obtain call frequency characteristics and call distribution characteristics; Based on the call frequency characteristics and call distribution characteristics, a first call characteristic is generated.

5. The method according to claim 4, characterized in that, The complete method call graph includes a set of method nodes and a set of method call edges. Each method node in the set of method nodes represents a method, and the starting node of each method call edge in the set of method call edges represents the caller, and the ending node represents the callee. Accordingly, identifying one or more characteristic method call subgraphs from the complete method call graph based on the characteristic method set includes: Traverse the feature methods in the feature method set, and perform the following steps for each traversed feature method to obtain one or more feature method call subgraphs: Based on the feature method, determine the corresponding method node from the set of method nodes; From the set of method call edges, filter out the method call edges whose endpoint is the corresponding method node to obtain the set of sub-method call edges; The set of sub-method nodes is determined based on the starting node in the set of sub-method call edges and the corresponding method node; Based on the set of sub-method nodes and the set of sub-method call edges, a characteristic method call subgraph is determined.

6. The method according to claim 5, characterized in that, The step of calling a subgraph based on one or more feature methods to obtain a set of callers includes: Extract the callers from the set of sub-method call edges of the one or more feature method call subgraphs to obtain the caller set.

7. The method according to claim 6, characterized in that, The step of performing call behavior characteristic analysis on the caller set to obtain call frequency characteristics and call distribution characteristics includes: The frequency of each caller calling different characteristic methods in the caller set is counted to obtain the first frequency characteristic; The total frequency of each feature method in the feature method set being invoked by all callers in the caller set is counted to obtain the second frequency feature; Based on the first frequency feature and the second frequency feature, the call frequency feature is obtained; Obtain the functional module and level to which each caller belongs in the caller set to obtain the first distribution feature; Identify callers in the caller set who invoke the same characteristic method to obtain a second distribution feature; Based on the first distribution feature and the second distribution feature, the call distribution feature is obtained.

8. The method according to claim 2, characterized in that, The step of generating a second call feature based on the key interface list and the complete method call graph includes: Traverse each key interface in the list of key interfaces, and obtain the call relationship within the predicted layer of each key interface by bidirectional breadth-first search based on the complete method call graph. Based on the aforementioned call relationships, generate one or more interface call sub-graphs; A second call feature is generated based on the one or more interface call subgraphs.

9. The method according to any one of claims 1 to 8, characterized in that, The training steps of the preset similarity detection model include: Obtain the full dataset of similarity analysis for multiple pre-labeled applications, where the multiple applications are those with similar or dissimilar application similarity. Based on the similarity analysis of the entire dataset, construct thought chain reasoning prompts; The preset initial large model is trained based on the thought chain reasoning prompts to obtain the preset similarity detection model.

10. The method according to claim 9, characterized in that, The full dataset for similarity analysis includes structured feature data, feature construction reasoning process, and similarity comparison results.

11. An application similarity detection device, characterized in that, include: The acquisition module is used to acquire multidimensional feature data of multiple applications to be detected, wherein the multidimensional feature data includes a first call feature and a second call feature, wherein the first call feature is used to indicate the call feature of calling the software development kit, and the second call feature is used to indicate the call feature of calling the key interface; The processing module is used to perform structured processing on the multidimensional feature data to obtain structured feature data; The detection module is used to input the structured feature data into a preset similarity detection model to output the application similarity detection results of the multiple applications to be detected.

12. An application similarity detection device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-10.

14. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-10.

Images