Application recordal result identification method, device, and equipment, and storage medium

Abstract

The application relates to the computer technical field and provides an application filing result identification method and device, equipment and a storage medium. The method comprises the following steps: extracting application description information of a to-be-identified application and a plurality of access domain names involved in a running process from an installation package of the to-be-identified application; matching the plurality of access domain names with a preset third-party service domain name set, screening out each access domain name which does not hit any third-party service domain name as a candidate domain name; selecting a candidate domain name which meets a preset screening condition in the degree of association between the application description information of the to-be-identified application and each candidate domain name as an application domain name of the to-be-identified application; and matching the application domain name with prestored filed application data to obtain a filing result of the to-be-identified application. The above method can solve the problem that a server cannot accurately determine whether an application program has been filed.

Description

Technical Field

[0001] This application relates to the field of computer technology and provides a method, apparatus, device, and storage medium for identifying the filing results of an application. Background Technology

[0002] Currently, according to relevant regulations, application operators engaged in internet information services must complete the registration process in accordance with the law. Those who fail to complete the registration process are prohibited from engaging in internet information services. Internet information services include mobile internet applications (including apps, mini-programs, quick apps, etc.). Therefore, internet access service providers should determine whether each application has been registered before providing network access services to each application, and only provide network access services to registered applications.

[0003] In related technologies, Internet access service providers (ISPs) typically determine whether an application requesting network access services has been registered by analyzing traffic data. The method involves the following steps: When the ISP's server receives request traffic, it uses a traffic analysis service deployed on network layer devices to reconstruct the request traffic into application layer protocols and obtain the domain name of the request traffic. This domain name is then matched against registration data to determine whether the application corresponding to that domain name has been registered.

[0004] However, the registered data includes not only registered application data but also registered website data. Since the server cannot determine whether the requested traffic originates from a website or an application when it receives a request, it will determine that the requested domain is registered if the domain name matches any record in the registered data. In other words, if an application is not registered, but its domain name is registered as a website, the server will assume that the application corresponding to that domain name is registered, thus providing network access services to the unregistered application.

[0005] This shows that the current server cannot accurately determine whether an application has been registered. This allows unregistered applications to provide internet information services, which makes it impossible to ensure the compliance of internet information services and may even affect the information security of the users of the application services. Summary of the Invention

[0006] This application provides a method, apparatus, device, and storage medium for identifying the filing results of an application, in order to solve the problem that the server cannot accurately determine whether an application has been filed.

[0007] In a first aspect, embodiments of this application provide a method for identifying the filing results of an application, including:

[0008] Extract the application description information of the application to be identified, as well as the multiple access domains involved in the operation, from the installation package of the application to be identified;

[0009] The multiple access domains are matched with a preset set of third-party service domains, and each access domain that does not match any third-party service domain is selected as a candidate domain; the set of third-party service domains includes service domains other than the application to be identified;

[0010] Based on the degree of association between the application description information of the application to be identified and each candidate domain name, the candidate domain names whose degree of association meets the preset screening conditions are selected from the candidate domain names and used as the application domain names of the application to be identified.

[0011] The application domain name is matched with the pre-stored data of registered applications to obtain the registration result of the application to be identified.

[0012] Secondly, embodiments of this application also provide an application filing result identification device, including:

[0013] The information extraction unit is used to extract the application description information of the application to be identified, as well as multiple access domain names involved in the operation, from the installation package of the application to be identified.

[0014] The third-party service domain name filtering unit is used to match the multiple access domain names with a preset set of third-party service domain names, and filter out each access domain name that does not match any third-party service domain name as a candidate domain name; the set of third-party service domain names includes service domain names other than the application to be identified;

[0015] The application domain name selection unit is used to select candidate domain names whose correlation with the application description information of the application to be identified meets the preset screening conditions from the candidate domain names based on the degree of correlation between the application description information of the application to be identified and each candidate domain name, and use them as the application domain names of the application to be identified.

[0016] The filing result identification unit is used to match the application domain name with the pre-stored filed application data to obtain the filing result of the application to be identified.

[0017] In one possible implementation, the information extraction unit extracts application description information and multiple access domains involved in the operation of the application to be identified from the installation package of the application to be identified. Specifically, it is used to: decompress the installation package of the application to be identified to obtain each resource file of the application to be identified, and extract the application description information of the application to be identified from each resource file; the resource files are used to describe the static resources involved in the application to be identified; match each resource file with a pre-stored set of protective shell source files to obtain matching results; the set of protective shell source files includes protective shell source files with different shelling methods, and each protective shell source file is the original file for shelling the application; the matching result indicates whether the application to be identified has been shelled; and unpack and parse the installation package according to the parsing method corresponding to the matching result to extract multiple access domains involved in the operation.

[0018] In one possible implementation, the information extraction unit unpacks and parses the installation package using the parsing method corresponding to the matching result, extracting multiple access domain names involved in the operation process. Specifically, it is used to: when the matching result indicates that the application to be identified is not packed, decompile the installation package to obtain the functional files of the application to be identified, and extract multiple access domain names involved in the operation process from the functional files; the functional files are used to describe the functions and operating logic of the application to be identified; when the matching result indicates that the application to be identified is packed, install and run the application to be identified through an emulator, monitor the network communication during the operation of the application to be identified, and extract multiple access domain names involved in the operation process from the monitoring results.

[0019] In one possible implementation, the information extraction unit monitors network communication during the operation of the application to be identified, and extracts multiple access domain names involved in the operation from the monitoring results. Specifically, it is used to: monitor network communication during the operation of the application to be identified, obtain Domain Name System (DNS) traffic packets, and parse the DNS traffic packets to obtain a first monitoring result; the DNS traffic packets are data packets transmitted via the DNS protocol; and add hook functions to functions related to network requests in the application to be identified, and monitor network communication through the hook functions during the operation of the application to be identified to obtain a second monitoring result; the hook functions are preset functions for monitoring network communication; and the multiple domain names extracted from the first monitoring result and the second monitoring result are respectively used as access domain names.

[0020] In one possible implementation, the application domain name selection unit selects candidate domain names whose association degree meets preset screening conditions from among the candidate domain names based on the association degree between the application description information of the application to be identified and each candidate domain name. Before obtaining the application domain name of the application to be identified based on the selected candidate domain names, the unit further performs the following operations for each candidate domain name: obtaining at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name; each type of sub-description information is used to describe a basic feature of the application to be identified; the at least one sub-association evaluation value is fused to obtain the association evaluation value of the candidate domain name; the association evaluation value is positively correlated with the association degree.

[0021] In one possible implementation, the sub-description information includes a package name. The application domain name selection unit obtains at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name. Specifically, this is done by: parsing the package name and the candidate domain name separately to obtain a package name string and a domain name string of the candidate domain name; obtaining a sub-association evaluation value corresponding to the candidate domain name based on the degree of overlap between the package name string and the domain name string; wherein the degree of overlap is positively correlated with the sub-association evaluation value.

[0022] In one possible implementation, the sub-description information includes the application name. The application domain name selection unit obtains at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name. Specifically, this is done by: parsing the candidate domain name to obtain the domain name string of the candidate domain name; transcribing the application name to obtain the full pinyin string and the abbreviated pinyin string corresponding to the application name; obtaining the sub-association evaluation value of the candidate domain name based on the degree of overlap between the domain name string and the full pinyin string, and the degree of overlap between the domain name string and the abbreviated pinyin string; wherein the degree of overlap is positively correlated with the sub-association evaluation value.

[0023] In one possible implementation, the sub-description information includes an application name. The application domain name selection unit obtains at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name. Specifically, this is used for: web crawling the candidate domain name to obtain the website content of the candidate domain name; performing semantic parsing on the application name and the website content corresponding to the candidate domain name respectively, and obtaining the semantic similarity between the application name and the website content based on the semantic parsing results; obtaining the sub-association evaluation value of the candidate domain name based on the semantic similarity; the semantic similarity is positively correlated with the sub-association value.

[0024] In one possible implementation, the sub-description information includes content information, which represents text information related to the service content of the application. The application domain name selection unit obtains at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name. Specifically, it is used to: obtain at least one service type of the candidate domain name; perform semantic parsing on the content information and the at least one service type respectively, and obtain the semantic similarity between the content information and the at least one service type based on the semantic parsing results; obtain the sub-association evaluation value of the candidate domain name based on the semantic similarity; the semantic similarity is positively correlated with the sub-association value.

[0025] In one possible implementation, the sub-description information includes the developer's name; the application domain name selection unit obtains at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name, specifically by: removing common characters from the developer's name and the domain name registrant of the candidate domain name respectively to obtain a developer's text sequence and a domain name registrant text sequence; obtaining a sub-association evaluation value of the candidate domain name based on the degree of overlap between the developer's text sequence and the domain name registrant text sequence; the degree of overlap is positively correlated with the sub-association evaluation value.

[0026] In one possible implementation, before the application domain name selection unit fuses the at least one sub-association evaluation value to obtain the association evaluation value of the candidate domain name, it is further configured to: obtain an additional evaluation value of the candidate domain name based on the number of subdomains corresponding to the main domain in the candidate domain name; the number of subdomains is the number of candidate domain names containing the main domain; the number of subdomains is positively correlated with the additional evaluation value; the application domain name selection unit fuses the at least one sub-association evaluation value to obtain the association evaluation value of the candidate domain name, specifically configured to: fuse the at least one sub-association evaluation value with the additional evaluation value to obtain the association evaluation value of the candidate domain name.

[0027] In one possible implementation, the application domain name selection unit selects candidate domain names whose association degree meets preset screening conditions based on the application description information of the application to be identified and each candidate domain name, and obtains the application domain name of the application to be identified based on the selected candidate domain name. Specifically, it is used to: select a candidate domain name whose association evaluation value is not less than a preset evaluation value threshold based on the association evaluation value of each candidate domain name, and obtain the application domain name of the application to be identified based on the selected candidate domain name; wherein, if there are multiple candidate domain names whose association evaluation value is not less than the preset evaluation value threshold, a candidate domain name is randomly selected, or a candidate domain name whose association evaluation value is greater than the association evaluation values ​​of other candidate domain names is selected.

[0028] Thirdly, embodiments of this application also provide a computer device, including a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor performs the steps of the filing result identification method of any of the above applications.

[0029] Fourthly, embodiments of this application also provide a computer-readable storage medium including program code, which, when the program product is run on a computer device, is used to cause the computer device to execute the steps of the filing result identification method of any of the above applications.

[0030] Fifthly, embodiments of this application also provide a computer program product, including computer instructions, which are executed by a processor using the steps of the filing result identification method for any of the above applications.

[0031] The beneficial effects of this application are as follows:

[0032] This application provides a method, apparatus, device, and storage medium for identifying application registration results. The method involves matching multiple access domains with a preset set of third-party service domains to filter out domains that are unlikely to be application domains of the application to be identified. This reduces the workload of subsequent correlation analysis and avoids the problems of long registration result identification times and low efficiency caused by too many access domains. By analyzing the correlation between the application description information of the application to be identified and each candidate domain, the application domain of the application to be identified can be effectively obtained. Then, by checking whether the application domain matches the data of already registered applications, the registration result is identified. This solves the problem in related technologies of being unable to accurately determine whether an application has been registered.

[0033] Furthermore, if it is possible to accurately determine whether an application has been registered, then unregistered applications can be prevented from providing internet information services, thereby ensuring the compliance of internet information services and protecting the information security of the application service recipients.

[0034] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 This is a schematic diagram illustrating the application of a filing result identification method in the related technologies provided in the embodiments of this application;

[0037] Figure 2 This is an optional schematic diagram of an application scenario in the embodiments of this application;

[0038] Figure 3 A flowchart illustrating the filing result identification method for the application provided in this embodiment of the application;

[0039] Figure 4 An exemplary flowchart of the unpacking and parsing method provided in the embodiments of this application;

[0040] Figure 5 This is a schematic diagram illustrating the process of constructing a set of third-party service domain names provided in an embodiment of this application.

[0041] Figure 6 An exemplary flowchart of the candidate domain name filtering method provided in the embodiments of this application;

[0042] Figure 7 This is a schematic diagram illustrating the association analysis process between package names and candidate domain names provided in an embodiment of this application.

[0043] Figure 8 This is one of the schematic diagrams illustrating the mapping rules between length and sub-association evaluation values ​​provided in the embodiments of this application;

[0044] Figure 9 This is a schematic diagram illustrating the association analysis process between application names and candidate domain names provided in an embodiment of this application.

[0045] Figure 10A This is one of the schematic diagrams illustrating the mapping rules between length and sub-association evaluation values ​​provided in the embodiments of this application;

[0046] Figure 10B This is one of the schematic diagrams illustrating the mapping rules between length and sub-association evaluation values ​​provided in the embodiments of this application;

[0047] Figure 11 This is a schematic diagram illustrating the association analysis process between application names and website content of candidate domain names provided in this application embodiment;

[0048] Figure 12 A schematic diagram illustrating the correlation analysis process between the content information provided in this application embodiment and the service type of the candidate domain name;

[0049] Figure 13 A schematic diagram illustrating the process of obtaining additional evaluation values ​​provided in the embodiments of this application;

[0050] Figure 14 This is a schematic diagram illustrating the process of obtaining the associated evaluation value provided in an embodiment of this application;

[0051] Figure 15 A schematic diagram of the system architecture of the filing result recognition system for the application provided in this embodiment of the application;

[0052] Figure 16 A schematic diagram of the structure of a filing result recognition device provided in an embodiment of this application;

[0053] Figure 17 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of this application;

[0054] Figure 18 This is a schematic diagram of the hardware structure of another computer device that applies an embodiment of this application. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0056] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0057] (1) Packing: This is a common software protection technique, mainly used to protect the source code of an APP from being easily reverse engineered or cracked. The "pack" is like a protective layer, wrapped around the binary code of the APP, making it difficult to directly analyze or modify this code.

[0058] (2) Package Name: In the Android system, each application has a unique package name, which identifies the application throughout the system. The package name usually consists of multiple parts, each separated by a period (.), for example, com.example.myapp.

[0059] (3) smali: is an assembly language used to represent Android Dalvik bytecode, and is commonly used for reverse engineering and analysis of Android applications.

[0060] (4) Application Filing: According to relevant regulations, Internet access service providers are prohibited from providing network access services to applications that have not completed the filing process. Application filing typically involves submitting detailed information about the application (such as application name, functions, developer information, etc.) and some necessary legal documents. The purpose of application filing is to protect users' rights and prevent the spread of malicious software and illegal content.

[0061] (5) Filing Entity: This refers to the individual, company, enterprise, or other organization responsible for filing when filing a website or application. In this embodiment, the filing entity includes the application developer and the domain name registrant. The relevant information of the filing entity may include name or company name, contact information, etc.

[0062] (6) Internet access service providers: Internet access service operators, Internet data center operators, and telecommunications operators and public Internet service providers that provide access services to websites in other ways.

[0063] The design concept of the embodiments of this application is briefly introduced below:

[0064] See Figure 1 This diagram illustrates a method for identifying filing results in the related technologies provided in this application embodiment. In related technologies, Internet access service providers typically consider traffic dimensions, such as... Figure 1 The method shown determines whether an application requesting network access service has been registered: Using a traffic analysis service deployed on a network layer device, the request traffic for network access is converted back to the application layer protocol, and the domain name of the request traffic is obtained. Then, this domain name is matched with the registration data to determine whether the application corresponding to the domain name has been registered. The registration result and the request traffic are then sent to the server of the Internet access service provider. The server determines whether to provide Internet access service for the request traffic based on the registration result.

[0065] However, the registered data includes not only registered application data but also registered website data. Since the server cannot determine whether the requested traffic originates from a website or an application when it receives a request, it will determine that the requested domain is registered if the domain name matches any record in the registered data. In other words, if an application is not registered, but its domain name is registered as a website, the server will assume that the application corresponding to that domain name is registered, thus providing network access services to the unregistered application.

[0066] This shows that the current server cannot accurately determine whether an application has been registered. This allows unregistered applications to provide internet information services, which makes it impossible to ensure the compliance of internet information services and may even affect the information security of the users of the application services.

[0067] In view of this, embodiments of this application provide a method, apparatus, device, and storage medium for identifying the registration results of an application. The method includes: extracting application description information and multiple access domains involved in the operation of the application from its installation package; matching these access domains with a preset set of third-party service domains; and filtering out access domains that do not match any third-party service domain as candidate domains. Then, based on the degree of correlation between the application description information of the application and each candidate domain, selecting candidate domains whose correlation meets preset filtering conditions as the application domains of the application to be identified. Finally, matching the application domains with pre-stored registered application data to obtain the registration result of the application to be identified.

[0068] By matching multiple access domains with a preset set of third-party service domains using the above method, some access domains that are unlikely to be application domains of the application to be identified are filtered out. This reduces the workload of subsequent correlation analysis and avoids the problems of long identification times and low efficiency caused by too many access domains. By analyzing the correlation between the application description information of the application to be identified and each candidate domain, the application domain of the application to be identified can be effectively obtained. Then, by checking whether the application domain matches the data of already registered applications, the registration result is identified. This solves the problem in related technologies of not being able to accurately determine whether an application has been registered.

[0069] Furthermore, if it is possible to accurately determine whether an application has been registered, then unregistered applications can be prevented from providing internet information services, thereby ensuring the compliance of internet information services and protecting the information security of the application service recipients.

[0070] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0071] Figure 2 One application scenario is shown, which includes a terminal device 210 and a server 220. The terminal device 210 establishes a communication connection with the server 220 through a wired network or a wireless network.

[0072] Application developers can send a request to the application store server 220 to list their application, via terminal device 210. Server 220 can extract the application description information and multiple access domains involved in the application's operation from the application's installation package. It then matches these access domains with a preset set of third-party service domains, filtering out those that do not match any third-party service domain as candidate domains. Next, based on the correlation between the application description information and each candidate domain, it selects those whose correlation meets preset filtering criteria as the application domain for the application. Finally, it matches the application domain with pre-stored registered application data to obtain the registration result of the application.

[0073] When server 220 determines that the application to be identified has been registered, it allows the application to be identified to be listed on the application market. Conversely, when it determines that the application to be identified has not been registered, it does not allow the application to be identified to be listed on the application market.

[0074] The terminal device 210 in this application embodiment may be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, etc., but is not limited to these.

[0075] The server 220 in this application embodiment can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. This application does not impose any restrictions on these services.

[0076] It should be noted that, Figure 2 The application scenarios shown are merely illustrative and are not intended to limit the scope of this application.

[0077] This application provides a method for identifying the filing results of an application that can be applied to... Figure 1 In server 220 shown. See also Figure 3 An exemplary flowchart of a filing result identification method for an application provided in this application embodiment is provided. The method may include the following steps 301-304:

[0078] Step 301: Extract the application description information of the application to be identified, as well as the multiple access domains involved in the operation, from the installation package of the application to be identified.

[0079] In one possible implementation, before executing step 301, the server can first obtain the download link of the application to be identified. For example, the download link for the application to be identified under the Android system could be http: / / www.xxx.com / xxx.apk. Then, the installation package of the application to be identified is downloaded through this download link. It should be noted that this embodiment of the application uses an application under the Android system as an example for illustration; applications under other mobile operating systems are also applicable, and will not be described in detail below.

[0080] Optionally, the server can first obtain download links for multiple applications pre-stored in the traffic database, and then filter out download links that do not require registration result identification through data cleaning methods such as whitelist filtering and three-level cache filtering. Then, the application to which each of the remaining at least one download link belongs can be used as the application to be identified, and the registration result identification method for applications provided in this application embodiment can be executed. The whitelist can include download links for applications whose registration result has been identified by the registration result identification method provided in this application embodiment, and whose registration result is already registered. Since multi-level caching can effectively reduce the application analysis workload, this application embodiment uses a three-level cache to store different types of data. The three-level cache can include a Uniform Resource Locator (URL) cache, a Message Digest Algorithm 5 (MD5) cache, and a package name cache.

[0081] In one possible implementation, step 301 can be specifically performed as follows: The installation package of the application to be identified is decompressed to obtain resource files describing the static resources involved in the application, and application description information of the application to be identified is extracted from each resource file. Then, each resource file is matched with different packer source files included in a pre-stored packer source file set to obtain matching results indicating whether the application to be identified has been packed. Finally, the installation package is unpacked and parsed using the parsing method corresponding to the matching results to extract multiple access domain names involved in the runtime process.

[0082] Each protective shell source file is the original file used to pack the application. Unpacking and parsing can be understood as disassembling the installation package of the application to be identified and obtaining the valid information contained therein. In this embodiment, the valid information refers to the multiple access domains involved in the operation of the application to be identified.

[0083] Based on the above scheme, by matching resource files with the protective shell source files in the protective shell source file set to determine whether the application to be identified is protected, a more suitable unpacking and parsing method can be selected for the application to be identified, thereby improving the efficiency of unpacking and parsing.

[0084] In one possible implementation, when the server decompresses the installation package of the application to be identified, since the installation package is usually an APK file, which is actually a zip compressed package, it can be decompressed using a zip decompression command or any tool for processing zip files. This application does not limit this.

[0085] In another possible implementation, the server can also use the Android Asset Packaging Tool (AAPT) to unpack the installation package of the application to be identified, extract the resource files in the installation package, and extract the resource files into the directory containing the AndroidManifest.xml file, thereby extracting the application description information of the application to be identified based on the contents of each resource file.

[0086] In some embodiments, the application description information of the application to be identified may include at least one type of sub-description information, each type of sub-description information being used to describe a basic characteristic of the application to be identified. For example, the sub-description information includes, but is not limited to, package name, application name, content information, and developer name, wherein the content information represents: text information related to the service content of the application.

[0087] For example, if the app to be identified is a job-seeking app, the content information could include text information representing job titles such as "waiter," "salesperson," "security guard," "housekeeper," and "driver," as well as job-related text information such as "salary," "resume," and "recruitment." As another example, if the app to be identified is a sports app, the content information could include sports-related text information such as "sports," "cycling," "running," and "fitness."

[0088] In some embodiments, after extracting each resource file into a directory containing an AndroidManifest.xml file, each resource file can be matched with each of the pre-stored shell source files by traversing all resource files in that directory to obtain a matching result that indicates whether the application to be identified has been shelled.

[0089] Specifically, if the matching result shows that there is no resource file in each resource file that matches any of the shell source files, it means that the application to be identified is not packed, that is, the matching result indicates that the application to be identified is not packed; if the matching result shows that there is a resource file in each resource file that matches any of the shell source files, it means that the application to be identified is packed, that is, the matching result indicates that the application to be identified is packed.

[0090] In one possible implementation, after obtaining the matching result, if the matching result indicates that the application to be identified is not packed, the parsing method corresponding to the matching result can be to decompile the installation package to obtain the functional files used to describe the functions and running logic of the application to be identified, and extract the multiple access domain names involved in the running process from the functional files.

[0091] Decompilation refers to the process of converting an application that has been compiled into binary code back into its source code. In one example, when decompiling an installation package, a tool called apktool, used for decompiling and reconstructing Android applications, can be used to perform decompilation parsing on the application to be identified. In practice, this tool can be run using the command: `java -jar apktool`. If decompilation is successful, the installation package will be parsed into a folder containing a smali directory; the smali directory is the decompiled result directory. Then, the decompiled result directory is traversed, and regular expressions are used to extract multiple access domains from files of certain target formats. These target formats include, but are not limited to, smali, assets, html, xml, and js.

[0092] It should be noted that the access domain name can be either a domain name or an Internet Protocol (IP) address; this application does not limit this.

[0093] In some embodiments, when traversing the decompiled result directory and performing regular expression extraction on files of certain target formats, at least one type of sub-description information can be extracted. For each type of sub-description information, the extracted sub-description information is deduplicated and merged with the same type of sub-description information extracted from the resource files, and then added as a single type of sub-description information to the application description information. The sub-description information extracted from the decompilation parsing may include text information such as content information, developer name, and application name.

[0094] If the matching result indicates that the application to be identified has been blocked, the corresponding parsing method can be to install and run the application to be identified through an emulator, monitor the network communication during the operation of the application to be identified, and extract multiple access domain names involved in the operation from the monitoring results.

[0095] Based on the above scheme, since more sub-description information can be extracted during decompilation and parsing, it is necessary to determine whether the application to be identified is packed before unpacking and parsing. This ensures that when the application to be identified is not packed, the installation package of the application to be identified is unpacked and parsed through decompilation and parsing, thereby providing more basis for selecting the application domain name of the application to be identified.

[0096] In some embodiments, when monitoring network communication during the operation of the application to be identified using a simulator and extracting multiple access domains involved in the operation from the monitoring results, network communication during the operation of the application to be identified can be monitored to obtain Domain Name System (DNS) traffic packets. Then, the DNS traffic packets are resolved to obtain a first monitoring result. Additionally, hook functions are added to functions related to network requests in the application to be identified, and network communication is monitored through the hook functions during the operation of the application to obtain a second monitoring result. After obtaining the first and second monitoring results, domain names are extracted from them, and the multiple domain names extracted from the first and second monitoring results are used as access domain names. Here, DNS traffic packets are data packets transmitted via the DNS protocol. Hooking is a technique that can change or extend the operating system, application, or other software components without modifying the original code. The hook functions used in this embodiment are preset functions for monitoring network communication.

[0097] Specifically, since apps communicate with the outside world over the network during runtime (except for standalone apps), multiple access domains involved in the process can be extracted by monitoring the network communication of the app after it is installed and running. The methods for monitoring the network communication of the app can be divided into the following two types:

[0098] Method 1: Non-invasive.

[0099] To avoid network communication issues due to cache hits, clear the emulator's DNS cache before running the application to be identified. Then, launch the network analysis tool Tcpdump, run the application to be identified, and obtain network packets captured by Tcpdump. Filter the packets to obtain DNS traffic packets, then parse the data in the DNS traffic packets to obtain the initial monitoring results.

[0100] Method 2: Invasive.

[0101] The Hook framework allows adding hook functions to key functions related to network requests in the application to be identified. This enables the monitoring of network communication during the application's runtime using these hook functions, thus obtaining a secondary monitoring result. The Hook framework can be Frida or similar frameworks; this application does not limit its scope.

[0102] It should be noted that methods one and two described above can be executed in parallel or sequentially; this application does not limit the execution order. When the matching result indicates that the application to be identified has been packed, in addition to methods one and two described above, the unpacking and parsing method can also be adopted from related technologies to unpack and parse the installation package.

[0103] Based on the above scheme, by combining non-intrusive and intrusive methods to obtain access domain names, the problem of shell cracking in related technologies is effectively avoided. Furthermore, the obtained access domain names are more abundant, thus providing more basis for selecting application domain names of the application to be identified.

[0104] In some embodiments, to avoid the situation where the access domain name cannot be obtained due to decompilation failure, when the matching result indicates that the application to be identified is not packed, but the decompilation of the installation package fails, the access domain name can also be extracted by monitoring the network communication during the operation of the application to be identified through an emulator.

[0105] Based on the above scheme, since the decompilation and parsing can still be performed by using a simulator when decompilation and parsing fail, the success rate of parsing and parsing can be greatly improved.

[0106] In one example, see Figure 4 An exemplary flowchart of the unpacking and parsing method provided in this application embodiment. The process includes steps 401-414:

[0107] Step 401: Download and extract the installation package of the application to be identified.

[0108] Download the installation package of the application to be identified via the download link, and then decompress the package using an unzipping tool to obtain the various resource files of the application.

[0109] Step 402: Match with the shell source file set.

[0110] Step 403: Should a shell be added?

[0111] Based on whether each resource file matches the protection shell source file, determine whether the application to be identified is protected. If it is protected, proceed to step 407; if it is not protected, proceed to step 404.

[0112] Step 404: Decompile and parse the installation package.

[0113] The application to be identified is decompiled and parsed using apktool.

[0114] Step 405: Was the decompilation successful?

[0115] If yes, proceed to step 406; otherwise, proceed to step 407.

[0116] Step 406: Extract the access domain name and application description information.

[0117] Step 407: Install the application to be identified.

[0118] Step 408: Clear DNS cache.

[0119] Clear the emulator's DNS cache.

[0120] Step 409: Open the network analysis tool.

[0121] Step 410: Run the application to be identified.

[0122] The first monitoring results are obtained during the operation of the application to be identified using network analysis tools.

[0123] Step 411: Load the application to be identified via the Hook framework.

[0124] The application to be identified is loaded via a Hook framework, and the application to be identified is paused.

[0125] Step 412: Add a Hook function.

[0126] Add a pre-defined Hook function to the key functions related to network requests in the application to be identified.

[0127] Step 413: Restore the running of the application to be identified.

[0128] Resume the operation of the application to be identified, and obtain a second monitoring result during the operation of the application to be identified.

[0129] Step 414: Extract the access domain name.

[0130] Multiple access domains were extracted from the first and second monitoring results.

[0131] It should be noted that the specific implementation methods of each step in steps 401-410 can be found in the descriptions in the above method embodiments, and will not be repeated here.

[0132] Step 302: Match multiple access domains with a preset set of third-party service domains, and filter out each access domain that does not match any third-party service domain as candidate domains.

[0133] The third-party service domain name set includes: at least one third-party service domain name, and each third-party service domain name is a service domain name other than the application to be identified.

[0134] In some embodiments, the access domain name extracted in step 301 may include the application domain name used by the application to be identified when it accesses the network; when the application to be identified provides third-party services, it may also include the domain name of the third-party service generated when calling the corresponding third-party service; when the application to be identified provides advertisements, it may also include the domain name of the accessed advertising service provider, and so on.

[0135] In one example, a third-party service domain name can also be called a Software Development Kit (SDK) domain name. SDK domain names can generally be categorized into the following five types:

[0136] (1) Sharing service domain name: The service domain name called when the sharing APP performs viral marketing. For example, tumblr.com.

[0137] (2) Payment service domain name: The service domain name called when making mobile payments. For example, alipay.net.

[0138] (3) Live streaming service domain name: The service domain name called when splitting live streams. For example, douyu.com.

[0139] (4) Blog service domain: The service domain used by technical blog websites when technical guidance, solutions, tutorials, and developer discussions are needed. For example, gjtool.cn.

[0140] (5) Other service domains: widely used service domains that cannot be categorized. For example, googleapis.cn.

[0141] See Figure 5 This is a schematic diagram illustrating the process of constructing a set of third-party service domain names provided in this application embodiment. Since third-party service domain names are typically called by a large number of different types of applications, in order to filter as many third-party service domain names as possible from the access domain names, it is possible to execute actions such as... Figure 5 The process shown is for building a set of third-party service domain names. This process includes:

[0142] Step 501: Obtain the application installation package.

[0143] Step 502: Unpacking and analysis.

[0144] The unpacking analysis method can be found in the detailed description in step 301, and will not be repeated here.

[0145] Step 503: Obtain the application description information and access domain name for each application.

[0146] Step 504: Store the mapping relationship between application description information and access domain names.

[0147] Establish a mapping relationship between application description information and access domain name, and store the mapping relationship in the application basic information database. Different mapping relationships correspond to different applications.

[0148] For example, assuming the application description information includes the application name, and the obtained application name is "Happy Exercise", then the mapping relationship can be established as follows: the access domains corresponding to Happy Exercise are: domain a, domain b, domain c, etc.

[0149] Step 505: Obtain candidate third-party service domains whose call counts exceed a preset call threshold.

[0150] The number of times each access domain is called can be defined as the number of mapping relationships in the application's basic information database that include that access domain and have different application categories. For example, suppose the application's basic information database includes applications A, B, and C with different package names and categories. Application A corresponds to access domains a and b, application B corresponds to access domains a and c, and application C corresponds to access domains a and d. Since the mapping relationships between applications A, B, and C all include access domain a, the number of times access domain a is called is 3. Similarly, since only the mapping relationship between application A and access domains includes access domain b, the number of times access domain b is called is 1; only the mapping relationship between application B and access domains includes access domain c, so the number of times access domain c is called is 1; and only the mapping relationship between application C and access domains includes access domain d, so the number of times access domain d is called is 1.

[0151] In some embodiments, when performing step 505, the basic information database can periodically bubble out candidate third-party service domains whose call count is greater than or equal to a preset call threshold through a bubbling algorithm, thereby obtaining one or more candidate third-party service domains.

[0152] Specifically, each access domain name can be treated as an element, and the number of calls corresponding to the domain name can be used as the value of the element to form an array. Then, the preset call threshold is added to the array as the value of the first element. Then, each element is traversed, and the values ​​of adjacent elements are compared in turn. If it is desired to place the element that is greater than or equal to the preset call threshold at the head of the array, the positions of two adjacent elements can be swapped when the value of the left element is less than the value of the right element. Otherwise, the swapping is not performed until all elements in the array are sorted. Then, the access domain names located to the left of the preset call threshold are bubbled out, and the bubbled access domain names are used as candidate third-party service domain names.

[0153] It should be noted that the preset call threshold can be set according to the actual situation or experience. For example, it can be set according to the number of mappings included in the application basic information database, such as 20 or 45. This application does not limit this.

[0154] Step 506: Review the candidate third-party service domain names.

[0155] Candidate third-party service domain names can be reviewed using large-scale models or manual verification to further confirm whether they are indeed third-party service domain names. Relevant methods can be found in the verification methods described in related technologies, and will not be elaborated upon here.

[0156] Step 507: Add the approved candidate third-party service domains to the third-party service domain set.

[0157] To obtain a more comprehensive set of third-party service domain names, a large number of application installation packages can be obtained in step 501. Steps 501-504 are then executed for each application installation package to obtain more candidate third-party service domain names in step 505. Filtering the access domain names with a more comprehensive set of third-party service domain names reduces the number of remaining access domain names, thereby reducing the workload of subsequent candidate domain name screening and improving the efficiency of identifying the filing results.

[0158] In some embodiments, when executing the application registration result identification method provided in this application, a mapping relationship between the application description information and the access domain name can be established and stored based on the application description information and access domain name extracted in step 301, to assist in constructing a more comprehensive set of third-party service domain names. Then, in step 302, candidate domain names are screened based on the constructed set of third-party service domain names.

[0159] See Figure 6 An exemplary flowchart of the candidate domain name filtering method provided in this application embodiment is shown, the process including:

[0160] Step 601: Obtain the application description information of the application to be identified, as well as the multiple access domains involved in the operation.

[0161] Step 602: Store the mapping relationship between application description information and access domain name.

[0162] Step 603: Obtain candidate third-party service domains whose call counts exceed a preset call threshold.

[0163] Step 604: Review the candidate third-party service domain names.

[0164] Step 605: Add to the third-party service domain set.

[0165] The approved candidate third-party service domains will be added to the third-party service domain set as third-party service domains.

[0166] Step 606: Is it a third-party service domain?

[0167] Based on the set of third-party service domain names, determine whether each of the multiple access domain names is a third-party service domain name. If it is, proceed to step 607 for filtering; otherwise, proceed to step 608 as a candidate domain name.

[0168] Step 607: Filtering.

[0169] Step 608: As a candidate domain name.

[0170] For detailed implementation methods of the above steps, please refer to [link / reference]. Figure 5 The relevant descriptions in the method embodiments shown will not be repeated here.

[0171] Step 303: Based on the degree of association between the application description information of the application to be identified and each candidate domain name, select the candidate domain names whose degree of association meets the preset screening conditions, and obtain the application domain name of the application to be identified based on the selected candidate domain names.

[0172] Since application domains are usually associated with their own application description information, the candidate domains with a greater degree of association are more likely to be application domains. Therefore, after filtering out third-party service domains in step 302, the server can determine the application domains among the candidate domains by determining the degree of association between the application description information of the application to be identified and each candidate domain.

[0173] In some embodiments, since the main domain is typically used for application registration, the application domain name can be obtained by using the main domain from the selected candidate domains. The main domain is the core part of the candidate domains, including the top-level domain and the second-level domain. For example, if the candidate domain is www.example.com, the main domain of this candidate domain is example.com, and the candidate domains containing this main domain are its subdomains, such as api.example.com and www.example.com.

[0174] In one possible implementation, before executing step 303, the degree of association between the application description information of the application to be identified and each candidate domain name can be determined by the following method:

[0175] For each candidate domain name, perform the following operations:

[0176] Based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name, at least one sub-association evaluation value is obtained for each candidate domain name. Then, these at least one sub-association evaluation values ​​are fused to obtain the association evaluation value for the candidate domain name. The association evaluation value is positively correlated with the degree of association.

[0177] In some embodiments, each type of sub-description information is used to describe a basic characteristic of the application to be identified. Therefore, the relevant information of the candidate domains used to determine similarity can also be different for different sub-description information. For example, when the sub-description information is a package name, since the package name is a string, the domain name itself of the candidate domain can be used to determine similarity. When the sub-description information is content information, since the content information is text information, the website content of the candidate domain can be used to determine similarity.

[0178] Based on the above scheme, since at least one sub-association evaluation value corresponding to a candidate domain name can be obtained by using the similarity between at least one type of sub-description information and the relevant information of a candidate domain name, different similarity values ​​can be used to obtain sub-association evaluation values ​​when different sub-description information is extracted, so that the sub-association evaluation value can be flexibly determined according to the actual situation.

[0179] In one possible implementation, when obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name, the following five strategies can be included:

[0180] Strategy 1: Perform correlation analysis between package names and candidate domain names.

[0181] The package name and a candidate domain name are parsed separately to obtain the package name string and the candidate domain name string, respectively. Then, based on the degree of overlap between the package name string and the domain name string, a sub-association evaluation value corresponding to a candidate domain name is obtained. The degree of overlap is positively correlated with the sub-association evaluation value.

[0182] In some embodiments, since the Longest Common Subsequence (LCS) algorithm can typically be used to find the longest common subsequence among two or more strings and is often used to calculate string relevance, the degree of overlap between the package name string and the domain name string can be determined by the LCS algorithm, that is, the degree of overlap is represented by the length of the longest common subsequence.

[0183] Specifically, when parsing package names, the package name can be first converted to lowercase, and common prefixes (such as "com.") can be removed to obtain the package name string. When parsing a candidate domain name, it can be first converted to lowercase, then top-level fields (such as ".com", ".cn", etc.) can be removed, followed by the removal of non-English characters (such as "-"), resulting in the domain name string. Then, the length of the longest common substring between the package name string and the domain name string can be determined using the LCS algorithm. Finally, the sub-association evaluation value corresponding to a candidate domain name can be obtained through the mapping rule between the length and the sub-association evaluation value.

[0184] For example, see Figure 7 This diagram illustrates the association analysis process between package names and candidate domain names provided in an embodiment of this application. Figure 7 As shown, assuming the package name of the application to be identified is com.orcatech.CleanShipon, and a candidate domain name is orca-Tech.cn, then after converting the package name to lowercase and removing the common prefix, we get the package name string: orcatech.cleanshipon. After converting the candidate domain name to lowercase, removing the top-level domain, and removing non-English characters, we get the domain name string: orcatech. Since both the package name string and the domain name string contain "orcatech", the longest common substring between the package name string and the domain name string is "orcatech", and its length is the number of characters included in the longest common substring: 8.

[0185] For example, see Figure 8 This is one of the schematic diagrams illustrating the mapping rule between length and sub-association evaluation value provided in an embodiment of this application. Assuming the scoring mechanism for the sub-association evaluation value is set to a 4-point scale, that is, the range of the sub-association evaluation value is 0-3, where 0 represents no association and 3 represents the highest association, the mapping rule can be as follows: Figure 8 As shown, x represents the length of the longest common substring. When the length is greater than or equal to 6, the sub-association evaluation value is 3; when the length is greater than or equal to 5 and less than 6, the sub-association evaluation value is 2; when the length is greater than or equal to 4 and less than 5, the sub-association evaluation value is 1; and when the length is less than 4, the sub-association evaluation value is 0. Based on this, through... Figure 8 The mapping rule shown determines that under this strategy, the sub-evaluation value corresponding to a candidate domain name is 3.

[0186] It should be noted that the scoring mechanism for the sub-association evaluation values ​​and the mapping rules between length and sub-association evaluation values ​​can be set according to actual conditions or experience. For example, the scoring mechanism can be a percentage system or a ten-point system, and the mapping rules can also be different depending on the scoring mechanism. This application does not limit this. In addition, in order to facilitate the subsequent fusion of various sub-association evaluation values, each sub-association evaluation value can be set to the same scoring mechanism. Therefore, in the embodiments of this application, the scoring mechanism for subsequent association evaluation values ​​is described using a 4-point system as an example, and will not be repeated hereafter.

[0187] Based on the above scheme, since the package name is usually the unique identifier of the application, if the candidate domain name has a high degree of overlap with the package name, it can be determined that the application domain name is more likely to be obtained based on the candidate domain name, and thus the candidate domain name that can be obtained can be effectively mined.

[0188] Strategy 2: Perform correlation analysis between application names and candidate domain names.

[0189] The process involves parsing a candidate domain name to obtain its domain name string, and transcribing the application name to obtain its full and abbreviated pinyin strings. Then, based on the degree of overlap between the domain name string and the full pinyin string, and between the domain name string and the abbreviated pinyin string, a sub-association evaluation value for the candidate domain name is obtained. The degree of overlap is positively correlated with the sub-association evaluation value.

[0190] Specifically, the method for character parsing of a candidate domain name can be found in Strategy 1, and will not be repeated here. When transcribing the application name, it can be converted into a corresponding string based on its pronunciation. For example, if the application name is in Chinese, it can be converted into Pinyin to obtain the full Pinyin string, and then the first letters of the Pinyin can be combined to form the abbreviated Pinyin string. Then, the LCS algorithm can be used to determine the length of the longest common substring between the full Pinyin string and the domain name string, as well as the length of the longest common substring between the abbreviated Pinyin string and the domain name string. Then, the sub-association evaluation value corresponding to the length of each of the two longest common substrings can be obtained through the mapping rule between the length and the sub-association evaluation value, and the maximum value is used as the sub-association evaluation value for a candidate domain name.

[0191] For example, see Figure 9This diagram illustrates the association analysis process between application names and candidate domain names provided in this application embodiment. Assuming a candidate domain name for the application to be identified is xxzbgs.com, and the application name is "Star Index Formula," then the domain name string for a candidate domain name is xxzbgs, and the full pinyin string corresponding to the application name is xingxingzhibiaogongshi. Taking the first letter of the pinyin for each character in the application name yields the corresponding abbreviated pinyin string, xxzbgs. Using the LCS algorithm, the length of the longest common substring between the full pinyin string and the domain name string is determined to be 0, and the length of the longest common substring between the abbreviated pinyin string and the domain name string is determined to be 6. Since there is a significant difference between the lengths of the full pinyin string and the abbreviated pinyin string, mapping rules between their respective lengths and sub-association evaluation values ​​can be set for each.

[0192] See Figure 10A This is one of the schematic diagrams illustrating the mapping rule between length and sub-association evaluation value provided in the embodiments of this application. The mapping rule between the length of the full-character string and the sub-association evaluation value can be as follows: Figure 10A As shown, x represents the length of the longest common substring. When the length is greater than or equal to 8, the sub-association evaluation value is 3; when the length is greater than or equal to 6 and less than 8, the sub-association evaluation value is 2; when the length is greater than or equal to 4 and less than 6, the sub-association evaluation value is 1; and when the length is less than 4, the sub-association evaluation value is 0. Based on this, through... Figure 10A The mapping rule shown can determine that the sub-evaluation value corresponding to the full spelling string is 0.

[0193] See Figure 10B This is one of the schematic diagrams illustrating the mapping rules between length and sub-association evaluation values ​​provided in the embodiments of this application. The mapping rule between the length of the abbreviated string and the sub-association evaluation value can be as follows: Figure 10B As shown, x represents the length of the longest common substring. When the length is greater than or equal to 5, the sub-association evaluation value is 3; when the length is greater than or equal to 4 and less than 5, the sub-association evaluation value is 2; when the length is greater than or equal to 3 and less than 4, the sub-association evaluation value is 1; and when the length is less than 3, the sub-association evaluation value is 0. Based on this, through... Figure 10B The mapping rule shown can determine that the sub-evaluation value corresponding to the abbreviated string is 3.

[0194] The maximum value between the sub-evaluation value corresponding to the full spelling string and the sub-evaluation value corresponding to the abbreviated spelling string is 3. Therefore, it can be determined that the sub-evaluation value corresponding to the next candidate domain name under this strategy is 3.

[0195] In one possible implementation, when the application name is not in Chinese, the sub-association evaluation value corresponding to the next candidate domain name of this strategy can also be determined according to the following method:

[0196] If the application name is in English and consists of only one word, it can be converted to lowercase to obtain the full spelling string. For example, if the application name is Orange, the full spelling string would be "orange". Then, based on the degree of overlap between the full spelling string and the domain name string, the sub-association evaluation value corresponding to the next candidate domain name can be determined for this strategy.

[0197] If the application name consists of multiple words, it is converted to lowercase, and spaces are removed to obtain the full spelling string. For example, if the application name is "See You Tomorrow," the full spelling string would be "seeyoutomorrow." Then, based on the first letter of each word, an abbreviated spelling string is obtained. For example, if the application name is "See You Tomorrow," the abbreviated spelling string would be "syt." Finally, based on the degree of overlap between the domain name string and the full spelling string, and the degree of overlap between the domain name string and the abbreviated spelling string, a sub-association evaluation value for a candidate domain name is obtained.

[0198] When the application name is in a language other than Chinese or English, it can be converted into a full Pinyin string composed of English letters based on the pronunciation or phonetic symbols of the application name. Then, based on the first letter of the English word in the full Pinyin string, an abbreviated Pinyin string is determined. Finally, based on the degree of overlap between the domain name string and the full Pinyin string, and the degree of overlap between the domain name string and the abbreviated Pinyin string, a sub-association evaluation value of a candidate domain name is obtained.

[0199] It should be noted that the specific method for determining the sub-association evaluation value corresponding to a candidate domain name based on the degree of overlap between strings can be found in the relevant description in the above method embodiments, and will not be repeated here.

[0200] Based on the above scheme, since many applications usually use the full or abbreviated spelling of their application name as their application domain name, if the domain name string of the candidate domain name has a high degree of overlap with the full or abbreviated spelling string, it can be determined that the candidate domain name is more likely to be obtained from the application domain name, and thus the candidate domain name that can be obtained from the application domain name can be effectively mined.

[0201] Strategy 3: Conduct correlation analysis between application names and website content of candidate domains.

[0202] A web crawler is performed on a candidate domain to obtain its website content. Then, semantic parsing is performed on the website content corresponding to both the application name and the candidate domain. Based on the semantic parsing results, the semantic similarity between the application name and the website content is obtained. Finally, based on the semantic similarity, a sub-association evaluation value for the candidate domain is obtained, where semantic similarity and sub-association value are positively correlated.

[0203] Specifically, crawling a candidate domain yields website content, which typically includes information such as the theme and keywords used during website development. To facilitate subsequent semantic analysis, the website content can be preprocessed; for example, irrelevant semantic information such as Cascading Style Sheets (CSS) formatting can be removed. This results in a string composed of Chinese, English, or other characters. Then, the application name and the corresponding string of website content can be input into a large language model. The model can then perform semantic analysis on this string to determine the semantic similarity between the application name and the website content, and ultimately output the sub-association evaluation value for the next candidate domain under this strategy.

[0204] In one example, see Figure 11 This diagram illustrates the association analysis process between application names and website content of candidate domains, as provided in this application embodiment. Figure 11 As shown, assuming the application name is "Happy Fitness," a candidate domain name obtained through web scraping might contain the following strings: "[Yuedongquan] Running, the benefits of running, exercise, fitness, cycling, exercise is the source of happiness." The application name and the corresponding strings of the website content can be input into the application name "Happy Fitness." By using a few-shot prompt to ask questions of the large language model, the model can be guided to generate outputs of a specific type or format. For example, the mapping rules between semantic similarity and sub-association evaluation values, as well as the data type of the sub-association evaluation values, can be written into the few-shot prompt, allowing the large language model to directly output integer (int) sub-association evaluation values. Since "[Yuedongquan] Running, the benefits of running, exercise, fitness, cycling, exercise is the source of happiness" has a high semantic similarity to "Happy Fitness," the output sub-association evaluation value can be 3.

[0205] In addition, small sample hints refer to filling a small number of samples into text hints to help large models improve their adaptive and self-learning abilities, thereby generating more accurate results. In other words, by giving large language models a small number of high-quality examples containing input and expected output, the models can better understand human intent and the criteria for generating accurate output. For example, a small sample prompt could be as follows: "I obtained a domain name from an application called [%s] by unpacking it. After web scraping, I obtained the website content [%s]. Please help me output the association score between the application name and the website content based on their similarity. Requirements:\n1. If the website content directly contains the name, the score is 3.\n2. If the website content is empty, the score is 0.\n3. Perform semantic analysis on the website content. If the semantic similarity is high, the score is high, and vice versa.\nYour answer only needs to give me an int (range 0-3), no analysis process, no other answers.\nExpected input: Application name: Horoscope; Website content: Today's horoscope, Scorpio, Libra, Aries, Gemini, Leo. Expected output: 3.\n```\n%s\n```"

[0206] In practical applications, the large language model can write the application name and website content of the application to be identified at %s, for example, for Figure 11 The example shown could have "Happy Fitness" written at the first %s, and the string corresponding to the website content inserted at the %s after "Website content obtained". The association score is the sub-association evaluation value under this strategy. Furthermore, at the end of the above limited sample hints, an example of expected input and expected output is also given.

[0207] It should be noted that web crawling can be performed using web crawling methods from relevant technologies. The large language model can be selected based on the actual situation or experience. For example, models such as GPT-4, mixed-component models, generative language models (GLM), Llama, and Gemini can be used. This application does not limit this.

[0208] Based on the above scheme, since the application name and the website content of its own application domain are usually matched, if the semantic similarity between the application name and the website content is high, it can be determined that the application domain is more likely to be obtained based on the candidate domain, and thus the candidate domains that can be obtained can be effectively mined.

[0209] Strategy 4: Conduct correlation analysis between content information and the service type of candidate domains.

[0210] Obtain at least one service type for a candidate domain name, then perform semantic parsing on the content information and service type respectively, and obtain the semantic similarity between the content information and service scope based on the semantic parsing results. Then, obtain the sub-association evaluation value of a candidate domain name based on the semantic similarity, where the semantic similarity and the sub-association value are positively correlated.

[0211] Specifically, a domain body query can be performed on a candidate domain to obtain at least one service type for the candidate domain. The service type can refer to the tag corresponding to the domain body, such as online job search, education, or shopping. Then, the content information and at least one service type are input into a large language model. The large language model can then perform semantic parsing on the content information and at least one service type to determine the semantic similarity between the content information and at least one service type, and thus output the sub-association evaluation value of a candidate domain under this strategy.

[0212] In one example, see Figure 12 This diagram illustrates the association analysis process between content information and service types of candidate domains provided in this application embodiment. Since the extracted content information may include various forms of text, it can be formatted using a custom JSON plugin before being input into the large model. Assume the extracted content information of the application to be identified includes waiter, catering, telemarketing, security, housekeeping, and business driver, and the service type of a candidate domain includes: online job seeking. The LangChain architecture can be used to interact with the large language model, using zero-shot prompts to guide the large model in semantic parsing and semantic similarity analysis. A pre-configured JsonOutPutParser component is used to parse and process the JSON-formatted output data, removing unnecessary redundant information, and finally obtaining the sub-association evaluation value.

[0213] The zero-sample prompt can be as follows: Help me analyze: The service type of the domain name is [%s]. Does the service type of the application with content information [%s] also have the service type [%s]? Your answer only needs to be an int (range 0-3). Do not provide the analysis process or any other answers.

[0214] In practical applications, the large language model can write the content information of the application to be identified and the service type of the domain name at %s, for example, for Figure 12 The example shown allows you to write the service type of the domain name, "online job search," in the first and third %s fields, and insert the content information, "waiter, catering, telemarketing, security, housekeeping, business driver," in the second %s field.

[0215] Because online job postings have a high semantic similarity to "waiter, restaurant, telemarketer, security guard, housekeeper, business driver", the sub-association evaluation value can be 3.

[0216] It should be noted that the content of the zero-sample prompt can be set based on experience or actual situation, and this application does not limit it.

[0217] Based on the above scheme, since the content information should usually include content information related to the service type of the application domain, if the semantic similarity between the content information and the service type of the candidate domain is high, it can be determined that the application domain is likely to be obtained based on the candidate domain, and thus the candidate domain that can be obtained can be effectively mined.

[0218] Strategy 5: Conduct correlation analysis between the developer's name and the domain registrants of the candidate domains.

[0219] Common characters are removed from the developer's name and the domain registrar's name of a candidate domain, respectively, to obtain the developer's text sequence and the domain registrar's text sequence. Then, based on the degree of overlap between the developer's text sequence and the domain registrar's text sequence, a sub-association evaluation value for a candidate domain is obtained, where the degree of overlap is positively correlated with the sub-association evaluation value.

[0220] Specifically, common characters in the developer's name and the domain name registrant's name can include: "Limited Company", "Limited Liability Company", "Technology Limited Company", "Joint-Stock Company", "Information Technology Company", "Network Technology Company", etc. After removing these common characters, the length of the longest common substring between the developer's text sequence and the domain name registrant's text sequence can be determined using the LCS algorithm. Then, the sub-association evaluation value corresponding to a candidate domain name under this strategy is obtained through the mapping rule between the length and the sub-association evaluation value.

[0221] In some embodiments, if the developer's name cannot be extracted from the installation package of the application to be identified, the developer's name can be retrieved by searching the application's package name on an internet search engine, or it can be obtained through cooperation with various app stores and publicly available app download sites on the internet. The domain name registrant can be obtained by querying the filing entity through a candidate domain name.

[0222] Based on this, the mapping rule between length and sub-association evaluation value can be as follows: if the developer name of the application to be identified cannot be found, or the domain name registrant cannot be obtained, the sub-association evaluation value is 0; if the developer text sequence is exactly the same as the registrant text sequence, the sub-association evaluation value is 3; if the developer text sequence contains the registrant text sequence, or the registrant text sequence contains the developer text sequence, the sub-association evaluation value is 2; if the length of the longest common substring is greater than 3, the sub-association evaluation value is 1; if other cases not covered by the above rules occur, the sub-association evaluation value is 0.

[0223] For example, suppose the developer's name is Xingxingdiandeng Co., Ltd., and the domain name registrant of a candidate domain name is Xingxing Co., Ltd. Then the developer's text sequence could be: Xingxingdiandeng, and the domain name registrant's text sequence could be: Xingxing. According to the mapping rules above, since the developer's name includes the domain name registrant, the sub-association evaluation value corresponding to a candidate domain name can be determined to be 2.

[0224] Optionally, when calculating the degree of overlap between the developer's text sequence and the registrant's text sequence, text vector similarity algorithms (such as cosine similarity, Euclidean distance, etc.), edit distance (Levenshtein Distance) algorithm, Smith-Waterman algorithm, and other text comparison algorithms can be used, and the mapping rules can be adjusted according to the corresponding algorithm. This application does not limit the algorithm used to calculate the degree of overlap.

[0225] Based on the above scheme, since the developer's name and the domain name registrant of the candidate domain name are usually the same company or there is a certain relationship between the companies, if the overlap between the developer's name and the domain name registrant of the candidate domain name is high, it can be determined that the candidate domain name is more likely to be used to obtain the application domain name, and thus the candidate domain name that can be used to obtain the application domain name can be effectively identified.

[0226] In some embodiments, when fusing at least one sub-association evaluation value to obtain the association evaluation value of a candidate domain name, the at least one sub-association evaluation value can be directly added together to obtain the association evaluation value of the candidate domain name. For example, assuming that for the candidate domain name aaa.com, the sub-association evaluation value obtained through strategy one is 3, the sub-association evaluation value obtained through strategy two is 2, the sub-association evaluation value obtained through strategy three is 3, the sub-association evaluation value obtained through strategy four is 3, and the sub-association evaluation value obtained through strategy five is 3, then the association evaluation value corresponding to the candidate domain name aaa.com is 3+2+3+3+3=14.

[0227] It should be noted that when fusing at least one sub-association evaluation value, it can also be achieved by setting the weight of each strategy and using a weighted fusion method. This application does not limit the fusion method.

[0228] In one possible implementation, before fusing at least one sub-association evaluation value to obtain the association evaluation value of a candidate domain, an additional evaluation value for the candidate domain can be obtained based on the number of subdomains corresponding to the main domain within the candidate domain. Here, the number of subdomains refers to the number of candidate domains containing the main domain, and the number of subdomains is positively correlated with the additional evaluation value. Then, when obtaining the association evaluation value, at least one sub-association evaluation value can be fused with the additional evaluation value to obtain the association evaluation value of the candidate domain.

[0229] Specifically, when obtaining the additional evaluation value of a candidate domain name, it can be based on the mapping rule between the number of subdomains and the additional evaluation value. For example, the mapping rule between the number of subdomains and the additional evaluation value can be: if the number of subdomains is greater than or equal to 4, then the additional evaluation value is 3; if the number of subdomains is less than 4 but greater than or equal to 3, then the additional evaluation value is 2; if the number of subdomains is less than 3 but greater than or equal to 2, then the additional evaluation value is 1; if the number of subdomains is less than 2, then the additional evaluation value is 0.

[0230] In one example, see Figure 13 This is a schematic diagram illustrating the process of obtaining additional evaluation values ​​provided in an embodiment of this application. If a candidate domain is api.cert.agrisaas.com, then the primary domain of this candidate domain is agrisaas.com. If the primary domain bucket corresponding to this primary domain also includes: test.nz.agrisaas.com, help.agrisaas.com, and shop.agrisaas.com, then the number of subdomains can be determined to be 4, and the additional evaluation value is 3.

[0231] Then, when calculating the association evaluation value, it can be added to at least one obtained sub-association evaluation value to obtain the association evaluation value of the candidate domain name. It should be noted that when fusing at least one sub-association evaluation value with the additional evaluation value, it can also be achieved by setting the weight of each strategy and using a weighted fusion method. This application does not limit the fusion method.

[0232] Based on the above scheme, since different services in an application are usually accessed through multiple subdomains of the same main domain, the more subdomains a main domain includes, the higher the probability that the main domain is the application domain. In other words, the higher the probability of obtaining the application domain by using candidate domains that contain the main domain, the more effectively candidate domains that can be used to obtain the application domain can be discovered.

[0233] In some embodiments, based on the association evaluation value of each candidate domain, a candidate domain with an association evaluation value not less than a preset evaluation value threshold is selected from among the candidate domains, and the application domain of the application to be identified is obtained based on the selected candidate domain. If there are multiple candidate domains with an association evaluation value not less than the preset evaluation value threshold, a candidate domain is randomly selected, or a candidate domain with an association evaluation value greater than the association evaluation values ​​of the other candidate domains is selected.

[0234] Since candidate domains with association evaluation values ​​not less than a preset evaluation value threshold are usually subdomains belonging to the same main domain, when multiple candidate domains with association evaluation values ​​not less than the preset evaluation value threshold exist, one candidate domain can be randomly selected, and its main domain can be used as the application domain. Alternatively, to ensure more accurate identification of the application domain, the candidate domain with the highest association evaluation value can be selected, and its main domain can be used as the application domain.

[0235] It should be noted that the association evaluation value not less than the preset evaluation value threshold is only one example of the preset screening conditions. The preset screening conditions can also be set according to the actual situation or experience. For example, it can also be to select the candidate domain name with the largest association evaluation value. This application does not limit this.

[0236] In some embodiments, after the application domain name is determined, its accuracy can be verified by manual review. If the application domain name is determined to be correct, step 304 is executed. If the application domain name is incorrect, steps 301-303 can be repeated until the correct application domain name is obtained.

[0237] In one implementation, see Figure 14 This diagram illustrates the process of obtaining the association evaluation value provided in this application embodiment. Based on the application description information and relevant information of the candidate domain names, the association evaluation value of each candidate domain name is obtained through one or more of the above strategies one to five and additional strategies. The additional strategy is a strategy that obtains an additional evaluation value for each candidate domain name based on the number of subdomains corresponding to the main domain. In the application process, each strategy can utilize different atomic capabilities, such as web crawling, large language model analysis, LCS algorithm, and filing entity query.

[0238] Step 304: Match the application domain name with the pre-stored registered application data to obtain the registration result of the application to be identified.

[0239] The application domain name is matched against each domain name included in the pre-stored data of registered applications. If any registered application domain name is matched, the application to be identified is determined to be registered. Conversely, if no registered application domain name is matched, the application to be identified is determined to be unregistered.

[0240] Furthermore, network access service providers can use the registration results to determine whether to provide network access services to the application to be identified. That is, if the application to be identified has been registered, network access services will be provided to it; if the application to be identified has not been registered, network access services will be refused.

[0241] Based on the same inventive concept as the above method embodiments, see [link to relevant documentation]. Figure 15 This is a schematic diagram of the system architecture for the application registration result identification system provided in this application embodiment. In this system, at least one application download link is first obtained. Then, the download links are whitelisted, and the filtered download links are used as the download links for the applications to be identified, resulting in at least one installation package for the application to be identified. These installation packages are then unpacked using AAPT to obtain the corresponding package name and application name. The obtained package name, application name, and installation package are then cached. Next, each cached installation package for the application to be identified is sequentially unpacked and analyzed, and SDK domain name filtering is performed to obtain the application description information and at least one candidate domain name for each application to be identified. Then, an association evaluation value is calculated for each candidate domain name to obtain the application domain name for the application to be identified. Finally, the application domain name is matched with the registered application data to obtain the registration result of the application to be identified.

[0242] Based on the same inventive concept as the above-described method embodiments, this application also provides an application-based device for identifying filing results. For example... Figure 16 The filing result recognition device 1600 for the application shown may include:

[0243] The information extraction unit 1601 is used to extract the application description information of the application to be identified, as well as multiple access domain names involved in the operation, from the installation package of the application to be identified.

[0244] The third-party service domain name filtering unit 1602 is used to match the multiple access domain names with a preset set of third-party service domain names, and filter out each access domain name that does not match any third-party service domain name as a candidate domain name; the set of third-party service domain names includes: service domain names other than the application to be identified;

[0245] The application domain name selection unit 1603 is used to select candidate domain names whose correlation with the application description information of the application to be identified meets the preset screening conditions from the candidate domain names based on the degree of correlation between the application description information of the application to be identified and each candidate domain name, and use them as the application domain names of the application to be identified.

[0246] The filing result identification unit 1604 is used to match the application domain name with the pre-stored filed application data to obtain the filing result of the application to be identified.

[0247] In one possible implementation, the information extraction unit 1601 extracts the application description information and multiple access domains involved in the operation of the application to be identified from the installation package of the application to be identified. Specifically, it is used to: decompress the installation package of the application to be identified to obtain each resource file of the application to be identified, and extract the application description information of the application to be identified from each resource file; the resource files are used to describe the static resources involved in the application to be identified; match each resource file with a pre-stored set of protective shell source files to obtain a matching result; the set of protective shell source files includes protective shell source files with different shelling methods, and each protective shell source file is the original file for shelling the application; the matching result indicates whether the application to be identified has been shelled; and unpack and parse the installation package according to the parsing method corresponding to the matching result to extract multiple access domains involved in the operation.

[0248] In one possible implementation, the information extraction unit 1601 unpacks and parses the installation package using the parsing method corresponding to the matching result, extracting multiple access domain names involved in the operation process. Specifically, it is used to: when the matching result indicates that the application to be identified is not packed, decompile the installation package to obtain the functional files of the application to be identified, and extract multiple access domain names involved in the operation process from the functional files; the functional files are used to describe the functions and operating logic of the application to be identified; when the matching result indicates that the application to be identified is packed, install and run the application to be identified through an emulator, monitor the network communication during the operation of the application to be identified, and extract multiple access domain names involved in the operation process from the monitoring results.

[0249] In one possible implementation, the information extraction unit 1601 monitors network communication during the operation of the application to be identified, and extracts multiple access domain names involved in the operation from the monitoring results. Specifically, it is used to: monitor network communication during the operation of the application to be identified, obtain Domain Name System (DNS) traffic packets, and parse the DNS traffic packets to obtain a first monitoring result; the DNS traffic packets are data packets transmitted through the DNS protocol; and add hook functions to functions related to network requests in the application to be identified, and monitor network communication through the hook functions during the operation of the application to be identified to obtain a second monitoring result; the hook functions are preset functions for monitoring network communication; and the multiple domain names extracted from the first monitoring result and the second monitoring result are respectively used as access domain names.

[0250] In one possible implementation, the application domain name selection unit 1603, based on the degree of association between the application description information of the application to be identified and each candidate domain name, selects candidate domain names whose association degree meets preset screening conditions from among the candidate domain names, and before obtaining the application domain name of the application to be identified based on the selected candidate domain names, further performs the following operations for each candidate domain name: based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name, obtains at least one sub-association evaluation value corresponding to the candidate domain name; each type of sub-description information is used to describe a basic feature of the application to be identified; the at least one sub-association evaluation value is fused to obtain the association evaluation value of the candidate domain name; the association evaluation value is positively correlated with the degree of association.

[0251] In one possible implementation, the sub-description information includes a package name. The application domain name selection unit 1603 obtains at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name. Specifically, it is used to: perform character parsing on the package name and the candidate domain name respectively to obtain the package name string of the package name and the domain name string of the candidate domain name; obtain the sub-association evaluation value corresponding to the candidate domain name based on the degree of overlap between the package name string and the domain name string; the degree of overlap is positively correlated with the sub-association evaluation value.

[0252] In one possible implementation, the sub-description information includes the application name. The application domain name selection unit 1603 obtains at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name. Specifically, it is used to: perform character parsing on the candidate domain name to obtain the domain name string of the candidate domain name; perform speech transcription on the application name to obtain the full pinyin string and the abbreviated pinyin string corresponding to the application name; and obtain the sub-association evaluation value of the candidate domain name based on the degree of overlap between the domain name string and the full pinyin string, and the degree of overlap between the domain name string and the abbreviated pinyin string; the degree of overlap is positively correlated with the sub-association evaluation value.

[0253] In one possible implementation, the sub-description information includes an application name. The application domain name selection unit 1603 obtains at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name. Specifically, it is used to: crawl the candidate domain name to obtain the website content of the candidate domain name; perform semantic parsing on the application name and the website content corresponding to the candidate domain name respectively, and obtain the semantic similarity between the application name and the website content based on the semantic parsing results; obtain the sub-association evaluation value of the candidate domain name based on the semantic similarity; the semantic similarity is positively correlated with the sub-association value.

[0254] In one possible implementation, the sub-description information includes content information, which represents text information related to the service content of the application; the application domain name selection unit 1603 obtains at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name, specifically used for: obtaining at least one service type of the candidate domain name; performing semantic parsing on the content information and the at least one service type respectively, and obtaining the semantic similarity between the content information and the at least one service type based on the semantic parsing results; obtaining the sub-association evaluation value of the candidate domain name based on the semantic similarity; the semantic similarity is positively correlated with the sub-association value.

[0255] In one possible implementation, the sub-description information includes the developer's name; the application domain name selection unit 1603 obtains at least one sub-association evaluation value corresponding to the candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of the candidate domain name, specifically used for: removing common characters from the developer's name and the domain name registrant of the candidate domain name respectively to obtain a developer's text sequence and a domain name registrant text sequence; obtaining a sub-association evaluation value of the candidate domain name based on the degree of overlap between the developer's text sequence and the domain name registrant text sequence; the degree of overlap is positively correlated with the sub-association evaluation value.

[0256] In one possible implementation, before fusing the at least one sub-association evaluation value to obtain the association evaluation value of a candidate domain, the application domain name selection unit 1603 is further configured to: obtain an additional evaluation value of the candidate domain based on the number of subdomains corresponding to the main domain in the candidate domain; the number of subdomains is the number of candidate domains containing the main domain; the number of subdomains is positively correlated with the additional evaluation value; specifically, fusing the at least one sub-association evaluation value with the additional evaluation value to obtain the association evaluation value of the candidate domain is configured to: fuse the at least one sub-association evaluation value with the additional evaluation value to obtain the association evaluation value of the candidate domain.

[0257] In one possible implementation, the application domain name selection unit 1603 selects candidate domain names whose association degree meets preset screening conditions from among the candidate domain names based on the application description information of the application to be identified and each candidate domain name, and obtains the application domain name of the application to be identified based on the selected candidate domain name. Specifically, it is used to: select a candidate domain name whose association evaluation value is not less than a preset evaluation value threshold from among the candidate domain names based on the association evaluation value of each candidate domain name, and obtain the application domain name of the application to be identified based on the selected candidate domain name; wherein, if there are multiple candidate domain names whose association evaluation value is not less than the preset evaluation value threshold, a candidate domain name is randomly selected, or a candidate domain name whose association evaluation value is greater than the association evaluation value of other candidate domain names is selected.

[0258] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program with a predetermined function, which works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functions of that module or unit.

[0259] After introducing the filing result identification method and apparatus of the application of the exemplary embodiments of this application, the computer device according to another exemplary embodiment of this application will be introduced next.

[0260] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0261] Based on the same inventive concept as the above-described method embodiments, this application also provides a computer device. In one embodiment, the computer device may be a server, such as... Figure 2 The server 220 is shown. In this embodiment, the computer device is structured as follows: Figure 17 As shown, it may include at least a memory 1701, a communication module 1703, and at least one processor 1702.

[0262] The memory 1701 is used to store computer programs executed by the processor 1702. The memory 1701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0263] Memory 1701 may be volatile memory, such as random-access memory (RAM); memory 1701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 1701 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 1701 may be a combination of the above-described memories.

[0264] Processor 1702 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 1702 is used to implement the filing result identification method of the above application when calling the computer program stored in memory 1701.

[0265] The communication module 1703 is used to communicate with terminal devices and other servers.

[0266] This application embodiment does not limit the specific connection medium between the memory 1701, communication module 1703, and processor 1702. This application embodiment... Figure 17 The memory 1701 and the processor 1702 are connected via a bus 1704, and the bus 1704 is in Figure 17 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 1704 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 17 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0267] The memory 1701 stores a computer storage medium, which stores computer-executable instructions for implementing the filing result identification method of the application in this embodiment. The processor 1702 is used to execute the aforementioned filing result identification method of the application, such as... Figure 3 As shown.

[0268] In another embodiment, the computer device can also be other computer devices, such as... Figure 2 The terminal device 210 is shown. In this embodiment, the structure of the computer device can be as follows: Figure 18 As shown, it includes components such as: communication component 1810, memory 1820, display unit 1830, camera 1840, sensor 1850, audio circuit 1860, Bluetooth module 1870, processor 1880, etc.

[0269] The communication component 1810 is used to communicate with the server. In some embodiments, it may include a Wireless Fidelity (WiFi) module, which is a short-range wireless transmission technology, and the electronic device can send and receive information through the WiFi module.

[0270] The memory 1820 can be used to store software programs and data. The processor 1880 executes various functions of the terminal device 110 and performs data processing by running the software programs or data stored in the memory 1820. The memory 1820 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The memory 1820 stores an operating system that enables the terminal device 110 to run. In this application, the memory 1820 may store the operating system and various application programs, and may also store a computer program that executes the filing result identification method applied in the embodiments of this application.

[0271] The display unit 1830 can also be used to display information input by an object or information provided to an object, as well as a graphical user interface (GUI) for various menus of the terminal device 110. Specifically, the display unit 1830 may include a display screen 1832 disposed on the front of the terminal device 110. The display screen 1832 may be configured as a liquid crystal display, a light-emitting diode, or the like.

[0272] The display unit 1830 can also be used to receive input digital or character information and generate signal inputs related to object settings and function control of the terminal device 110. Specifically, the display unit 1830 may include a touch screen 1831 disposed on the front of the terminal device 110, which can collect touch operations on or near the object, such as clicking a button, dragging a scroll bar, etc.

[0273] The touchscreen 1831 can be placed on top of the display screen 1832, or the touchscreen 1831 and the display screen 1832 can be integrated to realize the input and output functions of the terminal device 110. After integration, it can be referred to as a touch display screen. In this application, the display unit 1830 can display the application and the corresponding operation steps.

[0274] Camera 1840 can be used to capture still images, and objects can publish images captured by camera 1840 through an application. There can be one or multiple cameras 1840. An optical image of an object is generated through a lens and projected onto a photosensitive element. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then transmitted to processor 1880 to be converted into a digital image signal.

[0275] The terminal device may also include at least one sensor 1850, such as an accelerometer 1851, a proximity sensor 1852, a fingerprint sensor 1853, and a temperature sensor 1854. The terminal device may also be equipped with other sensors such as a gyroscope, barometer, hygrometer, thermometer, infrared sensor, light sensor, and motion sensor.

[0276] Audio circuitry 1860, speaker 1861, and microphone 1862 provide an audio interface between the device and terminal device 110. Audio circuitry 1860 converts received audio data into electrical signals, which are then transmitted to speaker 1861, where they are converted into sound signals for output. Terminal device 110 may also be equipped with volume buttons for adjusting the volume of the sound signal. On the other hand, microphone 1862 converts collected sound signals into electrical signals, which are then received by audio circuitry 1860, converted into audio data, and output to communication component 1810 for transmission to, for example, another terminal device 110, or to memory 1820 for further processing.

[0277] The Bluetooth module 1870 is used to interact with other Bluetooth devices that also have a Bluetooth module via the Bluetooth protocol. For example, a terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smartwatch) that also has a Bluetooth module through the Bluetooth module 1870, thereby exchanging data.

[0278] The processor 1880 is the control center of the terminal device, connecting various parts of the terminal through various interfaces and lines. It executes various functions and processes data by running or executing software programs stored in the memory 1820 and calling data stored in the memory 1820. In some embodiments, the processor 1880 may include one or more processing units; the processor 1880 may also integrate an application processor and a baseband processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the baseband processor mainly handles wireless communication. It is understood that the baseband processor may not be integrated into the processor 1880. In this application, the processor 1880 can run the operating system, applications, user interface display and touch response, and the filing result recognition method of the application in this embodiment. Furthermore, the processor 1880 is coupled to the display unit 1830.

[0279] Furthermore, it should be noted that in the specific implementation of this application, object data related to the identification of application filing results is involved. When the above embodiments of this application are applied to specific products or technologies, permission or consent from the object is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0280] In some possible implementations, various aspects of the application filing result identification method provided in this application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on a computer device, the computer program causes the computer device to perform the steps in the application filing result identification method according to various exemplary embodiments of this application described above. For example, the computer device can perform actions such as... Figure 3 The steps are shown in the figure.

[0281] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0282] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0283] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0284] Computer programs contained on readable media may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0285] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on the user's computer device, partially on the user's computer device, as a standalone software package, partially on the user's computer device and partially on a remote computer device, or entirely on a remote computer device. In cases involving remote computer devices, the remote computer device can be connected to the user's computer device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer device (e.g., via the Internet using an Internet service provider).

[0286] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0287] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0288] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing a computer-usable computer program.

[0289] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0290] These computer program commands may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the commands stored in the computer-readable storage medium produce an article of manufacture including command means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0291] These computer program commands can also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing the commands executed on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0292] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0293] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying the filing results of an application, characterized in that, include: Extract the application description information of the application to be identified, as well as the multiple access domains involved in the operation, from the installation package of the application to be identified; The multiple access domains are matched with a preset set of third-party service domains, and each access domain that does not match any third-party service domain is selected as a candidate domain. The set of third-party service domain names includes: service domain names other than the application to be identified; Based on the degree of association between the application description information of the application to be identified and each candidate domain name, candidate domain names whose degree of association meets the preset screening conditions are selected from each candidate domain name, and the application domain name of the application to be identified is obtained based on the selected candidate domain names. The application domain name is matched with the pre-stored data of registered applications to obtain the registration result of the application to be identified.

2. The method according to claim 1, characterized in that, The step of extracting the application description information of the application to be identified, as well as multiple access domains involved in its operation, from the installation package of the application to be identified includes: The installation package of the application to be identified is decompressed to obtain the resource files of the application to be identified, and the application description information of the application to be identified is extracted from the resource files; the resource files are used to describe the static resources involved in the application to be identified. Each resource file is matched with a pre-stored set of protective shell source files to obtain a matching result; the set of protective shell source files includes protective shell source files with different shelling methods, and each protective shell source file is the original file used to shell the application; the matching result indicates whether the application to be identified has been shelled; The installation package is unpacked and parsed using the parsing method corresponding to the matching result, and multiple access domains involved in the operation are extracted.

3. The method according to claim 2, characterized in that, The installation package is unpacked and parsed using the parsing method corresponding to the matching result to extract multiple access domains involved in the operation, including: When the matching result indicates that the application to be identified is not packed, the installation package is decompiled to obtain the functional files of the application to be identified, and multiple access domain names involved in the operation are extracted from the functional files; the functional files are used to describe the functions and operation logic of the application to be identified. When the matching result indicates that the application to be identified has been packed, the application to be identified is installed and run through an emulator. The network communication during the operation of the application to be identified is monitored, and multiple access domain names involved in the operation are extracted from the monitoring results.

4. The method according to claim 3, characterized in that, The monitoring of network communication during the operation of the application to be identified, and the extraction of multiple access domain names involved in the operation from the monitoring results, including: The network communication during the operation of the application to be identified is monitored to obtain Domain Name System (DNS) traffic packets, and the DNS traffic packets are parsed to obtain a first monitoring result; the DNS traffic packets are data packets transmitted through the DNS protocol. Furthermore, hook functions are added to the functions related to network requests in the application to be identified, and network communication is monitored through the hook functions during the operation of the application to be identified to obtain a second monitoring result; the hook functions are preset functions for monitoring network communication. Multiple domain names extracted from the first monitoring result and the second monitoring result will be used as access domain names.

5. The method according to any one of claims 1-4, characterized in that, Before selecting candidate domains that meet preset filtering criteria based on the correlation between the application description information of the application to be identified and each candidate domain, and before obtaining the application domain of the application to be identified based on the selected candidate domains, the method further includes: For each of the candidate domain names, perform the following operations: Based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name, at least one sub-association evaluation value corresponding to the candidate domain name is obtained; each type of sub-description information is used to describe a basic feature of the application to be identified. The association evaluation values ​​of the at least one sub-association are fused to obtain the association evaluation value of the candidate domain name; the association evaluation value is positively correlated with the degree of association.

6. The method according to claim 5, characterized in that, The sub-description information includes the package name. The step of obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name includes: The package name and the candidate domain name are parsed separately to obtain the package name string and the domain name string of the candidate domain name; Based on the degree of overlap between the package name string and the domain name string, a sub-association evaluation value corresponding to a candidate domain name is obtained; the degree of overlap is positively correlated with the sub-association evaluation value.

7. The method according to claim 5, characterized in that, The sub-description information includes the application name. The step of obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name includes: The candidate domain name is parsed to obtain the domain name string of the candidate domain name; The application name is transcribed from speech to obtain the full and abbreviated pinyin strings corresponding to the application name. The sub-association evaluation value of a candidate domain name is obtained based on the degree of overlap between the domain name string and the full spelling string, and the degree of overlap between the domain name string and the abbreviated spelling string; the degree of overlap is positively correlated with the sub-association evaluation value.

8. The method according to claim 5, characterized in that, The sub-description information includes the application name. The step of obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name includes: Perform web crawling on the candidate domain name to obtain the website content of the candidate domain name; Semantic parsing is performed on the application name and the website content corresponding to the candidate domain name, respectively, and the semantic similarity between the application name and the website content is obtained based on the semantic parsing results; Based on the semantic similarity, a sub-association evaluation value for the candidate domain name is obtained; the semantic similarity is positively correlated with the sub-association value.

9. The method according to claim 5, characterized in that, The sub-description information includes content information, which represents text information related to the service content of the application; obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name includes: Obtain at least one service type for the candidate domain name; Semantic parsing is performed on the content information and the at least one service type respectively, and the semantic similarity between the content information and the at least one service type is obtained based on the semantic parsing results; Based on the semantic similarity, a sub-association evaluation value for the candidate domain name is obtained; the semantic similarity is positively correlated with the sub-association value.

10. The method according to claim 5, characterized in that, The sub-description information includes the developer's name; obtaining at least one sub-association evaluation value corresponding to a candidate domain name based on the similarity between at least one type of sub-description information in the application description information and the relevant information of a candidate domain name includes: Remove common characters from the developer's name and the domain name registrant of a candidate domain name, respectively, to obtain the developer's text sequence and the domain name registrant's text sequence; The sub-association evaluation value of a candidate domain name is obtained based on the degree of overlap between the developer's text sequence and the domain name registrant's text sequence; the degree of overlap is positively correlated with the sub-association evaluation value.

11. The method according to claim 5, characterized in that, Before fusing the at least one sub-association evaluation value to obtain the association evaluation value of the candidate domain name, the method further includes: An additional evaluation value for a candidate domain is obtained based on the number of subdomains corresponding to the main domain in the candidate domain; the number of subdomains is the number of candidate domains that contain the main domain; the number of subdomains is positively correlated with the additional evaluation value. The step of fusing the at least one sub-association evaluation value to obtain the association evaluation value of the candidate domain name includes: The at least one sub-association evaluation value is fused with the additional evaluation value to obtain the association evaluation value of the candidate domain name.

12. The method according to claim 5, characterized in that, Based on the correlation between the application description information of the application to be identified and each candidate domain name, candidate domain names whose correlation meets preset screening conditions are selected from the candidate domain names, and the application domain name of the application to be identified is obtained based on the selected candidate domain names, including: Based on the association evaluation value of each candidate domain name, a candidate domain name with an association evaluation value not less than a preset evaluation value threshold is selected from the candidate domain names, and the application domain name of the application to be identified is obtained based on the selected candidate domain name. If there are multiple candidate domains whose association evaluation value is not less than a preset evaluation value threshold, then a candidate domain is randomly selected, or a candidate domain whose association evaluation value is greater than that of other candidate domains is selected.

13. A device for identifying the filing results of an application, characterized in that, include: The information extraction unit is used to extract the application description information of the application to be identified, as well as multiple access domain names involved in the operation, from the installation package of the application to be identified. The third-party service domain name filtering unit is used to match the multiple access domain names with a preset set of third-party service domain names, and filter out each access domain name that does not match any third-party service domain name as a candidate domain name; The set of third-party service domain names includes: service domain names other than the application to be identified; The application domain name selection unit is used to select candidate domain names whose correlation with the application description information of the application to be identified meets the preset screening conditions from the candidate domain names based on the degree of correlation between the application description information of the application to be identified and each candidate domain name, and use them as the application domain names of the application to be identified. The filing result identification unit is used to match the application domain name with the pre-stored filed application data to obtain the filing result of the application to be identified.

14. A computer device, characterized in that, It includes a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the method according to any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, It includes program code that, when run on a computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 12.

Images