Application detection method, electronic device and system

Abstract

The application relates to an application detection method, an electronic device and a system, and relates to the technical field of electronic devices, which can accurately detect the face-changing risk of an application and improve the security of the device. The method comprises the following steps: during the running of an application, displaying the running interface of the application; if the similarity between the running interface of the application and the corresponding listing interface of the application is less than a first threshold value, presenting first prompt information, wherein the first prompt information is used to prompt the user that the application has a face-changing risk. By using the method, the similarity between the running interface of the application and the listing interface is small, which means that the interface of the application is changed after the application is listed, and the terminal determines that the application has a face-changing risk. Therefore, even if the application uses an IP address and other countermeasures, since the running interface has been changed compared with the listing interface, the terminal can still detect the face-changing behavior of the application, the detection effect of the face-changing application can be improved, and the security of the device is improved.

Description

Application detection method, electronic device and system

[0001] The present application claims priority to the Chinese patent application No. 202411095500.8, filed on August 9, 2024, and entitled "Application detection method, electronic device and system", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of electronic devices, and in particular to an application detection method, an electronic device and a system. BACKGROUND

[0003] Currently, there are some face-changing applications (APPs), and the face-changing applications can have multiple behavior patterns and can activate different functions or features under different running conditions. For example, a face-changing application passes the application market audit, but later meets certain conditions, and the face-changing application may perform malicious behaviors, such as high-risk advertising, data leakage, privacy invasion, malicious charges, etc. It can be seen that the existence of the face-changing application can lead to the possible leakage of user privacy and low security. SUMMARY

[0004] An application detection method, an electronic device and a system can improve the detection effect of the face-changing application and further improve the security of the device.

[0005] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0006] In a first aspect, an application detection method is provided, which can be applied to a terminal or a component (such as a chip) with or supporting terminal functions. The method comprises: displaying a running interface of an application during the running of the application; and presenting a first prompt information in a case where the similarity between the running interface of the application and a listing interface corresponding to the application is less than a first threshold value, the first prompt information being used to prompt a user that the application has a face-changing risk.

[0007] By using the method, the similarity between the running interface of the application and the listing interface is small, which means that the interface of the application is changed after listing. Accordingly, the terminal determines that the application has a face-changing risk. In this way, even if the application uses an IP address or other countermeasures, since the running interface has been changed with respect to the listing interface, the terminal can still detect the face-changing behavior of the application, which can improve the detection effect of the face-changing application and further improve the security of the device.

[0008] In a possible design, the similarity between the running interface of the application and the corresponding listing interface is less than the first threshold value, which comprises: the similarity between a first running interface of the application and a corresponding first listing interface is less than the first threshold value.

[0009] Alternatively, the similarity between the running interface of the application and the corresponding shelving interface is less than a first threshold value, including: the similarity between N running interfaces of the application and corresponding N shelving interfaces is less than a first threshold value, N is an integer greater than 1.

[0010] With this method, the multiple running interfaces of the application are changed relative to the corresponding shelving interfaces, the terminal can determine that the application has a face-changing risk, and the accuracy of face-changing detection can be improved.

[0011] For example, the first running interface is multiple, such as interfaces A, B, C, and D are first running interfaces. The running interface A corresponds to the shelving interface A', the running interface B corresponds to the shelving interface B', the running interface C corresponds to the shelving interface C', and the running interface D corresponds to the shelving interface D'. When the similarity between the running interface A of the application and the shelving interface A' is less than the first threshold value, the similarity between the running interface B and the shelving interface B' is less than the first threshold value, the similarity between the running interface C and the shelving interface C' is less than the first threshold value, and the similarity between the running interface D and the shelving interface D' is less than the first threshold value, the terminal can determine that the application has a face-changing risk.

[0012] In a possible design, the method further includes: comparing the similarity between the second running interface of the application and the corresponding second shelving interface; the second running interface includes the first running interface.

[0013] Alternatively, the method further includes: comparing the similarity between M running interfaces of the application and corresponding M shelving interfaces; the M running interfaces include the N running interfaces, M is a positive integer, and N is greater than a third threshold value.

[0014] In a possible design, comparing the similarity between the second running interface of the application and the corresponding second shelving interface includes: comparing the similarity between the features of the second running interface and the features of the second shelving interface; wherein the features of each second running interface are determined according to information of the second running interface, and the features of each second shelving interface are determined according to information of the second shelving interface; the information of the second running interface includes at least one of the following information: a screenshot of the second running interface, text of the second running interface, a layout of the second running interface, or an interface call sequence of the second running interface; the information of the second shelving interface includes at least one of the following information: a screenshot of the second shelving interface, text of the second shelving interface, a layout of the second shelving interface, or an interface call sequence of the second shelving interface.

[0015] For example, after the application is uploaded, the text of the interface can be changed, but the text change does not mean that the face is changed. For example, the commodity text of the shopping application can be changed frequently, and the interface is not substantially modified, and no security risk is caused. In addition, the interface layout and API calling sequence of the application are usually unchanged, and if the application is changed, the application can have a face changing behavior. Based on this, the terminal can not compare the features of the text of the interface, and the terminal compares the similarity between the features of the screenshot of the running interface, the features of the layout, and the features of the interface calling sequence and the features of the screenshot of the uploaded interface, the features of the layout, and the features of the interface calling sequence. For example, the features of the screenshot of the running interface, the features of the layout, and the features of the interface calling sequence can constitute a vector (which can be referred to as a running feature), and the features of the screenshot of the uploaded interface, the features of the layout, and the features of the interface calling sequence can constitute a vector (which can be referred to as an uploaded feature). The terminal can compare the similarity between the running feature and the uploaded feature of the application.

[0016] The running feature can further include more or fewer features, and similarly, the uploaded feature can include more or fewer features. As long as the running feature and the uploaded feature can be compared to determine whether the application has substantially changed the interface after being uploaded.

[0017] By using this method, the information of the interface can be converted into corresponding features, which can reduce redundant information and reduce storage and transmission consumption.

[0018] In a possible design, the method further includes: in a case where the risk level of the application is greater than a second threshold, obtaining, from the server, the features of the uploaded interface of the application.

[0019] By using this method, on the one hand, the features of the uploaded interface of the high-risk application can be obtained, which helps to determine whether the high-risk application has a face changing risk by comparing the features of the uploaded interface of the high-risk application and the features of the running interface of the high-risk application, and reduces the security risk of the high-risk application. On the other hand, the features of the uploaded interface of the low-risk application do not need to be obtained, and the transmission overhead can be reduced.

[0020] In a possible design, the method further includes: in a case where the application is downloaded, obtaining, from the server, the features of the uploaded interface of the application.

[0021] In a possible design, the method further includes: in a case where the application is run, obtaining, from the server, the features of the uploaded interface of the application.

[0022] In a possible design, the method further includes: obtaining, from a server, a classifier, where the classifier is used to identify whether the application is a risky application; and training samples of the classifier include features of the listing interfaces of P applications, where P is an integer greater than 1. During execution of the application, a feature of a running interface of the application is input into the classifier, and whether the application is a risky application is identified by the classifier.

[0023] Optionally, the training samples of the classifier further include features of the running interfaces of the risky applications.

[0024] Optionally, the P applications include the risky applications.

[0025] In a possible design, the method further includes: in a case where the application is a risky application, presenting second prompt information, where the second prompt information is used to prompt the user that the application has a security risk.

[0026] Optionally, the method further includes: during execution of the application, obtaining information of a running interface of the application.

[0027] In a possible design, the feature of the running interface is a vector feature output by a model, where the information of the running interface is input into the model; and the feature of the listing interface is a vector feature output by the model, where the information of the listing interface is input into the model.

[0028] In a second aspect, a method for detecting an application is provided, which can be applied to a server or a component (for example, a chip) having or supporting a server function. The method can include: obtaining a feature of a listing interface of an application; sending, to a terminal, the feature of the listing interface of the application; and using the feature of the listing interface of the application and a feature of a running interface corresponding to the application to determine whether the application has a face-changing risk.

[0029] In a possible design, each feature of the listing interface is determined according to information of the listing interface, and the information of the listing interface includes at least one of the following: a screenshot of the listing interface, text of the listing interface, a layout of the listing interface, or an interface call sequence of the listing interface.

[0030] In a possible design, the method further includes: training a classifier, where the classifier is used to identify whether the application is a risky application; training samples of the classifier include features of listing interfaces of P applications, where P is an integer greater than 1; and sending, to the terminal, the classifier.

[0031] In a third aspect, the present application provides an application detection apparatus, which comprises function modules or units or means for performing the method in any possible design of any of the aspects of the present application. The modules can be implemented by software or hardware, or by a combination of software and hardware. For example, the apparatus comprises a processing unit and a communication unit, without limitation.

[0032] In a fourth aspect, the present application provides an application detection apparatus, which comprises a processor configured to perform the method in any design of any of the aspects.

[0033] Optionally, the apparatus further comprises the memory and / or the communication interface.

[0034] The communication interface is coupled to the processor, and the communication interface is configured to input and / or output information.

[0035] The memory is configured to store a computer program, and the processor is configured to perform the method in any design of any of the aspects by executing the computer program stored in the memory.

[0036] Alternatively, the processor can also be a hardware-implemented circuit, such as an artificial intelligence (AI) processor, to improve the running speed. The present application does not limit the specific implementation manner of the processor.

[0037] Optionally, the application detection apparatus can be a whole device or a module in a device, such as a chip.

[0038] In a fifth aspect, the present application provides a computer-readable storage medium, which comprises computer instructions. When the computer instructions run on an electronic device, the electronic device performs the method in any possible design of any of the aspects.

[0039] In a sixth aspect, the present application provides a computer program product, which performs the method in any possible design of any of the aspects when the computer program product runs on an electronic device.

[0040] In a seventh aspect, the present application provides a circuit system (or chip system), which comprises a processing circuit configured to perform the method in any possible design of any of the aspects. The processing circuit can be implemented as a corresponding circuit component, such as one or more processors. For example, the processing circuit is implemented as a processor and a memory. For example, the processing circuit is implemented as a processor and a transceiver.

[0041] In an eighth aspect, an electronic device is provided, which includes a display screen, a processor and a memory, the display screen, the memory and the processor being coupled together, the memory being configured to store program code including instructions, and the processor being configured to read the instructions from the memory to cause the electronic device to perform the method according to any one of the preceding aspects and any one of the possible designs thereof.

[0042] In a ninth aspect, a chip system is provided, which includes at least one processor and at least one interface circuit, the at least one interface circuit being configured to perform a transceiving function and send instructions to the at least one processor, and the at least one processor being configured to perform the method according to the first aspect and any one of the possible designs thereof when executing the instructions.

[0043] In a tenth aspect, an application detection system is provided, which includes the terminal and the server according to any one of the preceding aspects and any one of the possible designs thereof. BRIEF DESCRIPTION OF DRAWINGS

[0044] FIG. 1 is a schematic diagram of an application detection scenario according to the related art;

[0045] FIGS. 2 and 3 are schematic diagrams of an application detection architecture according to embodiments of the present application;

[0046] FIG. 4 is a schematic diagram of an electronic device according to embodiments of the present application;

[0047] FIG. 5 is a schematic diagram of an interface according to embodiments of the present application;

[0048] FIG. 6 is a schematic diagram of an application detection method according to embodiments of the present application;

[0049] FIGS. 7 and 8 are schematic diagrams of an interface according to embodiments of the present application;

[0050] FIG. 9 is a schematic diagram of a scenario of generating a feature vector according to embodiments of the present application;

[0051] FIGS. 10 and 11 are schematic diagrams of an application detection method according to embodiments of the present application;

[0052] FIG. 12 is a schematic diagram of an electronic device according to embodiments of the present application;

[0053] FIG. 13 is a schematic diagram of a chip system according to embodiments of the present application. DETAILED DESCRIPTION

[0054] In the description of the present application, unless otherwise specified, " / " represents that the objects before and after the correlation are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the present application is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone, of which A and B can be singular or plural.

[0055] In the description of the present application, unless otherwise specified, "multiple" means two or more than two. "At least one of the following" or the like means any combination of the items, including any combination of single item or multiple items. For example, at least one of a, b, or c can represent: a, b, c, a and b, a and c, b and c, a and b and c, wherein a, b, and c can be single or multiple.

[0056] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, "first", "second" and the like are used to distinguish the functions and effects of the same items or similar items. The skilled in the art can understand that "first", "second" and the like do not limit the quantity and execution order, and "first", "second" and the like do not necessarily mean different.

[0057] In the technical solutions of the embodiments of the present application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information comply with relevant laws and regulations and do not violate public order and good customs. For example, the processing of user personal information in the technical solutions of the embodiments of the present application is carried out under the authorization of the user. Here, it is uniformly stated that the following will not be described.

[0058] The face-changing application can include one or more normal functions and one or more hidden, potentially malicious deep functions. Among them, the face-changing application can activate the hidden function under certain conditions, i.e., the face-changing behavior is implemented. For example, the face-changing application can determine whether to provide a specific function or service for the device according to device information such as device model, operating system version, hardware configuration, etc., or optimize the execution efficiency of the application according to the performance of the device. For another example, the face-changing application can determine whether to adjust the behavior to implement the hidden function according to the geographic location of the user or the Internet Protocol (IP) address segment of the device. For another example, the face-changing application can activate the hidden function at a specific time or time period. For another example, the face-changing application can trigger the implementation of the hidden function according to the user's behavior pattern or usage habit. For another example, the face-changing application can implement the hidden function when it is connected to a specific server or meets a specific network condition. For another example, the face-changing application can activate the hidden function according to user characteristics such as user's age, gender, interests, etc. For another example, the face-changing application can activate the hidden function according to instructions from the server.

[0059] For example, a face-changing application executes a hidden function at night to provide a high-risk operation interface. The high-risk operation interface may, for example, cause loss of the user's property.

[0060] In some examples, the face-changing application can implement the face-changing behavior by executing dynamic code or Webview, etc.

[0061] Currently, the methods for application security detection of face-changing applications include static analysis and dynamic analysis. Static analysis can also be referred to as static detection. Dynamic analysis can also be referred to as dynamic detection.

[0062] Among them, for the static analysis method, the server analyzes the source code or binary file of the target application during the process of the target application going online, to detect potential security vulnerabilities of the target application. For example, the server obtains the data flow and control flow of the target application, and analyzes the obtained data flow and control flow according to the taint analysis technology to obtain a static analysis result.

[0063] For the dynamic analysis method, the server simulates the running environment of the target application through an emulator or a real machine during the process of the target application going online, and runs the target application in the running environment. The server can also simulate user operations to evaluate the behavior and response of the target application to detect potential vulnerabilities of the target application. For example, the server configures a dynamic detection running environment and uses a dynamic control traversal tool to execute a fixed sequence of operation events to obtain a dynamic detection result. The device can output a detection result of the target application according to the static analysis result and / or the dynamic detection result.

[0064] In some examples, after the target application is uploaded, the server can also periodically perform static analysis and dynamic analysis on the target application to determine whether the target application is a face-changing application.

[0065] Although the current application detection method can identify some face-changing applications, the accuracy of the identification needs to be improved. For example, a face-changing application implements face changing in certain IP address ranges through IP address rules, but does not implement face changing in other IP address ranges, i.e., there is IP address countermeasures. The server is difficult to know the IP address range in which the face-changing application implements face changing, and thus the face-changing behavior implemented by the face-changing application can not be detected.

[0066] For another example, a face-changing application has model countermeasures. Specifically, a face-changing application can adjust the behavior of the application according to the device model, operating system version, screen resolution, and other information of a user. For another example, a face-changing application has crowd countermeasures. Specifically, a face-changing application can analyze data such as personal information, behavior patterns, and social network relationships of a user, divide the user into different groups, and display different application interfaces or provide different functions for different groups. These countermeasures are very complex and difficult to predict, and the server is difficult to detect the face-changing behavior implemented by the face-changing application. FIG. 1 shows an example of a process from application uploading to application countermeasure detection.

[0067] As can be seen, the face-changing application can have no problem in the uploading stage, but once uploaded, the face-changing application uses IP address, region, model, crowd, and other countermeasures to evade or countermeasure detection, affecting the security of the user's device.

[0068] Based on this, the embodiments of the present application provide an application detection method. After an application is uploaded, a terminal can compare the running features and uploading features of the application. Once the running features and the uploading features of the application are significantly different, the terminal can determine that the application has face-changing behavior after being uploaded. In this way, even if the application uses IP address and other countermeasures, since the running features have been changed relative to the uploading features, the terminal can still detect the face-changing behavior of the application, which can improve the detection effect of the face-changing application and further improve the security of the device.

[0069] For example, FIG. 2 shows an architecture diagram of a communication system of an application detection method according to an embodiment of the present application. As shown in FIG. 2, the communication system includes a terminal device 201 and a server 202.

[0070] The server 202 can be a server for providing a security detection service for an application. For example, the server extracts the launching features of the target application in the launching stage of the target application. For another example, in the running stage of the target application, the server provides the launching features of the application to the terminal device 201, so that the terminal device 201 compares the launching features of the application with the running features of the target application, and then determines whether the target application is a face-changing application. The specific implementation of the feature comparison can be referred to later. The launching features refer to the application interface features generated in the launching stage, which can represent the interface characteristics of the application in the launching stage. The running features refer to the application interface features generated in the running stage, which can represent the interface characteristics of the application in the running stage.

[0071] In this document, the launching stage can also be referred to as a launching detection stage, and the name is not limited. The running features can also be referred to as runtime features, and the name is not limited.

[0072] Optionally, the server 202 can be a cloud server or a network server or other device or server with computing function. It can be a server, a server cluster composed of multiple servers, or a cloud computing service center.

[0073] The terminal device 201 can be various devices installed with an application. The terminal can be used to extract the running features of the target application in the running stage of the target application, and compare the launching features obtained from the server with the running features of the target application to identify the face-changing application.

[0074] For example, the terminal device 201 can include but is not limited to a mobile phone, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an artificial intelligence (AI) device, a wearable device, a vehicle-mounted device, a smart home device, and / or a smart city device. Optionally, the terminal device 201 can be a fixed device or a portable device. The specific type of the terminal device is not specially limited in the embodiments of the present application.

[0075] Optionally, the terminal device 201 and the server 202 can establish a connection through wired communication technology and / or wireless communication technology. The wireless communication technology includes, but is not limited to, at least one of the following: wireless local area network (WLAN) (such as wireless fidelity (Wi-Fi) network), Zigbee, frequency modulation (FM), infrared (IR), wide area network through relay device, etc.

[0076] For example, when the wireless communication technology is the wide area network mentioned above, the wireless communication technology can be a 3rd-generation wireless telephone technology (3G) network, a 4th-generation mobile communication technology (4G) network, a 5th-generation mobile communication technology (5G) network, a future evolved public land mobile network (PLMN), or the Internet, etc.

[0077] FIG. 3 shows another example of the architecture of the communication system. As shown in FIG. 3, an emulator or a real machine can be deployed in the server. For example, the emulator can be software. For example, the real machine can be a hardware unit, a module or a device. The server can simulate the running environment of the device hardware and the operating system through the emulator or the real machine, so as to run and test the target application in the running environment. The running environment simulating the real user's device and use scenario can be called a test environment. As follows, the example of "running and testing the target application through the emulator" is mainly taken.

[0078] As shown in FIG. 3, the server runs the target application through the emulator, and can obtain one or more of the following information: the interface screenshot of the listing interface, the interface text of the listing interface, the layout information of the listing interface, or the interface calling sequence of the listing interface. The listing interface of the application refers to the interface of the application in the listing stage.

[0079] The screenshot of the interface can also be called the picture of the interface, or the image of the interface, or simply the interface, and the name is not limited.

[0080] Layout information: refers to the layout structure corresponding to the interface, which records the hierarchical relationship of the interface elements. For example, the layout structure of the current homepage is a tree-shaped data structure. For example, the layout information can be in XML or JSON format. As a possible implementation manner, during the running of the application in the test environment, the simulator can obtain the layout information of the application interface through the application framework.

[0081] The application framework can also be referred to as a runtime framework or an application running framework. For example, the application framework in some systems is Application Framework, and the ARKUI of the Hongmeng operating system.

[0082] The interface calling sequence, which can also be referred to as an application programming interface (API) calling sequence, refers to the API of the system that is called by the application during the running of the application to display the corresponding interface or implement certain functions. The interface calling sequence records the API calling sequence of the application during the display of the interface.

[0083] The API calling sequence, which can also be referred to as an API calling set, is not limited in name. The API calling sequence can include one or more APIs called by the application. The simulator can record the API calling sequence. As a possible implementation manner, in the test environment, the simulator can obtain the interface calling sequence through the application framework.

[0084] Illustratively, the interface screenshots include the homepage screenshot of the application and the screenshot of the first-level interface. The homepage can also be referred to as the main page.

[0085] Illustratively, the interface text is the text contained in the above-mentioned interface screenshot. As a possible implementation manner, the simulator can recognize the text in the interface screenshot through optical character recognition (OCR).

[0086] As a possible implementation manner, still as shown in FIG. 3, the simulator can input the interface screenshots, the layout information, the interface calling sequence, and the interface text into the model, and output the listing features of each interface from the model.

[0087] Illustratively, the listing features of the application are vectorized representation information. The listing features can also be referred to as the listing embedding or the feature vector of the application, or the listing package feature, or the feature library of the listing. Illustratively, the listing embedding is a fixed-length, low-dimensional and dense vector. Such a vector representation can capture the semantic relationship between inputs, so that similar inputs have similar representations in the vector space.

[0088] Still as shown in FIG. 3, after the application is uploaded, the terminal can download and install the target application from the application market. The terminal can provide a model execution environment, and the terminal can run the target application in the model execution environment. For example, the model execution environment runs on a graphics processing unit (GPU) and / or a neural-network processing unit (NPU). During the process of running the target application, the terminal can obtain one or more running characteristics of the target application, including an interface screenshot of a running interface, interface text of the running interface, layout information of the running interface, or an interface call sequence of the running interface. The interface screenshot, interface text, layout information, and interface call sequence of the running interface, and the obtaining method, can refer to the related content of the uploading interface, and will not be described here.

[0089] As a possible implementation, still as shown in FIG. 3, the terminal can input the interface screenshot, layout information, interface call sequence, and interface text of the running interface into the model, and output the running characteristics of the corresponding interface of the target application from the model. The running characteristics and the obtaining method can refer to the related content of the uploading characteristics, and will not be described here.

[0090] Then, the terminal can input the uploading characteristics and the running characteristics of the target application into the comparison model, compare the similarity between the uploading characteristics and the running characteristics by the comparison model, and output the comparison result. In some examples, if the uploading characteristics and the running characteristics of the target application have high similarity, it means that the target application does not change the interface after being uploaded, and the terminal determines that the target application does not have the face-changing behavior. On the contrary, if the uploading characteristics and the running characteristics of the target application have low similarity, it means that the target application changes the interface after being uploaded, and the terminal determines that the target application has the face-changing behavior.

[0091] Subsequently, the auditors of the application market can audit whether the application has security problems. For example, whether the application is compliant, involves privacy, and the like. For example, the auditors determine the security of the application according to the security detection result of the server on the application.

[0092] It can be understood that FIG. 2 and FIG. 3 are only simplified schematic diagrams for understanding by way of example, and in actual application, the communication system shown in FIG. 2 and FIG. 3 can further include other devices, such as other terminal devices.

[0093] Exemplarily, FIG. 4 shows a structural schematic diagram of an electronic device provided by an embodiment of the present application. The electronic device can be the terminal described above. As shown in FIG. 4, the electronic device 300 can include a processor 110, a memory 120, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a key 180, a display screen 190, and the like.

[0094] The processor 110 can include one or more processing units. For example, the processor 110 can include an application processor (AP), a modem processor, a GPU, an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or an NPU, and the like. Different processing units can be independent devices or integrated into one or more processors.

[0095] The controller can generate operation control signals according to instruction operation codes and timing signals, and complete the control of fetching and executing instructions.

[0096] The processor 110 can also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory can save instructions or data that have just been used or are repeatedly used by the processor 110. If the processor 110 needs to use the instructions or data again, it can directly call them from the memory. This avoids repeated access and reduces the waiting time of the processor 110, thereby improving the efficiency of the system.

[0097] In some embodiments of the present application, taking the electronic device 300 as an example, the processor 110 can be configured to compare the similarity between the running interface of an application and the listing interface of the application, and determine whether the application has a face changing risk according to the similarity.

[0098] In some embodiments, the processor 110 can include one or more interfaces, such as the USB interface 130.

[0099] The charging management module 140 is configured to receive a charging input from a charger. The charging management module 140 can charge the battery 142 and supply power to the electronic device through the power management module 141.

[0100] The power management module 141 is configured to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to power the processor 110, the memory 120, the display 190, the wireless communication module 160, and the like.

[0101] The wireless communication function of the electronic device 300 can be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor, and the baseband processor, and the like.

[0102] The antenna 1 and the antenna 2 are configured to transmit and receive electromagnetic wave signals. Each antenna in the electronic device 300 can be configured to cover a single or multiple communication bands. Different antennas can also be multiplexed to improve the utilization of the antennas.

[0103] The mobile communication module 150 can provide a solution for wireless communication including 2G / 3G / 4G / 5G and the like applied to the electronic device 300.

[0104] The wireless communication module 160 can provide a solution for wireless communication including wireless local area networks (WLAN) (e.g., wireless fidelity (Wi-Fi) network), Bluetooth (BT), infrared (IR), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and the like applied to the electronic device 300.

[0105] In some embodiments, the antenna 1 and the mobile communication module 150 of the electronic device 300 are coupled, and the antenna 2 and the wireless communication module 160 are coupled, so that the electronic device 300 can communicate with a network and other devices through wireless communication technology. The wireless communication technology can include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, starlink, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS can include global positioning system (GPS), global navigation satellite system (GLONASS), beidou navigation satellite system (BDS), quasi-zenith satellite system (QZSS), and / or satellite based augmentation systems (SBAS).

[0106] In some embodiments of the present application, taking the electronic device 300 as a mobile phone as an example, the mobile phone can obtain the characteristics of the application uploading interface of the application from the server through the mobile communication module 150 or the wireless communication module 160 during the running of the application. The mobile phone can compare the similarity between the characteristics of the application uploading interface and the characteristics of the running interface of the application, and determine whether the application is a face changing application according to the similarity.

[0107] The display screen 190 is used to display images, videos, etc. The display screen 190 includes a display panel. Taking the electronic device 300 as a terminal as an example, the terminal can display first prompt information through the display screen 190, and the first prompt information is used to prompt the user that the application has face changing risk.

[0108] The memory 120 can be used to store computer executable program codes, including instructions. The memory 120 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function, and the like. The data storage area can store data created during use of the electronic device 300, and the like. In addition, the memory 120 can include a high-speed random access memory, and can further include a non-volatile memory such as at least one of a magnetic disk storage device, a flash memory device, a universal flash storage (UFS), and the like. The processor 110 executes various function applications and data processing of the electronic device 300 by running instructions stored in the memory 120 and / or instructions stored in a memory disposed in the processor.

[0109] The audio module 170 is used to convert digital audio information into an analog audio signal output, and is also used to convert an analog audio input into a digital audio signal. The audio module 170 can also be used to encode and decode audio signals.

[0110] The keys 180 include a power-on key, a volume key, and the like. The keys 180 can be mechanical keys. They can also be touch keys. The electronic device 300 can receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 300.

[0111] In this document, the server can include a processor. The server can also include a memory and a communication module. The processor, the memory, and the communication module are described above and will not be described again.

[0112] The structure shown in FIG. 4 does not constitute a specific limitation on the terminal or the server. In other embodiments of the present application, the terminal or the server can include more or fewer components than those shown, or combine certain components, or split certain components, or different component arrangements. The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0113] The technical solutions of the embodiments of the present application will be described in detail below in combination with scenarios and examples.

[0114] In some embodiments, the terminal can run a target application, and compare the running features of the target application with the shelving features to identify whether the target application is a face changing application.

[0115] For example, taking the target application as application y1, as shown in (1) of FIG. 5, the terminal can display the interface 501 of the application market, and in response to the user clicking the "install" button of the application y1, the terminal downloads and installs the application y1. After installing the application y1, the terminal can run the application y1 and calculate the running feature of the running interface of the application y1. The terminal can also obtain the listing feature of the listing interface of the application y1 from the server. For example, the terminal calculates the running feature of the home interface 502 as shown in (2) of FIG. 5, and obtains the listing feature of the home interface 503 as shown in (3) of FIG. 5 from the server. The terminal can also calculate the running feature of other detected interfaces, such as calculating the running feature of the first-level interface with the label xxx, the running feature of the first-level interface with the label yyy, and the running feature of the first-level interface with the label "my". Correspondingly, the terminal can obtain the listing feature of the corresponding detected interface from the server, such as obtaining the listing feature of the first-level interface with the label xxx, the listing feature of the first-level interface with the label yyy, and the listing feature of the first-level interface with the label "my". The terminal can compare the listing feature and the running feature of the application y1 accordingly.

[0116] In some examples, the terminal compares the listing feature and the running feature of the application y1, which can be implemented as follows: the terminal determines that the similarity between the running feature of the home interface 502 shown in (2) of FIG. 5 and the listing feature of the home interface 503 shown in (3) of FIG. 5 is low, which means that after the application y1 is listed, the application y1 changes the home interface during the user's use of the application y1, and there is a face-changing behavior with security risks. The terminal can also compare the similarity between the running feature and the listing feature of other detected interfaces. For example, the similarity between the running feature and the listing feature of each first-level interface is compared. If the application y1 changes a large number of detected interfaces after being listed, the terminal can determine that the application y1 is a face-changing application accordingly.

[0117] In other examples, after comparing the listing feature and the running feature of the application y1, the terminal determines that the similarity between the running feature and the listing feature of the detected interface is high, which means that the application y1 does not change the detected interface after being listed, and there is no face-changing behavior with security risks. The terminal can determine that the application y1 is not a face-changing application accordingly.

[0118] For example, FIG. 6 shows a flowchart of an application detection method provided by an embodiment of the present application. As shown in FIG. 6, the method can include the following steps:

[0119] S101, in the application listing stage, the server obtains the listing interface information of the application.

[0120] As a possible implementation, for an application to be listed, the developer submits the application to be listed through an application market portal or API to apply for listing the application. After receiving the listing application of the application, the server of the application market can perform security detection on the application, such as detecting whether privacy is involved, detecting viruses, detecting whether the content is compliant, detecting power consumption and performance, and the like. For the application that does not meet the requirements, the server can reject the developer, and the developer can modify it.

[0121] The process of security detection can include dynamic analysis. In the process of dynamic analysis, the server can automatically execute all functions of the application through a test tool, determine the running of the application, and record any abnormal behavior or error of the application. During the running of the application, the server can traverse the application interface through a real machine or an emulator. The server can obtain and record one or more of the following listing interface information of the application in the process of dynamic analysis: interface screenshot of the listing interface, text of the listing interface, layout information of the listing interface, or interface call sequence of the listing interface. For example, the server obtains the screenshot information of the listing interface through dynamic analysis. Subsequently, when the text of the listing interface is needed, the server can obtain the text through OCR.

[0122] The listing interface can include the home page and the first-level interface of the application in the listing stage. Optionally, considering that the interface level of the hidden function of the face changing application is deep, the server can also obtain and record the screenshots of the second-level, third-level and more level interfaces, so as to find the face changing behavior of the face changing application to the deeper level interface. Not limited. For example, the second-level interface is the interface entered through the home page interface.

[0123] As a possible implementation, the server can also obtain and record the paths of each listing interface. For example, the path of the home page and the path of the first-level interface.

[0124] For example, through dynamic analysis, the server can obtain the following information:

[0125] {

[0126] Path 1 of listing interface 1: {screenshot of listing interface 1, text of listing interface 1, layout of listing interface 1, API call sequence of listing interface 1}

[0127] Path 2 of listing interface 2: {screenshot of listing interface 2, text of listing interface 2, layout of listing interface 2, API call sequence of listing interface 2}

[0128] Path 3 of listing interface 3: {screenshot of listing interface 3, text of listing interface 3, layout of listing interface 3, API call sequence of listing interface 3}

[0129] Path 4 of the on-boarding interface 4: {screenshot of the on-boarding interface 4, text of the on-boarding interface 4, layout of the on-boarding interface 4, API calling sequence of the on-boarding interface 4}

[0130] …

[0131] For example, the screenshot of the on-boarding interface 1 is shown in (3) of FIG. 5. The path 1 of the on-boarding interface 1 is homepage / page / index. As shown in FIG. 7, the text in the on-boarding interface 1 includes: xxxx, payment, yy1…, wherein the text in the on-boarding interface 1 is marked in light gray.

[0132] For example, the layout of the on-boarding interface 1 is a tree data structure shown in (1) of FIG. 8. In the tree data structure, column 503 corresponds to the “payment” icon in the on-boarding interface 1 shown in (2) of FIG. 8.

[0133] For example, during the running of the application, the following APIs are called to display the on-boarding interface 1:

[0134] AbilityDelegatorRegistry.getAbilityDelegator()

[0135] AbilityDelegatorRegistry.getArguments()

[0136] abilityDelegator.startAbility()

[0137] …

[0138] As a possible implementation, the server can store the information of the on-boarding interface of the application.

[0139] As a possible implementation, the application can be uploaded to the application market after security detection.

[0140] S102, the server obtains the on-boarding feature of the application according to the information of the on-boarding interface.

[0141] As a possible implementation, the server can encode one or more information of the on-boarding interface to extract the feature information of the on-boarding interface of the application, and obtain the on-boarding feature of the application. For example, the server can convert the information of the on-boarding interface into a feature vector. For example, the server can input the information of the on-boarding interface into a pre-trained AI algorithm to obtain a feature vector.

[0142] In view of the fact that the screenshot of the on-shelf interface is in a picture format, occupies a large storage space and has a high computational complexity, the server can vectorize the screenshot of the on-shelf interface to reduce the storage space occupied and the computational complexity. For example, the method of vectorization can be a convolutional neural network (CNN) method. The server can convert the screenshot of the on-shelf interface into a fixed-length feature vector through the combination of the convolution layer, the pooling layer and the fully connected layer in the CNN, and the feature vector can capture the key high-level semantic information of the screenshot. For another example, the server can extract the features of the screenshot using a deep learning model, such as a visual geometry group model (VGG), a ResNet model, an Inception model, etc. The deep learning model is pre-trained on a large dataset, for example. For another example, as shown in FIG. 9, the server can also convert the screenshot of the on-shelf interface into a corresponding feature vector through a pre-trained masked autoencoder (MAE). Alternatively, the server can also use other AI models to convert the screenshot of the on-shelf interface into a corresponding feature vector.

[0143] For example, the server can obtain the vector of the output of the layer before the fully connected layer of the above-mentioned model, and take the vector as the feature vector of the screenshot, which can represent the screenshot. In this way, the server can convert the screenshot into a feature vector through a corresponding method, greatly reducing the redundant information of the screenshot.

[0144] For example, the server can also convert the text of the listing interface into corresponding feature vectors using a pre-trained word embedding model. Word embedding models can be, but are not limited to, Word2Vec, GloVe, FastText, or Bert. For example, the text "Attachment 1KM, Quality Restaurants, Coffee & Milk Tea, Group Meals, Delicious Boutique Restaurants..." is converted into the following feature vector: tensor([[[-0.3024,0.3087,-0.8989,...,0.9185,-0.2070,0.2339], [-0.1675,0.8403,-0.6591,...,-0.3065,-0.7560,-0.1686],[0.4785,0.5022,0.1371,...,0.3834,-0.0758,-0.7355],[0.5819,0.1774,-0.7730,... [0.4661,0.7347,-0.5661,...,-0.2218,-0.1496,0.1043],[0.1340,0.5956,-0.7074,...,1.9568,0.0031,0.2969]…]]).

[0145] For example, the server can use the layout information of the listing interface as the feature information of the listing interface. Alternatively, the server can also convert the layout information of the listing interface into a corresponding feature vector and use this feature vector as the feature information of the listing interface. For example, converting a tree data structure into a feature vector can be achieved by converting the nodes and edges in the tree into corresponding numerical vectors. The converted numerical vectors can be easily used in machine learning models. For example, a tree data structure can be converted into the following corresponding feature vector: [0.1, 0.2, 0.3, ..., 0.9, 1.0].

[0146] For example, the server can also convert the application's API call sequence into corresponding feature vectors. For instance, the server can use methods similar to those in natural language processing to obtain the feature vectors corresponding to the API call sequence. In one specific processing example, the server can preprocess the called APIs, such as serializing them, to obtain the API call sequence. For example, if displaying a certain interface requires calling 10 APIs, including APIs for obtaining device information, storing files, and saving images, the server can sort these 10 APIs to obtain the API call sequence for that interface.

[0147] The server can input the processed API call sequence into a selected word embedding model, which generates a corresponding feature vector. For example, the word embedding model can be Word2Vec, GloVe, or a context-aware embedding model, without limitation. The context-aware embedding model is, for example, BERT.

[0148] The feature information of any two of the screenshots, texts, layouts, API call sequences of the computing interface can use the same or different models, without limitation.

[0149] As one possible implementation, after obtaining the feature vectors of the screenshots of the listing interface, the texts in the listing interface, the layout of the listing interface, and the API call sequence of the listing interface, respectively, the server can concatenate the above-mentioned multiple feature vectors to form a single vector. For example, the following listing features of the application are obtained:

[0150] {

[0151] Path 1 of listing interface 1: feature information [[feature information of the screenshot of listing interface 1], [feature information of the text of listing interface 1], [feature information of the layout of listing interface 1], [feature information of the API call sequence of listing interface 1]]

[0152] Path 2 of listing interface 2: feature information [[feature information of the screenshot of listing interface 2], [feature information of the text of listing interface 2], [feature information of the layout of listing interface 2], [feature information of the API call sequence of listing interface 2]]

[0153] Path 3 of listing interface 3: feature information [[feature information of the screenshot of listing interface 3], [feature information of the text of listing interface 3], [feature information of the layout of listing interface 3], [feature information of the API call sequence of listing interface 3]]

[0154] …

[0155] As above, the listing features of the application include the listing features of multiple listing interfaces.

[0156] For example, the above-mentioned listing features include the features of the screenshots of the listing interfaces, the features of the texts in the listing interfaces, the features of the layouts of the listing interfaces, and the features of the API call sequences of the listing interfaces. In other embodiments, the listing features can only include the features of the screenshots of the listing interfaces. Alternatively, the listing features can include the features of the screenshots of the listing interfaces and at least one of the other three features.

[0157] In some embodiments, the server can also use other methods to calculate the above-mentioned listing features, without limitation.

[0158] S103, the server stores the application's listing features.

[0159] S104, the terminal installs the application.

[0160] For example, the user downloads and installs the application through an application market or the like.

[0161] S105, the terminal determines whether the application's risk level is high. If the application's risk level is low, the terminal ends the process. If the application's risk level is high, the terminal performs S106 as follows.

[0162] It can be understood that after the terminal installs the application, different strategies can be taken according to the application's risk level. As a possible implementation manner, after the terminal installs the application, it is determined whether to start face-lifting detection on the application according to the application's risk level. For an application with a high risk level, the terminal can continue to perform subsequent steps to detect whether the application is a face-lifting application. Conversely, for an application with a low risk level, the terminal can skip the face-lifting detection step. For example, for high-trust applications such as instant messaging applications and consultation applications, the terminal can skip the face-lifting detection step.

[0163] As a possible implementation manner, the terminal can be provided with a white list or a black list. The white list includes applications with a low risk level, and the black list includes applications with a high risk level. A high risk level can mean that the risk level is greater than a second threshold. For example, the white list includes applications with a large installation volume, and the black list includes applications with a small installation volume.

[0164] S106, the terminal obtains the application's listing features.

[0165] As a possible implementation manner, for an application with a high risk level, after the application is installed, the terminal can request the application's listing features from the server. The server can send the listing features to the terminal in response to the terminal's request. The terminal can download the listing features. For example, the listing features are in a vectorized representation format, and the listing features have a small size.

[0166] For example, the server has features of a screenshot of a listing interface, features of text in the listing interface, features of a layout of the listing interface, and features of an API calling sequence of the listing interface. The terminal downloads these four listing features from the server. For another example, the server has features of a screenshot of a listing interface. The terminal downloads the features of the screenshot of the listing interface from the server.

[0167] S107, the terminal runs the application and obtains information of a running interface of the application.

[0168] During the running of the application, the terminal can acquire the screenshot, text, layout and API calling sequence of the current running interface according to the application interface entered by the terminal. For example, when the application is running, the terminal first enters the home page, and can acquire the screenshot of the home page, the text in the home page, the API calling sequence of the home page and the layout of the home page. Subsequently, the terminal enters the running interface A of the application, and can acquire the screenshot of the running interface A, the text in the running interface A, the API calling sequence of the running interface A and the layout of the running interface A.

[0169] For example, after the home page of the application is rendered, the terminal can acquire the screenshots of the running interfaces of the application from the GPU cache area. For example, when the terminal enters a new running interface, the terminal can acquire the screenshot of the running interface from the GPU cache area through the application framework. In this way, the screenshot can be acquired from the GPU cache area, and the influence on the system performance can be greatly reduced.

[0170] For example, while acquiring the screenshot of the running interface, the terminal can acquire the layout of the running interface through the application framework.

[0171] For example, while acquiring the screenshot of the running interface, the terminal can acquire the API calling sequence of the running interface through the application framework. For example, the API calling sequence of the running interface is consistent with the API calling sequence of the home interface.

[0172] For example, after acquiring the screenshot, API calling sequence and layout of the running interface, the terminal can recognize the text of the running interface through OCR. The above method of acquiring the API calling sequence, layout and text of the running interface is only an example, and the terminal can also acquire the information of the running interface through other methods, and the timing of acquiring the information is not limited.

[0173] Optionally, the terminal can store the information of the running interface of the application.

[0174] S108, the terminal calculates the running feature of the application according to the information of the running interface.

[0175] As a possible implementation manner, the terminal can use a vectorization algorithm to convert the information of the running interface into the running feature of the application. For example, the terminal inputs the information of the running interface into a model, and outputs the running feature of the application from the model. For example, the model and the vectorization algorithm of the model used by the server to calculate the listing feature are consistent.

[0176] For example, the terminal calculates the feature vector of the screenshot, text, API calling sequence and layout of the running interface through a corresponding AI model, and splices the feature vectors into the running feature of the application. For details of the implementation process, reference can be made to the related content of the server calculating the listing feature, which will not be described herein again.

[0177] Optionally, the terminal can store the running feature of the application.

[0178] In S109, the terminal compares the similarity between the listing feature and the running feature of the application. If the similarity is high, the terminal ends the process. If the similarity is low, the terminal continues to perform S110.

[0179] The similarity represents the similarity between the listing feature and the running feature.

[0180] As a possible implementation, the terminal can calculate the cross-entropy between the listing feature of the listing interface and the running feature of the running interface. The cross-entropy can represent the similarity between the listing feature of the listing interface and the running feature of the running interface. As a possible implementation, the terminal can directly calculate the cosine similarity between the listing feature of the listing interface and the running feature of the running interface.

[0181] For example, the listing feature of the listing interface 1 is as follows: {path 1 of the listing interface 1: feature information [[feature information of the screenshot of the listing interface 1], [feature information of the text of the listing interface 1], [feature information of the layout of the listing interface 1], [feature information of the API call sequence of the listing interface 1]]}. The terminal can calculate the cross-entropy between the listing feature and the running feature of the corresponding running interface. Similarly, the terminal can compare the listing feature of other listing interfaces with the running feature of the corresponding running interface to determine the similarity between the listing interface and the corresponding running interface.

[0182] In the embodiments of the present application, in the case where the similarity between the listing interface and the running interface is low, the listing interface and the running interface can be referred to as a face-changing interface. Conversely, in the case where the similarity between the listing interface and the running interface is low, the listing interface and the running interface can be referred to as a non-face-changing interface. For example, if the similarity between the home page in the listing stage and the home page in the running stage is low, the home page can be referred to as a face-changing interface.

[0183] As a possible implementation, the similarity greater than or equal to the similarity threshold value can be considered as high similarity. Conversely, the similarity less than the similarity threshold value can be considered as low similarity. The similarity greater than or equal to the similarity threshold value can also be understood or replaced as: the similarity is higher than the similarity threshold value.

[0184] As a possible implementation, the terminal compares the similarity between the listing features of M listing interfaces and the running features of the corresponding M running interfaces. If the similarity between the listing features of more than N listing interfaces and the running features of the corresponding N running interfaces is higher than the similarity threshold value, the terminal determines that the similarity between the listing feature and the running feature of the application is relatively high. M and N are both positive integers.

[0185] Alternatively, the terminal compares the similarities between the shelf features of the M shelf interfaces and the running features of the corresponding M running interfaces. If the similarities between the shelf features of more than a proportion of the M shelf interfaces and the running features of the corresponding N running interfaces are higher than the similarity threshold, the terminal determines that the similarities between the shelf features and the running features of the application are high. That is, if more than a proportion of the M interfaces are non-face-changing interfaces, the terminal can determine that the similarities between the shelf features and the running features of the application are high, the application has no face-changing risk, and the terminal can end the current detection process. Conversely, if the number of face-changing interfaces is large, the terminal can determine that the similarities between the shelf features and the running features of the application are low, the application may have face-changing behavior, and the terminal can continue to perform the following step S110.

[0186] For example, M is 5 and N is 3. Among the 5 shelf interfaces, the similarities between the shelf features of 4 (more than 3) shelf interfaces and the running features of the corresponding running interfaces are higher than the similarity threshold. This means that after the application is shelved, the 4 shelf interfaces have not been changed or have been changed but do not affect security.

[0187] In the above examples, the terminal compares the features of the screenshots, the features of the texts, the features of the API call sequences, and the features of the layouts of the interfaces in the running stage and the shelving stage. In some other embodiments, the terminal can also directly compare the API call sequences, the layouts, and the texts of the interfaces in the running stage and the shelving stage, that is, the API call sequences, the layouts, and the texts can not be vectorized.

[0188] For example, in a shopping application, the goods presented in the shopping application can change, so the screenshots of the running interfaces of the shopping application can change compared to the screenshots of the shelf interfaces. However, some other features of the shopping application can not change, such as the layout of the home page, which includes a search box and some buttons related to goods. For another example, the API call sequence of the home page does not change. In this article, by comparing multiple features of the shelf interfaces and the running interfaces, false recognition of face-changing of the application can be prevented, and the accuracy of face-changing detection can be improved.

[0189] In some embodiments, the terminal can also calculate the above similarities through an AI model, without limitation.

[0190] S110, the terminal presents a prompt information. The prompt information is used to prompt the user that the application has a face-changing risk.

[0191] If the similarity between the application's on-shelf feature and the running feature is low, it means that the application has changed the running interface after being on-shelf, and the terminal can determine that the application has a face-changing risk. The terminal can present a prompt information to prompt the user that the application has a face-changing risk. In this way, the user can choose to quit, uninstall or close the application according to the prompt information, thereby improving the device security. For example, as shown in (2) of FIG. 5, the terminal can display the prompt information as shown in 504 in the running interface 502. The prompt information can also be in other forms, such as other texts, other UI styles, without limitation. For another example, the terminal can also present the prompt information in the form of voice playing, without limitation.

[0192] The prompt information can also be referred to as an alarm information, without limitation on the name.

[0193] Optionally, for the application with a face-changing risk, the terminal can also prompt the user to mark and report.

[0194] Optionally, for the application with a face-changing risk, the terminal can report the running feature of the application and / or the running interface information of the application to the server. Optionally, the terminal can also report one or more of the following information to the server: the application package of the application, the model of the terminal, the IP address of the terminal, the IP address segment of the terminal or the area where the terminal is located. Correspondingly, the server can obtain the data reported by multiple terminals and perform clustering analysis according to the data. If the application has a face-changing behavior, such as changing the running interface (face-changing) in different areas, face-changing for different models or face-changing for different IP addresses, the server can determine that the application is a face-changing application. The server can unshelve the application, or guide the user to uninstall the application, or perform other operations to reduce the security risk.

[0195] Embodiments of the present application also provide an application detection method, in which a terminal can use a classifier to determine a risk application to improve the device security. The risk application is an application with a security risk. For example, a certain type of risk application can cause property security problems, and such a risk application can be referred to as a property risk application. The property risk application includes but is not limited to providing functions such as false shopping consumption and online dating shopping. For another example, a certain type of risk application can cause user privacy leakage, and such a risk application can be referred to as a privacy risk application. FIG. 10 shows an example flow of the method. As shown in FIG. 10, the method can include:

[0196] S201, the server obtains information of the on-shelf interface of P applications.

[0197] Wherein, P is a positive integer.

[0198] For each of the P applications, the server can obtain the information of the on-shelf interface of the application by using the method mentioned above. For example, reference can be made to step S101 above.

[0199] The P applications include risk applications and non-risk applications. The server can obtain information of the P applications by dynamic analysis.

[0200] At S202, the server obtains the listing features of the P applications according to the information of the listing interfaces of the P applications.

[0201] As a possible implementation, the server can extract the listing features of each of the P applications by using an AI algorithm. For example, refer to step S102 above.

[0202] At S203, the server trains a classifier based on the listing features of the P applications.

[0203] As a possible implementation, the server trains the classifier based on the listing features of the P applications. Optionally, the server can train the classifier in combination with the listing features of the P applications and the annotation information. The annotation information is used to annotate whether each of the P applications is a risk application. The listing features of the P applications are used as training samples of the classifier.

[0204] As an example, the server inputs the training samples and the annotation information into a model to train the model to obtain the classifier. In subsequent use, the classifier can identify whether an application is a risk application based on the features of the application. For example, the server uses the listing features of 100 applications as training samples, wherein applications 1-10 are annotated as risk applications. The server can input the listing features of the 100 applications and the annotation information into a model to train the model.

[0205] In this document, the classifier can also be referred to as a classification model, and the name is not limited.

[0206] As a possible implementation, the server can update the classifier. For example, the server can obtain more training samples and use the more training samples to train the classifier to improve the recognition accuracy of the classifier.

[0207] In some embodiments, the server can train one classifier to identify multiple types of risk applications. For example, the server uses the listing features of 100 applications as training samples, wherein applications 1-5 are property risk applications and applications 6-10 are privacy risk applications. Applications 1-10 are uniformly annotated as risk applications. The server can input the listing features of the 100 applications and the annotation information into a model to train the model.

[0208] In other embodiments, the server can train one classifier for each type of risk application. For example, the server uses the listing features of 100 applications as training samples, wherein applications 1-5 are property risk applications and applications 6-10 are privacy risk applications. In this way, specific types of risk software can be identified to improve the recognition accuracy.

[0209] The server can input the listing features and the annotation information of the 100 applications into a model for training to obtain a classifier 1, which is used to identify property risk applications. The annotation information of the applications 1-5 is: property risk application, and the annotation information of the applications 6-100 is: non-property risk application.

[0210] The server can input the listing features and the annotation information of the 100 applications into a model for training to obtain a classifier 2, which is used to identify privacy risk applications. The annotation information of the applications 6-10 is: privacy risk application, and the annotation information of the applications 1-5 and 11-100 is: non-privacy risk application.

[0211] By using the above method, the server can take the listing features of multiple applications as input to train the classifier, without training the classifier for each application separately.

[0212] In some embodiments, the server can also train the classifier in combination with the running features of the risk applications. For example, the server takes the listing features of the P applications and the running features of the known risk applications as training samples to train the classifier. For example, the running features of the known risk applications can be reported by the terminal to the server or determined by the server according to historical data. In this way, the classifier is trained by using the running features of the risk applications, so that the classifier can identify applications with similar features of the risk applications.

[0213] S204, the terminal installs the application.

[0214] The implementation of this step can refer to S104.

[0215] S205, the terminal determines whether the risk level of the application is high. If the risk level of the application is low, the terminal ends the process. If the risk level of the application is high, the terminal continues to perform the following step S206.

[0216] The implementation of this step can refer to S105.

[0217] S206, the terminal obtains the classifier.

[0218] For example, the terminal downloads the latest classifier from the server.

[0219] Corresponding to the scheme in which one classifier can identify multiple risk applications, the terminal can download the classifier from the server.

[0220] Corresponding to the scheme in which each classifier identifies the respective risk application, the terminal can download the corresponding classifier from the server. For example, if the terminal wants to verify whether the application is a property risk application, the terminal downloads the classifier for identifying the property risk application from the server.

[0221] S207. The terminal runs the application and obtains information of a running interface of the application.

[0222] The implementation of this step can refer to S107.

[0223] S208. The terminal calculates a running feature of the application according to the information of the running interface.

[0224] The implementation of this step can refer to S108.

[0225] S209. The terminal determines whether the application is a risk application by using the classifier. If yes, the terminal performs S210; if no, the terminal ends the flow.

[0226] As a possible implementation manner, the terminal can input the running feature of the application into the classifier, determine whether the application has a security risk by the classifier, and output an identification result. For example, the terminal inputs the feature of the running interface of the application into the classifier during the running of the application, and identifies whether the application is a risk application by the classifier.

[0227] For example, the application 11 behaves well in the listing stage and has no abnormality, and the server normally lists the application 11. Subsequently, the terminal downloads, installs and runs the application 11, and inputs the running feature of the application 11 into the classifier. In some examples, the running feature of the application 11 is similar to the listing feature of the risk application, and the identification result output by the classifier is that the application 11 is a risk application. This means that the application 11 may have a face-changing behavior in the running stage, so that the running feature of the application 11 is similar to that of the risk application. For example, the text of the application 11 is similar to that of the risk application, such as including text related to sensitive information such as property. For another example, the API calling sequence of the application 11 is similar to that of the risk application, and the layout of the application 11 is similar to that of the risk application.

[0228] S210. The terminal presents prompt information.

[0229] The implementation of this step can refer to S110. For example, the terminal can display the second prompt information “the application is a risk application”.

[0230] FIG. 11 shows another flow example of the scheme of the embodiments of the present application.

[0231] S301. The terminal displays a running interface of an application during the running of the application.

[0232] S302. In a case where the similarity between the running interface of the application and the listing interface corresponding to the application is less than a first threshold value, the terminal presents first prompt information, and the first prompt information is used to prompt the user that the application has a face-changing risk.

[0233] The specific implementation of S302 can refer to other related content in this document, such as determining the similarity between the running interface of the application and the corresponding listing interface, and prompting the user that the application has a face-changing risk according to the similarity, as described in some steps of the flow shown in FIG. 6. Details are not repeated here.

[0234] As a possible implementation, the similarity between the running interface of the application and the corresponding listing interface is less than the first threshold value, including: the similarity between the first running interface of the application and the corresponding first listing interface is less than the first threshold value. Alternatively, the similarity between the running interface of the application and the corresponding listing interface is less than the first threshold value, including: the similarity between the N running interfaces of the application and the corresponding N listing interfaces is less than the first threshold value, N is a positive integer. For example, when the difference between one running interface of the application and the corresponding listing interface is large, the terminal can quickly determine that the application has a face-changing risk. For another example, when the difference between multiple running interfaces of the application and the corresponding listing interfaces is large, the terminal can determine that the application has a face-changing risk, and the recognition accuracy of the face-changing application can be improved.

[0235] In some examples, N is greater than the second threshold value. In this way, when the number of interfaces that are changed after the application is listed is greater than the second threshold value, the terminal can determine that the application has a face-changing risk, can avoid false recognition caused by false comparison of a small number of interfaces, and improve the recognition accuracy of the face-changing application.

[0236] In some embodiments, the method further includes: comparing the similarity between the second running interface of the application and the corresponding second listing interface; and the second running interface includes the first running interface. For example, the second running interface is multiple. For example, the similarity between 5 running interfaces of the application and the corresponding listing interfaces is compared, and the similarity between 4 running interfaces and the corresponding listing interfaces is less than the first threshold value, and the terminal can determine that the application has a face-changing risk.

[0237] Alternatively, the method can further include: comparing the similarity between the M running interfaces of the application and the corresponding M listing interfaces; and the M running interfaces include the N running interfaces, and M is a positive integer. For example, the similarity between M running interfaces and the corresponding listing interfaces is compared, and if a large number (greater than a third threshold value) of interfaces are changed after listing, the terminal can determine that the application has a face-changing risk. In this way, the accuracy of face-changing detection can be improved.

[0238] As a possible implementation, the similarity between the second running interface of the application and the corresponding second listing interface includes: comparing the similarity between the features of the second running interface and the features of the second listing interface; wherein each feature of the second running interface is determined according to the information of the second running interface, and each feature of the second listing interface is determined according to the information of the second listing interface; the information of the second running interface includes at least one of the following information: a screenshot of the second running interface, text of the second running interface, a layout of the second running interface, or an interface call sequence of the second running interface; the information of the second listing interface includes at least one of the following information: a screenshot of the second listing interface, text of the second listing interface, a layout of the second listing interface, or an interface call sequence of the second listing interface. The specific description of the information of the listing interface and the information of the running interface can be referred to the above, and will not be repeated here.

[0239] In some embodiments, as shown in FIG. 11, the method can further include: S401, the terminal obtains the features of the listing interface of the application from the server. As a possible implementation, the terminal obtains the features of the listing interface of the application from the server during the process of downloading the application. For example, the server judges that the application has a high risk level. In response to the request of the terminal to download the application with a high risk level, the server sends the installation package and the listing features of the application to the terminal. Alternatively, the terminal obtains the features of the listing interface of the application from the server during the process of running the application. For example, the terminal judges that the application has a high risk level, and requests the server for the listing features of the application.

[0240] The above mainly introduces the schemes provided by the embodiments of the present application from the perspective of the method. It can be understood that, in order to implement the above functions, the electronic device contains the hardware structure and / or software module corresponding to the execution of each function. The units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in hardware or computer driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present application.

[0241] The embodiments of the present application can divide the functional modules of the electronic device according to the above method examples, for example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing unit. The integrated unit can be in the form of hardware or software functional module. It should be noted that the division of units in the embodiments of the present application is illustrative, and is only a logical functional division. There can be another division way in actual implementation.

[0242] As shown in FIG. 12, a structural schematic diagram of an electronic device provided by an embodiment of the present application is shown. The electronic device 1300 can be used to implement the method performed by the electronic device in the above various method embodiments. For example, the electronic device 1300 can include a processing unit 1301, a communication unit 1302. Optionally, if the electronic device is used to implement the method performed by the terminal in the above various method embodiments, the electronic device can further include a display unit 1303.

[0243] As a possible example, taking the electronic device 1300 as a server, the processing unit 1301 is configured to support the electronic device 1300 to perform the processing functions of the server in any one of FIGS. 1-11, and the communication unit 1302 is configured to support the electronic device 1300 to perform the communication functions of the server in any one of FIGS. 1-11. The display unit 1303 is configured to support the electronic device 1300 to perform the display functions of the server in any one of FIGS. 1-11.

[0244] As another possible example, taking the electronic device 1300 as a terminal, the processing unit 1301 is configured to support the electronic device 1300 to perform the processing functions of the terminal in any one of FIGS. 1-11, and the communication unit 1302 is configured to support the electronic device 1300 to perform the communication functions of the terminal in any one of FIGS. 1-11. The display unit 1303 is configured to support the electronic device 1300 to perform the display functions of the terminal in any one of FIGS. 1-11.

[0245] Optionally, the electronic device 1300 shown in FIG. 12 can further include a storage unit (not shown in FIG. 12), which stores programs or instructions. When the processing unit 1301 executes the programs or instructions, the electronic device 1300 shown in FIG. 12 can perform the methods described in the above method embodiments.

[0246] The technical effects of the electronic device 1300 shown in FIG. 12 can refer to the technical effects described in the above method embodiments, which will not be described here. The processing unit 1301 involved in the electronic device 1300 shown in FIG. 12 can be realized by a processor or a processor-related circuit component, which can be a processor or a processing module. The communication unit 1302 can be realized by a transceiver or a transceiver-related circuit component, which can be a transceiver or a transceiving module. The display unit 1303 can be realized by a display screen-related component.

[0247] The embodiments of the present application also provide a chip system, as shown in FIG. 13, which includes at least one processor 1401 and at least one interface circuit 1402. The processor 1401 and the interface circuit 1402 can be interconnected by a line. For example, the interface circuit 1402 can be used to receive signals from other devices. For another example, the interface circuit 1402 can be used to send signals to other devices (e.g., the processor 1401). Illustratively, the interface circuit 1402 can read instructions stored in a memory and send the instructions to the processor 1401. When the instructions are executed by the processor 1401, the electronic device can perform various steps performed by the electronic device in the above embodiments. Of course, the chip system can also include other discrete devices, which are not limited in the embodiments of the present application.

[0248] Optionally, the processor in the chip system can be one or more. The processor can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading software codes stored in a memory.

[0249] Optionally, the memory in the chip system can also be one or more. The memory can be integrated with the processor or arranged separately from the processor, which is not limited in the embodiments of the present application. Illustratively, the memory can be a non-transient processor, for example, a read-only memory (ROM), which can be integrated on the same chip as the processor or arranged on different chips respectively, and the embodiments of the present application do not limit the type of the memory and the arrangement of the memory and the processor.

[0250] Illustratively, the chip system can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a micro controller unit (MCU), a programmable logic device (PLD) or other integrated chip.

[0251] It should be understood that each step in the above method embodiments can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software. The method steps disclosed in combination with the embodiments of the present application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

[0252] The embodiments of the present application also provide a computer storage medium, which stores computer instructions. When the computer instructions run on an electronic device, the electronic device executes the method described in the above method embodiments.

[0253] The embodiments of the present application provide a computer program product, which includes a computer program or instructions. When the computer program or instructions run on a computer, the computer executes the method described in the above method embodiments.

[0254] In addition, the embodiments of the present application also provide a device, which can be a chip, a component or a module. The device can include a processor and a memory connected to each other. The memory is used to store computer execution instructions. When the device runs, the processor can execute the computer execution instructions stored in the memory, so that the device executes the method in the above method embodiments.

[0255] The electronic device, the computer storage medium, the computer program product or the chip provided by the embodiments can execute the corresponding method provided above, and thus the beneficial effects thereof can refer to the beneficial effects of the corresponding method provided above, which will not be described here.

[0256] Through the above description of the embodiments, those skilled in the art can understand that, for the convenience and brevity of description, only the division of the above functional modules is taken as an example for illustration. In actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0257] In the several embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented by other ways. Each embodiment in the non-conflicting case can be combined or referred to each other. The device embodiment described above is only schematic, for example, the division of the module or unit is only a logical function division, and the actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed mutually can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0258] The units described as separate components may or may not be physically separate, and the components displayed as units may be a physical unit or multiple physical units, that is, may be located in one place, or also can be distributed to multiple different places. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0259] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0260] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a readable storage medium. Based on such understanding, the technical scheme of the embodiments of the present application essentially or the part that contributes to the prior art or the whole or part of the technical scheme can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions to make a device (which can be a single-chip microcomputer, a chip, etc.) or a processor execute all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0261] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An application detection method, characterized by, The method comprises: displaying a running interface of the application during running of the application; in a case where a similarity between the running interface of the application and a corresponding listing interface of the application is less than a first threshold, presenting first prompt information, the first prompt information being used to prompt a user that the application has a face-changing risk.

2. The method of claim 1, wherein, The similarity between the running interface of the application and the corresponding listing interface is less than the first threshold, comprising: a similarity between a first running interface of the application and a corresponding first listing interface is less than the first threshold.

3. The method of claim 2, wherein, The method further comprises: comparing a similarity between a second running interface of the application and a corresponding second listing interface; the second running interface comprises the first running interface.

4. The method of claim 3, wherein, The comparison of the similarity between the second running interface of the application and the corresponding second listing interface comprises: comparing a similarity between a feature of the second running interface and a feature of the second listing interface; wherein each feature of the second running interface is determined according to information of the second running interface, and each feature of the second listing interface is determined according to information of the second listing interface; the information of the second running interface comprises at least one of the following: a screenshot of the second running interface, text of the second running interface, a layout of the second running interface, or an interface call sequence of the second running interface; the information of the second listing interface comprises at least one of the following: a screenshot of the second listing interface, text of the second listing interface, a layout of the second listing interface, or an interface call sequence of the second listing interface.

5. The method according to any one of claims 1 to 4, characterized in that, Further comprising: in a case where a risk level of the application is greater than a second threshold, obtaining, from a server, a feature of a listing interface of the application.

6. The method of claim 5, wherein, The obtaining, from the server, of the feature of the listing interface of the application comprises: during downloading of the application, obtaining, from the server, the feature of the listing interface of the application.

7. The method of claim 5, wherein, The obtaining, from the server, of the feature of the listing interface of the application comprises: during running of the application, obtaining, from the server, the feature of the listing interface of the application.

8. The method according to any one of claims 1 to 7, characterized in that, The method further comprises: obtaining, from a server, a classifier used to identify whether an application is a risk application; training samples of the classifier comprise features of listing interfaces of P applications, P being an integer greater than 1; during running of the application, inputting a feature of a running interface of the application into the classifier to identify, by the classifier, whether the application is a risk application.

9. The method of claim 8, wherein, Further comprising: in a case where the application is a risk application, presenting second prompt information, the second prompt information being used to prompt a user that the application has a security risk.

10. A method for detecting an application, characterized by, The method comprises: obtaining a feature of a listing interface of an application; sending, to a terminal, the feature of the listing interface of the application; the feature of the listing interface of the application and a feature of a corresponding running interface of the application are used to determine that the application has a face-changing risk.

11. The method of claim 10, wherein, Each feature of the app store interface is determined according to information of the app store interface; the information of the app store interface comprises at least one of the following: a screenshot of the app store interface, text of the app store interface, a layout of the app store interface, or an interface call sequence of the app store interface.

12. The method according to claim 10 or 11, characterized in that, The method further comprises: training a classifier; the classifier is used to identify whether an application is a risk application; training samples of the classifier comprise features of app store interfaces of P applications, P being an integer greater than 1; sending the classifier to the terminal.

13. A computer-readable storage medium, characterized in that, A program or instructions, when executed, implement the method of any one of claims 1 to 9, or implement the method of any one of claims 10 to 12.

14. A computer program product, characterised in that, A computer program product, when run on a computer, causes the computer to perform the method of any one of claims 1 to 9, or perform the method of any one of claims 10 to 12.

15. A chip, characterized by A unit or module for performing the method of any one of claims 1 to 9, or a unit or module for performing the method of any one of claims 10 to 12.

16. A chip system, characterized by The chip system comprises processing circuitry configured to perform the method of any one of claims 1 to 9, or perform the method of any one of claims 10 to 12.

17. An electronic device, comprising: The electronic device comprises a processor and a memory; The memory is used to store computer execution instructions; when the electronic device is running, the processor executes the computer execution instructions stored in the memory, so that the electronic device performs the method of any one of claims 1 to 9, or performs the method of any one of claims 10 to 12.

18. An application detection system, comprising: The system comprises a terminal for implementing the method of any one of claims 1 to 9, and a server for implementing the method of any one of claims 10 to 12.

Images