An application detection method, a model training method, and related devices

Abstract

The application provides an application detection method, a model training method and related devices. The scheme can combine dynamic flow analysis and static statistical analysis, optimize the input features of a machine learning model through a heterogeneous information network, identify abnormal nodes related to an application program using the machine learning model, and determine a first sensitivity probability of the application program using the centrality index of the abnormal nodes. Then, the scheme can also perform static statistical analysis on the sensitive permissions, APIs and API sequences of the APP to determine a second sensitivity probability of the application program. Finally, the first sensitivity probability and the second sensitivity probability are weighted, and a third sensitivity probability of the application program is obtained based on the weighted first sensitivity probability and the second sensitivity probability. Through the scheme, the efficiency, accuracy and accuracy of application program sensitivity detection are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an application detection method, a model training method, and related apparatus. Background Technology

[0002] Nowadays, applications (APPs) have become an indispensable part of daily life. However, this has also led to the emergence of malicious applications, such as sensitive apps. These apps typically use malicious code injection and unauthorized access to device permissions to steal users' sensitive information, and they use false advertising and fake investment projects to trick users into making payments or investments, thus defrauding them of money.

[0003] Traditional application detection methods typically employ dynamic detection techniques that analyze the behavioral characteristics of application network traffic in order to identify and detect malicious behavior in applications.

[0004] However, the aforementioned dynamic detection methods typically select network traffic behavior characteristics corresponding to applications based on predetermined thresholds, and the setting of these thresholds is easily influenced by subjectivity. Furthermore, these detection methods rely on manual judgment when identifying malicious applications, lacking differentiated processing, resulting in insufficient precision and accuracy, and are time-consuming and labor-intensive.

[0005] Therefore, how to efficiently, accurately, and precisely identify and detect sensitive applications has become an urgent technical problem to be solved. Summary of the Invention

[0006] This application provides an application detection method, a model training method, and related apparatus, which can establish a heterogeneous information network corresponding to the multiple nodes based on the interaction requests of multiple nodes, input the heterogeneous information network into a first machine learning model, use the first machine learning model to identify abnormal nodes related to the application, and determine the sensitivity probability of the application based on the behavioral feature vector of the abnormal nodes, thereby realizing the sensitivity detection of the application. This method can improve the efficiency, accuracy, and precision of sensitivity detection.

[0007] Firstly, this application provides an application detection method applied to a cloud management platform connected to or located within an infrastructure. The infrastructure includes at least one data center, where each data center includes multiple computing nodes, and the application to be detected is deployed on at least one computing node within the infrastructure. Specifically, the application detection method includes the following:

[0008] First, the cloud management platform obtains data streams from multiple nodes. Each node's data stream is the data flow between that node and the application to be detected. Then, the cloud management platform parses the interaction requests from these nodes to obtain their communication parameters. Next, the cloud management platform constructs a heterogeneous information network based on the data streams from these nodes. This heterogeneous information network includes behavioral feature vectors from multiple nodes. The cloud management platform then inputs this heterogeneous information network into a first machine learning model, which identifies anomalous nodes among the nodes. Finally, upon identifying annomalous nodes, the cloud management platform determines their centrality index based on their behavioral feature vectors and inputs this index into the first machine learning model, which outputs the first sensitivity probability of the application to be detected.

[0009] In this application, a cloud management platform is used to perform dynamic traffic analysis on the application being detected and to establish a heterogeneous information network corresponding to multiple nodes. Compared to traditional dynamic detection methods that select behavioral features of each node based on predetermined thresholds, this scheme can optimize the behavioral feature vectors of each node. These behavioral feature vectors can accurately reflect the behavior and communication patterns of each node, thereby more accurately identifying abnormal nodes related to the application. The centrality index determined based on the behavioral feature vectors of these abnormal nodes helps the first machine learning model classify normal and abnormal nodes among the multiple nodes, thus more accurately outputting the first sensitivity probability of the application and achieving application detection. This method improves the efficiency, accuracy, and precision of sensitive application detection.

[0010] In some embodiments, during the establishment of a heterogeneous information network, the cloud management platform can parse the information flow of multiple nodes, obtain the communication parameters of multiple nodes, and establish a heterogeneous information network based on the communication parameters of the multiple nodes.

[0011] In this application, by parsing the communication parameters of multiple nodes, it is possible to analyze the connection mode of multiple nodes globally and the working mode of any node locally. This allows us to obtain the interaction relationship between each node and the application to be detected. Based on the above interaction relationship, a heterogeneous information network is established, providing rich feature inputs for the first machine learning model. This improves the identification and classification capabilities of subsequent abnormal nodes, thereby enhancing the efficiency, accuracy, and precision of sensitive application detection.

[0012] In some embodiments, the communication parameters of each node among the multiple nodes correspond to the interaction requests between that node and other nodes. These communication parameters include the request header, response information, request nature, and request count of the interaction request. In the specific process of establishing a heterogeneous information network, firstly, the cloud management platform can generate a node set representing the multiple nodes based on the request header and response information of the interaction request. Then, the cloud management platform can generate an edge set representing the connection edges and connection directions between the multiple nodes based on the request nature. Each edge in the edge set is assigned a weight, which is determined based on the request count. Finally, the cloud management platform can establish the heterogeneous information network corresponding to the application to be detected based on the node set and the edge set.

[0013] In this application, the request headers and response information of the interactive request can accurately reflect the type of each node, and the request nature can reflect the connection relationship between each node. Based on this, assigning edge weights to each connection edge can improve the accuracy of identifying dissimilar nodes.

[0014] In some embodiments, the cloud management platform can perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network, and input the adjacency matrix into the first machine learning model, so that the first machine learning model can determine the abnormal nodes among the multiple nodes.

[0015] In some embodiments, the first machine learning model includes a graph attention layer and a graph autoencoder. In the specific process of identifying abnormal nodes, the cloud management platform can input the adjacency matrix into the first machine learning model. The first machine learning model then uses the graph attention layer to assign corresponding attention weights to multiple nodes based on their behavioral feature vectors. Next, the cloud management platform can use the first machine learning model to update the graph embeddings of each node according to these attention weights, and use the graph autoencoder to obtain the reconstruction error of each node from the updated graph embeddings. The reconstruction error of each node represents the degree of deviation between that node and normal nodes. Finally, the cloud management platform can determine the abnormal nodes among the multiple nodes based on the reconstruction errors.

[0016] In this application, updating the graph embedding of each node by the attention weights of multiple nodes can help the first machine learning model to more accurately calculate the reconstruction error of each node, thereby determining the degree of deviation of each node from normal nodes, identifying abnormal nodes among multiple nodes, and improving the accuracy and precision of sensitive application detection.

[0017] In some embodiments, the first machine learning model further includes a classifier. The centrality indicators of anomaly nodes specifically include the node importance indicator, betweenness centrality indicator, and proximity centrality indicator of the anomaly node. In the specific process of determining the first sensitivity probability of the application to be detected, the cloud management platform can determine the node importance indicator, betweenness centrality indicator, and proximity centrality indicator of the anomaly node based on the behavioral feature vector of the anomaly node. Then, the cloud management platform can input the node importance indicator, betweenness centrality indicator, and proximity centrality indicator into the classifier, and the classifier outputs the first sensitivity probability of the application to be detected.

[0018] In this application, the node importance index, betweenness centrality index, and proximity centrality index of the abnormal node can more accurately reflect the behavior pattern of the abnormal node. Based on the above centrality index, the classifier can accurately output the first sensitivity probability of the application to be detected, thereby improving the accuracy and precision of sensitive application detection.

[0019] In some embodiments, the cloud management platform can also obtain the data packet volume of the application to be detected and input the data packet volume into the classifier, which outputs the first sensitivity probability of the application to be detected based on the node importance index, betweenness centrality index, proximity centrality index, and data packet volume.

[0020] In this application, by combining the centrality index of abnormal nodes with the data packet volume of the application to be detected, the first sensitivity probability of the application to be detected can be evaluated more comprehensively, thereby improving the accuracy and precision of sensitive application detection.

[0021] In some embodiments, the cloud management platform can also obtain multiple permissions of the application to be detected, analyze each permission using a T-test formula to identify sensitive permissions among the multiple permissions, and establish a sensitive permission set based on the sensitive permissions. Then, the cloud management platform can obtain multiple APIs of the application to be detected, analyze each API using the coefficient of variation to identify sensitive APIs among the multiple APIs, and establish a sensitive API set based on the sensitive APIs. Next, the cloud management platform can establish a sensitive API sequence set of the application to be detected based on the sensitive API set. Finally, the cloud management platform can input the sensitive permission set and the sensitive API sequence set into a second machine learning model, which will output a second sensitivity probability of the application to be detected.

[0022] This application introduces a T-test formula to analyze multiple permissions of the application under test, enabling more accurate identification of frequently used sensitive permissions within sensitive applications. By measuring and evaluating the stability of multiple APIs of the application under test based on the coefficient of variation and sensitivity scores, it is possible to distinguish between normal and sensitive behaviors of the application under test, thereby more accurately identifying sensitive APIs among multiple APIs. Furthermore, using sensitive API sequences can reduce the false alarm rate while maintaining accuracy. This method improves the efficiency, precision, and accuracy of sensitive application detection.

[0023] In some embodiments, the cloud management platform includes a sensitive permission dataset and a benign permission dataset. In determining sensitive permissions, firstly, the cloud management platform can determine the usage frequency of a first permission in the sensitive permission dataset. Here, the first permission is one of multiple permissions for the application to be monitored. Then, the cloud management platform can determine the usage frequency of the first permission in the benign permission dataset. Finally, the cloud management platform can use a T-test to analyze the usage frequencies in both the sensitive and benign permission datasets to determine whether the first permission is a sensitive permission.

[0024] In some embodiments, the cloud management platform includes a sensitive API dataset and a benign API dataset. In identifying sensitive APIs, the cloud management platform can determine the usage frequency of a first API in the sensitive API dataset. The first API is one of multiple APIs of the application to be detected. Then, the cloud management platform can determine the usage frequency of the first API in the benign API dataset. Next, the cloud management platform can determine the coefficient of variation of the first API based on its usage frequency in both the sensitive and benign API datasets. Finally, the cloud management platform can obtain a sensitivity score for the first API based on the coefficient of variation and determine whether the first API is a sensitive API based on the sensitivity score.

[0025] In some embodiments, the cloud management platform can input the first sensitivity probability and the second sensitivity probability into a third machine learning model, which will determine the weights of the first sensitivity probability and the second sensitivity probability respectively, and output the third sensitivity probability of the application to be detected based on the weighted first sensitivity probability and the second sensitivity probability.

[0026] In this application, the cloud management platform can combine dynamic traffic detection and static statistical analysis to determine the third sensitivity probability of the application under test, thereby judging whether the application under test is a sensitive application. This method improves the comprehensiveness of application detection and enhances the accuracy and precision of sensitive application detection.

[0027] Secondly, this application provides a training method for an application detection model. During the training phase, a cloud management platform can acquire communication parameters of multiple nodes. These multiple nodes include a first number of normal nodes and a second number of abnormal nodes. A heterogeneous information network for training is established based on the communication parameters. This heterogeneous information network includes behavioral feature vectors of normal and abnormal nodes. A matrix transformation is performed on the heterogeneous information network to obtain its corresponding adjacency matrix. The adjacency matrix is ​​input to a graph attention layer, which assigns attention weights to each node based on the behavioral feature vectors of the normal and abnormal nodes. The graph embeddings of each node are updated according to the attention weights, and the updated graph embeddings are input to a graph autoencoder for training, resulting in a trained graph autoencoder. A feature training set is obtained based on the behavioral feature vectors of the normal and abnormal nodes. The feature training set is input to a classifier for training, resulting in a trained classifier. A first machine learning model is obtained based on the graph attention layer, the trained graph autoencoder, and the classifier.

[0028] Thirdly, this application provides a cloud management platform. The cloud management platform includes a dynamic detection instance. The dynamic detection instance includes an application traffic packet capture module, a heterogeneous information network establishment module, and a first anomaly detection module.

[0029] The application traffic capture module is used to obtain data streams from multiple nodes. The data stream of each of these nodes is the data stream between that node and the application to be detected.

[0030] The heterogeneous information network establishment module can establish a heterogeneous information network corresponding to the application to be detected based on the above communication parameters. The heterogeneous information network includes the behavioral feature vectors of the aforementioned multiple nodes.

[0031] The first anomaly detection module pre-deploys a first machine learning model. This module is used to input heterogeneous information networks into the first machine learning model, which then identifies anomalous nodes among multiple nodes.

[0032] In the case of identifying an abnormal node, the first anomaly detection module can determine the centrality index of the abnormal node based on its behavioral feature vector, and input the centrality index into the first machine learning model, which will then output the first sensitivity probability of the application to be detected.

[0033] In some embodiments, the cloud management platform further includes an application traffic parsing module. This module parses the data streams from multiple nodes to obtain communication parameters of the nodes related to the application under test. In this case, the heterogeneous information network establishment module is also used to establish a heterogeneous information network based on the aforementioned communication parameters.

[0034] In some embodiments, the heterogeneous information network establishment module is further configured to generate a node set representing multiple nodes based on the request header and response information in the communication parameters, and to generate an edge set representing the connection edges and connection directions between the multiple nodes based on the request nature in the communication parameters. Each edge in the edge set is assigned a weight, which is determined based on the number of requests. The heterogeneous information network establishment module can then establish a heterogeneous information network corresponding to the application to be detected based on the aforementioned node set and edge set.

[0035] In some embodiments, the first anomaly detection module is further configured to perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network. The first anomaly detection module can input the adjacency matrix into a first machine learning model, which will then determine the abnormal nodes among the multiple nodes.

[0036] In some embodiments, the first machine learning model includes a graph attention layer and a graph autoencoder. The first anomaly detection module is further configured to input an adjacency matrix into the first machine learning model, whereby the first machine learning model uses the graph attention layer to assign corresponding attention weights to each node among the multiple nodes based on the behavioral feature vectors of the multiple nodes. The first anomaly detection module can use the first machine learning model to update the graph embedding of each node according to the aforementioned attention weights, and obtain the reconstruction error of each node among the multiple nodes through the graph autoencoder based on the updated graph embedding. The reconstruction error of each node represents the degree of deviation of that node from normal nodes. The first anomaly detection module can determine abnormal nodes among the multiple nodes based on the aforementioned reconstruction errors.

[0037] In some embodiments, the first machine learning model further includes a classifier. Upon identifying an anomalous node, the first anomaly detection module is further configured to determine the node importance index, betweenness centrality index, and proximity centrality index of the anomalous node based on its behavioral feature vector. The first anomaly detection module can input the node importance index, betweenness centrality index, and proximity centrality index into the classifier of the first machine learning model, and the classifier can output a first sensitivity probability of the application to be detected based on the node importance index, betweenness centrality index, and proximity centrality index of the anomalous node.

[0038] In some embodiments, the cloud management platform includes a static detection instance, which comprises a sensitive permission set establishment module, a sensitive API set establishment module, a sensitive sequence set establishment module, and a second anomaly detection module. The sensitive permission set establishment module obtains multiple permissions invoked by the application under test, analyzes each permission using a T-test formula to determine whether these permissions are sensitive, and establishes a sensitive permission set based on these permissions. The sensitive API set establishment module obtains multiple APIs of the application under test, analyzes each API using the coefficient of variation to determine whether these APIs are sensitive, and establishes a sensitive API set based on these sensitive APIs. The sensitive sequence set establishment module establishes a sensitive API sequence set corresponding to the application under test based on the sensitive API set and sends this sensitive API sequence set to the second anomaly detection module. The second anomaly detection module pre-deploys a second machine learning model composed of a classification model. The second anomaly detection module inputs the sensitive permission set and the sensitive API sequence set into the second machine learning model, which outputs a second sensitivity probability of the application under test.

[0039] In some embodiments, the sensitive permission set establishment module includes a pre-deployed sensitive permission dataset and a benign permission dataset. The sensitive permission dataset includes permissions invoked by multiple sensitive apps, and the benign permission dataset includes permissions invoked by multiple benign apps. Taking the first permission as an example, firstly, the sensitive permission set establishment module can determine the usage frequency of the first permission in the sensitive permission dataset. The first permission is one of multiple permissions of the application to be detected. Then, the sensitive permission set establishment module can determine the usage frequency of the first permission in the benign permission dataset. Finally, the sensitive permission set establishment module can use a T-test formula to analyze the usage frequency in the sensitive permission dataset and the benign permission dataset to determine whether the first permission is a sensitive permission.

[0040] In some embodiments, the sensitive API set establishment module includes a pre-deployed sensitive API dataset and a benign API dataset. The sensitive API dataset includes multiple APIs from multiple sensitive apps, and the benign API dataset includes multiple APIs from multiple benign apps. Taking a first API as an example, firstly, the sensitive API set establishment module can determine the usage frequency of the first API in the sensitive API dataset. The first API is one of multiple APIs from the application to be detected. Then, the sensitive API set establishment module can determine the usage frequency of the first API in the benign API dataset. Next, the sensitive API set establishment module can determine the coefficient of variation of the first API based on its usage frequency in both the sensitive and benign API datasets. Finally, the sensitive API set establishment module can obtain a sensitivity score for the first API based on the coefficient of variation. After determining the sensitivity scores of multiple APIs from the application to be detected, the sensitive API set establishment module can determine whether the first API is a sensitive API based on these multiple sensitivity scores.

[0041] In some embodiments, the cloud management platform may also include a sensitive identification instance, in which a third machine learning model consisting of an eXtreme Gradient Boosting (XGBoost) model is pre-deployed.

[0042] The sensitive identification instance can receive a first sensitive probability sent by the dynamic traffic analysis module and a second sensitive probability sent by the static statistical analysis module. It then inputs the first and second sensitive probabilities into a third machine learning model, which adjusts the weights of the first and second sensitive probabilities and combines the weighted first and second sensitive probabilities to output a third sensitive probability for detecting the application.

[0043] Fourthly, this application also provides a data center, which includes at least one computing device, each computing device including a processor and a memory, wherein the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the data center executes the application detection method provided in the first aspect or the training method of the application detection model provided in any possible implementation of the second aspect.

[0044] Fifthly, this application also provides a computer-readable storage medium including computer program instructions, which, when executed by a data center, enable the data center to perform a training method for the application detection model provided by the application detection method provided in the first aspect or any possible implementation of the second aspect.

[0045] Sixthly, this application also provides a computer program product, including computer program instructions, which, when executed by a data center, enable the data center to execute the application detection method provided in the first aspect or the training method of the application detection model provided in any possible implementation of the second aspect.

[0046] Any of the cloud management platforms, computing devices, data centers, computer storage media, or computer program products provided above are used to execute the methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects of the corresponding solutions in the corresponding methods provided above, and will not be repeated here. Attached Figure Description

[0047] Figure 1 The diagram shown is a schematic representation of an application detection scenario provided by an embodiment of this application;

[0048] Figure 2 This is a deployment diagram of a cloud management platform provided in an embodiment of this application;

[0049] Figure 3 This is a flowchart illustrating an application detection method proposed in this application;

[0050] Figure 4 This is a schematic diagram of the heterogeneous information network of the application to be tested;

[0051] Figure 5 This is a schematic diagram illustrating the first sensitivity probability output by the first machine learning model;

[0052] Figure 6 This is a diagram illustrating the establishment of a set of sensitive permissions for the application to be tested;

[0053] Figure 7 This is a diagram illustrating the establishment of a set of sensitive APIs for the application to be detected;

[0054] Figure 8 This is a schematic diagram illustrating the output of the second sensitivity probability by the second machine learning mode;

[0055] Figure 9 This is a flowchart illustrating the training method for the applied detection model;

[0056] Figure 10 This is a schematic diagram of a cloud management platform proposed in this application;

[0057] Figure 11 This is a schematic diagram of a computing device proposed in this application;

[0058] Figure 12 This is a schematic diagram of a data center structure provided in an embodiment of this application;

[0059] Figure 13 This application provides an embodiment of a deployment in a data center. Figure 10 The diagram shows a cloud management platform. Detailed Implementation

[0060] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0061] The technical solutions in this application will now be described in conjunction with the accompanying drawings.

[0062] As cyberattacks become increasingly complex, traditional application detection methods typically employ dynamic detection approaches to identify and detect malicious behavior in applications.

[0063] Dynamic monitoring methods, during app runtime, can detect malicious behavior by capturing the app's real-time data traffic and behavioral characteristics. For example, through feature selection and deep learning techniques, behavioral characteristics of the data flow can be obtained, and these characteristics can be filtered based on pre-set thresholds. The filtered behavioral characteristics are then input into a machine learning model to identify abnormal behavior, thereby enabling the detection of sensitive applications.

[0064] Traditional application testing methods also include static testing methods and dynamic testing methods.

[0065] Static detection methods do not require running the app. They typically analyze the application's code and configuration files to identify and detect potential malicious behavior in sensitive applications. For example, permission and API features are extracted from application samples. The sensitivity of each feature is calculated using a pre-set sensitivity threshold to filter and retain high-sensitivity features. Subsequently, a random forest classifier is built using the filtered features. The model is trained to determine the app's sensitive permissions and sensitive APIs, thus enabling the detection of sensitive applications.

[0066] Static monitoring alone is insufficient to capture the dynamic behavior of an app during runtime, leading to limitations in identifying new malicious patterns. Dynamic monitoring alone cannot trigger all code paths, sometimes making it difficult to detect malicious behavior under specific conditions. Therefore, existing technologies also include application detection methods that combine dynamic and static approaches.

[0067] The application detection method that combines dynamic and static approaches uses more complex features and considers the rich relationships between various functions of the APP, which can effectively improve the accuracy of application detection. At the same time, it attempts to solve the problems of high runtime overhead and potential loss of hidden malicious behaviors in dynamic analysis-based methods.

[0068] However, the aforementioned detection methods still rely on predetermined thresholds to select applications based on the behavioral characteristics of network traffic or the sensitivity characteristics of APIs. The setting of these thresholds is easily influenced by subjectivity. Furthermore, these methods depend on manual judgment when identifying malicious applications, lacking differentiated processing, resulting in insufficient accuracy and precision, and are time-consuming and labor-intensive.

[0069] To more efficiently, accurately, and precisely identify and detect sensitive applications, this application provides an application detection method, a model training method, and related apparatus. This scheme combines dynamic traffic analysis and static statistical analysis, optimizes the input features of a machine learning model through a heterogeneous information network, identifies abnormal nodes related to the application using the aforementioned machine learning model, and determines the application's first sensitivity probability using the centrality index of the abnormal nodes. Based on this, static statistical analysis can be performed on the APP's sensitive permissions, APIs, and API sequences to determine the application's second sensitivity probability. Finally, the first and second sensitivity probabilities are weighted, and a third sensitivity probability of the application is obtained based on the weighted first and second sensitivity probabilities. This scheme improves the efficiency, accuracy, and precision of application sensitivity detection.

[0070] For example, Figure 1 The illustration shown is a schematic diagram of an application detection scenario provided by an embodiment of this application. For example... Figure 1 As shown, the cloud management platform 200 can be deployed in a cloud data center.

[0071] The Cloud Management Platform 200 not only provides cloud services for application detection to application developers, but also to AI application users. When application developers need to list their developed application products on third-party app stores, or when application users need to perform sensitivity checks on the applications they use, they can activate the application detection service on the Cloud Management Platform 200.

[0072] The cloud management platform 200 provides access interfaces (such as user interfaces or application program interfaces, APIs). Users can remotely access these interfaces via client machines to register a cloud account and password on the cloud management platform 200 and log in. After successful authentication of the cloud account and password, users can further select and purchase application detection services on the cloud management platform 200. Figure 1 Step 1 in the process.

[0073] After successful purchase, users can download the software development kit (SDK) corresponding to the application testing service. The cloud management platform 200 provides multiple development versions of the SDK for users to choose from based on their development environment needs, such as Java, Python, PHP, and Android SDKs. Figure 1 Step 2 in the process.

[0074] After downloading the corresponding SDK version to their local machine, users can import the SDK project into their local development environment for configuration and debugging. The local development environment also allows for the development of other functionalities, creating an AI application with integrated application detection capabilities. Figure 1 Step 3 in the process.

[0075] When an AI application is used and application detection is required, it can trigger an API call to the application detection service. When the AI ​​application triggers the application detection function, it initiates an API request to the running instance of the application detection service in the cloud data center. This API request carries the application to be detected, and the running instance in the cloud data center performs inference on the application to obtain the detection result. Figure 1 Step 4 in the process.

[0076] The cloud data center returns the detection results to the AI ​​application, thus completing an application detection service call.

[0077] During the use of the aforementioned AI application cloud services, users can also monitor information such as the service call frequency and number of calls on the cloud management platform.

[0078] Using application detection services as an example of AI application cloud services, the usage process for other AI application cloud services is the same or similar. Before some AI application cloud services are invoked, users can also configure special rules on the cloud platform to make the AI ​​application cloud services more suitable for their application scenarios.

[0079] The aforementioned AI application cloud service provides an on-demand, no-development model, making it easier to integrate AI capabilities into various AI applications.

[0080] It is worth noting that, in addition to providing cloud-based application detection services to users via API interfaces, this application embodiment can also provide application detection services to third-party platforms or enterprises in the form of software, deployed locally. Alternatively, this application embodiment can be integrated into the overall security solution of a third-party platform or enterprise to provide application detection services to users as a security tool. In other words, this application does not limit the method of providing or the specific implementation of the application detection service.

[0081] The cloud management platform can be connected to the infrastructure, or it can be set up within the infrastructure, which includes at least one data center, wherein each data center includes multiple compute nodes, and the application to be tested is deployed on at least one compute node within the infrastructure. For example, Figure 2 This is a deployment diagram of a cloud management platform provided in an embodiment of this application. Figure 2 As shown, the cloud management platform 200 can be deployed on any computing node in the cloud data center, such as computing node 10.

[0082] The compute node 10 includes a hardware layer and a software layer. The hardware layer consists of the conventional configuration of the compute node, where PCI devices can be, for example, network cards, GPUs, offloading cards, etc., which can be plugged into the PCI / PCIe slots of the compute node. The software layer includes the operating system installed and running on the compute node (which can be called the host operating system relative to the operating system of a virtual machine). The host operating system can be deployed on the cloud management platform 200 that provides detection services to user applications.

[0083] In actual implementation, the software layer of computing node 10 includes cloud service 1 and cloud service 2. Cloud service 1 is used to deploy the application to be tested 100, and cloud service 2 is used to deploy the cloud management platform 200.

[0084] It is worth noting that the application to be tested 100 can be a desktop application, a mobile application, or a web application. Figure 1 The deployment method of the application to be tested 100 shown is intended to facilitate understanding of this application. In actual implementation, the application to be tested 100 can also run on the operating system, virtual machine, container or sandbox of the computing device 10, or on the operating system, virtual machine, container or sandbox of other computing devices, or run on cloud service 2 at the same time as cloud management platform 200. This application does not limit this.

[0085] The cloud management platform 200 includes dynamic detection instance 210, static detection instance 220 and sensitive identification instance 230.

[0086] When the cloud management platform 200 runs the aforementioned dynamic detection instance 210, it can capture data streams from multiple nodes interacting with the application 100 under test. The data stream of each of these multiple nodes is the data stream between that node and the application 100 under test. These multiple nodes may include one or more of compute nodes, server nodes, and storage nodes.

[0087] The aforementioned data stream includes multiple data packets, each corresponding to an interaction request. This interaction request can be either a Hypertext Transfer Protocol (HTTP) request or a Hypertext Transfer Protocol Secure (HTTPS) request.

[0088] The cloud management platform 200 can parse the aforementioned multiple traffic data packets to obtain the communication parameters of multiple nodes. These communication parameters include the request header, request method, domain name, IP address, status code, and data packet size for each interaction request, as well as the number of requests between the application under test 100 and any node.

[0089] The cloud management platform 200 can establish a heterogeneous information network based on the above communication parameters to obtain the behavioral feature vectors of multiple nodes.

[0090] Schematic, the heterogeneous information network described above can be represented as G = (V, E). Based on the behavior patterns and functions of the nodes, the multiple nodes in the heterogeneous information network G = (V, E) can be divided into process nodes for executing the request process of the application under test 100, service nodes for providing APIs or services to the application under test 100, and resource nodes for storing the data requested by the application under test 100.

[0091] For example, the multiple nodes mentioned above can be represented as a set V = {v1, v2, ..., vn}, and the edges connecting the multiple nodes can be represented as a set E = {e1, e2, ..., em}.

[0092] In practical implementation, the direction of edges connecting multiple nodes in a heterogeneous information network G=(V,E) can be determined based on the nature of the interaction request (e.g., sending a request or responding to a request). The weights of these edges are defined based on the number of requests. For example, the weight W of a certain edge... ij This can be represented as the time interval from node v within time t. i to node v j The number of requests.

[0093] By establishing the aforementioned heterogeneous information network, the behavior and communication patterns of the application 100 under test can be accurately reflected.

[0094] In the dynamic detection instance 210, a first machine learning model based on a graph neural network is pre-deployed. The cloud management platform 200 can also perform matrix transformation on the above heterogeneous information network to obtain the adjacency matrix corresponding to the node of the heterogeneous information network, and input the adjacency matrix into the first machine learning model, and the first machine learning model outputs the first sensitivity probability of the application 100 to be detected.

[0095] In practice, the first machine learning model may include a graph attention layer, a graph autoencoder, and a classifier. The specific process by which the first machine learning model outputs the first sensitivity probability may include the following.

[0096] First, the cloud management platform 200 can input the adjacency matrix into the first machine learning model, which then uses a graph attention layer to assign corresponding attention weights to multiple nodes based on the behavioral feature vectors they are placed in.

[0097] Then, the first machine learning model updates the graph embedding of each node according to the attention weights mentioned above.

[0098] Graph embedding, also known as graph representation learning, is a technique that maps graph structures (including nodes, edges, subgraphs, and their attributes) to a low-dimensional continuous vector space. In the embodiments of this application, the core objective of graph embedding is to transform unstructured heterogeneous information networks into numerical feature vectors suitable for machine learning models by preserving the structural information, inter-node relationships, and semantic features of the heterogeneous information network.

[0099] Then, the first machine learning model can use its own graph autoencoder to obtain the reconstruction error of each of the above multiple nodes based on the updated graph embedding, and determine the abnormal nodes among the multiple nodes based on the above reconstruction error.

[0100] Finally, once the abnormal nodes are identified, the cloud management platform 200 can determine the centrality index of each abnormal node based on the behavioral feature vector of each abnormal node, and input the above centrality index into the classifier, which outputs the first sensitivity probability of the application 100 to be detected.

[0101] The centrality indicators of a particular anomalous node may include its node importance, betweenness centrality, and proximity centrality.

[0102] The following sections will introduce the importance index, betweenness centrality index, and proximity centrality index.

[0103] The NodeRank metric is used to identify nodes that interact frequently with the application being tested (100) and to determine the node's influence in the network.

[0104] The mathematical expression for the node importance index is as follows:

[0105]

[0106] Where d is the damping factor, N is the total number of nodes in the heterogeneous information network, M(vi) is the set of nodes pointing to node vi, and L(vj) is the number of outgoing edges from node vj.

[0107] Betweenness centrality is used to identify intermediate nodes (also known as bridge nodes) that frequently act as relay stations in heterogeneous information networks.

[0108] The illustrative mathematical expression for the betweenness centrality index is as follows:

[0109]

[0110] Where, σ st Let σ be the shortest path from node s to node t, where σ represents the total number of paths that traverse the fewest nodes. st (v i ) is through v i The total number of shortest paths.

[0111] The proximity centrality metric is used to indicate whether a node of interest has unusually efficient data transmission.

[0112] The illustrative mathematical expression for the centrality index is as follows:

[0113]

[0114] Wherein d(v i ,v j ) is node v i and v j The shortest path distance between two nodes is the number of edges on the path from one node to another. The weights of the edges are not considered in the shortest path distance.

[0115] When the cloud management platform 200 runs the above static detection instance 210, it can obtain multiple permissions called by the application 100 to be detected, and use the T-test formula to analyze each permission to determine whether the above multiple permissions are sensitive permissions, and establish a sensitive permission set based on the above sensitive permissions.

[0116] The T-test formula will be introduced below.

[0117] The t-test is a statistical method used to assess whether the difference between two sample means is statistically significant. The basic principle of the t-test formula is to calculate a t-value, which reflects the magnitude of the difference between the two sample means relative to the degree of variation within the sample. Additionally, a p-value is calculated to determine whether the difference is caused by random factors. If the p-value is less than a pre-set significance level, the two sample means are considered to be significantly different. For illustration, the p-value can be set to 0.05.

[0118] In actual implementation, static detection instance 210 includes a pre-deployed sensitive permission dataset and a benign permission dataset. The sensitive permission dataset includes permissions invoked by multiple sensitive apps, while the benign permission dataset includes permissions invoked by multiple benign apps.

[0119] The cloud management platform 200 can use the T-test formula to calculate the differences in permissions of the application 100 to be tested in the sensitive permission dataset and the benign permission dataset, thereby selecting the sensitive permissions that are more representative of sensitive risks and establishing a sensitive permission set.

[0120] When the cloud management platform 200 runs the above-mentioned static detection instance 210, it is also used to obtain multiple APIs of the application 100 to be detected, and to analyze each API using the coefficient of variation to determine whether the above-mentioned multiple APIs are sensitive APIs, and to establish a sensitive API set based on the above-mentioned sensitive APIs.

[0121] The coefficient of variation will be introduced below.

[0122] The coefficient of variation (CV) is a statistical measure of the relative dispersion of data. It is expressed as the ratio of the standard deviation to the mean, typically as a percentage. The CV eliminates the influence of data scaling, facilitating comparisons between different datasets. In sensitive app detection, the CV can be used to assess the stability of API usage frequency, helping to identify APIs with significantly fluctuating usage frequencies across different apps, thereby improving the accuracy of the detection model.

[0123] In actual implementation, static detection instance 210 also includes a pre-deployed sensitive API dataset and a benign API dataset. The sensitive API dataset includes multiple APIs from multiple sensitive apps, and the benign API dataset includes multiple APIs from multiple benign apps.

[0124] The cloud management platform 200 can calculate the average usage frequency of each API of the application 100 to be tested in both sensitive and benign API datasets, and set thresholds for initial screening. Furthermore, the cloud management platform 200 can introduce the coefficient of variation to assess the stability of API usage frequency, and, combined with comparative analysis of the benign API dataset, define a comprehensive sensitivity scoring system. APIs are then selected based on their scores to establish a sensitive API set.

[0125] The cloud management platform 200 is also used to establish a set of sensitive API sequences corresponding to the application 100 to be detected based on the aforementioned set of sensitive APIs.

[0126] In static detection instance 210, a second machine learning model consisting of a classification model is pre-deployed. The cloud management platform 200 can input the aforementioned sensitive permission set and sensitive API sequence set into the second machine learning model, which will output the second sensitivity probability of the application 100 to be detected.

[0127] Sensitive identification instance 230 pre-deploys a third machine learning model consisting of an eXtreme Gradient Boosting (XGBoost) model.

[0128] When the cloud management platform 200 runs the aforementioned sensitive identification instance 230, it can receive the first sensitive probability sent by the dynamic analysis instance 210 and the second sensitive probability sent by the static analysis instance 220, and input the first and second sensitive probabilities into the third machine learning model. The third machine learning model adjusts the weights of the first and second sensitive probabilities, and outputs the third sensitive probability of the detection application 100 by combining the weighted first and second sensitive probabilities.

[0129] Firstly, based on the content described above, the application detection method provided in the embodiments of this application will be introduced. It is understood that this method is proposed based on the content described above, and some or all of the content of this method can be found in the description above.

[0130] For example, Figure 3 This is a flowchart illustrating an application detection method proposed in this application, as shown below. Figure 3 As shown, sensitivity detection of the application under test can be achieved through steps S310 to S340. It is understood that this method is applied to a cloud management platform 200, which is used in a cloud data center, including... Figure 1 Multiple computing nodes, including computing node 10, are shown.

[0131] S310: Obtain data streams from multiple nodes.

[0132] The cloud management platform 200 can obtain data streams from multiple nodes. The data stream for each of these nodes is the data stream between that node and the application 100 under test. The application 100 under test can be a desktop application, a mobile application, or a web application, and the data stream includes interaction requests from multiple nodes related to the application 100 under test. These multiple nodes can include one or more of compute nodes, server nodes, and storage nodes.

[0133] S320: Establish a heterogeneous information network based on the data flow of multiple nodes.

[0134] First, the cloud management platform 200 can parse the data streams of the above multiple nodes to obtain the communication parameters of each node.

[0135] Then, the cloud management platform 200 can establish a heterogeneous information network of the application to be detected 100 based on the communication parameters of the above-mentioned multiple nodes.

[0136] In some possible implementations, the communication parameters of each of the multiple nodes correspond to the interaction requests that node makes with other nodes. These communication parameters include the request headers, response information, request nature, and number of requests.

[0137] The cloud management platform 200 can generate a node set to represent multiple nodes based on request headers and response information.

[0138] The cloud management platform 200 can generate a set of edges to represent the connection relationships and directions of multiple nodes based on the nature of the request. Each edge in the set is assigned a weight, which is determined based on the number of requests.

[0139] The cloud management platform 200 can establish a heterogeneous information network corresponding to the application 100 to be detected based on the above node set and edge set.

[0140] To illustrate, firstly, the cloud management platform 200 establishes a node set V = {v1, v2, ..., vn} for multiple nodes based on the aforementioned communication parameters.

[0141] Then, the cloud management platform 200 uses the request relationship as a connection edge, determines the direction of the connection edge according to the nature of the request, and establishes an edge set E = {e1,e2,…,em}.

[0142] Then, the cloud management platform 200 uses the number of requests within a specific time period as the weight of the edge. That is, for the edge eij between two nodes vi and vj, its weight is... Where f(vi,vj,t) represents the number of requests from vi to vj within time t, and T is the observation time period.

[0143] Finally, the cloud management platform 200 can establish a heterogeneous information network G = (V, E) of the application 100 to be detected based on the node set V = {v1, v2, ..., vn} and the edge set E = {e1, e2, ..., em}. Different encoding methods can be used for different parameters in each node to obtain the feature vector of each node, which is used for subsequent anomaly detection processing.

[0144] For example, Figure 4 This is a schematic diagram of the heterogeneous information network of the application to be tested, such as... Figure 4 As shown, the heterogeneous information network includes nodes V1 to V6. V1 corresponds to process node P1, and V2 corresponds to process node P2. V3 corresponds to service node S1, and V4 corresponds to service node S2. V5 corresponds to resource node R1, and V6 corresponds to resource node R2.

[0145] The following content will explain the calling relationships between the above nodes.

[0146] v1 initiates an interaction request to v3. The edge corresponding to this request is e13, the direction of this edge is v1->v3, and the weight of this edge is w13, which is 4.

[0147] v3 responds to the interaction request initiated by v1. The edge corresponding to this response action is e31, the direction of this edge is v3->v1, and the weight w31 of this edge is 2.

[0148] v1 initiates an interaction request to v4. The edge corresponding to this request is e14, the direction of this edge is v1->v4, and the weight w14 of this edge is 5.

[0149] v4 initiates an interaction request to v5. The edge corresponding to this request is e45, the direction of this edge is v4->v5, and the weight of this edge is w45=6.

[0150] v5 responds to the interaction request initiated by v4. The edge corresponding to this response action is e54, the direction of this edge is v5->v4, and the weight of this edge is w54=3.

[0151] v2 initiates an interaction request to v4, with the corresponding edge being e24. The direction of this edge is v2->v4, and the weight of this edge, w24, is 1. v4 initiates an interaction request to v6, with the corresponding edge being e46. The direction of this edge is v4->v6, and the weight of this edge, w46, is 2.

[0152] v3 initiates an interaction request to v6. The edge corresponding to this request is e36, the direction of this edge is v3->v6, and the weight of this edge w36 is 3.

[0153] v6 responds to the interaction request initiated by v3. The edge corresponding to this response action is e63, the direction of this edge is v6->v3, and the weight of this edge w63 is 4.

[0154] S330: Input the heterogeneous information network into the first machine learning model, and the first machine learning model determines the abnormal nodes among multiple nodes.

[0155] In some possible implementations, the first machine learning model includes a graph attention layer, a graph autoencoder, and a classifier.

[0156] For example, Figure 5 This is a diagram illustrating the first sensitivity probability output by the first machine learning model. (Example) Figure 5 As shown, the first machine learning model can be pre-trained before performing sensitivity detection on the application to be detected.

[0157] First, during the training phase, the cloud management platform 200 can establish a heterogeneous information network for training based on the communication parameters of multiple nodes. These multiple nodes include a first number of normal nodes and a second number of abnormal nodes, and the heterogeneous information network includes the behavioral feature vectors of both the normal and abnormal nodes.

[0158] Then, the cloud management platform 200 can perform matrix transformation on the above heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network, and input the adjacency matrix into the first machine learning model. The first machine learning model uses the graph attention layer to assign the corresponding attention weights to the multiple nodes according to the behavioral feature vectors of the multiple nodes.

[0159] Then, the first machine learning model can update the graph embedding of each node according to the aforementioned attention weights, and input the updated graph embeddings of multiple nodes into the graph autoencoder for training to obtain the trained graph autoencoder. The graph autoencoder includes an encoder and a decoder.

[0160] During the iterative training process, firstly, the graph autoencoder can use unsupervised learning to map the above graph embeddings to a low-dimensional space using the encoder, and then the decoder reconstructs the graph embeddings of multiple nodes.

[0161] Then, the graph autoencoder can reduce the reconstruction error of each node and learn the feature representation of normal nodes by labeling multiple normal and abnormal nodes and adjusting its own model parameters based on the graph embedding of multiple normal and abnormal nodes. Illustratively, the graph autoencoder can label normal nodes as "0" and abnormal nodes as "1".

[0162] The reconstruction error described above represents the degree to which a node deviates from the behavioral characteristics of a normal node. The larger the value, the further the node deviates from the normal node. Conversely, the smaller the reconstruction error, the closer the node is to the normal node.

[0163] Meanwhile, the cloud management platform 200 can also generate a feature training set based on the behavioral feature vectors in heterogeneous information networks. This feature training set includes behavioral feature vectors from multiple normal and abnormal nodes.

[0164] The cloud management platform 200 can input the above feature training set into the classifier, and the classifier can perform supervised learning based on whether multiple nodes are normal (marked "0") or abnormal (marked "1").

[0165] Finally, by iterating through the classifier to find the optimal balance point, we can minimize the false alarm rate while maintaining a high detection accuracy.

[0166] After the first machine learning model is trained, the cloud management platform 200 can use the first machine learning model to identify abnormal nodes among multiple nodes through steps S331 to 333.

[0167] S331: Matrix transformation.

[0168] As mentioned above, the heterogeneous information network established in step S330 includes process nodes v1 and v2, service nodes v3 and v4, and resource nodes v5 and v6. Based on the connection edges in the heterogeneous information network, which are used as connection relationships for request relationships, the cloud management platform 200 can perform matrix transformation according to the above content to obtain the adjacency matrix corresponding to the heterogeneous information network.

[0169] S332: Calculate attention weights.

[0170] The cloud management platform 200 can input the adjacency matrix into the first machine learning model, which then uses a graph attention layer to assign corresponding attention weights to multiple nodes based on their behavioral feature vectors.

[0171] Indicatively, the cloud management platform 200 can use a graph attention mechanism (GAT) to assign different attention weights to the neighbors of each node in a heterogeneous information network, in order to determine their contribution to the node's embedding. The mathematical expression for the attention weights is:

[0172]

[0173] Among them, h i and h j These are the input feature vectors of node i and node j, respectively, w ijis the edge weight between nodes i and j, which is treated as an additional input feature in GAT. W is a linear transformation matrix used to transform the node's features. a is the parameter vector of the attention mechanism used to calculate the attention coefficients between neighboring nodes. || denotes the vector concatenation operation. LeakyReLU is an activation function, whose mathematical expression is:

[0174]

[0175] Where x is the input value, and α = 0.01 represents the output slope of a negative input.

[0176] As one possible implementation, the edge weight w can also be added during the process of assigning attention weights to neighboring nodes. ij To improve the accuracy of attention allocation.

[0177] By introducing edge weight w ij This allows the attention coefficients to depend not only on the features of node i and its neighbor j, but also on the information of the edges connecting them. This means that the attention weights will be determined based on both the node features and the properties of the connecting edges.

[0178] During the processing of the first machine learning model, the attention coefficient α calculated above can be used. ij Update the graph embedding for each node.

[0179] For node i, its new graph embedding h' i The mathematical expression is:

[0180] h′ i =ReLU(∑ j∈N(i) α ij Wh j ),

[0181] Where N(i) is the set of neighboring nodes of node i, and ReLU is a non-linear activation function, ReLU(x) = max(0,x).

[0182] S333: Reconstruction error of computing nodes.

[0183] The cloud management platform 200 can embed the graph obtained in step S343 into a graph autoencoder and use the graph autoencoder to determine abnormal nodes among the aforementioned process nodes, service nodes, and resource nodes.

[0184] In practice, a graph autoencoder can reconstruct the graph embedding based on the graph embedding of each node using a pre-trained autoencoder. The autoencoder calculates the error (also called reconstruction error) between the input graph embedding and the reconstructed graph embedding based on the behavioral feature vectors of normal nodes. The mathematical expression for the reconstruction error is as follows:

[0185]

[0186] Among them, f enc This is an encoder function used to process h. i 'By performing feature extraction and compression, h can be...' i 'Mapped to a low-dimensional latent space, f dec This is a decoder function used to reconstruct the encoder output representation in an attempt to recover the original feature form.

[0187] When the reconstruction error of the above node increases significantly, it indicates that the behavior of the node deviates far from that of a normal node, thus identifying the node as an abnormal node.

[0188] S340: The first machine learning model determines the centrality index of the abnormal node based on the behavioral feature vector of the abnormal node, and outputs the first sensitivity probability of the application to be detected based on the centrality index.

[0189] Once an anomalous node is identified, the first trained machine learning model can determine the centrality index of the anomalous node based on its behavioral feature vector, and output the first sensitivity probability of the application to be detected based on the centrality index. As mentioned earlier, the centrality index of an anomalous node includes node importance index, betweenness centrality index, and proximity centrality index.

[0190] Please continue reading. Figure 5 The cloud management platform 200 can use the trained first machine learning model to output the first sensitivity probability of the application to be detected through steps S341-342.

[0191] S341: Determine the centrality index of anomalous nodes.

[0192] In some possible implementations, the cloud management platform 200 can determine the centrality index of each node based on the behavioral feature vectors of the heterogeneous information network.

[0193] As one possible implementation, the cloud management platform 200 could also calculate the centrality index of each abnormal node only after the abnormal node has been identified.

[0194] As mentioned above, the centrality metrics include the node importance metric, betweenness centrality metric, and proximity centrality metric for each node.

[0195] The following content will introduce the process of determining the importance index of nodes.

[0196] As an illustration, the cloud management platform 200 can initialize the node importance metric for each node. For example, assuming the initial value of the node importance metric for each node is 1, it is represented as NR0(v i = 1 / 6. Iterative calculation is performed using the following formula:

[0197]

[0198] Where d is the damping factor, taken as 0.85, N is the total number of nodes, and M(v i ) is a pointer to node v i The set of nodes, L(v) j ) is node v j The number of outgoing edges.

[0199] Taking node v4 as an example, during the first round of iteration calculation, v4 is pointed to by v1, v2 and v5.

[0200]

[0201] Therefore, we can conclude that NR0(v1) = 0.1667 with an out-degree of 2, NR0(v2) = 0.1667 with an out-degree of 1, NR0(v3) = 0.1667 with an out-degree of 1, and NR1(v4) = 0.3808.

[0202] In the same way, the NR values ​​of other nodes can be obtained: NR1(v1) = 0.0958, NR1(v2) = 0.02, NR1(v3) = 0.1667, NR1(v5) = 0.0958, and NR1(v6) = 0.1667. It is worth noting that in actual implementation, multiple iterations are required to stabilize the NR values ​​of each node.

[0203] The process of determining proximity centrality will be described below.

[0204] As mentioned earlier, the mathematical expression for proximity centrality is:

[0205]

[0206] Wherein d(v i ,v j ) is node v i and v j The shortest path distance between two nodes is the number of edges on the path from one node to another. The weights of the edges are not considered in the shortest path distance.

[0207] The following is combined with Figure 4 Please refer to Table 1 for further explanation.

[0208] Table 1 Path Distance Statistics for Nodes

[0209] node <![CDATA[to v1]]> <![CDATA[to v2]]> <![CDATA[to v3]]> <![CDATA[to v4]]> <![CDATA[to v5]]> <![CDATA[to v6]]> <![CDATA[v1]]> 0 3 1 1 2 2 <![CDATA[v2]]> 3 0 3 2 3 1 <![CDATA[v3]]> 1 3 0 2 3 1 <![CDATA[v4]]> 1 2 2 0 1 1 <![CDATA[v5]]> 2 3 3 1 0 2 <![CDATA[v6]]> 2 1 1 1 2 0

[0210] Schematic illustration, starting with node v1. Since both v1 and v2 are process nodes, the path distance from v1 to v2 is 3. v3 and v4 are service nodes, so the path distance from v1 to both v3 and v4 is 1. v5 and v6 are resource nodes, so the path distance from v1 to both v3 and v4 is 2. The path distances for other nodes will not be elaborated further below.

[0211] Based on the above mathematical expression for near-centrality, we can derive that C C (v1)≈0.111、C C (v2)≈0.083, C C (v3) = 0.1, C C (v4)≈0.143, C C (v5)≈0.091, C C( v6)≈0.143.

[0212] The process of determining betweenness centrality will be described below.

[0213] As mentioned earlier, the mathematical expression for betweenness centrality is:

[0214]

[0215] Where σst is the shortest path from node s to node t, and the shortest path represents the total number of paths that pass through the fewest nodes. σst(vi) is the total number of shortest paths through vi.

[0216] The following is combined with Figure 4 Please refer to Table 2 for further explanation.

[0217] Table 2 Shortest Path Statistics for Nodes

[0218] Starting point s End point t Shortest path intermediate nodes <![CDATA[v1]]> <![CDATA[v3]]> <![CDATA[v1→v3]]> none <![CDATA[v1]]> <![CDATA[v4]]> <![CDATA[v1→v4]]> none <![CDATA[v1]]> <![CDATA[v5]]> <![CDATA[v1→v4→v5]]> <![CDATA[v4]]> <![CDATA[v1]]> <![CDATA[v6]]> <![CDATA[v1→v4→v6]]> <![CDATA[v4]]> <![CDATA[v2]]> <![CDATA[v4]]> <![CDATA[v2→v4]]> none <![CDATA[v2]]> <![CDATA[v5]]> <![CDATA[v2→v4→v5]]> <![CDATA[v4]]> <![CDATA[v2]]> <![CDATA[v6]]> <![CDATA[v2→v4→v6]]> <![CDATA[v4]]> <![CDATA[v3]]> <![CDATA[v6]]> <![CDATA[v3→v6]]> none <![CDATA[v4]]> <![CDATA[v5]]> <![CDATA[v4→v5]]> none <![CDATA[v4]]> <![CDATA[v6]]> <![CDATA[v4→v6]]> none <![CDATA[v5]]> <![CDATA[v4]]> <![CDATA[v5→v4]]> none <![CDATA[v6]]> <![CDATA[v3]]> <![CDATA[v6→v3]]> none

[0219] For illustration, with node v1 as the starting point and v3 and v4 as service nodes, there are no intermediate nodes between v1 and v3 / v4. v5 and v6 are resource nodes, so the path from v1 to v5 will pass through the intermediate node v4. The path from v1 to v will also pass through the intermediate node v4. The shortest paths for other nodes will not be elaborated further below.

[0220] Based on the mathematical expression for betweenness centrality mentioned above, we can derive that C B (v1) = 0, C B (v2) = 0, C B(v3) = 1, CB(v4) = 3, C B (v5) = 0, C B (v6) = 0.

[0221] S342: Output the first sensitivity probability.

[0222] Once an anomalous node is identified, the cloud management platform 200 can input the centrality index of the anomalous node into a classification model, which will then output the first sensitivity probability of the application 100 to be detected. The centrality index of the anomalous node is determined based on its behavioral feature vector.

[0223] In some possible implementations, the cloud management platform 200 may also use the data packet size of the application 100 to be detected as the first sensitivity probability detection indicator to more comprehensively assess the sensitivity risk of the application 100 to be detected.

[0224] It is understandable that the cloud management platform 200 can obtain the detection result of the application 100 to be detected based on the first sensitivity probability and send the detection result to the user, which will not be elaborated here.

[0225] By performing dynamic traffic analysis on the application to be detected through a cloud management platform, a heterogeneous information network corresponding to the above-mentioned nodes can be established based on the interactive requests of multiple nodes. The above-mentioned heterogeneous information network is input into a first machine learning model, which is used to identify abnormal nodes related to the application. Based on the behavioral feature vectors of the abnormal nodes, the first sensitivity probability of the application is determined, thereby realizing the sensitivity detection of the application. This method can improve the efficiency, accuracy and precision of sensitive application detection.

[0226] In some possible implementations, in order to improve the accuracy and precision of application sensitivity detection, the application detection method may also include steps S350 to S390.

[0227] Please continue reading. Figure 3 ,like Figure 3 As shown in the dashed line, the cloud management platform 200 can further realize sensitive detection of the application to be detected through S350 to S390.

[0228] S350: Obtain multiple permissions for the application to be tested, and use the T-test formula to analyze each permission to determine the sensitive permissions among the multiple permissions.

[0229] The cloud management platform 200 can obtain multiple permissions of the application 100 to be tested, and use the T-test formula to analyze each permission to determine the sensitive permissions among the multiple permissions, and establish a set of sensitive permissions for the application 100 to be tested based on the above sensitive permissions.

[0230] For example, Figure 6 This is a diagram illustrating the establishment of a set of sensitive permissions for the application to be tested, such as... Figure 6 As shown, the cloud management platform 200 can obtain permissions for multiple sensitive apps and establish a sensitive permission dataset based on these permissions. The cloud management platform 200 can also obtain permissions for multiple benign apps and establish a benign permission dataset based on these benign app permissions.

[0231] When performing sensitivity testing on the application 100 to be tested, the security review platform 200 can determine the sensitivity permissions of the application 100 to be tested based on the aforementioned sensitive permission dataset and benign permission dataset.

[0232] Taking the SP (first permission) of the application 100 to be tested as an example, the cloud management platform 200 can determine whether the first permission is a sensitive permission through steps S351 to S353. The first permission is one of multiple permissions of the application 100 to be tested.

[0233] S351: Calculate the frequency of SP usage in the sensitive permissions dataset. Illustratively, this frequency can be represented as f. fraud,sp .

[0234] S352: Calculate the frequency of SP usage in the benign permissions dataset. Illustratively, this frequency can be represented as f. benign,sp .

[0235] S353: Calculate the t-value of SP using the T-test formula.

[0236] The mathematical expression for the T-test formula is:

[0237]

[0238] Where M represents the total number of sensitive apps, N represents the total number of benign apps, and S pooled This represents the combined standard deviation of the sensitive app set and the benign app set.

[0239] Based on the above, the pooled standard deviation S can be obtained. pooled The mathematical expression is:

[0240]

[0241] in, and This represents the variance of the frequency of permission usage in a sensitive app. Permission SPs must satisfy the following constraint, the mathematical expression of which is: g

[0242]

[0243] The above mathematical expression illustrates that if the P-value of permission SP is less than a predetermined threshold and its frequency is higher among sensitive permissions, then permission SP can be determined as a sensitive permission. Here, δ is the critical value corresponding to the significance level. As mentioned earlier, the predetermined threshold for the P-value can be set to P < 0.05.

[0244] Understandably, the security audit platform 200 can perform the above operations on each permission of the application 100 to be tested in the same way, and establish a set of sensitive permissions SP = {sp1, sp2, sp3, ...} for the application 100 to be tested based on the sensitive permissions of the application 100 to be tested.

[0245] S360: Obtains multiple APIs of the application to be detected, and analyzes each API using the coefficient of variation to identify sensitive APIs among the multiple APIs.

[0246] The cloud management platform 200 can obtain multiple APIs of the application 100 to be detected, analyze each API using the coefficient of variation to identify sensitive APIs among the multiple APIs, and establish a set of sensitive APIs of the application 100 to be detected based on the above sensitive APIs.

[0247] For example, Figure 7 This is a diagram illustrating the creation of a set of sensitive APIs for the application to be monitored, such as... Figure 7 As shown, the API of application 100 to be tested j Taking the first API as an example, the cloud management platform 200 can determine whether the first API is a sensitive permission through steps S351 to S353. The first API is one of multiple APIs of the application 100 to be tested.

[0248] S361: Determine the API j Frequency of use in sensitive API datasets. Illustratively, this frequency of use can be represented as f. j,fraud .

[0249] S362: Determine the API j Frequency of use in benign API datasets. Indicatively, this frequency of use can be represented as f. j,benign .

[0250] In some possible implementations, to reduce the computational overhead of the cloud management platform 200, a predetermined threshold γ can be set, and the frequency f can be adjusted accordingly. j,fraud Filter the APIs of the application to be tested, such as Figure 6 The mathematical expression for the above filtering is:

[0251] S={j|f j,fraud ≥γ}

[0252] Where S is a set of APIs of the application to be detected 100 that meet the screening criteria, and this set includes multiple APIs whose usage frequency is greater than the threshold γ.

[0253] S363: Determine the coefficient of variation of APIj in the sensitive API dataset and the benign API dataset, respectively.

[0254] Before determining the coefficient of variation, the cloud management platform 200 can determine the frequency of use of the first API in the sensitive API dataset based on f. j,fraud and the frequency of use f in benign API datasets. j,benign Determine the mean value corresponding to each frequency.

[0255] Based on the frequency of use f in the sensitive API dataset j,fraud For example, the mathematical expression for this mean is:

[0256]

[0257] Where M is the total number of sensitive apps, n ij Use API for the i-th APP j The number of times, N i This represents the total number of API calls made by the i-th app.

[0258] Understandably, cloud management platform 200 could use the same approach to analyze the usage frequency f in a benign API dataset. j,benign The analysis will be conducted separately, and will not be repeated below.

[0259] The cloud management platform 200 can determine the coefficient of variation of APIj in sensitive API datasets and benign API datasets, respectively.

[0260] Based on the frequency of use f in the sensitive API dataset j,fraud For example, this coefficient of variation can represent CV j,fraud The coefficient of variation, used to reflect the stability of APIj usage frequency, is expressed mathematically as follows:

[0261]

[0262] Among them, f j,fraud APIs in the collection of sensitive apps j Using the mean of the frequency, σ j,fraud APIs in the collection of sensitive apps j Standard deviation of frequency.

[0263] Understandably, the cloud management platform 200 could use the same method to perform the same analysis on a collection of benign apps, thereby obtaining APIs. jThe frequency mean f in the set of benign apps j,benign With coefficient of variation CV j,benign .

[0264] S364: Determine the sensitivity score of APIj.

[0265] The cloud management platform 200 can determine the sensitivity score of APIj based on the frequency coefficient and variation coefficient of the first API obtained in step S363.

[0266] To illustrate, the sensitivity score of APIj can be represented as a Score. j The mathematical expression for this sensitivity score is:

[0267] Score j =(f j,fraud -f j,benign (1-CV) j,fraud (1-CV) j,benign )

[0268] The cloud management platform 200 can calculate the overall sensitivity score of each API of the application 100 to be tested based on the mathematical expression of the sensitivity score, until the sensitivity calculation of all APIs of the application 100 to be tested is completed. The APIs are sorted from high to low according to a predetermined threshold, and the first predetermined number of APIs are selected from the above sequence to establish a sensitive API set A = {a1, a2, a3, ...} of the application 100 to be tested.

[0269] S370: Establish a set of sensitive API sequences for the application to be detected based on the set of sensitive APIs.

[0270] The cloud management platform 200 can establish a sensitive API sequence set of the application to be detected based on the sensitive API set of the application to be detected 100 determined in step S360.

[0271] First, the cloud management platform 200 can generate an API call graph corresponding to the sensitive APP based on the above sensitive API sequence set.

[0272] Then, the cloud management platform 200 can traverse the call graph using a breadth-first search algorithm to transform the above sensitive API sequence set into an API call sequence, which can retain only the subsequences associated with the sensitive APIs in set A.

[0273] For illustration, the API sequence used by the application to be tested 100 is: {a1→a2→b1→a3→b2→b3, a1→a5→b2→a2→b5, ...}.

[0274] Here, ai represents sensitive APIs in set A, and bi represents non-sensitive APIs. The cloud management platform 200 can filter out non-sensitive APIs from the sequence to obtain the sensitive API sequence.

[0275] Indicatively, the sensitive API sequence can be represented as: {s1: a1→a2→a3, s2: a1→a5→a2, ...}.

[0276] The cloud management platform 200 can use the same method to statistically analyze each sensitive app, identify and record sensitive API sequences with a frequency of 0.2 or higher within the sensitive app set, and assign a corresponding sensitivity score to each sequence based on the sensitivity score of the sensitive APIs in the sequence. The mathematical expression for this sensitivity score is as follows:

[0277]

[0278] The cloud management platform 200 can determine the sensitive API sequence set S using the mathematical expression for the aforementioned sensitive scores. i = {s1, s2, s3, ...}. Where S... i This indicates the sensitive API sequence of the application to be detected (100).

[0279] S380: Input the set of sensitive permissions and the set of sensitive API sequences into the second machine learning model, and the second machine learning model outputs the second sensitivity probability of the application to be detected.

[0280] The cloud management platform 200 can input the set of sensitive permissions and the set of sensitive API sequences of the application to be detected into the second machine learning model, and the second machine learning model outputs the second sensitivity probability of the application to be detected.

[0281] For example, Figure 8 This is a schematic diagram illustrating the output of the second sensitivity probability by the second machine learning model. For example... Figure 8 As shown, a second machine learning model can be pre-trained before performing sensitivity detection on the application to be detected. As previously mentioned, this second machine learning model consists of a classifier.

[0282] First, during the training phase, a feature training set, a feature test set, and a feature verification set containing both benign and sensitive apps can be established.

[0283] Each sample in the dataset above can contain two main features.

[0284] 1) The percentage of sensitive permissions used by multiple applications under test in total permissions.

[0285] 2) Sensitivity scores of the sensitive API sequences used by multiple applications under test.

[0286] During the training phase, each sample in the training set can be labeled. For example, benign apps can be labeled as "0" and sensitive apps as "1".

[0287] Understandably, during training, feature test sets and feature validation sets can be used to evaluate the trained machine learning model. The loss function can be used to calculate the loss and adjust the classification threshold of the second machine learning model, which is the critical value of the model's output probability, to determine whether the APP is sensitive.

[0288] Then, the optimal balance point for classification by the second machine learning model can be found through multiple iterations, so as to minimize the false alarm rate while maintaining a high detection accuracy.

[0289] After training is completed, the cloud management platform 200 can input the sensitive permission set and sensitive API sequence set of the application to be detected 100 into the second machine learning model, and the second machine learning model will output the second sensitivity probability of the application to be detected.

[0290] S390: Input the first sensitivity probability and the second sensitivity probability into the third machine learning model, the third machine learning model determines the weights of the first sensitivity probability and the second sensitivity probability respectively, and outputs the third sensitivity probability of the application to be detected based on the weighted first sensitivity probability and the second sensitivity probability.

[0291] After the application to be tested 100 obtains a first sensitivity probability through steps S310-S340 and a second sensitivity probability through steps S350-S380, the cloud management platform 200 can input the first and second sensitivity probabilities into a third machine learning model. The third machine learning model determines the weights of the first and second sensitivity probabilities and outputs the third sensitivity probability of the application to be tested based on the weighted first and second sensitivity probabilities. As mentioned above, this third machine learning model is composed of an XGBoost model.

[0292] The training process of the third machine learning model will be introduced below.

[0293] During the training process of the third machine learning model, the training dataset can be used to collect the dynamic parsed first and second sensitivity probabilities for each application to be detected, as well as the actual sensitivity label of the application to be detected, such as "0" or "1". The training dataset composed of the above data can be used to train the third machine learning model.

[0294] In practice, the first and second sensitivity probabilities can be used as input features, and the actual sensitivity labels can be used as target variables.

[0295] The third machine learning model uses a weighted boosting method to determine the optimal combination of the first and second sensitivity probabilities, making the third sensitivity probability predicted by the model closer to the actual label.

[0296] Then, through iterative training, the third sensitivity probability automatically learns and determines the optimal feature weights. The mathematical expression for these feature weights is:

[0297] λ out =α·λ Dynamic +β·λ Static

[0298] Wherein, the first sensitivity probability λ Dynamic The weighting coefficient α, the second sensitivity probability λ Static The weighting coefficient β.

[0299] After the XGBoost model is trained, the third machine learning model can output the third sensitivity probability of the application to be detected based on the weighted first and second sensitivity probabilities.

[0300] Secondly, based on the content described above, this application introduces the training method of the application detection model provided in the embodiments of this application. It is understood that this application detection model is proposed based on the content described above, and some or all of the content in this application detection model can be found in the description above.

[0301] For example, Figure 9 This is a flowchart illustrating the training method for the applied detection model, such as... Figure 9 As shown, the first machine learning model can be trained through steps S910 to S980.

[0302] S910: Obtain communication parameters from multiple nodes. These multiple nodes include a first number of normal nodes and a second number of abnormal nodes.

[0303] S920: A heterogeneous information network for training is established based on the communication parameters of multiple nodes. This heterogeneous information network includes behavioral feature vectors of normal and abnormal nodes.

[0304] S930: Perform matrix transformation on heterogeneous information networks to obtain the adjacency matrix corresponding to the heterogeneous information networks.

[0305] S940: Input the adjacency matrix corresponding to the heterogeneous information network into the graph attention layer. The graph attention layer then assigns attention weights to each node in the network based on the behavioral feature vectors of normal and abnormal nodes.

[0306] S950: Update the graph embedding of each node according to the above attention weights, and input the updated graph embedding into the graph autoencoder for training to obtain the trained graph autoencoder.

[0307] S960: Based on the behavioral feature vectors of normal and abnormal nodes, a feature training set is obtained.

[0308] S970: Input the feature training set into the classifier for training to obtain the trained classifier.

[0309] S980: The first machine learning model is obtained based on the graph attention layer, as well as the trained graph autoencoder and classifier.

[0310] Thirdly, based on the content described above, the cloud management platform provided in the embodiments of this application will be introduced. It is understood that this cloud management platform is proposed based on the content described above, and some or all of the content of this cloud management platform can be found in the description above.

[0311] For example, Figure 10 This is a schematic diagram of a cloud management platform proposed in this application. (For example...) Figure 10 As shown, the cloud management platform 200 may include dynamic detection instance 210, static detection instance 220, and sensitive identification instance 230.

[0312] The dynamic detection instance 210 includes an application traffic packet capture module 211, an application traffic parsing module 212, a heterogeneous information network establishment module 213, and a first anomaly detection module 214.

[0313] The application traffic capture module 211 is used to obtain data streams from multiple nodes. The data stream of each of the multiple nodes is the data stream between that node and the application 100 to be detected.

[0314] Taking mobile applications as an example, firstly, the application traffic capture module 211 can use the Android Debug Bridge (adb) tool to extract the process of the application 100 to be tested.

[0315] Then, the application traffic capture module 211 can identify and start the relevant processes of the application 100 to be detected by executing specific adb commands.

[0316] Then, the application traffic capture module 211 uses the intermediate proxy tool (also known as mitmproxy) provided by the high-level programming language Python to capture the data stream generated during the operation of the application 100 to be detected, based on the above process.

[0317] In actual implementation, the application traffic capture module 211 can use mitmproxy to perform man-in-the-middle attack-style monitoring of interactive requests in the data stream according to the above process, capture data streams from multiple nodes and the output of the application under test 100 pointing to multiple nodes, and store them in the form of Python scripts.

[0318] The application traffic capture module 211 can also send the above data stream to the application traffic parsing module 212.

[0319] The application traffic parsing module 212 can parse the above data stream to obtain the communication parameters of multiple nodes related to the application to be detected.

[0320] Taking a mobile application as an example, the application traffic parsing module 212 can parse the aforementioned Python script to obtain the communication parameters carried in each interaction request. These communication parameters may include the request header, request method, domain name, Internet Protocol address, status code, and data packet size of the interaction request.

[0321] The application traffic parsing module 212 can also input the above communication parameters to the heterogeneous information network establishment module 213.

[0322] The heterogeneous information network establishment module 213 can establish a heterogeneous information network corresponding to the application to be tested 100 based on the above communication parameters. The heterogeneous information network includes the behavioral feature vectors of the above-mentioned multiple nodes.

[0323] In some possible implementations, the heterogeneous information network establishment module 213 is further configured to generate a node set representing multiple nodes based on the request header and response information in the communication parameters, and to generate an edge set representing the connection edges and connection directions between the multiple nodes based on the request properties in the communication parameters. Each edge in the edge set is assigned a weight, which is determined based on the number of requests. The heterogeneous information network establishment module 213 can then establish a heterogeneous information network corresponding to the application 100 to be detected based on the aforementioned node set and edge set.

[0324] The heterogeneous information network establishment module 213 can send the aforementioned heterogeneous information network to the first anomaly detection module 214.

[0325] The first anomaly detection module 214 pre-deploys a first machine learning model. The first anomaly detection module 214 is used to input heterogeneous information networks into the first machine learning model, which then identifies anomalous nodes among multiple nodes.

[0326] In the case of identifying an abnormal node, the first anomaly detection module 214 can determine the centrality index of the abnormal node based on the behavioral feature vector of the abnormal node, and input the centrality index into the first machine learning model, which then outputs the first sensitivity probability of the application 100 to be detected.

[0327] As one possible implementation, the first anomaly detection module 214 is also used to perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network. The first anomaly detection module 214 can input the above adjacency matrix into the first machine learning model, and the first machine learning model can determine the abnormal nodes among multiple nodes.

[0328] In some possible implementations, the first machine learning model includes a graph attention layer and a graph autoencoder. The first anomaly detection module 214 is also used to input the adjacency matrix into the first machine learning model, which uses the graph attention layer to assign corresponding attention weights to each of the multiple nodes based on the behavioral feature vectors of the multiple nodes.

[0329] The first anomaly detection module 214 can use a first machine learning model to update the graph embedding of each node according to the aforementioned attention weights, and obtain the reconstruction error of each node among the multiple nodes through a graph autoencoder based on the updated graph embedding. The reconstruction error of each node represents the degree of deviation between that node and normal nodes. The first anomaly detection module 214 can determine the abnormal nodes among the multiple nodes based on the aforementioned reconstruction errors.

[0330] As one possible implementation, the first machine learning model also includes a classifier.

[0331] In the case of identifying an abnormal node, the first anomaly detection module 214 is further configured to determine the node importance index, betweenness centrality index, and proximity centrality index of the abnormal node based on the behavioral feature vector of the abnormal node.

[0332] The first anomaly detection module 214 can input the node importance index, betweenness centrality index, and proximity centrality index into the classifier of the first machine model. The classifier outputs the first sensitivity probability of the application to be detected 100 based on the node importance index, betweenness centrality index, and proximity centrality index of the anomaly node.

[0333] Please continue reading. Figure 10 ,like Figure 10 As shown, the cloud management platform 200 may also include a static detection instance 220. The static detection instance 220 includes a sensitive permission set establishment module 221, a sensitive API set establishment module 222, a sensitive sequence set establishment module 223, and a second anomaly detection module 224.

[0334] The sensitive permission set establishment module 221 is used to obtain multiple permissions called by the application 100 to be detected, and to analyze each permission using the T-test formula to determine whether the above multiple permissions are sensitive permissions, and to establish a sensitive permission set based on the above sensitive permissions.

[0335] In some possible implementations, the sensitive permission set establishment module 221 includes a pre-deployed sensitive permission dataset and a benign permission dataset. The sensitive permission dataset includes permissions invoked by multiple sensitive apps, while the benign permission dataset includes permissions invoked by multiple benign apps.

[0336] Taking the first permission as an example, firstly, the sensitive permission set establishment module 221 can determine the usage frequency of the first permission in the sensitive permission dataset. The first permission is one of the multiple permissions of the application 100 to be detected.

[0337] Then, the sensitive permission set establishment module 221 can determine the frequency of use of the first permission in the benign permission dataset.

[0338] Then, the sensitive permission set establishment module 221 can use the T-test formula to analyze the usage frequency in the sensitive permission dataset and the usage frequency in the benign permission dataset to determine whether the first permission is a sensitive permission.

[0339] After the sensitive permissions among the multiple permissions of the application 100 to be detected are determined, the sensitive permission set establishment module 221 is also used to send the above-mentioned sensitive permission set to the second anomaly detection module 224.

[0340] The sensitive API set establishment module 222 is used to obtain multiple APIs of the application 100 to be detected, and to analyze each API using the coefficient of variation to determine whether the multiple APIs are sensitive APIs, and to establish a sensitive API set based on the sensitive APIs.

[0341] As one possible implementation, the sensitive API set establishment module 222 includes a pre-deployed sensitive API dataset and a benign API dataset. The sensitive API dataset includes multiple APIs from multiple sensitive apps, while the benign API dataset includes multiple APIs from multiple benign apps.

[0342] Taking the first API as an example, firstly, the sensitive API set establishment module 222 can determine the usage frequency of the first API in the sensitive API dataset. The first API is one of multiple APIs of the application 100 to be detected.

[0343] Then, the sensitive API set building module 222 can determine the frequency of use of the first API in the benign API dataset.

[0344] Then, the sensitive API set building module 222 can determine the coefficient of variation of the first API based on the frequency of use of the first API in the sensitive API dataset and the frequency of use in the benign API dataset.

[0345] Finally, the sensitive API set building module 222 can obtain the sensitivity score of the first API based on the coefficient of variation.

[0346] After the sensitivity scores of multiple APIs of the application to be tested 100 are determined, the sensitive API set building module 222 can determine whether the first API is a sensitive API based on the multiple sensitivity scores.

[0347] Indicatively, the sensitive API set building module 222 can sort each API from highest to lowest sensitivity score, select the top N APIs with higher scores according to a predetermined threshold as the sensitive APIs of the application to be detected 100, and build a sensitive API set based on the sensitive APIs.

[0348] The sensitive API set establishment module 222 is also used to send the sensitive API set to the sensitive sequence set establishment module 223.

[0349] The sensitive sequence set establishment module 223 is used to establish a sensitive API sequence set corresponding to the application to be detected 100 based on the above sensitive API set, and send the above sensitive API sequence set to the second anomaly detection module 224.

[0350] The second anomaly detection module 224 pre-deploys a second machine learning model composed of a classification model. The second anomaly detection module 224 is used to input the sensitive permission set and the sensitive API sequence set into the second machine learning model, and the second machine learning model outputs the second sensitivity probability of the application 100 to be detected.

[0351] Please continue reading. Figure 10 To improve the accuracy and precision of application sensitivity detection, the cloud management platform 200 may also include a sensitivity identification instance 230, in which a third machine learning model consisting of an eXtreme Gradient Boosting (XGBoost) model is pre-deployed.

[0352] Sensitive identification instance 230 can receive a first sensitive probability sent by dynamic traffic analysis module 210 and a second sensitive probability sent by static statistical analysis module 220, and input the first and second sensitive probabilities into a third machine learning model. The third machine learning model adjusts the weights of the first and second sensitive probabilities, and outputs a third sensitive probability of the detection application 100 by combining the weighted first and second sensitive probabilities.

[0353] Fourthly, this application also provides a computing device 10. For example... Figure 11 As shown, the computing device 10 includes a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, memory 12, and communication interface 13 communicate with each other via the bus 14. The computing device 10 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 10.

[0354] Bus 14 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 12 The bus 104 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 104 may include a path for transmitting information between various components of the computing device 10 (e.g., memory 12, processor 11, communication interface 13).

[0355] The processor 11 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0356] The memory 12 may include volatile memory, such as random access memory (RAM). The processor 11 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0357] The memory 12 stores executable program code, and the processor 11 executes the executable program code to implement the functions of the aforementioned dynamic detection instance 210, static detection instance 220, and sensitive identification instance 230, thereby achieving... Figure 3 The method shown.

[0358] The communication interface 13 uses modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 10 and other devices or communication networks.

[0359] Sixthly, embodiments of this application also provide a data center. Figure 12 This is a data center 900 provided in the embodiments of this application.

[0360] The data center 900 may include at least one computing device 10 as described above. This computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0361] like Figure 13 As shown, the data center 900 includes at least one computing device 10. The memory 12 of one or more computing devices 10 in the data center may store the same memory for executing... Figure 3 The instructions for the method shown.

[0362] In some possible implementations, the memory 12 of one or more computing devices 10 in the data center may also store data for execution. Figure 3 The instructions of the method shown are partial. In other words, a combination of one or more computing devices 10 can jointly execute instructions for performing... Figure 3 The instructions for the method shown.

[0363] It should be noted that the memory 12 in different computing devices 10 in the data center can store different instructions, which are used to execute some functions of the cloud management platform 200. That is, the instructions stored in the memory 12 in different computing devices 10 can realize the functions of one or more modules of dynamic detection instance 210, static detection instance 220, and sensitive identification instance 230.

[0364] In some possible implementations, one or more computing devices in data center 900 can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 13 One possible implementation is shown. For example... Figure 13As shown, the two computing devices 10A and 10B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this possible implementation, the memory 12 in computing device 10A stores instructions for executing the functions of dynamic detection instance 210 and static detection instance 220. Meanwhile, the memory 12 in computing device 10B stores instructions for executing the function of sensitive identification instance 230. Figure 13 The connection method between data centers shown can be considered because the data processing method of the key-value storage system provided in this application requires a large amount of storage and computing resources (e.g., storing a large amount of data). Therefore, it is considered that the functions implemented by dynamic detection instance 210 and static detection instance 220 are executed by computing device 10A, and the functions implemented by sensitive identification instance 230 are executed by computing device 10B. It should be understood that Figure 13 The functions of the computing device 10A shown can also be performed by multiple computing devices 10. Similarly, the functions of the computing device 10B can also be performed by multiple computing devices 10.

[0365] This application also provides another data center. The connection relationships between the computing devices in this data center can be similarly referenced. Figure 13 The connection method of the data center is shown. The difference is that the memory 12 of one or more computing devices 10 in this data center can store the same memory for execution. Figure 3 Instructions for applying detection methods.

[0366] In some possible implementations, the memory 12 of one or more computing devices 10 in the data center may also store data for execution. Figure 3 The instructions for the application detection method are shown. In other words, a combination of one or more computing devices 10 can jointly execute instructions for performing... Figure 3 The instructions for applying the detection method are shown.

[0367] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0368] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0369] The basic principles of this application have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this application are merely examples and not limitations, and should not be considered as essential features of the various embodiments of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the specific details described above.

[0370] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0371] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions to this disclosure.

[0372] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

[0373] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The specific embodiments described above have further detailed the purpose, technical solutions, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0374] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above description is only a specific embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An application detection method, characterized in that, The method is applied to a cloud management platform, which is connected to infrastructure, or the cloud management platform is located within the infrastructure, which includes at least one data center, wherein each data center includes multiple computing nodes, and the application to be detected is deployed on at least one computing node within the infrastructure. The method includes: Obtain data streams from multiple nodes, wherein the data stream of each node is the data stream between that node and the application to be detected; A heterogeneous information network is established based on the data streams of the multiple nodes, and the heterogeneous information network includes the behavioral feature vectors of the multiple nodes; The heterogeneous information network is input into a first machine learning model, which then identifies the abnormal nodes among the plurality of nodes. In the case of identifying the abnormal node, the centrality index of the abnormal node is determined based on the behavioral feature vector of the abnormal node, and the centrality index is input into the first machine learning model, which then outputs the first sensitivity probability of the application to be detected.

2. The method according to claim 1, characterized in that, The step of establishing a heterogeneous information network based on the data streams of the multiple nodes includes: The information flow of the multiple nodes is parsed to obtain the communication parameters of the multiple nodes; The heterogeneous information network is established based on the communication parameters.

3. The method according to claim 2, characterized in that, The communication parameters of each of the plurality of nodes correspond to the interaction requests between that node and other nodes. These communication parameters include the request header, response information, request nature, and number of requests. Establishing the heterogeneous information network based on these communication parameters includes: A node set representing multiple nodes is generated based on the request header and the response information; Based on the nature of the request, an edge set is generated to represent the connection edges and connection directions between multiple nodes, wherein each edge in the edge set is assigned an edge weight, and the edge weight is determined based on the number of requests; A heterogeneous information network corresponding to the application to be detected is established based on the set of nodes and the set of edges.

4. The method according to claim 1, characterized in that, The step of inputting the heterogeneous information network into a first machine learning model, and having the first machine learning model determine the abnormal nodes among the plurality of nodes, includes: Perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network; The adjacency matrix is ​​input into the first machine learning model, which then determines the abnormal nodes among the plurality of nodes.

5. The method according to claim 4, characterized in that, The first machine learning model includes a graph attention layer and a graph autoencoder. The step of inputting the adjacency matrix into the first machine learning model and having the first machine learning model determine outlier nodes among the plurality of nodes includes: The adjacency matrix is ​​input into the first machine learning model, which uses the graph attention layer to assign corresponding attention weights to the multiple nodes based on their behavioral feature vectors. The first machine learning model updates the graph embedding of each node according to the attention weight, and the graph autoencoder obtains the reconstruction error of each node among multiple nodes according to the updated graph embedding. The reconstruction error of each node is used to represent the degree of deviation of the node from the normal node. The abnormal nodes among the plurality of nodes are determined based on the reconstruction error.

6. The method according to claim 5, characterized in that, The first machine learning model further includes a classifier. The centrality index of the abnormal node includes the node importance index, betweenness centrality index, and proximity centrality index of the abnormal node. The step of determining the centrality index of the abnormal node based on its behavioral feature vector and inputting the centrality index into the first machine learning model, and then having the first machine learning model output the first sensitivity probability of the application to be detected, includes: Based on the behavioral feature vector of the abnormal node, determine the node importance index, betweenness centrality index, and proximity centrality index of the abnormal node. The node importance index, the betweenness centrality index, and the proximity centrality index are input into the classifier, and the classifier root outputs the first sensitivity probability of the application to be detected.

7. The method according to claim 6, characterized in that, The method further includes: The data packet volume of the application to be detected is obtained and input into the classifier. The classifier outputs the first sensitivity probability of the application to be detected based on the node importance index, betweenness centrality index, proximity centrality index and data packet volume.

8. The method according to claim 1, characterized in that, The method further includes: Multiple permissions of the application to be detected are obtained, and each permission is analyzed using the T-test formula to determine the sensitive permissions among the multiple permissions, and a set of sensitive permissions is established based on the sensitive permissions. Multiple APIs of the application to be detected are obtained, and each API is analyzed using the coefficient of variation to identify sensitive APIs among the multiple APIs, and a set of sensitive APIs is established based on the sensitive APIs. A set of sensitive API sequences for the application to be detected is established based on the set of sensitive APIs. The sensitive permission set and the sensitive API sequence set are input into the second machine learning model, and the second machine learning model outputs the second sensitivity probability of the application to be detected.

9. The method according to claim 8, characterized in that, The cloud management platform includes a sensitive permission dataset and a benign permission dataset. The T-test formula is used to analyze each permission to determine the sensitive permissions among the multiple permissions, including: Determine the frequency of use of the first permission in the sensitive permission dataset, wherein the first permission is one of multiple permissions of the application to be detected; Determine the frequency of use of the first permission in the benign permission dataset; The T-test formula is used to analyze the usage frequency in the sensitive permission dataset and the benign permission dataset to determine whether the first permission is a sensitive permission.

10. The method according to claim 8, characterized in that, The cloud management platform includes a sensitive API dataset and a benign API dataset. The analysis of each API using the coefficient of variation to identify sensitive APIs among the multiple APIs includes: Determine the usage frequency of a first API in the sensitive API dataset, wherein the first API is one of multiple APIs of the application to be detected; Determine the frequency of use of the first API in the benign API dataset; The coefficient of variation of the first API is determined based on the frequency of use of the first API in the sensitive API dataset and the frequency of use in the benign API dataset; The sensitivity score of the first API is obtained based on the coefficient of variation; The sensitivity score is used to determine whether the first API is a sensitive API.

11. The method according to claims 1-10, characterized in that, The method further includes: The first sensitivity probability and the second sensitivity probability are input into the third machine learning model, which determines the weights of the first sensitivity probability and the second sensitivity probability, and outputs the third sensitivity probability of the application to be detected based on the weighted first sensitivity probability and the second sensitivity probability.

12. A training method for an application detection model, characterized in that, The method includes: Obtain communication parameters of multiple nodes, wherein the multiple nodes include a first number of normal nodes and a second number of abnormal nodes; A heterogeneous information network for training is established based on the communication parameters, wherein the heterogeneous information network includes the behavioral feature vectors of the normal nodes and the abnormal nodes; Perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network; The adjacency matrix is ​​input to the graph attention layer, which then assigns corresponding attention weights to each of the multiple nodes based on the behavioral feature vectors of the normal and abnormal nodes. The graph embedding of each node is updated according to the attention weights, and the updated graph embedding is input into the graph autoencoder for training to obtain the trained graph autoencoder. Based on the behavioral feature vectors of the normal and abnormal nodes, a feature training set is obtained; The feature training set is input into the classifier for training to obtain the trained classifier; The first machine learning model is obtained based on the graph attention layer, the trained graph autoencoder, and the classifier.

13. A cloud management platform, characterized in that, The cloud management platform includes dynamic detection instances, which include: An application traffic packet capture module is used to obtain data streams from multiple nodes, wherein the data stream of each node is the data stream between that node and the application to be detected. A heterogeneous information network establishment module is used to establish a heterogeneous information network based on the data streams of the multiple nodes, wherein the heterogeneous information network includes the behavioral feature vectors of the multiple nodes; The first anomaly detection module is used to input the heterogeneous information network into a first machine learning model, and the first machine learning model determines the abnormal nodes among the plurality of nodes; when the abnormal node is determined, the centrality index of the abnormal node is determined according to the behavioral feature vector of the abnormal node, and the centrality index is input into the first machine learning model, and the first machine learning model outputs the first sensitivity probability of the application to be detected.

14. The cloud management platform according to claim 13, characterized in that, The cloud management platform also includes: An application traffic parsing module is used to parse the data streams of the multiple nodes to obtain the communication parameters of the multiple nodes related to the application to be detected. The heterogeneous information network establishment module is also used for: The heterogeneous information network is established based on the communication parameters.

15. The cloud management platform according to claim 13, characterized in that, The communication parameters of each of the plurality of nodes correspond to the interaction requests between that node and other nodes. These communication parameters include the request header, response information, request nature, and number of requests. The heterogeneous information network establishment module is further used for: A node set representing multiple nodes is generated based on the request header and the response information; Based on the nature of the request, an edge set is generated to represent the connection edges and connection directions between multiple nodes, wherein each edge in the edge set is assigned an edge weight, and the edge weight is determined based on the number of requests; A heterogeneous information network corresponding to the application to be detected is established based on the set of nodes and the set of edges.

16. The cloud management platform according to claim 13, characterized in that, The first anomaly detection module is also used for: Perform matrix transformation on the heterogeneous information network to obtain the adjacency matrix corresponding to the heterogeneous information network; The adjacency matrix is ​​input into the first machine learning model, which then determines the abnormal nodes among the plurality of nodes.

17. The cloud management platform according to claim 16, characterized in that, The first machine learning model includes a graph attention layer and a graph autoencoder, and the first anomaly detection module is further used for: The adjacency matrix is ​​input into the first machine learning model, which uses the graph attention layer to assign corresponding attention weights to each of the multiple nodes based on the behavioral feature vectors of the multiple nodes. The first machine learning model updates the graph embedding of each node according to the attention weight, and the graph autoencoder obtains the reconstruction error of each node among multiple nodes according to the updated graph embedding. The reconstruction error of each node is used to represent the degree of deviation of the node from the normal node. The abnormal nodes among the plurality of nodes are determined based on the reconstruction error.

18. The cloud management platform according to claim 16, characterized in that, The first machine learning model further includes a classifier, and the centrality indicators of the anomalous node include the node importance indicator, betweenness centrality indicator, and proximity centrality indicator of the anomalous node. The first anomaly detection module is further used for: In the case of identifying the abnormal node, the node importance index, betweenness centrality index, and proximity centrality index of the abnormal node are determined based on the behavioral feature vector of the abnormal node. The node importance index, betweenness centrality index, and proximity centrality index are input into the classifier, which then outputs the first sensitivity probability of the application to be detected based on these indices.

19. The cloud management platform according to claim 13, characterized in that, The cloud management platform includes static detection instances, which include: A sensitive permission set establishment module is used to obtain multiple permissions of the application to be detected, analyze each permission using a T-test formula to determine the sensitive permissions among the multiple permissions, and establish a sensitive permission set based on the sensitive permissions. A sensitive API set establishment module is used to obtain multiple APIs of the application to be detected, analyze each API using the coefficient of variation to determine the sensitive APIs among the multiple APIs, and establish a sensitive API set based on the sensitive APIs. A sensitive sequence set establishment module is used to establish a sensitive API sequence set of the application to be detected based on a sensitive API set; The second anomaly detection module is used to input the sensitive permission set and the sensitive API sequence set into the second machine learning model, and the second machine learning model outputs the second sensitivity probability of the application to be detected.

20. The cloud management platform according to claim 19, characterized in that, The cloud management platform includes a sensitive permission dataset and a benign permission dataset. The sensitive permission set creation module is further used for: Determine the frequency of use of the first permission in the sensitive permission dataset, where the first permission is one of multiple permissions of the application to be detected; Determine the frequency of use of the first permission in the benign permission dataset; The T-test formula is used to analyze the usage frequency in the sensitive permission dataset and the benign permission dataset to determine whether the first permission is a sensitive permission.

21. The cloud management platform according to claim 19, characterized in that, The cloud management platform includes a sensitive API dataset and a benign API dataset. The sensitive API dataset creation module is also used for: Determine the frequency of use of the first API in the benign API dataset; The coefficient of variation of the first API is determined based on the frequency of use of the first API in the sensitive API dataset and the frequency of use in the benign API dataset; The sensitivity score of the first API is obtained based on the coefficient of variation; The sensitivity score is used to determine whether the first API is a sensitive API.

22. The cloud management platform according to any one of claims 13-21, characterized in that, The cloud management platform also includes a sensitive identification instance, which is used for: The first sensitivity probability and the second sensitivity probability are input into the third machine learning model, which determines the weights of the first sensitivity probability and the second sensitivity probability, and outputs the third sensitivity probability of the application to be detected based on the weighted first sensitivity probability and the second sensitivity probability.

23. A data center, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the data center to perform the method according to any one of claims 1-11 or 12.

24. A computer-readable storage medium, characterized in that, Includes computer program instructions that, when executed by the data center, cause the data center to perform the method as described in any one of claims 1-11 or 12.

25. A computer program product, characterized in that, Includes computer program instructions, which, when executed by a data center, enable the data center to perform the method as described in any one of claims 1-11 or 12.

Images