Interactive application behavior deviation security detection method, device, equipment and medium

Abstract

The application discloses an interactive application behavior bias security detection method, device, equipment and medium, relates to the field of information security technology, and after a current method enters a current page of a detected application, analyzes a visible expression of a page title, a process position and a triggerable control, determines a current gentle interaction entrance, and obtains an entrance expression source item, a trigger layer source item and a retreat response source item; generates a commitment boundary according to the entrance expression source item, generates an action load according to the trigger layer source item, and reversely traces the commitment boundary from the action load, and determines an action load that cannot be explained by the commitment boundary as an implicit load; then generates a retreat damping according to the backflow association of the retreat response source item and the implicit load, and forms an intention bearing difference kernel from the commitment boundary, the implicit load and the retreat damping; constructs an interactive security bias fingerprint according to the intention bearing difference kernel, and generates a detection conclusion and a disposal path according to the interactive security bias fingerprint.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method, apparatus, device, and medium for detecting behavioral deviations in interactive applications. Background Technology

[0002] Interactive applications typically interact with users through page controls, pop-ups, prompts, entry buttons, system permission pages, authentication pages, and third-party authorization pages during operation. Current interactive application behavior deviation security detection targets not only application code, API requests, and permission calls, but also the entry point expressions perceptible to the user before clicking, the runtime layer entered after clicking, and the page reflow results after the user performs a back, close, or refuse action. This is particularly relevant to detection scenarios involving mild interactive entry points triggering security actions such as system permissions, authentication, phone number binding, third-party authorization, or device capability calls.

[0003] In existing application security testing, the detection logic typically revolves around judging permission calls, API access, page redirects, or the activation of sensitive capabilities, with the detection starting point often being the runtime event generated after a click. For mild interactive entry points such as "View Details," "Continue to Experience," "Set Up Later," "Skip," "Learn More," and "Browse," existing detection methods struggle to establish a continuous analytical link between the pre-click entry point expression and the post-click runtime layer. When users interpret the page text as content browsing, feature experience, temporary settings suspension, or process exit, the application may still enter the system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, or device capability call layer after triggering the request. Existing detection results usually only record the permission pop-up, login page, or authorization page itself, making it difficult to explain the lack of commitment basis in the pre-click entry point expression for current high-security actions, and also making it difficult to distinguish between ordinary business redirects and deviations in interaction intent.

[0004] The aforementioned shortcomings typically arise in scenarios where the interaction entry point and application runtime behavior are detected separately. Application pages may hide critical security actions behind milder interaction entry points, or cause the page to revert to the same runtime layer after the user performs a back, close, or refuse action. This creates a disconnect between the user's understanding before clicking, the transition to the runtime layer after clicking, and the return flow of the backtracking action. When this happens, users may enter permission requests, login verification, phone number binding, third-party authorization, or device capability invocation processes without fully understanding the situation. It may also prevent the detection system from locating the path of the anomaly, only outputting a single permission call or a single page jump record, making it difficult to form reproducible detection conclusions and handling paths. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method, apparatus, device, and medium for detecting interactive application behavior deviations, thus solving the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an interactive application behavior offset security detection method, comprising the following steps:

[0007] S1. After entering the current page of the application being tested, analyze the page title, flow position and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtain the entry expression source item, trigger transition source item and fallback response source item around the current gentle interaction entry point;

[0008] S2. Generate commitment boundaries based on the entry expression source terms, generate action loads based on the triggering layer transition source terms, and trace back from the action loads to the commitment boundaries. Action loads that cannot be explained by the commitment boundaries are identified as implicit loads. Then, generate backflow damping based on the backflow association between backflow response source terms and implicit loads. The commitment boundaries, implicit loads, and backflow damping constitute the intention-bearing differential core.

[0009] S3. Based on the commitment boundary, implicit load and fallback damping in the intention-bearing differential kernel, construct the interaction security offset fingerprint according to the interaction occurrence order of the current mild interaction entry point;

[0010] S4. Generate detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the transition to the runtime layer, and reviewing the page reflow results after returning, closing, or rejecting.

[0011] Preferably, S1 includes S11 and S12;

[0012] S11. After entering the current page of the application being tested, first obtain the page title of the current page, the page path before entering the current page, and the visible representation of the triggerable controls in the current page, and determine the process position based on the page path before entering the current page.

[0013] Using the current page title as the scenario limitation basis, the visible expression of the triggerable controls on the current page as the entry meaning basis, and the adjacent descriptions around the triggerable controls as the supplementary basis for the entry meaning, an entry context unit is formed for each triggerable control on the current page; the entry context unit is not a single control text, but an interactive context result formed by "current page title, process position, visible expression of triggerable controls, and adjacent descriptions";

[0014] Semantic merging of entry context units: entry context units that express meanings such as view, continue, skip, later, understand, experience, and browse are classified into the lightweight operation semantic scope, and triggerable controls that fall into the lightweight operation semantic scope are identified as the current gentle interaction entry point;

[0015] Combine the visible text of the current gentle interactive entry point, adjacent descriptions, and the current page title into the entry point expression source item;

[0016] The current entry point expression source item is used to characterize the operation commitment that the user can obtain from the page before triggering the current mild interaction entry point. Its source is limited to the content already presented on the current page and does not introduce permission events, network requests or page jump results after clicking.

[0017] S12. Execute a trigger action on the current mild interaction entry point, and obtain the trigger transition source item from the first runtime layer change after the trigger action occurs;

[0018] The first operational layer changes are categorized into application content layer, system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, and device capability invocation layer;

[0019] Among them, the application content layer is formed by the ordinary content pages inside the application, the system permission layer is formed by the system permission pop-up window, the identity authentication layer is formed by the login, real name or verification page, the mobile phone number binding layer is formed by the mobile phone number input, verification code input or binding confirmation page, the third-party authorization layer is formed by the external account authorization or external page launch, and the device capability call layer is formed by the device capability call of positioning, clipboard, camera, album, microphone and other devices.

[0020] Therefore, the triggering source item for the transition is not a single page name, but the result of the first run layer entered after the current gentle interaction entry is triggered;

[0021] After obtaining the triggering layer transition source item, continue to execute fallback actions around the same current mild interaction entry point. Fallback actions include returning, closing, and rejecting.

[0022] After executing the fallback action, record the page reflow result and generate the fallback response source item;

[0023] Page reflow results include returning to the current page, entering the previous process page, remaining in the running layer after the trigger, re-entering the same running layer, and entering a new confirmation page.

[0024] The current fallback response source item is used to characterize the actual backflow path given by the application when a user attempts to leave the current process after triggering the current mild interaction entry. Since both the trigger transition source item and the fallback response source item are generated from the same current mild interaction entry, the entry expression source item, the trigger transition source item, and the fallback response source item are formed in the same interaction chain, which can jointly support the construction of subsequent commitment boundaries, action loads, and fallback damping;

[0025] Preferably, S2 includes S21 and S22;

[0026] S21. Semantically decompose the entry expression source item into entry action semantics, entry object semantics, and entry restriction semantics;

[0027] Among them, the semantics of the entry action comes from the visible text of the current gentle interaction entry, the semantics of the entry object comes from the current page title and adjacent descriptions, and the semantics of the entry restriction comes from the content in the adjacent descriptions that indicate purpose, scope, delay, skip, close, and continue experience;

[0028] The entry action semantics, entry object semantics, and entry restriction semantics are combined into a commitment boundary; the commitment boundary is used to limit the scope of operations that the current mild interactive entry can express before the user clicks, and the scope of operations includes content browsing, function experience, pause settings, and process exit;

[0029] Based on the commitment boundary, the triggering transition source item is decomposed into the runtime layer, and the triggering transition source item is divided into the runtime layer body and the runtime layer action;

[0030] The main body of the runtime layer comes from the application content layer, system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer or device capability call layer. The runtime layer actions come from the authorization, verification, binding, external authorization, device capability activation and other actions that occur after the current gentle interaction entry is triggered.

[0031] The runtime layer body and runtime layer actions are combined into an action load; the action load is used to characterize the actual runtime behavior triggered by the current gentle interaction entry after it is clicked.

[0032] Preferably, in step S22, the reverse interpretation is performed from the action load towards the commitment boundary, specifically as follows:

[0033] First, read the runtime body and runtime actions in the action load, and then look for the entry action semantics, entry object semantics and entry constraint semantics that can describe the runtime body and runtime actions in the commitment boundary;

[0034] When the runtime body and runtime actions in the action load can be interpreted by the operation scope in the commitment boundary, the current action load is classified as an in-commitment load.

[0035] When the runtime body or runtime action in the action load cannot be interpreted by the operation scope in the commitment boundary, the current action load is determined to be an implicit load.

[0036] For example, the commitment boundary is limited to content browsing, but the action load enters the system permission layer; the commitment boundary is limited to postpone setting, but the action load enters the identity authentication layer; the commitment boundary is limited to process exit, but the action load enters the mobile phone number binding layer, all of which form implicit loads.

[0037] The current reverse interpretation method uses the actual running behavior after the click to look back at the scope of the commitment before the click, without using single-point permission judgment, so that the implicit load comes from the semantic disconnect between the commitment boundary and the action load.

[0038] Merge the page reflow results with the implicit load;

[0039] If the page reflow result returns to the current page, the previous process page, or exits the current running layer, the backflow response source item will not form a backflow damping;

[0040] If the page reflow result re-enters the runtime layer where the implicit load is located, or remains in the runtime layer where the implicit load is located, the current backflow response source item and the implicit load are combined into backflow damping;

[0041] The backtracking damping is used to characterize the application's continued redirection of the interaction link to the processing result of the runtime layer where the implicit load resides after a user attempts to leave the current process;

[0042] Combining commitment boundaries, implicit loads, and fallback damping forms the intentional load differential core.

[0043] The current source chain that intends to carry the differential core is as follows: the entry expression source item generates the commitment boundary, the triggering layer transition source item generates the action load, the action load reverse interprets the commitment boundary to generate the implicit load, and the fallback response source item and the implicit load are merged to generate the fallback damping.

[0044] Preferably, S3 includes S31 and S32;

[0045] S31. Read the commitment boundary, implicit load and fallback damping in the intention-bearing differential core, and chain them according to the interaction order of the current mild interaction entry.

[0046] The chained interaction sequence is as follows: before clicking, the user receives the operation range expressed by the current mild interaction entry; after the user triggers the current mild interaction entry, they enter the runtime layer where the implicit load is located; and after the user performs the return, close, or reject action, a fallback damping is generated.

[0047] After chaining, the commitment boundary, implicit load, and fallback damping are compressed from the same source.

[0048] Same-origin compression refers to retaining content from all three sources that are related to the same current gentle interaction entry point, while removing page content and behaviors that are unrelated to the current gentle interaction entry point;

[0049] The specific processing steps are as follows: extract the entry commitment type from the commitment boundary, extract the operation layer transfer type from the implicit load, and extract the return traction type from the fallback damping.

[0050] Arrange the entry commitment type, runtime layer transfer type, and return flow traction type in the order of before click, after click, and after the back path action to form an interactive offset chain;

[0051] S32. Based on the interaction offset chain, re-enter the page where the current gentle interaction entry is located, and execute the interaction again in the order of actions of the entry expression source item, the triggering layer source item, and the fallback response source item in S1.

[0052] The review process includes: entering the current page, locating the same current gentle interaction entry point, triggering the current gentle interaction entry point, recording the first entry into the runtime layer, executing the return, close, or reject action, and recording the page reflow result;

[0053] The commitment boundary, implicit load, and fallback damping are regenerated according to the processing logic of S2, and the regenerated commitment boundary, implicit load, and fallback damping are converted into a verification interaction offset chain.

[0054] When the entry commitment type, runtime transfer type, and backflow traction type in the verification interaction offset chain are consistent with the interaction offset chain, the interaction offset chain is solidified as an interaction security offset fingerprint.

[0055] The interactive security offset fingerprint comprises three parts: entry commitment type, runtime layer transition type, and backflow pull type, preserving the interaction sequence of these three parts. Current solidification processing ensures that the interactive security offset fingerprint is not a record of a single, isolated page behavior, but rather a security offset result jointly formed by the same current mild interactive entry point during the initial and review interactions. Through this processing, the interactive security offset fingerprint can characterize the complete offset path of the current mild interactive entry point, from the committed range before clicking, to the runtime layer containing the implicit load after clicking, and then to the backflow pull after the fallback action, providing a single fingerprint basis for generating subsequent detection conclusions and handling paths.

[0056] Preferably, S4 includes S41 and S42;

[0057] S41. Take the entry commitment type, runtime layer transfer type and backflow traction type from the interactive security offset fingerprint, and merge the conclusions according to the order of interaction of the three in the current mild interactive entry point;

[0058] Entry commitment type is derived from commitment boundary and is used to characterize the scope of operation expressed by the current mild interaction entry before clicking; runtime layer transition type is derived from implicit load and is used to characterize the runtime layer entered after the current mild interaction entry is triggered; backflow pull type is derived from backflow damping and is used to characterize the page backflow result after the user performs a back, close, or refuse action;

[0059] In the process of merging conclusions, first determine the pre-click expression category of the current mild interaction entry based on the entry commitment type, then determine the actual traction category after the click based on the runtime layer transfer type, and finally determine the process orientation category after the return traction action based on the return traction type.

[0060] The security exception type is generated by merging the expression category before clicking, the actual traction category after clicking, and the process orientation category in sequence.

[0061] The entry point promises a content browsing type, the runtime layer transfers to the system permission layer, and security exception types are grouped into lightweight browsing entry points that pull system permissions.

[0062] The entry commitment type is "delayed setting", the runtime layer transfer type is "identity authentication layer", and the security exception type is merged into the "delayed setting" entry to drive identity authentication.

[0063] The entry commitment type is process exit, the runtime layer transfer type is mobile number binding layer, and the security exception type is merged into skip entry to guide mobile number binding;

[0064] The detection conclusion is generated by fitting the current mild interaction entry point, security anomaly type, and interaction security offset fingerprint.

[0065] Preferably, S42, an interactive security offset fingerprint is used as the basis for path organization to generate a processing path;

[0066] The handling path unfolds sequentially according to the entry commitment type, runtime layer transfer type, and backflow traction type in the interaction security offset fingerprint, including reproducing the current page, triggering the current mild interaction entry, reviewing the runtime layer transfer, and reviewing the page backflow results after returning, closing, or rejecting.

[0067] The current page is reproduced based on the current page title and process position used when the entry expression source item was formed in S1;

[0068] The current gentle interaction entry point is triggered based on the current gentle interaction entry point determined by S1;

[0069] The runtime layer transfer is reviewed and executed based on the runtime layer transfer type recorded in the interactive security offset fingerprint in S3;

[0070] The review page reflow results are executed based on the reflow traction type recorded in the interactive security offset fingerprint in S3;

[0071] During the process of generating the handling path, the security anomaly type in the detection conclusion is used as the path labeling content, and the interactive security offset fingerprint is used as the basis for the review order, so that the handling path is not just a page access path, but a complete review link that includes "expression before clicking, transfer after clicking, and backtracking action".

[0072] After the processing path is generated, the current interactive application behavior deviation security detection method outputs the current page entry method, the current mild interaction entry trigger action, the runtime layer transfer to review action, the return action, the page reflow review action after the close action or the rejection action.

[0073] Preferably, the interactive application behavior deviation security detection device includes an entry source item acquisition module, an intent-bearing differential kernel construction module, an interactive security deviation fingerprint construction module, and a detection conclusion and processing path output module.

[0074] After the entry source item acquisition module enters the current page of the application being tested, it analyzes the page title, flow position, and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtains the entry expression source item, trigger transition source item, and fallback response source item around the current gentle interaction entry point;

[0075] The intent-bearing differential core construction module generates a commitment boundary based on the ingress expression source term, generates an action load based on the triggering layer transition source term, and traces back from the action load to the commitment boundary. Action loads that cannot be explained by the commitment boundary are identified as implicit loads. Then, a fallback damping is generated based on the fallback response source term and the fallback damping. The commitment boundary, implicit load, and fallback damping constitute the intent-bearing differential core.

[0076] The interactive security offset fingerprint construction module constructs the interactive security offset fingerprint according to the commitment boundary, implicit load and fallback damping in the intent-bearing differential kernel, and in the order of interaction occurrence of the current mild interactive entry point.

[0077] The detection conclusion and handling path output module generates detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the runtime layer transfer, and reviewing the page reflow results after returning, closing, or rejecting.

[0078] An interactive application behavior deviation security detection device includes a processor coupled to a memory;

[0079] The processor is configured to execute a computer program stored in the memory, such that the interactive application behavior offset security detection device executes the computer program of any of the interactive application behavior offset security detection methods described above.

[0080] The interactive application behavior deviation security detection medium includes a computer program or instructions, which, when run on a computer, stores a computer program capable of being loaded by a processor and executing the interactive application behavior deviation security detection method described in any of the first aspects.

[0081] This invention provides a method, apparatus, device, and medium for security detection of interactive application behavior deviation, which has the following beneficial effects:

[0082] (1) By generating backflow damping based on the backflow association between the backflow response source item and the implicit load, and by forming an intent-bearing differential kernel with commitment boundary, implicit load, and backflow damping, the detection process can further analyze the page backflow results after the user performs a return, close, or refuse action. Thus, it is possible to identify situations where the user attempts to leave the current process but still returns to the runtime layer where the implicit load is located, so that the detection results not only reflect the security action entered after clicking, but also reflect the link traction relationship between the backflow action and the implicit load, which is convenient for locating the interaction intent offset caused by the page backflow.

[0083] (2) By continuing to execute return, close, and reject actions around the same current mild interaction entry point after obtaining the trigger layer source item, and recording the page backflow results to form a fallback response source item, the detection process can cover the application response after the user attempts to leave the current process. The page backflow results include returning to the current page, entering the previous process page, staying in the running layer after the trigger, re-entering the same running layer, and entering a new confirmation page, thereby distinguishing the normal fallback path and the continued traction path after the current mild interaction entry point is triggered. By forming the entry expression source item, the trigger layer source item, and the fallback response source item under the same current mild interaction entry point, it can provide a common source basis for the construction of subsequent commitment boundaries, implicit loads, and fallback damping, so that the detection results can locate the formation process of mild entry point triggering heavy safety actions and fallback action backflow anomalies.

[0084] (3) By constructing the intent-bearing differential core from the commitment boundary, implicit load, and fallback damping, and arranging and compressing these three elements in a chain according to the interaction sequence of the current mild interaction entry point, an interaction offset chain is formed. Then, a verification interaction offset chain is regenerated through a verification action, and the verification interaction offset chain is solidified into an interaction security offset fingerprint when it is consistent with the interaction offset chain. Thus, the final result is not a single permission call record or page jump record formed by a single click, but a fingerprint result composed of the commitment before the click, the implicit load after the click, and the fallback action return flow. The current interaction security offset fingerprint can provide a verification basis for subsequent detection conclusions and handling paths, enabling the detection system to locate the anomaly formation process and reproduce the complete path of the current mild interaction entry point triggering the heavy security action.

[0085] (4) First, determine the pre-click expression category of the current mild interactive entry point based on the entry commitment type, then determine the actual post-click traction category based on the runtime transition type, and then determine the process return category after the fallback action based on the return traction type. Finally, merge the pre-click expression category, the actual post-click traction category, and the process return category to generate a security anomaly type, so that the security anomaly type has a clear source chain. For example, it can merge situations such as content browsing traction system permissions, temporarily suspending traction identity authentication, and process exit traction mobile phone number binding, so that privacy misrepresentation, insufficient pre-authorization explanation, and lightweight entry triggering heavy operation no longer exist in the form of scattered events, but form a security anomaly result oriented towards the interaction process. Attached Figure Description

[0086] Figure 1 This is a schematic diagram of the interactive application behavior offset security detection method of the present invention;

[0087] Figure 2 This is a schematic diagram of the interactive application behavior deviation security detection device of the present invention;

[0088] Figure 3 This is a schematic diagram of the implicit load and fallback damping determination process of the present invention;

[0089] Figure 4 This is a schematic diagram of the interactive secure offset fingerprint construction and solidification process of the present invention. Detailed Implementation

[0090] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0091] Example 1

[0092] This invention provides a method for security detection of interactive application behavior deviations. Please refer to [link / reference]. Figures 1 to 4 This includes the following steps:

[0093] S1. After entering the current page of the application being tested, analyze the page title, flow position and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtain the entry expression source item, trigger transition source item and fallback response source item around the current gentle interaction entry point;

[0094] S2. Generate commitment boundaries based on the entry expression source terms, generate action loads based on the triggering layer transition source terms, and trace back from the action loads to the commitment boundaries. Action loads that cannot be explained by the commitment boundaries are identified as implicit loads. Then, generate backflow damping based on the backflow association between backflow response source terms and implicit loads. The commitment boundaries, implicit loads, and backflow damping constitute the intention-bearing differential core.

[0095] S3. Based on the commitment boundary, implicit load and fallback damping in the intention-bearing differential kernel, construct the interaction security offset fingerprint according to the interaction occurrence order of the current mild interaction entry point;

[0096] S4. Generate detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the transition to the runtime layer, and reviewing the page reflow results after returning, closing, or rejecting.

[0097] In this embodiment, after entering the current page of the application being tested, the page title, flow position, and visible representation of triggerable controls are analyzed simultaneously to determine the current gentle interaction entry point. This shifts the detection starting point from permission calls, API access, or page jumps after a click to the entry point representation that the user can perceive before clicking. Therefore, the detection process can establish entry point representation source items, trigger transition source items, and fallback response source items around the current gentle interaction entry point, ensuring that the entry point representation before clicking, the runtime transition after clicking, and the fallback action return flow are all within the same interaction chain, thus solving the problem of separation between interaction entry point representation and application runtime behavior in existing detection methods.

[0098] By generating commitment boundaries based on the entry point expression source item, generating action loads based on the triggering layer transition source item, and tracing back from the action loads to the commitment boundaries, it is possible to determine the explanatory basis of the entry point expression before the click for the actual execution layer entered after the click. For action loads that cannot be explained by the commitment boundaries, they are identified as implicit loads. This ensures that important security actions such as system permission layers, identity authentication layers, mobile phone number binding layers, third-party authorization layers, or device capability invocation layers are no longer recorded as single execution events, but are classified into security detection objects that do not match the current mild interaction entry point, making it easier to identify problems where mild entry points lead to heavy security actions.

[0099] By constructing an interaction security offset fingerprint according to the interaction sequence of the current mild interaction entry point, and generating detection conclusions and handling paths based on the interaction security offset fingerprint, the detection results can simultaneously include the current mild interaction entry point, the security anomaly type, and the interaction security offset fingerprint. It can also provide the page reflow results after reproducing the current page, triggering the current mild interaction entry point, reviewing the transition to the runtime layer, and reviewing the page reflow results after returning, closing, or rejecting.

[0100] Example 2

[0101] Please refer to Figure 3 Specifically: S1 includes S11 and S12; S11, after entering the current page of the application being tested, first obtain the page title of the current page, the page path before entering the current page, and the visible representation of the triggerable controls in the current page, and determine the process position based on the page path before entering the current page;

[0102] Using the current page title as the basis for scene limitation, the visible expression of the triggerable controls on the current page as the basis for entry meaning, and the adjacent descriptions around the triggerable controls as the basis for supplementing entry meaning, entry context units are formed for each triggerable control on the current page.

[0103] Semantic merging of entry context units: entry context units that express meanings such as view, continue, skip, later, understand, experience, and browse are classified into the lightweight operation semantic scope, and triggerable controls that fall into the lightweight operation semantic scope are identified as the current gentle interaction entry point;

[0104] Combine the visible text of the current gentle interactive entry point, adjacent descriptions, and the current page title into the entry point expression source item;

[0105] S12. Execute a trigger action on the current mild interaction entry point, and obtain the trigger transition source item from the first runtime layer change after the trigger action occurs;

[0106] The first operational layer changes are categorized into application content layer, system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, and device capability invocation layer;

[0107] Among them, the application content layer is formed by the ordinary content pages inside the application, the system permission layer is formed by the system permission pop-up window, the identity authentication layer is formed by the login, real name or verification page, the mobile phone number binding layer is formed by the mobile phone number input, verification code input or binding confirmation page, the third-party authorization layer is formed by the external account authorization or external page launch, and the device capability call layer is formed by the device capability call of positioning, clipboard, camera, album, microphone and other devices.

[0108] After obtaining the triggering layer transition source item, continue to execute fallback actions around the same current mild interaction entry point. Fallback actions include returning, closing, and rejecting.

[0109] After executing the fallback action, record the page reflow result and generate the fallback response source item;

[0110] Page reflow results include returning to the current page, entering the previous process page, remaining in the running layer after the trigger, re-entering the same running layer, and entering a new confirmation page.

[0111] In this embodiment, by acquiring the current page title, the page path before entering the current page, and the visible representation of triggerable controls on the current page, and determining the flow position based on the page path before entering the current page, the detection object is no longer limited to a single button text or a single page jump, but rather analyzes the current page's flow in conjunction with the triggerable controls on the current page. Therefore, an entry context unit can be formed before the user clicks, ensuring that the determination of the current gentle interactive entry point has both page scene and flow position basis, solving the problem of incomplete entry point recognition caused by judging the meaning of the entry point solely based on the control text in existing detection methods.

[0112] In this embodiment, by using the current page title as the scene limitation basis, the visible expression of triggerable controls on the current page as the entry meaning basis, and the adjacent descriptions around the triggerable controls as supplementary entry meaning basis, entry context units are formed for each triggerable control on the current page. These entry context units are then semantically merged, enabling the identification of lightweight operation semantics such as view, continue, skip, later, learn, experience, and browse from the overall page context. Therefore, the current gentle interaction entry is not directly determined by a single text, but is jointly limited by the page title, process location, visible expression, and adjacent descriptions. This ensures that the identification result of the gentle interaction entry is consistent with the operation meaning perceived by the user before clicking, facilitating subsequent analysis of the differences between the entry expression before clicking and the transition to the running layer after clicking.

[0113] In this embodiment, by executing a trigger action on the current mild interaction entry point and obtaining the trigger transition source item from the first runtime layer change after the trigger action occurs, the detection process can record the runtime layer first entered after the current mild interaction entry point is triggered. The first runtime layer change is categorized into application content layer, system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, and device capability call layer. This allows ordinary content pages within the application, system permission pop-ups, login real-name or verification pages, mobile phone number input verification code input or binding confirmation pages, external account authorization or external page launch, and device capability calls such as location clipboard, camera, album, and microphone to all be included in the same runtime layer analysis scope. Therefore, the detection object after clicking is no longer just a page name or permission event, but forms a trigger transition source item that can connect with the entry point expression source item, facilitating the subsequent construction of action load.

[0114] Example 3

[0115] Please refer to Figure 4 Specifically: S2 includes S21 and S22;

[0116] S21. Semantically decompose the entry expression source item into entry action semantics, entry object semantics, and entry restriction semantics;

[0117] The entry action semantics, entry object semantics, and entry restriction semantics are combined into a commitment boundary;

[0118] Based on the commitment boundary, the triggering transition source item is decomposed into the runtime layer, and the triggering transition source item is divided into the runtime layer body and the runtime layer action;

[0119] Combine the runtime layer body and runtime layer actions into an action load.

[0120] S22. Starting from the action load, perform a reverse interpretation towards the commitment boundary, specifically as follows:

[0121] First, read the runtime body and runtime actions in the action load, and then look for the entry action semantics, entry object semantics and entry constraint semantics that can describe the runtime body and runtime actions in the commitment boundary;

[0122] When the runtime body and runtime actions in the action load can be interpreted by the operation scope in the commitment boundary, the current action load is classified as an in-commitment load.

[0123] When the runtime body or runtime action in the action load cannot be interpreted by the operation scope in the commitment boundary, the current action load is determined to be an implicit load.

[0124] Merge the page reflow results with the implicit load;

[0125] If the page reflow result returns to the current page, the previous process page, or exits the current running layer, the backflow response source item will not form a backflow damping;

[0126] If the page reflow result re-enters the runtime layer where the implicit load is located, or remains in the runtime layer where the implicit load is located, the current backflow response source item and the implicit load are combined into backflow damping;

[0127] Combining commitment boundaries, implicit loads, and fallback damping forms the intentional load differential core.

[0128] S3 includes S31 and S32; S31 reads the commitment boundary, implicit load and fallback damping in the differential core of the intent to carry out the task, and arranges the three in a chain according to the interaction order of the current mild interaction entry point;

[0129] The chained interaction sequence is as follows: before clicking, the user receives the operation range expressed by the current mild interaction entry; after the user triggers the current mild interaction entry, they enter the runtime layer where the implicit load is located; and after the user performs the return, close, or reject action, a fallback damping is generated.

[0130] After chaining, the commitment boundary, implicit load, and fallback damping are compressed from the same source.

[0131] The specific processing steps are as follows: extract the entry commitment type from the commitment boundary, extract the operation layer transfer type from the implicit load, and extract the return traction type from the fallback damping.

[0132] Arrange the entry commitment type, runtime layer transfer type, and return flow traction type in the order of before click, after click, and after the back path action to form an interactive offset chain;

[0133] S32. Based on the interaction offset chain, re-enter the page where the current gentle interaction entry is located, and execute the interaction again in the order of actions of the entry expression source item, the triggering layer source item, and the fallback response source item in S1.

[0134] The review process includes: entering the current page, locating the same current gentle interaction entry point, triggering the current gentle interaction entry point, recording the first entry into the runtime layer, executing the return, close, or reject action, and recording the page reflow result;

[0135] The commitment boundary, implicit load, and fallback damping are regenerated according to the processing logic of S2, and the regenerated commitment boundary, implicit load, and fallback damping are converted into a verification interaction offset chain.

[0136] When the entry commitment type, runtime transfer type, and backflow traction type in the verification interaction offset chain are consistent with the interaction offset chain, the interaction offset chain is solidified as an interaction security offset fingerprint.

[0137] In this embodiment, by semantically decomposing the entry point expression source item, it is divided into entry action semantics, entry object semantics, and entry restriction semantics, and synthesized into a commitment boundary. This allows the operational scope expressed to the user by the current gentle interaction entry point before clicking to be structurally represented. By decomposing the trigger transition source item into a runtime layer, it is divided into runtime layer body and runtime layer action, and synthesized into action load. This allows the actual runtime layer entered after clicking and the triggered runtime action to be analyzed under the same link as the commitment boundary. Thus, the detection process no longer stops at the separate recording of page text or runtime events, but forms two ends of the basis: "commitment scope before clicking" and "action load after clicking," which facilitates the solution to the problem of separation between entry point expression and runtime behavior in existing detection methods.

[0138] In this embodiment, by interpreting the action load backwards towards the commitment boundary, the system first reads the runtime body and runtime actions within the action load. Then, it searches the commitment boundary for entry action semantics, entry object semantics, and entry restriction semantics that can explain the runtime body and runtime actions. This allows the detection logic to trace back from the heavy security action after the click to the explanatory basis before the click. Action loads that can be explained by the operation scope within the commitment boundary are classified as commitment-based loads; action loads that cannot be explained by the operation scope within the commitment boundary are identified as implicit loads. As a result, the system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, or device capability invocation layer are no longer recorded merely as runtime events, but can be identified as security detection objects lacking pre-click commitment basis, facilitating the identification of issues where gentle entry points drive heavy security actions.

[0139] In this embodiment, by linking the page reflow result with the implicit load, and generating backflow damping based on the reflow relationship between the page reflow result and the runtime layer where the implicit load resides, the detection process can cover interactive reflow situations after the user performs a return, close, or refuse action. When the page reflow result returns to the current page, the previous process page, or exits the current runtime layer, the backflow response source item does not form backflow damping; when the page reflow result re-enters the runtime layer where the implicit load resides, or remains in the runtime layer where the implicit load resides, the current backflow response source item and the implicit load are combined to form backflow damping. Therefore, the detection results can reflect situations where the user attempts to leave the current process but is still directed to the runtime layer where the implicit load resides, providing a common analytical basis for privacy misrepresentation, insufficient pre-authorization explanation, and abnormal backflow actions.

[0140] Example 4

[0141] This invention provides an interactive application behavior deviation security detection device. Please refer to [link / reference]. Figure 1 S4 includes S41 and S42;

[0142] S41. Take the entry commitment type, runtime layer transfer type and backflow traction type from the interactive security offset fingerprint, and merge the conclusions according to the order of interaction of the three in the current mild interactive entry point;

[0143] In the process of merging conclusions, first determine the pre-click expression category of the current mild interaction entry based on the entry commitment type, then determine the actual traction category after the click based on the runtime layer transfer type, and finally determine the process orientation category after the return traction action based on the return traction type.

[0144] The security exception type is generated by merging the expression category before clicking, the actual traction category after clicking, and the process orientation category in sequence.

[0145] The entry point promises a content browsing type, the runtime layer transfers to the system permission layer, and security exception types are grouped into lightweight browsing entry points that pull system permissions.

[0146] The entry commitment type is "delayed setting", the runtime layer transfer type is "identity authentication layer", and the security exception type is merged into the "delayed setting" entry to drive identity authentication.

[0147] The entry commitment type is process exit, the runtime layer transfer type is mobile number binding layer, and the security exception type is merged into skip entry to guide mobile number binding;

[0148] The detection conclusion is generated by fitting the current mild interaction entry point, security anomaly type, and interaction security offset fingerprint.

[0149] S42. Generate a processing path based on the interactive security offset fingerprint;

[0150] The handling path unfolds sequentially according to the entry commitment type, runtime layer transfer type, and backflow traction type in the interaction security offset fingerprint, including reproducing the current page, triggering the current mild interaction entry, reviewing the runtime layer transfer, and reviewing the page backflow results after returning, closing, or rejecting.

[0151] The current page is reproduced based on the current page title and process position used when the entry expression source item was formed in S1;

[0152] The current gentle interaction entry point is triggered based on the current gentle interaction entry point determined by S1;

[0153] The runtime layer transfer is reviewed and executed based on the runtime layer transfer type recorded in the interactive security offset fingerprint in S3;

[0154] The review page reflow results are executed based on the reflow traction type recorded in the interactive security offset fingerprint in S3;

[0155] During the process of generating the handling path, the security anomaly type in the detection conclusion is used as the path labeling content, and the interactive security offset fingerprint is used as the basis for the review order, so that the handling path is not just a page access path, but a complete review link that includes "expression before clicking, transfer after clicking, and backtracking action".

[0156] After the processing path is generated, the current interactive application behavior deviation security detection method outputs the current page entry method, the current mild interaction entry trigger action, the runtime layer transfer to review action, the return action, the page reflow review action after the close action or the rejection action.

[0157] In this embodiment, by obtaining the entry commitment type, runtime transition type, and backflow traction type from the interactive security offset fingerprint, and merging the conclusions according to the interaction sequence in the current mild interactive entry point, the detection conclusion is no longer directly generated by a single page jump, permission pop-up, or device capability call, but is jointly limited by the expression before the click, the transition after the click, and the backflow action. Therefore, the problem of mild interactive entry points triggering heavy security actions can be grouped into the same conclusion generation chain, solving the problem in existing detection methods that can only record runtime events and are difficult to explain the source of the offset between entry expression and runtime behavior.

[0158] By fitting the current mild interaction entry point, security anomaly type, and interaction security offset fingerprint, a detection conclusion is generated, ensuring that the conclusion simultaneously includes the anomaly occurrence entry point, anomaly type, and fingerprint basis. The current processing can integrate "which entry point it occurred at," "which type of pre-click expression caused it," "which operational layer it entered after the click," and "where it flows after the fallback action" into the same detection conclusion, facilitating the localization of the anomaly formation path. Compared to methods that only output permission calls, login pages, or authorization pages, the current detection conclusion can explain the formation process of the current security anomaly type and maintains the same source link as the aforementioned entry expression source item, triggering layer transition source item, and fallback response source item.

[0159] By generating a handling path based on the interactive security offset fingerprint, and sequentially unfolding the current page reproduction, triggering the current mild interactive entry, reviewing the operational layer entry, and reviewing the page return result after returning, closing, or rejecting according to the entry commitment type, operational layer transfer type, and return traction type, the handling path is not just a page access path, but a complete review link that includes pre-click expression, post-click transfer, and return path action return.

[0160] Example 5

[0161] For interactive application behavior offset security detection devices, please refer to [link / reference]. Figure 2 It includes an entry source item acquisition module, an intent-bearing differential kernel construction module, an interactive security offset fingerprint construction module, and a detection conclusion and processing path output module;

[0162] After the entry source item acquisition module enters the current page of the application being tested, it analyzes the page title, flow position, and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtains the entry expression source item, trigger transition source item, and fallback response source item around the current gentle interaction entry point;

[0163] The intent-bearing differential core construction module generates a commitment boundary based on the ingress expression source term, generates an action load based on the triggering layer transition source term, and traces back from the action load to the commitment boundary. Action loads that cannot be explained by the commitment boundary are identified as implicit loads. Then, a fallback damping is generated based on the fallback response source term and the fallback damping. The commitment boundary, implicit load, and fallback damping constitute the intent-bearing differential core.

[0164] The interactive security offset fingerprint construction module constructs the interactive security offset fingerprint according to the commitment boundary, implicit load and fallback damping in the intent-bearing differential kernel, and in the order of interaction occurrence of the current mild interactive entry point.

[0165] The detection conclusion and handling path output module generates detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the runtime layer transfer, and reviewing the page reflow results after returning, closing, or rejecting.

[0166] Example 6

[0167] For interactive application behavior deviation security detection equipment, please refer to... Figure 2 Specifically, it includes a processor coupled to a memory; the processor is used to execute a computer program stored in the memory;

[0168] In this embodiment, the interactive application behavior deviation security detection device may include a processor, a memory, a communication interface, an input / output interface, and a bus. The processor, memory, communication interface, and input / output interface transmit data through the bus. The memory stores a computer program. When the processor executes the computer program stored in the memory, the interactive application behavior deviation security detection device enters the current page of the application being detected and performs the following actions: obtaining the page title of the current page, identifying the flow position, analyzing the visible expression of triggerable controls, determining the current mild interaction entry point, forming the entry point expression source item, forming the trigger transition source item, and forming the fallback response source item. The communication interface is used to exchange information with the terminal where the application being detected resides, the test environment, or the application's runtime environment. The input / output interface is used to output detection conclusions, handling paths, and review actions.

[0169] When the processor executes the computer program, it is also used to generate commitment boundaries based on the entry expression source item, generate action loads based on the trigger layer transition source item, and perform reverse interpretation from the action load to the commitment boundary. When the runtime body or runtime action in the action load cannot be interpreted by the entry action semantics, entry object semantics, and entry restriction semantics in the commitment boundary, the processor determines the current action load as the implicit load. The processor is also used to link merge the page backflow result in the backflow response source item with the implicit load, and generate backflow damping when the page backflow result re-enters or stays in the runtime layer where the implicit load is located. The commitment boundary, implicit load, and backflow damping constitute the intent-bearing differential core.

[0170] When the processor executes the computer program, it also reads the commitment boundaries, implicit loads, and fallback damping in the intent-bearing differential core and arranges them in a chain according to the interaction sequence of the current mild interaction entry point. The chain sequence is: commitment range before click, runtime layer entry after click, and page backflow pull after fallback action. The processor extracts the entry commitment type from the commitment boundaries, the runtime layer entry type from the implicit loads, and the backflow pull type from the fallback damping, forming an interaction offset chain from the entry commitment type, runtime layer entry type, and backflow pull type. The processor also re-enters the page containing the current mild interaction entry point based on the interaction offset chain, repeatedly executing entry location, entry triggering, runtime layer recording, return action, close action or rejection action, and page backflow recording. When the interaction offset chain is verified to be consistent with the current mild interaction entry point, the processor solidifies the interaction offset chain as an interaction security offset fingerprint.

[0171] When the processor executes the computer program, it also generates detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint; the handling paths include reproducing the current page, triggering the current mild interaction entry point, verifying the runtime layer transition, and verifying the page reflow results after returning, closing, or rejecting. Through the above device structure, the interactive application behavior offset security detection device can, without changing the hardware structure of the terminal where the detected application resides, detect interaction paths that trigger system permissions, identity authentication, mobile phone number binding, third-party authorization, or device capability calls based on the computer program executed by the processor, and output verifiable detection conclusions and handling paths.

[0172] Example 7

[0173] For interactive application behavior offset security detection media, please refer to... Figure 2 Specifically, it includes computer programs or instructions that, when run on a computer, cause the computer to execute an interactive application behavior offset security detection method.

[0174] In this embodiment, the interactive application behavior offset security detection medium can be a computer-readable storage medium that stores computer programs or instructions. When the computer program or instructions are run on the computer, the computer executes the interactive application behavior offset security detection method. The computer-readable storage medium may include a read-only memory, random access memory, disk, optical disk, flash memory, removable storage medium, or other storage medium capable of storing computer programs or instructions.

[0175] In this embodiment, when a computer program or instruction runs on a computer, it causes the computer to enter the current page of the application being tested, obtains the page title of the current page, the page path before entering the current page, and the visible representation of triggerable controls in the current page, determines the flow position based on the page path before entering the current page, and determines the current gentle interaction entry point based on the page title of the current page, the flow position, the visible representation of triggerable controls, and the adjacent descriptions around the triggerable controls; subsequently, the computer forms an entry expression source item around the current gentle interaction entry point, triggers the current gentle interaction entry point and obtains the trigger transition source item, and then executes a return, close, or reject action and obtains the fallback response source item.

[0176] When a computer program or instruction runs on a computer, it also enables the computer to generate a commitment boundary based on the entry expression source item, generate an action load based on the triggering layer source item, and perform a reverse interpretation from the action load to the commitment boundary. When the action load cannot be interpreted by the commitment boundary, the computer determines the current action load as the implicit load and generates a backflow damping based on the backflow correlation between the backflow response source item and the implicit load. The commitment boundary, the implicit load, and the backflow damping constitute the intention-bearing differential core.

[0177] When a computer program or instruction runs on a computer, it also enables the computer to construct an interaction offset chain according to the order of interaction occurrence of the current mild interaction entry point, based on the commitment boundary, implicit load and fallback damping in the intention to carry the differential core. By verifying the page where the current mild interaction entry point is located, verifying the triggering action of the current mild interaction entry point, verifying the transition to the runtime layer, and verifying the page reflow results after returning, closing or rejecting, the interaction offset chain is solidified into an interaction security offset fingerprint.

[0178] When a computer program or instruction runs on a computer, it also enables the computer to generate detection conclusions and handling paths based on the interactive security offset fingerprint. The detection conclusions include the current mild interactive entry point, the type of security anomaly, and the interactive security offset fingerprint; the handling paths include reproducing the current page, triggering the current mild interactive entry point, verifying the runtime layer transition, and verifying the page reflow results after returning, closing, or rejecting. Through the aforementioned computer-readable storage medium, the computer can execute the detection process of triggering heavy security actions through mild interactive entry points without changing the hardware structure of the terminal where the detected application resides, and output verifiable detection conclusions and handling paths.

[0179] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended technical solutions and their equivalents.

Claims

1. A method for detecting behavioral deviations in interactive applications, characterized in that: Includes the following steps: S1. After entering the current page of the application being tested, analyze the page title, flow position and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtain the entry expression source item, trigger transition source item and fallback response source item around the current gentle interaction entry point; S2. Generate commitment boundaries based on the entry expression source terms, generate action loads based on the triggering layer transition source terms, and trace back from the action loads to the commitment boundaries. Action loads that cannot be explained by the commitment boundaries are identified as implicit loads. Then, generate backflow damping based on the backflow association between backflow response source terms and implicit loads. The commitment boundaries, implicit loads, and backflow damping constitute the intention-bearing differential core. S3. Based on the commitment boundary, implicit load and fallback damping in the intention-bearing differential kernel, construct the interaction security offset fingerprint according to the interaction occurrence order of the current mild interaction entry point; S4. Generate detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the transition to the runtime layer, and reviewing the page reflow results after returning, closing, or rejecting.

2. The interactive application behavior deviation security detection method according to claim 1, characterized in that: S1 includes S11 and S12; S11. After entering the current page of the application being tested, first obtain the page title of the current page, the page path before entering the current page, and the visible representation of the triggerable controls in the current page, and determine the process position based on the page path before entering the current page. Using the current page title as the basis for scene limitation, the visible expression of the triggerable controls on the current page as the basis for entry meaning, and the adjacent descriptions around the triggerable controls as the basis for supplementing entry meaning, entry context units are formed for each triggerable control on the current page. Semantic merging of entry context units: entry context units that express meanings such as view, continue, skip, later, understand, experience, and browse are classified into the lightweight operation semantic scope, and triggerable controls that fall into the lightweight operation semantic scope are identified as the current gentle interaction entry point; Combine the visible text of the current gentle interactive entry point, adjacent descriptions, and the current page title into the entry point expression source item; S12. Execute a trigger action on the current mild interaction entry point, and obtain the trigger transition source item from the first runtime layer change after the trigger action occurs; The first operational layer changes are categorized into application content layer, system permission layer, identity authentication layer, mobile phone number binding layer, third-party authorization layer, and device capability invocation layer; Among them, the application content layer is formed by the ordinary content pages inside the application, the system permission layer is formed by the system permission pop-up window, the identity authentication layer is formed by the login, real name or verification page, the mobile phone number binding layer is formed by the mobile phone number input, verification code input or binding confirmation page, the third-party authorization layer is formed by the external account authorization or the external page launch, and the device capability call layer is formed by the location, clipboard, camera, album and microphone device capability call. After obtaining the triggering layer transition source item, continue to execute fallback actions around the same current mild interaction entry point. Fallback actions include returning, closing, and rejecting. After executing the fallback action, record the page reflow result and generate the fallback response source item; Page reflow results include returning to the current page, entering the previous process page, remaining in the running layer after the trigger, re-entering the same running layer, and entering a new confirmation page.

3. The interactive application behavior deviation security detection method according to claim 2, characterized in that: S2 includes S21 and S22; S21. Semantically decompose the entry expression source item into entry action semantics, entry object semantics, and entry restriction semantics; The entry action semantics, entry object semantics, and entry restriction semantics are combined into a commitment boundary; Based on the commitment boundary, the triggering transition source item is decomposed into the runtime layer, and the triggering transition source item is divided into the runtime layer body and the runtime layer action; Combine the runtime layer body and runtime layer actions into an action load.

4. The interactive application behavior deviation security detection method according to claim 3, characterized in that: S22. Starting from the action load, perform a reverse interpretation towards the commitment boundary, specifically as follows: First, read the runtime body and runtime actions in the action load, and then look for the entry action semantics, entry object semantics and entry constraint semantics that can describe the runtime body and runtime actions in the commitment boundary; When the runtime body and runtime actions in the action load can be interpreted by the operation scope in the commitment boundary, the current action load is classified as an in-commitment load. When the runtime body or runtime action in the action load cannot be interpreted by the operation scope in the commitment boundary, the current action load is determined to be an implicit load. Merge the page reflow results with the implicit load; If the page reflow result returns to the current page, the previous process page, or exits the current running layer, the backflow response source item will not form a backflow damping; If the page reflow result re-enters the runtime layer where the implicit load is located, or remains in the runtime layer where the implicit load is located, the current backflow response source item and the implicit load are combined into backflow damping; Combining commitment boundaries, implicit loads, and fallback damping forms the intentional load differential core.

5. The interactive application behavior deviation security detection method according to claim 4, characterized in that: S3 includes S31 and S32; S31. Read the commitment boundary, implicit load and fallback damping in the intention-bearing differential core, and chain them according to the interaction order of the current mild interaction entry. The chained interaction sequence is as follows: before clicking, the user receives the operation range expressed by the current mild interaction entry; after the user triggers the current mild interaction entry, they enter the runtime layer where the implicit load is located; and after the user performs the return, close, or reject action, a fallback damping is generated. After chaining, the commitment boundary, implicit load, and fallback damping are compressed from the same source. The specific processing steps are as follows: extract the entry commitment type from the commitment boundary, extract the operation layer transfer type from the implicit load, and extract the return traction type from the fallback damping. Arrange the entry commitment type, runtime layer transfer type, and return flow traction type in the order of before click, after click, and after the back path action to form an interactive offset chain; S32. Based on the interaction offset chain, re-enter the page where the current gentle interaction entry is located, and execute the interaction again in the order of action of the entry expression source item, the triggering layer source item, and the fallback response source item in S1; The review process includes: entering the current page, locating the same current gentle interaction entry point, triggering the current gentle interaction entry point, recording the first entry into the runtime layer, executing the return, close, or reject action, and recording the page reflow result; The commitment boundary, implicit load, and fallback damping are regenerated according to the processing logic of S2, and the regenerated commitment boundary, implicit load, and fallback damping are converted into a verification interaction offset chain. When the entry commitment type, runtime transfer type, and backflow traction type in the verification interaction offset chain are consistent with the interaction offset chain, the interaction offset chain is solidified as an interaction security offset fingerprint.

6. The interactive application behavior deviation security detection method according to claim 5, characterized in that: S4 includes S41 and S42; S41. Take the entry commitment type, runtime layer transfer type and backflow traction type from the interactive security offset fingerprint, and merge the conclusions according to the order of interaction of the three in the current mild interactive entry point; In the process of merging conclusions, first determine the pre-click expression category of the current mild interaction entry based on the entry commitment type, then determine the actual traction category after the click based on the runtime layer transfer type, and finally determine the process orientation category after the return traction action based on the return traction type. The security exception type is generated by merging the expression category before clicking, the actual traction category after clicking, and the process orientation category in sequence. The entry point promises a content browsing type, the runtime layer transfers to the system permission layer, and security exception types are grouped into lightweight browsing entry points that pull system permissions. The entry commitment type is "delayed setting", the runtime layer transfer type is "identity authentication layer", and the security exception type is merged into the "delayed setting" entry to drive identity authentication. The entry commitment type is process exit, the runtime layer transfer type is mobile number binding layer, and the security exception type is merged into skip entry to guide mobile number binding; The detection conclusion is generated by fitting the current mild interaction entry point, security anomaly type, and interaction security offset fingerprint.

7. The interactive application behavior deviation security detection method according to claim 6, characterized in that: S42. Generate a processing path based on the interactive security offset fingerprint; The handling path unfolds sequentially according to the entry commitment type, runtime layer transfer type, and backflow traction type in the interaction security offset fingerprint, including reproducing the current page, triggering the current mild interaction entry, reviewing the runtime layer transfer, and reviewing the page backflow results after returning, closing, or rejecting. The current page is reproduced based on the current page title and process position used when the entry expression source item was formed in S1; The current gentle interaction entry point is triggered based on the current gentle interaction entry point determined by S1; The runtime layer transfer is reviewed and executed based on the runtime layer transfer type recorded in the interactive security offset fingerprint in S3; The review page reflow results are executed based on the reflow traction type recorded in the interactive security offset fingerprint in S3; During the process of generating the handling path, the security anomaly type in the detection conclusion is used as the path annotation content, and the interactive security offset fingerprint is used as the basis for the review order, so that the handling path is not just a page access path, but a complete review link that includes "expression before clicking, redirection after clicking, and backtracking action". After the processing path is generated, the current interactive application behavior deviation security detection method outputs the current page entry method, the current mild interaction entry trigger action, the runtime layer transfer to review action, the return action, the page reflow review action after the close action or the rejection action.

8. An interactive application behavior deviation security detection device, characterized in that: It includes an entry source item acquisition module, an intent-bearing differential kernel construction module, an interactive security offset fingerprint construction module, and a detection conclusion and processing path output module; After the entry source item acquisition module enters the current page of the application being tested, it analyzes the page title, flow position, and visible expression of triggerable controls of the current page to determine the current gentle interaction entry point, and obtains the entry expression source item, trigger transition source item, and fallback response source item around the current gentle interaction entry point; The intent-bearing differential core construction module generates a commitment boundary based on the ingress expression source term, generates an action load based on the triggering layer transition source term, and traces back from the action load to the commitment boundary. Action loads that cannot be explained by the commitment boundary are identified as implicit loads. Then, a fallback damping is generated based on the fallback response source term and the fallback damping. The commitment boundary, implicit load, and fallback damping constitute the intent-bearing differential core. The interactive security offset fingerprint construction module constructs the interactive security offset fingerprint according to the commitment boundary, implicit load and fallback damping in the intent-bearing differential kernel, and in the order of interaction occurrence of the current mild interactive entry point. The detection conclusion and handling path output module generates detection conclusions and handling paths based on the interaction security offset fingerprint. The detection conclusions include the current mild interaction entry point, the type of security anomaly, and the interaction security offset fingerprint. The handling paths include reproducing the current page, triggering the current mild interaction entry point, reviewing the runtime layer transfer, and reviewing the page reflow results after returning, closing, or rejecting.

9. An interactive application behavior deviation security detection device, characterized in that: Includes a processor, which is coupled to a memory; The processor is configured to execute a computer program stored in the memory, causing the interactive application behavior deviation security detection device to perform the method as described in any one of claims 1 to 6.

10. An interactive application behavior offset security detection medium, characterized in that: It includes a computer program or instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images