Application analysis method, apparatus, device, medium, and program product

Abstract

The application provides an application analysis method and device, equipment, medium and program product, relates to the network security technical field, and is used for improving the efficiency and accuracy of identifying the main network communication address of the abnormal application. The specific technical scheme is: based on the configuration file of the target application, at least one first network communication address is obtained, the first network communication address is the address configured for the target application for network communication; the target application is run in an application simulation environment, and at least one second network communication address of the target application when running in the application simulation environment is obtained; based on the association score of each first network communication address and the association score of each second network communication address, the target network communication address is determined; based on the target network communication address, it is determined whether the target application is an abnormal application. The application is applied to the network security scene.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an application analysis method, apparatus, device, medium, and program product. Background Technology

[0002] With the rapid development of mobile internet, telecommunications network security has become a major concern. Currently, some malicious applications, during operation, may seriously endanger the safety of the public and their property. Therefore, accurately identifying the main communication servers of these malicious applications is crucial to improving telecommunications network security.

[0003] Currently, the mainstream technologies in the industry mainly use network traffic parsing technology to identify the communication addresses of abnormal applications during operation. This technology collects network traffic of abnormal applications during operation by capturing it on the terminal or gateway side, extracts the real network communication addresses, and then uses manual analysis and judgment based on the real network communication addresses during operation, combined with manual judgment methods, to determine the main network communication address, so as to truly identify the main communication server of the abnormal application.

[0004] However, in scenarios with a large number of abnormal applications, the above technical solutions cannot quickly and accurately locate and identify the main network communication address corresponding to the main communication server from a large number of complex real network communication addresses, resulting in low efficiency and accuracy in identifying the main network communication address of abnormal applications. Summary of the Invention

[0005] This application provides an application analysis method, apparatus, device, medium, and program product for improving the efficiency and accuracy of identifying the main network communication addresses of abnormal applications.

[0006] In a first aspect, embodiments of this application provide an application analysis method, the method comprising: obtaining at least one first network communication address based on a configuration file of a target application, wherein the first network communication address is an address configured for network communication for the target application; running the target application in an application simulation environment and obtaining at least one second network communication address of the target application running in the application simulation environment; determining a target network communication address based on an association score for each first network communication address and an association score for each second network communication address; wherein the association score is used to characterize the degree of association between the network communication address and an important function of the target application; and determining whether the target application is an abnormal application based on the target network communication address.

[0007] The technical solution provided in this application brings at least the following beneficial effects: In this solution, by combining static analysis and dynamic analysis, that is, simultaneously obtaining the network communication address in the configuration file and the network communication address during the simulated application runtime, and performing correlation scoring on all extracted network communication addresses to obtain the degree of correlation between each network communication address and important modules, the network communication address with a high degree of correlation with important modules is determined as the main network communication address, that is, the aforementioned target network communication address, and further, based on the target network communication address, it is determined whether the current application is an abnormal application, thereby improving the accuracy and efficiency of the main network communication address determination of the application, and also improving the accuracy of the abnormal application determination.

[0008] In one possible implementation, before determining the target network communication address based on the association scores of each first network communication address and each second network communication address, the method further includes: identifying at least one important functional module of the target application, wherein the important functional module is related to the degree of anomaly of the target application; determining the call chain of the network request based on the network request received at the third network communication address as a starting point, using a reverse tracing method, wherein the call chain calls some or all of the important functional modules among the at least one important functional module; determining the weight value corresponding to each important functional module called in the call chain based on the call level of each important functional module called in the call chain, wherein the call level is inversely proportional to the weight value; calculating the association score of each important core functional module called in the call chain based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, so as to obtain the association score of the third network communication address; wherein the third network communication address is one of the first network communication address or the second network communication address.

[0009] Another possible implementation, which involves running the target application in an application simulation environment and obtaining at least one second network communication address of the target application while it is running in the application simulation environment, includes: installing and starting the target application in an application simulation environment configured with a proxy service and a traffic capture tool; using dynamic instrumentation to intercept the proxy detection function in the target application and bypass the Secure Sockets Layer (SSL) certificate verification logic, simulating user operation of the target application to obtain network requests received by the target application while it is running in the application simulation environment; and capturing the at least one second network communication address of the target application while it is running in the application simulation environment based on the network requests.

[0010] In another possible implementation, before obtaining at least one first network communication address based on the configuration file of the target application, the method further includes: obtaining the installation package file of the target application; unpacking the installation package file of the target application to obtain the configuration file corresponding to the installation package file; and obtaining the at least one first network communication address from the configuration file.

[0011] Another possible implementation is that, based on the target network communication address, determining whether the target application is an abnormal application includes: identifying the target communication server corresponding to the target network communication address; and, if the target communication server and the communication server of the first application are a shared communication server, determining the target application as an abnormal application.

[0012] Secondly, embodiments of this application provide an application analysis apparatus, comprising: an acquisition module and a processing module; the acquisition module is configured to acquire at least one first network communication address based on a configuration file of a target application, wherein the first network communication address is an address configured for network communication for the target application; the processing module is configured to run the target application in an application simulation environment; the acquisition module is further configured to acquire at least one second network communication address of the target application running in the application simulation environment; the processing module is further configured to determine a target network communication address based on the association score of each first network communication address and the association score of each second network communication address; the association score is used to characterize the degree of association between the network communication address and the important functions of the target application; the processing module is further configured to determine whether the target application is an abnormal application based on the target network communication address.

[0013] In one possible implementation, the apparatus further includes: an identification module; the identification module is configured to identify at least one important functional module of the target application before the processing module determines the target network communication address based on the association score of each first network communication address and the association score of each second network communication address, wherein the important functional module is related to the degree of anomaly of the target application; the processing module is further configured to determine the call chain of the network request starting from the network request received at the third network communication address, using a reverse tracing method, wherein the call chain calls some or all of the important functional modules among the at least one important functional module; the processing module... The module is further configured to determine the weight value corresponding to each important functional module called in the call chain based on the call level of each important functional module called in the call chain, wherein the call level is inversely proportional to the weight value; the processing module is further configured to calculate the association score of each important core functional module called in the call chain based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, so as to obtain the association score of the third network communication address; wherein the third network communication address is one of the first network communication address or the second communication network address.

[0014] Another possible implementation, the aforementioned acquisition module is specifically used to: install and start the target application in an application simulation environment configured with a proxy service and traffic capture tool; use dynamic instrumentation to intercept the proxy detection function in the target application and bypass the Secure Sockets Layer (SSL) certificate verification logic to simulate user operation of the target application in order to obtain network requests received by the target application during runtime in the application simulation environment; and capture at least one second network communication address of the target application during runtime in the application simulation environment based on the network requests.

[0015] In another possible implementation, the above-mentioned acquisition module is further configured to acquire the installation package file of the target application before acquiring at least one first network communication address based on the configuration file of the target application; the above-mentioned processing module is further configured to unpack the installation package file of the target application to obtain the configuration file corresponding to the installation package file; the above-mentioned acquisition module is further configured to acquire the at least one first network communication address from the configuration file.

[0016] Another possible implementation is that the above processing module is specifically used to: identify the target communication server corresponding to the target network communication address; and, if the target communication server and the communication server of the first application are a shared communication server, determine the target application as an abnormal application.

[0017] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0018] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0019] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0020] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0021] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0022] Figure 1 A schematic diagram of the network architecture for an application analysis method provided in this application embodiment;

[0023] Figure 2 A flowchart illustrating an application analysis method provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating another application analysis method provided in this application embodiment;

[0025] Figure 4 A flowchart illustrating another application analysis method provided in this application embodiment;

[0026] Figure 5 A flowchart illustrating another application analysis method provided in this application embodiment;

[0027] Figure 6 A flowchart illustrating another application analysis method provided in this application embodiment;

[0028] Figure 7 A flowchart illustrating the implementation process of an application analysis method provided in this application embodiment;

[0029] Figure 8 A flowchart illustrating a primary address identification process provided in an embodiment of this application;

[0030] Figure 9 This is a schematic diagram of an abnormal application group provided in an embodiment of this application;

[0031] Figure 10 This is a schematic diagram of the structure of an application analysis device provided in an embodiment of this application;

[0032] Figure 11 This is a schematic diagram of another application analysis device provided in an embodiment of this application;

[0033] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0035] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0036] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0037] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0038] The application analysis method, apparatus, device, medium, and program product provided in this application embodiment can be applied to network security identification scenarios.

[0039] With the rapid development of mobile internet, telecommunications network security is in grave danger. Some malicious applications are disguised as legitimate applications by developers to lure users into downloading and installing them, thereby causing significant losses to users' telecommunications network security.

[0040] In the process of identifying anomalous applications, identifying the primary communication server (i.e., the primary communication address, or the primary network communication address) of the anomalous application is a crucial step. The primary communication refers to the communication connection established between the anomalous application and its core server during operation. This server typically undertakes core functions such as data transmission and reception, command issuance, and information theft, and is the nerve center of the anomalous application.

[0041] Existing communication address identification technologies for abnormal applications mainly include the following categories:

[0042] (1) Static feature analysis method: This method involves decompiling the application package (APK) file and extracting hard-coded strings such as Uniform Resource Locator (URL) and Internet Protocol (IP) addresses as communication addresses. This method is simple to implement, but abnormal applications often use techniques such as code obfuscation, string encryption, and dynamic loading to hide the real communication address. As a result, the address extracted by static analysis is often incomplete or has been encrypted and protected, making it impossible to obtain the real primary communication address that is decrypted at runtime.

[0043] (2) Network traffic capture method: This method captures the network traffic of an application (APP) during runtime on the terminal or gateway side and extracts the communication target address. This method can obtain the real communication address during runtime, but it lacks the ability to identify the main communication. The captured address list contains a large number of non-main communication addresses such as third-party software development kits (SDKs), advertising platforms, and statistical services, making it difficult to accurately identify the real fraudulent master control server.

[0044] (3) Manual analysis method: Security analysts manually analyze and determine the communication addresses of abnormal applications by combining information from multiple sources. This method relies on expert experience, is inefficient and costly, and cannot meet the needs of rapid analysis of massive abnormal application samples.

[0045] (4) Rule-based blacklist matching method, which compares the APP communication address with the known abnormal application blacklist. This method relies on the timeliness and completeness of the blacklist, and cannot identify the servers of new abnormal applications that are not included in the blacklist. In addition, abnormal applications may frequently change their server addresses, which leads to a continuous decline in the effectiveness of blacklist matching.

[0046] In summary, current technologies for identifying master control servers in abnormal applications have the following common shortcomings: ① They cannot accurately identify the master control server from a large number of candidate communication addresses; ② Their identification capabilities are insufficient in the face of adversarial methods such as encryption, obfuscation, and anti-detection; ③ They lack the ability to perform correlation analysis on shared master control servers among abnormal applications; ④ Their level of automation is low, which cannot meet the needs of large-scale and rapid analysis.

[0047] To address the shortcomings of current technologies, this embodiment proposes a method and system for identifying the main communication channel of an abnormal application. This method comprehensively extracts candidate communication addresses through a combination of static and dynamic analysis, then uses a multi-dimensional weighted scoring algorithm to accurately identify the main communication channel from the candidate addresses. Finally, based on communication association analysis, it constructs a knowledge graph of the application and the server to identify server groups. This embodiment can automatically and accurately identify the master control server of an abnormal application, effectively overcoming the deficiencies of existing technologies in terms of accuracy of main communication channel identification, anti-attack capabilities, and group association analysis.

[0048] Current technology has the following drawbacks:

[0049] Lack of primary communication address identification: Current technology can only extract the list of communication addresses of the APP, but cannot accurately identify which one is the core master control server that controls the abnormal application, i.e., the primary communication address. This results in a lack of precise targets for subsequent interception and tracing work.

[0050] Insufficient countermeasures: Abnormal applications commonly employ anti-analysis techniques such as string encryption, code obfuscation, proxy detection, and SSL Pinning. Existing static analysis or simple traffic capture methods cannot effectively extract the protected real communication address.

[0051] Non-primary communication interference is severe: Among the communication addresses generated during APP runtime, a large number belong to normal communication addresses such as third-party SDKs, advertising platforms, and content delivery networks (CDNs). The current method cannot effectively distinguish between primary and non-primary communication, resulting in a high false alarm rate.

[0052] Server correlation analysis is lacking: Current technology analyzes the communication address of a single APP in isolation, without considering the correlation between multiple abnormal applications sharing the same master control server, and cannot support clustering identification and chain mining of multiple abnormal applications.

[0053] Low level of automation: Current methods rely on manual judgment, which has a long analysis cycle and low efficiency, and cannot meet the governance needs of abnormal applications that mutate rapidly and appear on a large scale.

[0054] The purpose of this embodiment is to provide an automated method for identifying the master server of anomaly applications, which can accurately identify the master server from candidate connection addresses; to overcome the defenses against encryption, obfuscation, and anti-detection measures by combining static and dynamic analysis, and to fully extract the real connection addresses; to establish a multi-dimensional weighted scoring algorithm to effectively distinguish between master and non-master connections and reduce the false alarm rate; to construct a knowledge graph based on connection association analysis to achieve clustering identification of anomaly applications; and to achieve fully automated analysis to meet the practical needs of rapid judgment of large-scale anomaly applications.

[0055] The application analysis methods, apparatus, devices, media, and program products provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0056] Figure 1 This illustration shows a network architecture for an application analysis method provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture includes an application analysis device 101 and a terminal device 102. The application analysis device 101 and the terminal device 102 are interconnected.

[0057] In some embodiments, the application analysis device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster comprising multiple servers. It should be noted that the embodiments of this application do not limit the specific device form of the application analysis device 101. Figure 1 The example shown is an application analysis device 101 as a single server.

[0058] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone, with terminal device 102 as an example.

[0059] In some embodiments, the application analysis device 101 obtains at least one first network communication address based on the configuration file of the target application. The first network communication address is an address configured for network communication for the target application. The device runs the target application in an application simulation environment and obtains at least one second network communication address of the target application during operation in the application simulation environment. Based on the association score of each first network communication address and the association score of each second network communication address, a target network communication address is determined. The association score characterizes the degree of association between the network communication address and important functions of the target application. Based on the target network communication address, the device determines whether the target application is an abnormal application. The terminal device 102 performs operations such as prohibiting the operation of identified abnormal applications.

[0060] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0061] See Figure 2 This is a flowchart illustrating an application analysis method provided in an embodiment of this application. Figure 2 As shown, the application analysis method provided in this application embodiment can be implemented by the above-mentioned application analysis device, specifically including the following steps 201 to 204.

[0062] Step 201: The application analysis device obtains at least one first network communication address based on the target application's configuration file.

[0063] In some embodiments, the target application described above is an application that has cybersecurity issues.

[0064] In some embodiments, the first network communication address is an address configured for network communication for the target application.

[0065] In some embodiments, the application analysis device obtains the installation package of the target application, parses the installation package to obtain the configuration file in the installation package, and then further extracts strings and code from the configuration file to analyze and obtain the first network communication address.

[0066] Step 202: The application analysis device runs the target application in the application simulation environment and obtains at least one second network communication address of the target application when it runs in the application simulation environment.

[0067] In some embodiments, the above-mentioned application simulation environment is a virtualized / sandbox runtime environment used to isolate and run the target application. It can replicate real terminal hardware and system environment and support automated simulation of user behaviors such as manual touch, page jump, and login operations.

[0068] For example, the above application simulation environment can be a sandbox environment.

[0069] In some embodiments, the application analysis device can capture network requests generated during the application's runtime in an application simulation environment, and then extract the application's real network communication address during runtime, i.e., the aforementioned second network communication address, based on these network requests.

[0070] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, step 202 above is specifically implemented through steps 202a to 202c below.

[0071] Step 202a: The application analysis device installs and starts the target application in an application simulation environment configured with proxy services and traffic capture tools.

[0072] In some embodiments, in the above-described application simulation environment, Hypertext Transfer Protocol (HTTP) / Hypertext Transfer Protocol Secure (HTTPS) requests (i.e., the network requests described below) can be captured using a proxy packet capture tool, and all Transmission Control Protocol (TCP) / User Datagram Protocol (UDP) traffic (i.e., network traffic) can be captured using a transparent proxy mode. All domain name resolution requests can be captured using a Domain Name System (DNS) record resolution tool to obtain the second network communication address described below.

[0073] Step 202b: The application analysis device uses dynamic instrumentation to intercept the proxy detection function in the target application and bypass the Secure Sockets Layer (SSL) certificate verification logic to simulate user operations on the target application in order to obtain the network requests received by the target application when it is running in the application simulation environment.

[0074] In some embodiments, the above-mentioned dynamic instrumentation method refers to injecting probe code into the target application process in real time during the program execution phase, without the need to statically repackage or decompile the target application installation package. It is a runtime code hijacking technique that dynamically hooks the target function in the execution chain of application loading and function calls, hijacking the function's input parameters, return values, and execution flow.

[0075] In some embodiments, the above-mentioned proxy detection function is a built-in verification function of the target application, used to detect whether the device's current network is configured with an HTTP / HTTPS proxy or a packet capture proxy tool. If a proxy environment is detected, the application will trigger risk control logic, disconnect the network connection, terminate the business process, or return abnormal business data.

[0076] In some embodiments, the above SSL certificate verification logic is a built-in security verification process when an application initiates an HTTPS network request, used to verify the domain name, signature, validity period, and trust chain legitimacy of the SSL certificate issued by the server; if the verification fails, the establishment of an encrypted communication link is refused, and the packet capture device is blocked from parsing the encrypted network traffic.

[0077] In some embodiments, the network request mentioned above is an encrypted / plaintext communication message generated by the interaction between the target application and the remote business server, which includes business interaction traffic such as request headers, request parameters, and response data.

[0078] In some embodiments, the application analysis device launches the target application in an application simulation environment, injects probe hooks to the proxy detection function and SSL certificate verification function through dynamic instrumentation; intercepts the proxy detection logic and returns a result without proxy forgery, bypassing SSL certificate verification; automatically simulates user operations to drive the application to initiate network interactions, and finally captures all network request packets during the application's operation.

[0079] Step 202c: The application analysis device captures at least one second network communication address of the target application running in the application simulation environment based on the network request.

[0080] In some embodiments, the application analysis device parses each captured network request, extracts the communication identification information carried in the message header and connection establishment field, filters and identifies at least one remote second network communication address, and stores and classifies the extracted second network communication addresses for subsequent source tracing analysis of application communication links and backend service interfaces.

[0081] In this way, the application analysis device can obtain the real network communication address of the target application during operation through dynamic analysis.

[0082] In some embodiments, after steps 201 and 202 above, that is, after the application analysis device obtains at least one first network communication address and at least one second network communication address, it will fuse and deduplicate the at least one first network communication address and at least one second network communication address to obtain at least one candidate network communication address.

[0083] It is understood that the following steps can also be performed on network communication addresses among the candidate network communication addresses.

[0084] Step 203: The application analysis device determines the target network communication address based on the association score of each first network communication address and the association score of each second network communication address.

[0085] In some embodiments, the aforementioned association score is used to characterize the degree of association between network communication addresses and key functions of the target application.

[0086] In some embodiments, the degree of correlation between the network communication address and the important functions of the target application is used to characterize the probability that the network communication address is the target network communication address.

[0087] For example, the higher the degree of association, the higher the probability that the network communication address is the main network communication address of the target application.

[0088] In some embodiments, the application analysis device determines the association score corresponding to each network communication address by calculating the association score between each network communication address and an important functional module.

[0089] For example, network communication addresses with a comprehensive score exceeding a preset threshold T, such as T=0.65, are identified as target communication addresses. The address with the highest score is marked as the first target communication address, and other addresses exceeding the threshold are marked as backup target communication addresses.

[0090] Step 204: The application analysis device determines whether the target application is an abnormal application based on the target network communication address.

[0091] In some embodiments, the aforementioned abnormal applications are those with cybersecurity issues.

[0092] In some embodiments, the application analysis device obtains the target network communication address and identifies whether the primary communication server corresponding to the target network communication address is a communication server shared with multiple other abnormal applications. If it is a shared communication server, the target application is determined to be an abnormal application as well; otherwise, it is a normal application.

[0093] In some embodiments, combined with Figure 2 ,like Figure 4 As shown, step 204 can be implemented through steps 204a and 204b.

[0094] Step 204a: The application analysis device identifies the target communication server corresponding to the target network communication address.

[0095] Step 204b: If the target communication server and the communication server of the first application are a shared communication server, the application analysis device identifies the target application as an abnormal application.

[0096] In this way, after accurately filtering out the main network communication address, the application analysis device can trace back to its core main communication server. By determining whether the main communication server is the main communication server of other identified abnormal applications, it can determine whether the current target application is an abnormal application, thereby improving the accuracy of abnormal application judgment.

[0097] In some embodiments, prior to step 204 above, the application analysis device can establish a knowledge graph by analyzing in advance the main network communication addresses of multiple identified anomalous applications and the association between the main communication servers corresponding to their main network communication addresses.

[0098] In some embodiments, the knowledge graph described above is analyzed to identify multiple anomalous applications that share the same primary communication server as an anomalous application group.

[0099] In some embodiments, each abnormal application group is analyzed to extract characteristic information of each abnormal application group, such as function type, code similarity, release channel, and active time window.

[0100] In one embodiment, if the target application and the abnormal application share a primary communication server, then the target application is also identified as an abnormal application.

[0101] In another embodiment, if the feature information of the target application matches the feature information of one of the abnormal application groups, then the target application is also identified as an abnormal application.

[0102] Thus, by identifying the similarity between the target application and multiple anomalous applications, the accuracy of anomalous application identification can be improved.

[0103] The application analysis method provided in this application combines static and dynamic analysis, that is, it simultaneously obtains the network communication addresses in the configuration file and the network communication addresses during the simulated application runtime, and performs correlation scoring on all extracted network communication addresses to obtain the degree of correlation between each network communication address and important modules. The network communication addresses with a high degree of correlation with important modules are determined as the main network communication addresses, that is, the aforementioned target network communication addresses. Furthermore, the target network communication addresses are used to determine whether the current application is an abnormal application, thereby improving the accuracy and efficiency of determining the main network communication address of the application, and also improving the accuracy of determining abnormal applications.

[0104] In some embodiments, combined with Figure 2 ,like Figure 5As shown, prior to step 203 above, the application analysis method provided in this application embodiment further includes steps 301 to 304.

[0105] Step 301: The application analysis device identifies at least one important functional module of the target application.

[0106] In some embodiments, the aforementioned key functional modules are related to the degree of anomaly of the target application.

[0107] In some embodiments, the aforementioned important functional modules include, but are not limited to, at least one of the following: user authentication and login module, fund transaction and account management module, abnormal content display and interaction module, victim data collection and reporting module, and remote instruction receiving and execution module.

[0108] In some embodiments, the application analysis device performs semantic analysis on class names, method names, and string constants in the code of the target application, and, in conjunction with the functional pattern library of abnormal APPs, marks important functional modules and their corresponding code scopes.

[0109] Step 302: The application analysis device uses the network request received from the third network communication address as the starting point and adopts a reverse tracing method to determine the call chain of the network request.

[0110] In some embodiments, the third network communication address is one of the first network communication address or the second communication network address.

[0111] In some embodiments, the above call chain calls some or all of the important functional modules in at least one important functional module.

[0112] Step 303: The application analysis device determines the weight value corresponding to each important functional module called in the call chain based on the call level of each important functional module called in the call chain.

[0113] In some embodiments, the call hierarchy described above is inversely proportional to the weight value.

[0114] For example, different importance weights are assigned according to the important function types: the instruction receiving and execution module has the highest weight (W=1.0), followed by the fund transaction module (W=0.9), the data reporting module (W=0.8), the abnormal content interaction module (W=0.7), and the user authentication module (W=0.6).

[0115] For example, the shallower the call hierarchy, the more directly the network request is initiated by the important module, and the higher the correlation.

[0116] Step 304: The application analysis device calculates the association score of each important core functional module called in the call chain based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, so as to obtain the association score of the third network communication address.

[0117] In some embodiments, the above-mentioned correlation score can be calculated using the following formula (1).

[0118] F_func = Σ(W_func_i × depth_factor_i × call_count_i) / Σ(call_count_i) (1)

[0119] Where W_func_i is the core function weight associated with the i-th call, depth_factor_i is the corresponding depth decay coefficient, and call_count_i is the corresponding number of calls.

[0120] Therefore, current analysis techniques for abnormal applications typically focus only on external behavioral characteristics such as the frequency and volume of network requests, without delving into the code-level relationships between network requests and the core business modules within the app. This embodiment, through call chain tracing, verifies the possibility of candidate addresses acting as master servers from a code semantic level, significantly improving identification accuracy.

[0121] In some embodiments, combined with Figure 2 ,like Figure 6 As shown, prior to step 201 above, the application analysis method provided in this application embodiment further includes steps 401 to 403.

[0122] Step 401: The application analysis device obtains the installation package file of the target application.

[0123] Step 402: The application analysis device unpacks the installation package file of the target application to obtain the configuration file corresponding to the installation package file.

[0124] For example, the application analysis device obtains the target application file to be analyzed and performs preprocessing operations on the sample, specifically including (1) APK unpacking: using an unpacking tool to unpack the APK file and extract the AndroidManifest.xml, DEX bytecode file, resource file and asset / static resource (assets) directory, etc.; (2) Metadata extraction: extracting the application package name, permission list, declaration information of the four major components: Activity, Service, Receiver and Provider, as well as the network-related permissions applied for, such as network access permission (INTERNET) and network status permission (ACCESS_NETWORK_STATE), etc. from AndroidManifest.xml.

[0125] Step 403: The application analysis device obtains at least one first network communication address from the configuration file.

[0126] Thus, through static analysis—namely, the extraction of the string pool URL, network framework BaseURL, and encrypted configuration decryption—combined with dynamic analysis—namely, sandbox traffic capture, proxy detection bypass, SSL pinning bypass, and simulated user operations—can the candidate communication addresses of the target application be comprehensively extracted, effectively overcoming the commonly used encryption, obfuscation, and anti-detection techniques employed by the target application.

[0127] The application analysis method of the embodiments of this application will be described below through specific examples.

[0128] like Figure 7 As shown, the implementation process of the application analysis method provided in this application embodiment includes the following S1 to S6:

[0129] This embodiment proposes an abnormal application master communication identification method and system, which aims to achieve automated and high-precision identification of abnormal application master servers through candidate communication extraction combining static and dynamic analysis, accurate identification of master communication based on multi-dimensional weighted scoring, and gang association analysis based on knowledge graph.

[0130] S1: Information Acquisition and Preprocessing for the Target Application

[0131] First, obtain the target application file to be analyzed and perform preprocessing operations on the target application, specifically including (1) APK unpacking: use unpacking tools to unpack the APK file and extract the AndroidManifest.xml, DEX bytecode file, resource file and assets directory, etc.; (2) Metadata extraction: extract the application package name, permission list, declaration information of the four major components and the network-related permissions applied for from AndroidManifest.xml; (3) Sandbox environment creation: create an isolated sandbox environment on the analysis server, configure proxy packet capture tools, Virtual Private Network (VPN) traffic capture tools, DNS resolution record tools, and auxiliary tools for bypassing proxy detection and Secure Sockets Layer (SSL) pinning. The sandbox environment is pre-installed with commonly used runtime libraries to simulate a real terminal environment.

[0132] S2: Static analysis to extract candidate communication addresses

[0133] Static analysis is performed on the unpacked APP file to extract potential candidate communication addresses from the code, namely the first network communication address mentioned above. The specific steps include:

[0134] (1) String pool URL extraction: Decompile the DEX bytecode file, traverse the string constant pool, use regular expressions to extract all strings that conform to the URL format (starting with http / https, domain name + path format), as well as strings that conform to the IP address format, and perform deduplication and format standardization processing on the extracted URLs.

[0135] (2) Extraction of the base URL of the network framework: Analyze the network communication framework used by the APP, such as OkHttp, Retrofit, Volley, etc., and extract the base URL, server address constants, etc. in the framework configuration. Pay special attention to the URL definition in Retrofit interface annotations and the redirect address in OkHttp Interceptor configuration.

[0136] (3) Encryption configuration decryption extraction: Identify the encryption algorithms used in the code, such as Advanced Encryption Standard (AES), Data Encryption Standard (DES), and asymmetric encryption algorithm (Rivest-Shamir-Adleman, RSA) and keys, locate the storage location of the encryption configuration file, and extract the decrypted communication address by reverse analysis of the decryption logic.

[0137] (4) Summary of candidate communication addresses: The addresses extracted by the above three methods are summarized into a set of candidate communication addresses C_static. Each address records its source type, such as string pool / network framework / encryption configuration, and extraction location.

[0138] S3: Dynamically analyze and extract runtime communication addresses

[0139] Run the target application in a sandbox environment, capture the network communications generated during its runtime, and extract the actual communication address, i.e., the second network communication address mentioned above. The specific steps include:

[0140] (1) Sandbox operation and traffic capture: Install and start the fraudulent APP in a sandbox environment with the proxy and traffic capture tools configured. Capture HTTP / HTTPS requests through the proxy packet capture tool, capture all TCP / UDP traffic through the transparent proxy mode, and capture all domain name resolution requests through the DNS record resolution tool.

[0141] (2) Bypassing proxy detection: For common proxy detection mechanisms in abnormal applications, such as checking system proxy settings, detecting specific ports, and detecting VPN interfaces, use transparent proxy mode in the sandbox. For example, use transparent proxy based on VPN tunnel technology to replace system proxy, modify system properties to hide proxy characteristics, and use dynamic instrumentation Hook frameworks, such as Xposed and Frida, to bypass proxy detection by intercepting the return value of proxy detection functions.

[0142] (3) Bypass SSL Pinning: For SSL certificate pinning mechanisms implemented in abnormal applications, use dynamic instrumentation scripts, such as Frida framework scripts based on dynamic instrumentation technology, to hook SSL certificate verification functions, such as TrustManager, OkHttp's CertificatePinner, etc., and replace them with logic that trusts all certificates; or use a system image that has imported custom Certificate Authority (CA) certificates.

[0143] (4) Simulate user operations: Simulate typical user operation paths in the APP through an automated testing framework, including login and registration, page browsing, function clicks, form submission, etc., to trigger the deep functional modules and network requests of the APP and ensure that the communication addresses are captured as completely as possible.

[0144] (5) Runtime communication address summary: All captured communication target addresses, domain names, IPs, and ports are summarized into a runtime communication address set C_dynamic. Each address records its runtime characteristic information such as communication protocol, request frequency, data transmission volume, and request timing.

[0145] (6) Candidate communication fusion and deduplication: The C_static extracted from static analysis, i.e. the first network communication address mentioned above, and the C_dynamic extracted from dynamic analysis, i.e. the second network communication address mentioned above, are fused and deduplicated to form a complete set of candidate communication addresses C=C_static∪C_dynamic.

[0146] S4: Identification and Determination of the Primary Address

[0147] For each address in the candidate address set C, a multi-dimensional weighted scoring algorithm is used to calculate its comprehensive score as the primary address, and the primary address is determined accordingly. For example... Figure 8 As shown, the specific process and steps are as follows:

[0148] Step S401: Communication frequency scoring

[0149] The frequency with which each candidate communication address is accessed by the APP during the dynamic analysis period is statistically analyzed. As the core control server, the primary communication address usually has the highest communication frequency or a relatively stable periodic communication pattern. Therefore, the higher the frequency, the greater the probability that the candidate communication address is the primary communication address.

[0150] Scoring formula: F_freq = normalize(number of visits × communication persistence weight)

[0151] Among them, the communication continuity weight is determined based on whether the communication runs through the entire lifecycle of the APP, and the continuous communication throughout the entire process has a higher weight.

[0152] Step S402: Data Proportion Scoring

[0153] Calculate the proportion of uplink and downlink data transmission volume for each candidate address relative to the total data transmission volume of the app. The primary address typically carries the transmission of core business data, and its data proportion is significantly higher than that of other addresses. Therefore, the higher the data proportion, the greater the probability that the candidate address is the primary address.

[0154] Scoring formula: F_data = normalize(uplink data volume + downlink data volume) / total data volume of the app

[0155] Step S403: Domain Name Feature Scoring

[0156] Analyze the domain characteristics of candidate communication addresses, including: domain registration time (newly registered domains score higher), whether the domain's WHOIS information is associated with known abnormal domains, whether the domain uses free DNS services, and whether the domain uses CDN. Domains that do not use CDN score higher because the main control server usually uses an independent IP or a simple domain name.

[0157] Scoring formula: F_domain = Σ(Score of each sub-feature × corresponding weight)

[0158] Step S404: Server Ownership Rating

[0159] Analyze the attribution information of the servers corresponding to the candidate communication addresses, including: IP geographical location (higher scores for overseas or high-risk areas), whether the Autonomous System (AS) to which the IP belongs is a small Internet Data Center (IDC) provider, whether the IP belongs to an elastic computing instance of a cloud service provider, and whether multiple abnormal domain names are hosted on the same IP.

[0160] Scoring formula: F_server = Σ(Score of each sub-feature × corresponding weight)

[0161] Step S405: SSL Certificate Scoring

[0162] Analyze the SSL certificate characteristics of candidate communication addresses, including: whether the certificate is self-signed (self-signed certificates score higher), whether the certificate authority is a free CA, such as Let'sEncrypt (free CAs score moderately), whether the certificate validity period is short (short validity periods score higher), and whether the certificate subject name does not match the APP package name or brand (mismatch scores higher).

[0163] Scoring formula: F_ssl = Σ(Score of each sub-feature × corresponding weight)

[0164] Step S406: Important Function Association Scoring

[0165] Analyzing the correlation between candidate communication addresses and key functions of the app is a unique scoring dimension that distinguishes this embodiment from current abnormal application analysis techniques. The specific implementation steps are as follows:

[0166] (a) Identification of important functional modules: By statically analyzing the decompiled code of the APP, important functional modules related to fraudulent business are identified.

[0167] For example, the identification method is as follows: perform semantic analysis on class names, method names, and string constants in the code, and combine them with the functional pattern library of fraudulent APPs to mark important functional modules and their corresponding code scope.

[0168] (b) Call chain tracing: For each candidate communication address, trace back along the call chain from the point where the network request was initiated to determine whether the network request was initiated by an important functional module.

[0169] The specific method is as follows: Starting from the network request method where the candidate communication address is located, the caller link is traced by analyzing the method call graph. If the link contains important functional modules that have been marked, an "address-important function" association is established, and the associated important function type and call level depth are recorded.

[0170] (c) Functional importance weighting: assign different importance weights according to the type of important function.

[0171] For example, the shallower the call level of an important functional module, that is, the more directly the network request is initiated by the important module, the higher the correlation. An additional depth decay coefficient is added: depth_factor=1 / (1+0.2×depth).

[0172] (d) Scoring Calculation: A comprehensive score is calculated based on the weight of key function types and the depth of function calls.

[0173] F_func=Σ(W_func_i×depth_factor_i×call_count_i) / Σ(call_count_i)

[0174] Where W_func_i is the weight of the important function associated with the i-th call, depth_factor_i is the corresponding depth decay coefficient, and call_count_i is the corresponding number of calls.

[0175] Step S407: Comprehensive Scoring and Judgment

[0176] Calculate a comprehensive score for each candidate address, which is to weight the scores from S401 to S406 above:

[0177] Score=0.25×F_freq+0.20×F_data+0.15×F_domain+0.15×F_server+0.10×F_ssl+0.15×F_func

[0178] For example, candidate communication addresses whose overall score exceeds a preset threshold T, such as T=0.65, are determined to be primary communication addresses. The address with the highest score is marked as the first primary communication address, and other addresses exceeding the threshold are marked as backup primary communication addresses.

[0179] Experimental Verification: To verify the effectiveness of the multi-dimensional weighted scoring algorithm in this embodiment, a comparative experiment was conducted on a sample of 500 confirmed primary communication abnormal applications. Three control groups were set up: (A) the six-dimensional weighted scoring method of this embodiment; (B) a single-dimensional determination method using only communication frequency, where the address with the highest communication frequency was determined as the primary communication address; and (C) a random weight allocation method, where the weights of the six dimensions were randomly assigned. The experimental results are as follows:

[0180]

[0181] Table 1

[0182] The threshold T=0.65 was determined through Receiver Operating Characteristic (ROC) analysis. At this threshold, the Youden index is the largest (0.78), which is the optimal decision threshold.

[0183] Experimental results show that the six-dimensional weighted scoring algorithm in this embodiment improves accuracy by 20.9 percentage points and F1 score by 21.16 percentage points compared to the single-dimensional method, verifying the effectiveness of multi-dimensional scoring and the rationality of weight allocation. In particular, the ablation experiment of the "important functional association" dimension shows that removing this dimension reduces the F1 score by 4.7 percentage points, proving that this original dimension makes a significant contribution to the recognition accuracy.

[0184] S5: Address Association Analysis and Identification of Abnormal Application Groups

[0185] For example, based on the identified primary communication address, cross-app communication correlation analysis is performed to identify abnormal application groups sharing the same master control server, such as... Figure 9 As shown, the specific steps include:

[0186] (1) Construction of APP-Server Knowledge Graph: A bipartite knowledge graph is constructed using multiple abnormal applications and their corresponding main communication servers as nodes and communication relationships as edges. Communication feature attributes, such as communication protocol, data volume, and time pattern, are added to each edge.

[0187] (2) Shared server clustering: In the knowledge graph, abnormal applications that share the same main communication server are aggregated into an abnormal application group. Through graph clustering algorithms, APP groups that share multiple servers or have indirect connections are identified.

[0188] (3) Abnormal application group feature analysis: For each identified abnormal application group, analyze its common features, including: APP function type, code similarity, release channel, active time window, etc., and generate an abnormal application group profile.

[0189] S6: Results Output and Warnings

[0190] The results of primary address identification and abnormal application group analysis are structured and output, and alerts are triggered, specifically including:

[0191] Output of primary communication address results: Outputs a list of primary communication addresses for each abnormal application, including comprehensive score, scores for each dimension, and communication feature details.

[0192] Output of abnormal application group association results: Output the clustering results of abnormal application groups, including abnormal application group number, abnormal APP list, shared server list, abnormal application group profile, etc.

[0193] Warning Trigger: When a new primary communication address is identified, an warning notification is automatically triggered and pushed to the network security warning platform; when a new APP is detected to be associated with a known abnormal application group, an extended warning is triggered.

[0194] Data import: The analysis results are stored in the database of the main communication terminal of the abnormal application, supporting subsequent queries and continuous updates.

[0195] Therefore, the core technical key points of this embodiment mainly focus on the following aspects:

[0196] (1) Multi-dimensional weighted scoring identification method for abnormal application master communication: This embodiment proposes for the first time an automated identification method for abnormal APP master control server (master communication). Through a weighted scoring algorithm of six dimensions, namely communication frequency, data ratio, domain name characteristics, server ownership, SSL certificate, and association with important functions, the master communication is accurately identified from the candidate communication addresses. This method effectively solves the technical problem of being unable to identify the master control server from a large number of candidate addresses.

[0197] (2) Candidate communication extraction method combining static analysis and dynamic analysis: This embodiment combines static analysis and dynamic analysis to fully extract the candidate communication addresses of abnormal APPs, effectively breaking through the encryption, obfuscation, anti-detection and other anti-countermeasures commonly used by fraudulent APPs.

[0198] (3) Knowledge Graph-Based Abnormal App Group Association Analysis Method: This embodiment constructs an APP-server knowledge graph based on the master connection identification results. It then uses a graph clustering algorithm to identify abnormal APP groups sharing the same master control server, achieving cluster identification and chain mining of fraudulent abnormal application groups. This method overcomes the shortcomings of isolated analysis of individual APPs and the lack of abnormal application group association analysis capabilities.

[0199] (4) Bypass methods for adversarial techniques in dynamic analysis: This embodiment proposes a systematic bypass scheme for anti-analysis techniques of abnormal apps, including proxy detection bypass based on transparent proxy mode, SSL Pinning bypass based on dynamic instrumentation Hook technology, and deep function triggering based on automated testing framework, to ensure that the real runtime communication address can still be extracted in an adversarial environment. The core innovation of this bypass scheme is not in the individual bypass techniques themselves, but in integrating these adversarial techniques into the specific process of abnormal app main communication identification, forming a complete closed-loop scheme from "environment configuration → adversarial bypass → traffic capture → address extraction".

[0200] (5) Important Function Association Scoring Dimension: This embodiment creatively proposes the “important function association” scoring dimension. By analyzing the calling context of the candidate communication address in the APP code, it is determined whether the address is called by the core business module, and the possibility of it serving as the master control server is verified from the code semantic level.

[0201] It should be noted that the communication address in this embodiment can be understood as the network communication address, and the two have the same meaning.

[0202] It should be noted that the descriptions of each step S1 to S6 in this embodiment can be found in the descriptions in the above embodiments, and will not be repeated here.

[0203] It should be noted that the core objective of this embodiment is to achieve precise interception and source tracing of abnormal application groups by identifying the main control server (main communication) of abnormal apps. Besides the described technical solution, several alternative implementation methods can also be used:

[0204] (1) Feature extraction alternatives: In static analysis, machine learning models, such as BERT-based code semantic analysis models, can be used to automatically identify communication addresses in the code, replacing string matching based on regular expressions and improving the adaptability to code obfuscation. In dynamic analysis, kernel-level traffic capture technology can be used to replace user-space proxy packet capture, directly capturing network communication from the operating system kernel layer, further reducing the risk of being detected by abnormal apps.

[0205] (2) Alternative scoring algorithms: In the scoring algorithm for primary address identification, machine learning-based classification models, such as XGBoost and Random Forest, can be used to replace the manually set weighted scoring formula. The model can automatically learn the weights and combination relationships of features in each dimension by training on the labeled dataset. Alternatively, deep learning models can be used to automatically learn the feature representations and importance scores of candidate addresses.

[0206] (3) Alternative solutions for identifying abnormal application groups: In the correlation analysis of abnormal application groups, graph neural networks can be used to replace the traditional community detection algorithm. By leveraging the powerful graph structure learning capabilities of graph neural networks, complex correlation patterns between apps and servers can be automatically discovered. Alternatively, time series analysis can be introduced to perform time-dimensional correlation analysis of abnormal application groups based on the active time window of the main connected server.

[0207] (4) Dynamic update alternative: The main communication identification model can be dynamically updated through incremental learning or online learning. When a new abnormal APP sample is analyzed and the result is confirmed, the parameters and knowledge graph of the scoring model are automatically updated to improve the system's adaptability to new abnormal APPs.

[0208] (5) Multimodal fusion alternative: In candidate communication extraction and main communication identification, the text features of the APP, such as application description, permission declaration, and visual features, such as APP interface screenshots and icon similarity, can be further integrated for comprehensive analysis and judgment to improve the comprehensiveness and accuracy of recognition.

[0209] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0210] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0211] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0212] This application embodiment can divide the application analysis device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0213] In some embodiments, this application also provides an application analysis apparatus. The application analysis apparatus may include one or more functional modules for implementing the application analysis method of the above method embodiments.

[0214] For example, Figure 10 This is a schematic diagram of an application analysis device provided in an embodiment of this application. Figure 10As shown, the application analysis device 900 includes: an acquisition module 901 and a processing module 902; the acquisition module 901 is used to acquire at least one first network communication address based on the configuration file of the target application, wherein the first network communication address is an address configured for network communication for the target application; the processing module 902 is used to run the target application in an application simulation environment; the acquisition module 901 is also used to acquire at least one second network communication address of the target application running in the application simulation environment; the processing module 902 is also used to determine a target network communication address based on the association score of each first network communication address and the association score of each second network communication address; the association score is used to characterize the degree of association between the network communication address and the important functions of the target application; the processing module 902 is also used to determine whether the target application is an abnormal application based on the target network communication address.

[0215] In the application analysis device provided in this application embodiment, static analysis and dynamic analysis are combined, that is, the network communication addresses in the configuration file and the network communication addresses of the simulated application runtime are obtained simultaneously, and all extracted network communication addresses are associated and scored to obtain the degree of association between each network communication address and important modules. The network communication addresses with a high degree of association with important modules are determined as the main network communication addresses, that is, the aforementioned target network communication addresses. Furthermore, the current application is judged as an abnormal application based on the target network communication addresses, thereby improving the accuracy and efficiency of the main network communication address judgment of the application, and also improving the accuracy of the abnormal application judgment.

[0216] One possible implementation method is to combine Figure 10 ,like Figure 11As shown, the aforementioned device 900 further includes: an identification module 903; the identification module 903 is used to identify at least one important functional module of the target application before the processing module 902 determines the target network communication address based on the association score of each first network communication address and the association score of each second network communication address, wherein the important functional module is related to the degree of anomaly of the target application; the processing module 902 is further used to determine the call chain of the network request based on the network request received at the third network communication address as a starting point, using a reverse tracing method, wherein the call chain calls some or all of the important functional modules among the at least one important functional module; the aforementioned processing... Module 902 is further configured to determine the weight value corresponding to each important functional module called in the call chain based on the call level of each important functional module called in the call chain, wherein the call level is inversely proportional to the weight value; the processing module 902 is further configured to calculate the association score of each important core functional module called in the call chain based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, so as to obtain the association score of the third network communication address; wherein the third network communication address is one of the first network communication address or the second communication network address.

[0217] Another possible implementation, the aforementioned acquisition module 901, is specifically used to: install and start the target application in an application simulation environment configured with a proxy service and traffic capture tool; use dynamic instrumentation to intercept the proxy detection function in the target application and bypass the Secure Sockets Layer (SSL) certificate verification logic to simulate user operation of the target application in order to obtain network requests received by the target application during its operation in the application simulation environment; and capture at least one second network communication address of the target application during its operation in the application simulation environment based on the network requests.

[0218] In another possible implementation, the acquisition module 901 is further configured to acquire the installation package file of the target application before acquiring at least one first network communication address based on the configuration file of the target application; the processing module 902 is further configured to unpack the installation package file of the target application to obtain the configuration file corresponding to the installation package file; and the acquisition module 901 is further configured to acquire the at least one first network communication address from the configuration file.

[0219] Another possible implementation is that the processing module 902 is specifically used to: identify the target communication server corresponding to the target network communication address; and, if the target communication server and the communication server of the first application are a shared communication server, determine the target application as an abnormal application.

[0220] It should be noted that the application analysis device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0221] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 12 As shown, the electronic device 90 includes: a processor 92, a communication interface 93, and a bus 94. Optionally, the electronic device 90 may also include a memory 91.

[0222] Processor 92 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0223] Communication interface 93 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0224] The memory 91 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0225] As one possible implementation, the memory 91 can exist independently of the processor 92. The memory 91 can be connected to the processor 92 via a bus 94 and is used to store instructions or program code. When the processor 92 calls and executes the instructions or program code stored in the memory 91, it can implement the application analysis method provided in the embodiments of this application.

[0226] In another possible implementation, memory 91 can also be integrated with processor 92.

[0227] Bus 94 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 94 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 12 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0228] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0229] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above application analysis method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0230] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0231] This application also provides a readable storage medium storing a program or instructions that, when executed by a computer, implement the application analysis method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; the readable storage medium can be any of the foregoing embodiments or memory; the readable storage medium can also be an external storage device of the service invocation device, such as a pluggable hard drive, Smart MediaCard (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0232] This application also provides a computer program product, which is stored in a storage medium and implements the application analysis method provided in the above embodiments when the computer program product is executed by a computer.

[0233] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0234] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0235] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An application analysis method, characterized in that, include: Based on the target application's configuration file, at least one first network communication address is obtained, wherein the first network communication address is an address configured for network communication for the target application; Run the target application in an application simulation environment and obtain at least one second network communication address of the target application while it is running in the application simulation environment; The target network communication address is determined based on the association score of each first network communication address and the association score of each second network communication address; the association score is used to characterize the degree of association between the network communication address and the important functions of the target application. Based on the target network communication address, determine whether the target application is an abnormal application.

2. The application analysis method according to claim 1, characterized in that, Before determining the target network communication address based on the association score of each first network communication address and the association score of each second network communication address, the method further includes: Identify at least one important functional module of the target application, wherein the important functional module is related to the degree of anomaly of the target application; Starting from the network request received at the third network communication address, a reverse tracing method is used to determine the call chain of the network request, and the call chain calls some or all of the important functional modules in the at least one important functional module. Based on the call level of each important functional module called in the call chain, a weight value corresponding to each important functional module called in the call chain is determined, and the call level is inversely proportional to the weight value; Based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, the association score of each important core functional module called in the call chain is calculated to obtain the association score of the third network communication address. The third network communication address is one of the first network communication address or the second communication network address.

3. The application analysis method according to claim 1, characterized in that, The step of running the target application in an application simulation environment and obtaining at least one second network communication address of the target application while it is running in the application simulation environment includes: Install and launch the target application in an application simulation environment configured with proxy services and traffic capture tools; By employing dynamic instrumentation, the proxy detection function in the target application is intercepted, and the SSL certificate verification logic of Secure Sockets Layer is bypassed. The user operation of the target application is simulated to obtain the network requests received by the target application when it is running in the application simulation environment. Based on the network request, capture at least one second network communication address of the target application running in the application simulation environment.

4. The application analysis method according to claim 1, characterized in that, Before obtaining at least one first network communication address based on the target application's configuration file, the method further includes: Obtain the installation package file of the target application; The installation package file of the target application is unpacked to obtain the configuration file corresponding to the installation package file; Obtain the at least one first network communication address from the configuration file.

5. The application analysis method according to claim 1, characterized in that, Determining whether the target application is an abnormal application based on the target network communication address includes: Identify the target communication server corresponding to the target network communication address; If the target communication server and the communication server of the first application are a shared communication server, the target application is identified as an abnormal application.

6. An application analysis device, characterized in that, include: Acquisition module and processing module; The acquisition module is used to acquire at least one first network communication address based on the configuration file of the target application, wherein the first network communication address is an address configured for network communication for the target application. The processing module is used to run the target application in an application simulation environment; The acquisition module is further configured to acquire at least one second network communication address of the target application when it is running in the application simulation environment; The processing module is further configured to determine a target network communication address based on the association score of each first network communication address and the association score of each second network communication address; the association score is used to characterize the degree of association between the network communication address and the important functions of the target application; The processing module is also used to determine whether the target application is an abnormal application based on the target network communication address.

7. The application analysis device according to claim 6, characterized in that, The device further includes: an identification module; The identification module is used to identify at least one important functional module of the target application before the processing module determines the target network communication address based on the association score of each first network communication address and the association score of each second network communication address. The important functional module is related to the degree of abnormality of the target application. The processing module is further configured to determine the call chain of the network request by taking the network request received from the third network communication address as the starting point and using a reverse tracing method. The call chain calls some or all of the important functional modules in the at least one important functional module. The processing module is further configured to determine the weight value corresponding to each important functional module called in the call chain based on the call level of each important functional module called in the call chain, wherein the call level is inversely proportional to the weight value; The processing module is further configured to calculate the association score of each important core functional module called in the call chain based on the weight value corresponding to each important functional module called in the call chain and the call level of each important core functional module called in the call chain, so as to obtain the association score of the third network communication address. The third network communication address is one of the first network communication address or the second communication network address.

8. The application analysis device according to claim 6, characterized in that, The acquisition module is specifically used for: Install and launch the target application in an application simulation environment configured with proxy services and traffic capture tools; By employing dynamic instrumentation, the proxy detection function in the target application is intercepted, and the SSL certificate verification logic of Secure Sockets Layer is bypassed. The user operation of the target application is simulated to obtain the network requests received by the target application when it is running in the application simulation environment. Based on the network request, capture at least one second network communication address of the target application running in the application simulation environment.

9. The application analysis device according to claim 6, characterized in that, The acquisition module is further configured to acquire the installation package file of the target application before acquiring at least one first network communication address based on the configuration file of the target application; The processing module is also used to unpack the installation package file of the target application to obtain the configuration file corresponding to the installation package file; The acquisition module is further configured to acquire the at least one first network communication address from the configuration file.

10. The application analysis device according to claim 6, characterized in that, The processing module is specifically used for: Identify the target communication server corresponding to the target network communication address; If the target communication server and the communication server of the first application are a shared communication server, the target application is identified as an abnormal application.

11. An electronic device, characterized in that, It includes a processor and a memory, the memory storing programs or instructions that can run on the processor, the programs or instructions being executed by the processor to implement the application analysis method as described in any one of claims 1-5.

12. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a computer, implement the application analysis method as described in any one of claims 1-5.

13. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the application analysis method as described in any one of claims 1-5.

Images