Method for application type detection and non-transitory machine-readable medium

Abstract

A method for detecting application (APP) types includes: collecting multiple system-level information about multiple APPs, wherein the multiple APPs are associated with at least two APP types; and training a machine learning model using a contrastive learning method to obtain a trained model, wherein the trained model is used to detect the APP type of each of the multiple APPs, and the multiple system-level information is used as multiple input data of the machine learning model.

Claims

1. A method for detecting application (APP) type, comprising: The method involves collecting multiple system-level information from multiple apps, wherein the multiple apps are related to at least two app types; and training a machine learning model using a contrastive learning method to obtain a trained model, wherein the multiple system-level information is used as multiple input data for the machine learning model, and the trained model is used to detect the app type of each app among the multiple apps; wherein the multiple apps include at least one first app belonging to a first app type and at least one second app belonging to a second app type, wherein the second app type is different from the first app type, and each positive pair in the feature space includes two features corresponding to the same app type, the two features being generated by the machine learning model, and maximizing the similarity of the positive pairs in the feature space using the contrastive learning method.

2. The method as described in request item 1, wherein, Each of these multiple system-level information items includes one of system calls, application programming interface (API) calls, and information related to the performance monitoring unit (PMU).

3. The method as described in request item 1, wherein, This machine learning model is based on the Temporal Convolutional Network (TCN) architecture.

4. The method as described in request item 1, wherein, Each negative pair in the feature space includes a first feature corresponding to the first APP type and a second feature corresponding to the second APP type, the first feature and the second feature being generated by the machine learning model, and the similarity of the negative pairs in the feature space being minimized by the contrastive learning method.

5. The method as described in request item 1, wherein, The plurality of apps includes at least one first app belonging to the first app type and at least one second app belonging to the second app type. The plurality of input data includes a plurality of first input data corresponding to the first app type and at least one second input data corresponding to the second app type. The step of training the machine learning model using the contrastive learning method includes: performing an augmentation operation on the first input data corresponding to the first app type to generate an augmentation result; and training the machine learning model according to a loss function, wherein the loss function is related to a plurality of features, and the plurality of features are generated by the machine learning model based on the plurality of first input data, the augmentation result, and the at least one second input data, respectively.

6. The method as described in claim 5, wherein, The steps of performing the enhancement operation on the first input data to generate the enhancement result include: in response to the first input data being a system call sequence, randomly masking a portion of the system call sequence to generate the enhancement result; or in response to the first input data being a system call count, randomly masking discontinuous system calls to generate the enhancement result.

7. The method as described in request item 5, wherein, The steps of training the machine learning model based on the loss function include: encoding the plurality of first input data respectively to generate a plurality of first features through the machine learning model; encoding the augmentation result to generate a third feature through the machine learning model; and encoding at least one second input data to generate at least one second feature through the machine learning model.

8. The method as described in request item 1, wherein, The method also includes: using the trained model to perform detection operations on the front-end APP to generate detection results; and determining the corresponding system strategy based on the detection results, wherein different APP types correspond to different system strategies.

9. The method as described in claim 1, wherein, The method also includes: after obtaining the trained model, training the trained model using a multilayer perceptron.

10. A non-transitory machine-readable medium for storing program code, wherein, When the program code is loaded and executed by the processor, the program code instructs the processor to perform a method for detecting application (APP) types, the method comprising: collecting multiple system-level information of multiple APPs, wherein the multiple APPs are associated with at least two APP types; and training a machine learning model using a contrastive learning method to obtain a trained model, wherein the multiple system-level information is used as multiple input data of the machine learning model, and the trained model is used to detect the APP type of each of the multiple APPs; wherein the multiple APPs include at least one first APP belonging to a first APP type and at least one second APP belonging to a second APP type, wherein the second APP type is different from the first APP type, and each pair of positive pairs in the feature space includes two features corresponding to the same APP type, the two features being generated by the machine learning model respectively, and maximizing the similarity of the positive pairs in the feature space by the contrastive learning method.

11. The non-transitory machine-readable medium as described in claim 10, wherein, These multiple system-level information include one of the following: system calls, application programming interface (API) calls, and information related to the performance monitoring unit (PMU).

12. The non-transitory machine-readable medium as described in claim 10, wherein, This machine learning model is based on the Temporal Convolutional Network (TCN) architecture.

13. The non-transitory machine-readable medium as described in claim 10, wherein, Each negative pair in the feature space includes a first feature corresponding to the first APP type and a second feature corresponding to the second APP type, the first feature and the second feature being generated by the machine learning model, and the similarity of the negative pairs in the feature space being minimized by the contrastive learning method.

14. The non-transitory machine-readable medium as described in claim 10, wherein, The plurality of apps includes at least one first app belonging to the first app type and at least one second app belonging to the second app type. The plurality of input data includes a plurality of first input data corresponding to the first app type and at least one second input data corresponding to the second app type. The step of training the machine learning model using the contrastive learning method includes: performing an augmentation operation on the first input data corresponding to the first app type to generate an augmentation result; and training the machine learning model according to a loss function, wherein the loss function is related to a plurality of features, and the plurality of features are generated by the machine learning model based on the plurality of first input data, the augmentation result, and the at least one second input data, respectively.

15. The non-transitory machine-readable medium as described in claim 14, wherein, The steps of performing the enhancement operation on the first input data to generate the enhancement result include: in response to the first input data being a system call sequence, randomly masking a portion of the system call sequence to generate the enhancement result; or in response to the first input data being a system call count, randomly masking discontinuous system calls to generate the enhancement result.

16. The non-transitory machine-readable medium as described in claim 14, wherein, The steps of training the machine learning model based on the loss function include: encoding the plurality of first input data respectively to generate a plurality of first features through the machine learning model; encoding the augmentation result to generate a third feature through the machine learning model; and encoding at least one second input data to generate at least one second feature through the machine learning model.

17. The non-transitory machine-readable medium as described in claim 10, wherein, The method also includes: using the trained model to perform detection operations on the front-end APP to generate detection results; and determining the corresponding system strategy based on the detection results, wherein different APP types correspond to different system strategies.

18. The non-transitory machine-readable medium as described in claim 10, wherein, The method also includes: after obtaining the trained model, training the trained model using a multilayer perceptron.

Images