Application program management method, electronic device and computer-readable storage medium

Abstract

The present application relates to the technical field of electronics. Provided are an application program management method, an electronic device and a computer-readable storage medium. The method comprises: acquiring a first illegitimate behavior sequence, the first illegitimate behavior sequence representing first illegitimate behaviors of an illegitimate application; using an on-device AI model to perform risk level identification on the first illegitimate behavior sequence, so as to obtain a target risk level; according to the target risk level, generating a target management and control rule corresponding to the illegitimate application; and performing management and control on the first illegitimate behaviors according to the target management and control rule. The described method can intercept illegitimate behaviors accurately, thus enhancing user experience.

Description

Application management method, electronic device and computer readable storage medium This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on June 30, 2023, with application number 202310801552.1 and application name “Application Management Method, Electronic Device and Computer-readable Storage Medium”, the entire contents of which are incorporated by reference in this application. Technical Field The present application relates to the field of electronic technology, and in particular to an application management method, an electronic device, and a computer-readable storage medium. Background Art In the development of Internet technology, the Internet has never stopped suffering from cyber attacks. As one of the most important Internet devices, the security of computer equipment cannot be ignored. With the development of mobile Internet technology, mobile terminals have gradually replaced personal computers and become one of the most widely used electronic devices. The Internet threats to mobile terminals have gradually shifted from previous virus threats to commercial and gray areas. Attackers no longer use traditional virus attacks, but gradually have a business perspective. The division of attack technology has also become more refined, gradually transforming from previous technical threats to business threats. These business threats make the division of network attack behaviors more vague, and people often cannot directly distinguish whether the generators of these business threats are virus software or normal software. For example, in order to maximize the benefits of advertising business, some applications arbitrarily pop up advertising pop-ups on mobile terminals for network promotion. Although multiple pop-up advertising pop-ups will not cause the mobile terminal to paralyze, it will still seriously affect the user experience. Currently, people usually mark applications that frequently display pop-up ads in advance, and then reduce the number of pop-up ads by prohibiting the pop-up behavior of such marked applications. However, the method of prohibiting pop-up behavior through manual marking cannot timely identify some newly emerging applications. These newly emerging applications will continue to pop up advertising windows before being marked, affecting the user experience. Summary of the invention The present application provides an application management method, device, chip, electronic device, computer-readable storage medium and computer program product, which can intercept illegal behavior in a timely manner and improve user experience. In a first aspect, an application management method is provided, which is applied to a terminal device, and the method includes: obtaining a first illegal behavior sequence, the first illegal behavior sequence representing a first illegal behavior of an illegal application; using an end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level; generating a target control rule corresponding to the illegal application according to the target risk level; and controlling the first illegal behavior according to the target control rule. The terminal device uses the end-side AI model to identify the target risk level of illegal applications corresponding to the first illegal behavior sequence, and then manages the illegal applications according to the target control strategy generated by the target risk level. It can timely identify and control illegal behaviors that occur on the end side. Compared with the traditional method of manually marking illegal applications, there is no need to wait for the results of manual marking, and illegal behaviors can be intercepted in time, thereby improving the user experience. When the client-side AI model is trained and delivered by the cloud testing server, even if some illegal behaviors that have never occurred before occur on the current terminal device and these illegal behaviors have been reported by other terminal devices, Therefore, the terminal devices that currently receive the updated end-side AI model do not need to wait until the illegal behavior occurs and then spend a certain amount of time and resources to identify it themselves. The above method can accurately identify the illegal application through the new end-side AI model and control it in time. This method can achieve the combination of end and cloud, and quickly identify illegal applications when illegal applications are generated too quickly, which has the effect of long-term combating illegal applications. In some possible implementations, the method further includes: controlling a second illegal behavior according to a target control rule, the second illegal behavior is an illegal behavior of an illegal application, and the second illegal behavior is different from the first illegal behavior. The second illegal behavior mentioned above is other illegal behavior generated by illegal applications, which may also interfere with users in some scenarios. Then, after the terminal device identifies the target risk level of the illegal application, the target control strategy obtained based on the target risk level can not only control the first illegal behavior that has already appeared on the terminal device, but also control the second illegal behavior that has not yet appeared on the first terminal device. Therefore, there is no need to wait until the second illegal behavior occurs on the terminal device itself and spend a certain amount of time and resources to identify it by itself. Instead, the target control strategy generated by the identified target risk level can achieve control of the second illegal behavior that has not yet appeared but will affect the user. Therefore, the control of illegal applications is more timely and comprehensive, improving the user experience. In some possible implementations, the target control rules include a target control path set formed by a first control path and a second control path, the first control path is the control path corresponding to the first illegal behavior, and the second control path is the control path corresponding to the second illegal behavior; according to the target risk level, generating target control rules corresponding to illegal applications, including: obtaining multiple control path sets, the multiple control path sets correspond to multiple risk levels, the target risk level is one of the multiple risk levels; determining the target control path set corresponding to the target risk level from the multiple control path sets according to the target risk level. The control path is used as a marker of illegal behavior to achieve the control of illegal applications, which facilitates the systematic management of the control path and improves the control efficiency. In some possible implementations, multiple control path sets include multiple general control path sets and at least one special control path set, the multiple general control path sets correspond to multiple risk levels one-to-one, and each of the at least one special control path set corresponds to the identification of an application; determining a target control path set corresponding to the target risk level from the multiple control path sets according to the target risk level, including: determining a target general control path set corresponding to the target risk level from the multiple general control path sets; determining a target special control path set that matches the identification of an illegal application from at least one special control path set; generating a target control path set based on the target general control path set and the target special control path set. The terminal device first selects a target general control path set from multiple general control path sets corresponding to multiple risk levels according to the target risk level, that is, extracts the common features of applications of the target risk level, and then finds the target special control path set corresponding to the illegal application from at least one special control path set in combination with the illegal application, that is, extracts the individual features of the illegal application, and finally merges the target general control path set and the target special control path set to obtain a target control path set that matches the illegal application. This method combines the common and individual features of the risk level of illegal applications, and can comprehensively and accurately implement the control of illegal applications, further improving the user experience. In some embodiments, the target special control path set includes a target addition control path and / or a target removal control path, the target addition control path represents the illegal behavior of illegal applications that need to be intercepted, and the target removal control path represents the illegal behavior of illegal applications that do not need to be intercepted; based on the target general control path set and the target special control path set, a target control path set is generated, including: adding a target addition control path to the target general control path set, and / or deleting a target removal control path from the target general control path set to obtain a target control path set. Each of the above-mentioned special control path sets may include some control paths of the corresponding application that are different from the general control path set, may include an add control path that needs to be added, and may also include a remove control path that needs to be deleted. Then the target special control path set may include a target add control path and / or a target remove control path. Specifically, the terminal device can add a target addition control path based on the target general control path set, and / or delete a target removal control path from the target general control path set to obtain a final target control path set. This method combines the common and individual characteristics of the risk level of illegal applications, and can fully implement the control of illegal applications. The implementation method is simple and accurate. In some embodiments, multiple general control path sets include multiple fixed general sets and multiple artificial intelligence AI general sets, and the multiple fixed general sets, the multiple AI general sets and the multiple risk levels correspond one to one. The multiple fixed general sets are sets corresponding to the multiple risk levels obtained by fixed rule identification, and the multiple AI general sets are sets corresponding to the multiple risk levels obtained by AI identification; determining a target general control path set corresponding to the target risk level from the multiple general control path sets includes: determining a target general control path set corresponding to both the target risk level and the target identification source from the multiple general control path sets, the target identification source characterizing the identification method of the target risk level is fixed rule identification or AI identification; when the target identification source is fixed rule identification, the target general control path set is a target fixed general set, and the target fixed general set is one of the multiple fixed general sets; when the target identification source is AI identification, the target general control path set is a target AI general set, and the target AI general set is one of the multiple AI general sets. The above-mentioned multiple general control path sets can also be sets corresponding to different identification sources. It should be noted that the identification source can include fixed rule identification and AI identification. Among them, fixed rule identification means that the general control path set is a set corresponding to the risk level identified by using fixed rules; AI identification means that the general control path set is a set corresponding to the risk level identified by using an AI model. For example, when multiple risk levels include high risk, medium risk and low risk, multiple general management and control path sets may include three general management and control path sets of high risk, medium risk and low risk whose identification sources are fixed rules; and / or, three general management and control path sets of high risk, medium risk and low risk whose identification sources are AI. Optionally, fixed rule identification can also include end-side fixed rule identification and cloud-side fixed rule identification; AI identification can include end-side AI identification and cloud-side AI identification. Among them, the end-side fixed rule identification identifies that the universal control path set is a set corresponding to the risk level identified by the fixed rule method on the end side (terminal device side); the cloud-side fixed rule identification identifies that the universal control path set is a set corresponding to the risk level identified by the fixed rule method on the cloud side (cloud-side server); the end-side AI identification indicates that the universal control path set is a set corresponding to the risk level identified by the end-side AI model; the cloud-side AI identification indicates that the universal control path set is a set corresponding to the risk level identified by the cloud-side AI model. Then the target identification source can characterize the identification method of the target risk level as end-side fixed rule identification, end-side AI identification, cloud-side fixed rule identification or cloud-side AI identification. For example, when multiple risk levels include high risk, medium risk and low risk, multiple general management and control path sets may include three general management and control path sets of high risk, medium risk and low risk identified by fixed rules on the end side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by AI on the end side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by fixed rules on the cloud side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by AI on the cloud side. The identification source containing the "end side" identifier indicates that the identification process occurs on the terminal device, and the identification source containing the "cloud side" identifier indicates that the identification process occurs on the cloud side server. The fixed rules or AI models used on the end side and the cloud side may be different. When selecting the target universal control path set, the target universal control path set may also be selected in combination with the identification source, so that the obtained target universal control path set is more accurate, thereby making the control of illegal applications more precise. In some embodiments, an end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: if the identifier of the illegal application corresponding to the first illegal behavior sequence is not in a preset illegal list, the end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level; the preset illegal list includes the identifier of at least one identified application, and the identified application is an application with an identified risk level. In some embodiments, the method further includes: if the identifier of the illegal application corresponding to the first illegal behavior sequence exists in a preset illegal list, determining the risk level of the identifier of the illegal application of the first illegal behavior sequence in the preset illegal list as the target risk level. It should be noted that the cloud-side server may store a preset illegal list of one or more applications with identified risk levels, which may then be sent to the terminal device for use. The terminal device may receive the preset illegal list at idle time. Before identification, the terminal device can first use the end-side AI model to identify the risk level of the first illegal behavior sequence, and can also check whether the illegal application is an application with an identified risk level. If the identifier of the illegal application corresponding to the first illegal behavior sequence is not in the preset illegal list, it means that the risk level of the illegal application has not yet been identified, and the end-side AI model will continue to be used for identification. If the identifier of the illegal application corresponding to the first illegal behavior sequence is in the preset illegal list, it means that the risk level of the illegal application has been identified, and there is no need to use the end-side AI model for repeated identification, which can save system resources and power consumption, and improve identification efficiency. In some embodiments, an end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: using a trigger management module in the end-side AI model to determine whether the first illegal behavior sequence meets the trigger condition; if so, using an identification module in the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level. The terminal device identifies the risk level of the first illegal behavior sequence only when the behavioral characteristics of the first illegal behavior sequence meet the trigger conditions. Obtaining the target risk level can filter out situations that need to be identified, avoid situations that do not need to be identified, reduce invalid identification processes, and thus save system resources and power consumption. In some embodiments, the recognition module in the terminal-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: using the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain a target risk level. The terminal device can identify the first illegal behavior sequence through fixed rule identification and / or AI identification by the identification module to obtain the target risk level, and the implementation method is flexible. In some embodiments, an identification module is used to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain a target risk level, including: using a fixed rule identification submodule in the identification module to perform fixed rule identification on the first illegal behavior sequence to obtain an initial risk level; if the initial risk level is not empty, the initial risk level is determined as the target risk level, and the target identification source is determined to be fixed rule identification; if the initial risk level is empty, the AI ​​identification submodule in the identification module is continued to be used to perform AI identification on the first illegal behavior sequence to obtain a target risk level, and the target identification source is determined to be AI identification. The terminal device can first use fixed rules for identification. If the initial risk level obtained is empty, it means that the fixed rules cannot obtain the identification result. Then continue to use the AI ​​identification submodule for identification to obtain the identification result, which can ensure the recognition rate. If the initial risk level obtained by using fixed rules for identification is not empty, it means that the fixed rules have obtained the identification result, and there is no need to use the AI ​​identification submodule for identification. The efficiency of fixed rules for identification is higher than that of the AI ​​identification submodule. In some embodiments, an identification module is used to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain a target risk level, including: using an identification module to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain an initial risk level; determining the target risk level based on the initial risk level and a virus application list, the virus application list indicating whether the risk level of the application is the highest level. The detailed description of the virus application list can be found in the following text and will not be repeated here. The terminal device combines the initial risk level obtained by its own identification with the known virus application list to correct the identification result and obtain a more accurate target risk level. In some embodiments, multiple risk levels include high risk, medium risk, low risk and no risk. The target risk level is determined based on the initial risk level and the virus application list, including: if there is no identification of illegal applications in the virus application list, the initial risk level is determined to be the target risk level; if there is an identification of illegal applications in the virus blacklist in the virus application list, and the initial risk level is empty, the target risk level is determined to be high risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is empty, the target risk level is determined to be no risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is high risk or medium risk, the target risk level is determined to be medium risk. If the package name of the application is not in the virus application list (empty or NA), the final identification result is based on the identification result of the terminal side. If the virus application list indicates that the application is on the virus blacklist (determined to be a virus), and the preliminary identification result of the illegal application is empty, the final identification result is high risk, that is, it is treated as a virus with the highest risk level. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application on the terminal side is empty, the final identification result is not a virus application, for example, it can be risk-free. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is high risk or medium risk, the final identification result is medium risk. The terminal device reasonably combines the initial risk level obtained by its own identification with the known virus application list, so as to accurately correct the identification result and obtain a more accurate target risk level. In some embodiments, target control rules corresponding to illegal applications are generated according to the target risk level, including: if the target risk level is high risk or low risk, the step of generating target control rules corresponding to illegal applications according to the target risk level is executed; if the target risk level is medium risk, when the first illegal behavior of the illegal application is monitored, the step of generating target control rules corresponding to the illegal application according to the target risk level is executed. If the target risk level of the illegal application is high risk or low risk, the instantiation of the control rules for the illegal application can be directly triggered when the risk level is identified. The description of the instantiation of the control rules can also be found in the description of the aforementioned embodiment, which will not be repeated here. If the target risk level of the illegal application is medium risk, it is still impossible to determine whether the illegal application will really affect the current user at this time. Then, when the first illegal behavior of the illegal application is monitored again, it can be determined that the illegal application is active and will affect the user. Only then is the instantiation of the control rules for the illegal application triggered, which can avoid the instantiation of invalid control rules, thereby saving resources. In some embodiments, obtaining a first illegal behavior sequence includes: collecting a suspected behavior sequence; determining whether the suspected behavior sequence matches a behavior sequence whitelist, the behavior sequence whitelist including behavior sequence identifiers corresponding to M behavior sequences that need to be monitored, where M is a non-negative integer; if so, determining that the suspected behavior sequence is the first illegal behavior sequence; if not, discarding the suspected behavior sequence. When the terminal device monitors the behavior sequence, it will insert the behavior series that need to be monitored. These behavior sequences that need to be monitored are called suspected behavior sequences, which are used to characterize suspected behaviors. After the terminal device collects the suspected behavior sequence, it can be compared with the behavior sequence whitelist. If the suspected behavior sequence matches the behavior sequence whitelist, it means that the suspected behavior sequence needs to be reported and identified. If the suspected behavior sequence does not match the behavior sequence whitelist, it means that the suspected behavior sequence does not need to be reported for identification. Among them, the suspected behavior sequence and the behavior sequence whitelist match, which may be that the identifier of the suspected behavior sequence is in the behavior sequence whitelist; the suspected behavior sequence and the behavior sequence whitelist do not match, which may be that the identifier of the suspected behavior sequence is not in the behavior sequence whitelist. The description of the behavior sequence whitelist and the behavior sequence collector can also be found in the following text. The suspected behavior sequence is the behavior sequence reported to the behavior sequence collector by the logic function module in the following text. The suspected behavior sequence is screened by the behavior sequence collector, and the behavior sequence matching the behavior sequence whitelist is reported and identified as the first illegal behavior sequence. The unmatched ones are directly discarded, which can avoid reporting a large number of invalid behavior sequences, save system resources, and improve data processing efficiency. In some embodiments, before determining whether the suspected behavior sequence matches the behavior sequence whitelist, it also includes: obtaining an initial behavior sequence; determining whether the behavior characteristics of the initial behavior sequence meet the monitoring conditions; if so, adding the behavior sequence identifier of the initial behavior sequence to the behavior sequence whitelist. The method of obtaining the behavior sequence whitelist can also be found in the following text and will not be repeated here. The terminal device adds the behavior sequences that meet the monitoring conditions to the behavior sequence whitelist, and can filter out the behavior sequences that need to be reported based on the behavior characteristics and monitoring conditions of the behavior sequences and generate a behavior sequence whitelist to filter the reported behavior sequences, thereby improving the accuracy of the reported behavior sequences and thus improving the rationality of application management and control. In some embodiments, the monitoring conditions include a combination of one or more of the following conditions: the installation duration of the illegal application corresponding to the initial behavior sequence is less than or equal to a preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a first preset time period exceeds the first preset number threshold; the upgrade duration of the illegal application is less than or equal to the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within the first preset time period exceeds the first preset number threshold; the installation duration and / or upgrade duration of the illegal application is greater than the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a second preset time period exceeds the second preset number threshold; the identifier of the illegal application exists in the list of applications to be monitored, and the device identifier of the terminal device and the identifier of the illegal application are in the list of applications to be monitored The corresponding device identifier matches, the list of monitored applications includes multiple identifiers of monitored applications that need to be monitored, and the list of monitored applications is a list issued by Cloud Measurement; the identifier of the illegal application exists in the identified illegal application blacklist, and there is no corresponding control path for the illegal application, and the identified illegal application blacklist includes at least one illegal application identifier; the identifier of the illegal application exists in the identified illegal application blacklist, and there is no control path corresponding to the initial behavior sequence in the existing control path corresponding to the illegal application; the temperature of the terminal device is lower than the preset temperature threshold, and / or the battery power of the terminal device in the uncharged state is greater than the preset power threshold; wherein the first preset time period is a time period less than one day, and the second preset time period is a time period less than or equal to one day. In the above monitoring conditions, by setting different monitoring conditions for newly installed or newly upgraded applications and applications that have been installed or upgraded for a long time, it is possible to comprehensively and reasonably screen out suspected behaviors that need to be monitored and trigger application monitoring, as well as the list of applications to be monitored and the blacklist of identified illegal applications, which can help quickly and accurately screen out suspected behaviors that need to be monitored. This method avoids invalid monitoring processes and makes the method of triggering application monitoring more reasonable and complete, thereby improving resource utilization. Combining battery power as a monitoring condition can avoid the situation where the battery is too low and the battery is monitored. Suspected behaviors cause excessive power consumption, shorten the standby time, and give priority to ensuring the standby time, thereby improving the user experience; combining temperature as a monitoring condition can avoid the consumption of a small amount of power, and can also avoid the situation where the terminal device is continuously overheated and the device is damaged and the user feels that the experience is not high, such as being hot. In some embodiments, the first illegal behavior is controlled according to the target control rule, including: querying whether the first control path exists in the target control path set; if it exists, intercepting the first illegal behavior; if it does not exist, allowing the first illegal behavior. In some embodiments, the method also includes: querying whether there is a third control path in the target control path set, the third control path is the control path corresponding to the third illegal behavior, the third illegal behavior is the illegal behavior of the illegal application, the third illegal behavior is the same as or different from the first illegal behavior or the second illegal behavior; if it exists, intercepting the third illegal behavior; if it does not exist, allowing the third illegal behavior. When the terminal device is about to initiate an illegal behavior, it can query whether there is a control path corresponding to the illegal behavior in the target control path set. For example, when initiating the third illegal behavior, it can query whether there is a third control path. If it exists, it means that the third illegal behavior needs to be intercepted, so the third illegal behavior can be intercepted directly; if it does not exist, it means that the third illegal behavior does not need to be intercepted, so it can be released and the process of initiating the third illegal behavior can continue, thereby realizing precise control of illegal behaviors. In some embodiments, the method further includes: recording a control record of the illegal behavior, the control record indicating whether the illegal behavior is intercepted; and uploading the control record according to a preset reporting cycle. The preset reporting period can be a fixed period, such as one day, or a fixed state, such as when the terminal device is idle, or when the cloud server needs to report, and the reporting timing can be handled flexibly. The control record here is the record of the control information mentioned above. The specific description of the control information is not repeated here. Before the illegal behavior is initiated, the target control path set is queried, and the corresponding control information will be generated and recorded. After that, the control record can be uploaded to the cloud server, so that the cloud server can modify the various models and lists in the text according to the control record to improve the accuracy. In a second aspect, an application management device is provided, comprising a unit composed of software and / or hardware, wherein the unit is used to execute any one of the methods in the technical solution of the first aspect. In a third aspect, an electronic device is provided, comprising: a processor, a memory and an interface; the processor, the memory and the interface cooperate with each other so that the electronic device executes any one of the methods in the technical solution described in the first aspect. In a fourth aspect, an embodiment of the present application provides a chip, comprising a processor; the processor is used to read and execute a computer program stored in a memory to execute any one of the methods in the technical solution described in the first aspect. Optionally, the chip also includes a memory, and the memory is connected to the processor via a circuit or wire. Further optionally, the chip also includes a communication interface. In a fifth aspect, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the processor executes any one of the methods in the technical solution described in the first aspect. In a sixth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on an electronic device, the electronic device executes any one of the methods in the technical solution described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a schematic diagram of the structure of a terminal device 100 provided in an embodiment of the present application; FIG2 is a software structure block diagram of the terminal device 100 provided in an embodiment of the present application; 3 is a schematic diagram of a functional deployment example of a terminal-cloud combination to implement application management provided by an embodiment of the present application; FIG4 is a schematic diagram of a reporting process of an illegal behavior sequence provided in an embodiment of the present application; FIG5 is a schematic diagram of an interface of a risk management and control center provided in an embodiment of the present application; FIG6 is a schematic diagram of a risk details interface of a risk management and control center provided in an embodiment of the present application; 7 is a flowchart of an application management method provided in an embodiment of the present application; FIG8 is a flowchart of another application management method provided in an embodiment of the present application; 9 is a flowchart of another application management method provided in an embodiment of the present application; 10 is a flowchart of another application management method provided in an embodiment of the present application; 11 is a flowchart of another application management method provided in an embodiment of the present application; FIG12 is a schematic diagram of the architecture of another application management method provided in an embodiment of the present application; 13 is a flowchart of an application management method provided in an embodiment of the present application; FIG. 14 is a schematic diagram of the structure of an application management device provided in an embodiment of the present application. DETAILED DESCRIPTION The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two. In the following, the terms "first", "second", and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", and "third" may explicitly or implicitly include one or more of the features. In the development of Internet technology, the Internet has never stopped suffering from cyber attacks. As one of the most important Internet devices, the security of computer equipment cannot be ignored. With the development of mobile Internet technology, mobile terminals have gradually replaced personal computers and become one of the most widely used electronic devices. The Internet threats to mobile terminals have gradually shifted from previous virus threats to commercial and gray areas. Attackers no longer use traditional virus attacks, but gradually have a business perspective. The division of attack technology has also become more refined, gradually transforming from previous technical threats to business threats. These business threats make the division of network attack behaviors more vague, and people often cannot directly distinguish whether the generators of these business threats are virus software or normal software. For example, in order to maximize the benefits of advertising business, some applications arbitrarily pop up advertising pop-ups on mobile terminal devices for network promotion. Although multiple pop-up advertising pop-ups will not affect the security of mobile terminals, they will still seriously affect the user experience. Such behaviors of popping up advertising pop-ups, keeping alive in the background, or starting up automatically with the system when the user does not expect them can be called illegal behaviors. At present, people usually mark applications that often have illegal behaviors such as pop-up ads, background keep-alive or self-start as illegal applications, and then summarize the application identifiers marked as illegal applications to obtain a blacklist of illegal applications, which can then be sent to each mobile terminal through version updates and other methods. When a mobile terminal runs an application, it can be queried whether the running application exists in this blacklist. If the identifier of the application running on the mobile terminal exists in the blacklist, control can be achieved by prohibiting illegal behaviors of such illegal applications, such as prohibiting pop-up ads, prohibiting background keep-alive or prohibiting self-start. However, the control method of manually marking illegal applications will result in some newly-generated illegal applications being installed on mobile terminals before the blacklist is updated in time. In this case, the illegal applications cannot be identified in time and illegal behaviors will continue to occur, thus affecting the user experience. In the application management method provided in the present application, the terminal device monitors illegal behaviors that are not expected by the user on the terminal device, and uses the local artificial intelligence (AI) model of the terminal device to identify the behavior sequence of illegal behaviors, thereby identifying the risk level corresponding to the illegal application that has committed illegal behaviors, and then selects the control strategy that matches the risk level to implement the control of the illegal application. This method can timely identify illegal applications that have committed illegal behaviors locally through the AI ​​model, without waiting for the blacklist of illegal applications issued by the server, so it can avoid the omission of illegal applications due to untimely acquisition or update of the blacklist. In the case of timely identification of illegal applications, the terminal device can timely implement the corresponding control strategy according to the risk level corresponding to the illegal application, thereby improving the timeliness of illegal application control and thus improving the user experience. It should be noted that the terminal device in the present application can be the mobile terminal mentioned above. The application management method provided in the embodiment of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiment of the present application does not impose any restrictions on the specific type of terminal devices. Exemplarily, Fig. 1 is a schematic diagram of the structure of an example terminal device 100 provided in an embodiment of the present application. The terminal device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc. It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware. The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors. The controller may be the nerve center and command center of the terminal device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions. The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system. In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc. The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the terminal device 100. The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset. The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication. The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset. The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the terminal device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the terminal device 100. The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc. The USB interface 130 is an interface that complies with the USB standard specification, and specifically can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the terminal device 100, and can also be used to transmit data between the terminal device 100 and peripheral devices. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc. It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods. The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the terminal device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141. The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device. The wireless communication function of the terminal device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. The structures of antenna 1 and antenna 2 in FIG. 1 are only an example. Each antenna in terminal device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna of a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch. The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the terminal device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110. The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be arranged in the same device as the mobile communication module 150 or other functional modules. The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the terminal device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2. In some embodiments, the antenna 1 of the terminal device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the terminal device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-CDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS). The terminal device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change display information. The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1. The terminal device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor. ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193. The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the terminal device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1. The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the terminal device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy. Video codecs are used to compress or decompress digital videos. The terminal device 100 may support one or more video codecs. Thus, the terminal device 100 may play or record videos in various coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc. NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of the terminal device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc. The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card. The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the terminal device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area can store data created during the use of the terminal device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The terminal device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor. The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110. The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The terminal device 100 can listen to music or listen to a hands-free call through the speaker 170A. The receiver 170B, also called a "handset", is used to convert audio electrical signals into sound signals. When the terminal device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the ear. Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to the microphone 170C to input the sound signal into the microphone 170C. The terminal device 100 can be provided with at least one microphone 170C. In other embodiments, the terminal device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the terminal device 100 can also be provided with three, four or more microphones 170C to realize the collection of sound signals, noise reduction, identification of sound sources, realization of directional recording function, etc. The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface. The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The terminal device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the terminal device 100 detects the touch operation intensity according to the pressure sensor 180A. The terminal device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed. The gyroscope sensor 180B can be used to determine the motion posture of the terminal device 100. In some embodiments, the angular velocity of the terminal device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 180B. The gyroscope sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 180B detects the angle of the terminal device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the terminal device 100 through reverse movement to achieve anti-shake. The gyroscope sensor 180B can also be used for navigation and somatosensory game scenes. The air pressure sensor 180C is used to measure air pressure. In some embodiments, the terminal device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation. The magnetic sensor 180D includes a Hall sensor. The terminal device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the terminal device 100 is a flip phone, the terminal device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover automatic unlocking and other features are set. The acceleration sensor 180E can detect the magnitude of the acceleration of the terminal device 100 in various directions (generally three axes). When the terminal device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device and applied to applications such as horizontal and vertical screen switching and pedometers. The distance sensor 180F is used to measure the distance. The terminal device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the terminal device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing. The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The terminal device 100 emits infrared light outward through the light emitting diode. The terminal device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal device 100. When insufficient reflected light is detected, the terminal device 100 can determine that there is no object near the terminal device 100. The terminal device 100 can use the proximity light sensor 180G to detect that the user holds the terminal device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode, and pocket mode automatically unlocks and locks the screen. The ambient light sensor 180L is used to sense the ambient light brightness. The terminal device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the terminal device 100 is in a pocket to prevent accidental touch. The fingerprint sensor 180H is used to collect fingerprints. The terminal device 100 can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc. The temperature sensor 180J is used to detect temperature. In some embodiments, the terminal device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the terminal device 100 reduces the performance of the processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 heats the battery 142 to avoid abnormal shutdown of the terminal device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature. The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the terminal device 100, which is different from the position of the display screen 194. The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a vibrating bone block of the vocal part of the human body. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure beat signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vibrating bone block of the vocal part obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M to realize a heart rate detection function. The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The terminal device 100 may receive key input and generate key signal input related to user settings and function control of the terminal device 100. Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization. Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc. The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the terminal device 100 by inserting the SIM card interface 195 or pulling it out from the SIM card interface 195. The terminal device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The terminal device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the terminal device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the terminal device 100 and cannot be separated from the terminal device 100. The software system of the terminal device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. The present application embodiment takes the Android system of the layered architecture as an example to exemplify the software structure of the terminal device 100. Fig. 2 is a software structure diagram of the terminal device 100 of the embodiment of the present application. The layered architecture divides the software into several layers, each layer has a clear role and division of labor. The layers communicate through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom, respectively, the application layer, the application framework layer (Framework layer, FWK), the Android runtime (Android runtime) and the system library, and the kernel layer. The application layer can include a series of application packages. As shown in FIG2 , the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. The application package may also include a system manager, which is used to schedule and manage the system. The application layer may also include an illegal application identification engine for identifying illegal applications. The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions. As shown in Figure 2, the application framework layer may include a window manager (Window Manager Service, WMS), a content provider, a view system, a phone manager, a resource manager, a notification manager (Notification), an activity manager (Activity Manager Service, AMS), a package manager (Package Manager Service, PMS), a power consumption manager (iAware), a behavior sequence collector (Behavior Collect Manager) and a control manager (Add View Manager), etc. The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc. Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc. The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images. The phone manager is used to provide communication functions of the terminal device 100, such as management of call status (including connection, disconnection, etc.). The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on. The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, the terminal device vibrates, the indicator light flashes, etc. The activity manager coordinates the management of the four major components of the system and centrally schedules each application process. The power consumption manager is used to schedule and manage the power consumption of the whole machine to ensure the performance of the whole machine. The package manager is used to manage the information of applications installed by the system, and to query the information of each installation package and the information of applications with hidden icons. The behavior sequence collector is used to collect the behavior sequences of logical function modules such as WMS, AMS, PMS, Notification and iAware, and report the behavior sequences that need to be reported to the system manager of the application layer. The control manager can cache control rules and provide an interface to query control rules. Android runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system. The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library. The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection. The system library may include multiple functional modules, such as surface manager, media libraries, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc. The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications. The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc. The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing. A 2D graphics engine is a drawing engine for 2D drawings. The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver. For ease of understanding, the following embodiments of the present application will take a terminal device having the structure shown in FIG. 1 and FIG. 2 as an example. In combination with the accompanying drawings and application scenarios, the application management method provided in the embodiment of the present application is specifically explained. In order to clearly describe the technical solution of the present application, illegal acts, illegal applications and other related concepts are explained here. Illegal behavior (also called abnormal behavior) refers to some behaviors that are not expected by users on terminal devices, such as pop-up advertisements on the interface of third-party applications, pop-up advertisements on the desktop, pop-up advertisements on the lock screen interface, application icons are transparent, application icons are hidden, application lock screen is disabled, third-party applications use system capabilities to achieve self-startup, third-party applications are pulled up again when running (not on the desktop), impersonating system applications, impersonating system contact data providers, setting for barrier-free startup, etc. The above illegal behaviors can be expressed in illegal behavior sequences. Applications that exhibit the above illegal behaviors may be called illegal applications (for simplicity, they are all referred to as illegal applications in the following text, and may also be referred to as abnormal applications). Generally, marking illegal applications may include recording the identifier of the illegal application, such as recording the package name of the illegal application. Control path: Each control path corresponds to an illegal behavior. The terminal device can implement control over various illegal behaviors by managing multiple control paths. For example, if an illegal behavior needs to be intercepted or released (not intercepted), it can be achieved by defining interception or non-interception for the control path corresponding to the illegal behavior. Optionally, the control path can be represented by a control path identifier. For example, the control path identifiers of multiple control paths can be named using non-repeating positive integers. The control rule is used to describe the way to control the behavior of illegal applications, that is, which illegal behaviors of the illegal application need to be intercepted. The control rule can be expressed by the control path set corresponding to the illegal application, and the control path set includes multiple control paths corresponding to the illegal behaviors that need to be intercepted. The control information is information generated based on the results of the control rule query. When the logical function module needs to execute an illegal behavior, it first queries the control manager to see whether the control path corresponding to the illegal behavior exists. Regardless of whether it exists, the control information corresponding to the illegal behavior will be generated. The control information may include the identifier of the illegal application corresponding to the illegal behavior (such as the package name), the control path corresponding to the illegal behavior, and the control result obtained by the query. Among them, the control results include interception or non-interception. If it is found, it means that control is required, and the control result is interception. If it is not found, it means that control is not required, and the control result is non-interception. Control rule instantiation is the process of generating control rules corresponding to an application, that is, the process of obtaining a control path set consisting of control paths that need to be controlled corresponding to the application. The result of control rule instantiation is a control path set corresponding to the generated application, which includes control paths corresponding to the behaviors that need to be intercepted. For ease of understanding, the functional deployment of the technical solution of this application is first introduced, as shown in Figure 3, the technical solution can be deployed on the cloud side and the terminal side, and the terminal and cloud are combined to achieve the management of illegal applications. The cloud side is the cloud side server, and the terminal side is the terminal device. Among them, the cloud-side server can be set: The big data analysis platform, which can also be called a dot database, is an example of the Hiview big data platform. The big data analysis platform can count the interception results, such as the number of successful interceptions and failed interceptions of illegal applications, and analyze the interception results to evaluate the interception success rate. Security cloud platform: used to collect statistics on various behavior sequences reported by the end side, generate behavior sequence distribution rules for summarizing, formatting, distributing and filtering behavior sequences, and then send them to the system manager on the end side; it can also generate a preset illegal list based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, or the smart cloud platform can send the black and white lists of illegal applications and combine them with manual corrections to generate the final preset illegal list for storage, and finally send the final preset illegal list to the end side; it can also generate control rules for each illegal application based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, and store them on the security cloud platform. After that, the configuration file containing the control rules can be sent to the system manager on the end side to implement control. The security cloud platform extracts rules based on group data reported by multiple terminal devices, generates rules quickly, takes effect quickly, and has high accuracy. Optionally, the security cloud platform can send the generated various rules and lists to the terminal side at an appropriate time, such as sending them regularly every day, or sending them when the terminal device is charging, connected to Wi-Fi, or idle. Smart cloud platform: includes decision-making middle platform and machine learning platform. The machine learning platform is used to summarize various illegal behavior sequences reported from the end side, obtain training samples after calibration, and then perform feature calculation on these training samples to train the model, obtain a trained AI model, and use the AI ​​model for inference and prediction to verify the accuracy of the AI ​​model. It should be noted that the machine learning platform can train two types of AI models, one is the AI ​​model applied to cloud testing, called the cloud testing AI model, and the other is applied to the end side, called the end side AI model. The above-mentioned cloud test AI model is a group recognition model. The input data may include multiple behavior sequences reported by multiple terminal devices of multiple users. Then, more complete features can be identified during the recognition process, so the recognition result is more accurate. The cloud test AI model can be expressed as a decision-making middle platform of the cloud test, which can be used to determine whether to trigger management based on the input behavior sequence. If the triggering conditions of the trigger management are met (for example, a timed trigger), the input behavior sequence can be feature analyzed to identify risks and obtain risk identification results. The risk identification result can be the package name and corresponding risk level of the identified illegal application. Then the cloud test AI model manages and distributes the risk identification results. The cloud test AI model can identify illegal applications after the cloud test implementation (after the illegal behavior is implemented on the end side) and generate a black and white list of illegal applications. Optionally, the black and white list of illegal applications generated by the smart cloud platform can be transmitted to the security cloud platform and used as a preset illegal list, or it can be used as a preset illegal application list after manual correction. The input data of the above-mentioned end-side AI model is the behavior sequence of a single terminal device, and the recognition result obtained is the recognition result corresponding to the behavior sequence of a single terminal device. It should be noted that the smart cloud platform can also send the trained end-side AI model to the end side through the network, which can be sent to multiple terminal devices for local identification of illegal applications by the terminal devices. The smart cloud platform can also correct and optimize the generated end-side AI model based on the continuously reported behavior data to make the end-side AI model more accurate. When the continuously corrected end-side AI model is sent to the end side, the accuracy of the recognition result can be improved, and it can adapt to the evolution of illegal applications, so as to achieve the effect of continuously combating illegal applications. In comparison, the cloud-based AI model is trained by combining training samples from multiple terminal devices, so its recognition accuracy is higher than that of the end-side AI model. The end-side AI model can identify illegal behavior sequences locally on the terminal device, which is faster and consumes less power than the cloud-based AI model. The above-mentioned big data analysis platform, smart cloud platform, and security cloud platform can be set up on different cloud-side servers respectively, or on the same cloud-side server, which is not limited to this embodiment of the present application. The end-side can include multiple end-devices, which can share various rules, lists, and identification results of cloud testing. Taking one of the end-devices as an example, the application layer of the end-device can install a system manager and set up an end-side identification engine. The system manager and end-side identification engine can provide a set of security services for local rapid identification and timely control of illegal applications. The terminal recognition engine can be a terminal AI model issued by the smart cloud platform. The system framework layer of the terminal device includes multiple logical function modules, such as AMS, WMS, PMS, Notification and iAware. For the introduction of each logical function module, please refer to the previous article and will not be repeated here. The system framework layer is also equipped with a behavior sequence collector (IHnBehaviorCollectManager), which can collect the behavior sequences reported by each logical function module. The collected behavior sequences can include dynamic behavior sequences that characterize dynamic behaviors and static behavior sequences that characterize static features. The behavior sequence collector can also report the collected behavior sequences to the system manager at the application layer, which will be recognized by the AI ​​model on the input side of the system manager. After receiving the behavior sequence reported by the system framework layer, the system manager can first aggregate, format, filter and distribute the data according to the behavior sequence distribution rules issued by the security cloud platform, and filter out the behavior sequences that do not need to be identified. The filtered behavior sequences that need to be identified are then formatted according to the needs of data transmission and input into the end-side AI model (that is, the local AI model of the terminal device) for identification. Optionally, formatting the transmitted data is not a necessary step, but a data processing step to achieve smooth data transmission. It can be understood that in the subsequent evolution of the data format, if the entire process can be executed using a normalized data format, then the step of formatting the transmitted data can be omitted. The end-side AI model can include a decision-making middle platform, a computing engine base, and a data middle platform. The data center of the end-side AI model is used to manage input and output data, such as caching input behavior sequences, storing recognition results, and distributing input and output data. The computing engine foundation is used to manage and infer the AI ​​model on the client side. Model inference is also the process of inference prediction, that is, outputting the inference result based on the input behavior sequence. The decision-making center in the end-side AI model can be used to determine whether to trigger reasoning based on system events when inputting a behavior sequence. If the triggering conditions for triggering reasoning are met, such as an application popping up more than three times in a short period of time, or a timed trigger, the input behavior sequence can be feature analyzed, that is, the input computing engine is used to perform model reasoning, and then specific risk identification results are obtained based on the reasoning results output by the computing engine. Finally, the decision-making center manages or distributes the risk identification results (for example, sending them to the system manager for management, and reporting to the smart cloud platform). The risk identification results of the decision-making platform in the end-side AI model can also be integrated with the preset illegal list downloaded from the security cloud platform in the system manager to output the final risk identification results. The risk identification results can include the package name of the illegal application and the corresponding risk level. The system manager can also parse the configuration files of the control rules issued by the security cloud platform to instantiate the control rules, which are then sent to the control manager at the application framework layer to implement control. When the logic function module needs to execute an illegal behavior, it can query the control path corresponding to the illegal behavior in the control manager. Among them, the control manager is used to cache the control rules of each illegal application that needs to be controlled, and provide an interface for the logic function module to query. If the control path corresponding to the illegal behavior that needs to be executed exists in the package control list of the control manager, it means that the illegal behavior needs to be controlled, and the logic function module does not execute the subsequent process of the illegal behavior. In terms of pop-up behavior, no pop-up window will appear. If the control path corresponding to the illegal behavior that needs to be executed is not in the package control list of the control manager, it means that the illegal behavior does not need to be controlled, and the logic function module continues to execute the illegal behavior. In terms of pop-up behavior, the pop-up window will continue to appear. The system manager can also obtain the list of viruses detected by the virus detection engine. When illegal behavior occurs, it first determines whether the illegal behavior is the behavior of the virus application. If it is, it directly executes the control strategy corresponding to the virus application. If not, the behavior sequence of the illegal behavior is input into the end-side AI model for identification. The illegal application control process described in the embodiment of the present application may include the following processes: triggering the collection of illegal behavior sequences, distributing illegal behavior sequences, triggering and identifying risk levels, and illegal application control. 1. Trigger the collection of illegal behavior sequences: When the logic function module executes a behavior (action), it will output a behavior sequence representing the behavior to complete the execution of the action. The behavior sequence collector can collect the behavior sequence and cache it. In an embodiment of the present application, the behavior sequence collector can be a container of a process, which is set at the application framework layer, as shown in Figures 2 and 3. The behavior sequence collector can cache the behavior sequences reported by each logical function module. Specifically, the behavior sequence collector can build a buffer queue of a preset length, such as a buffer queue with a preset length of 256, to store the reported behavior sequences. When the buffer queue is not full, the behavior sequence collector can cache the behavior sequences reported by each logical function module, and the behavior sequences that overflow the buffer queue can be directly discarded. Usually, logical function modules such as AMS, WMS, PMS, Notification and iAware do not need to perceive whether the behavior sequences reported by themselves need to be reported to the system manager of the application layer, but directly call the behavior sequence interface (sendBehavior) to obtain the behavior sequence of the behavior (action) to be executed, and add it to the buffer queue (ConcurrentLinkedQueue) of the behavior sequence collector, and return immediately. The above-mentioned behavior sequence can carry parameters such as the package name (pkg) of the behavior sequence, the behavior sequence identifier (bid) and the content (bundle) of the behavior sequence. Usually, the behavior sequence collector can also store the behavior sequence whitelist issued by the system manager, and the behavior sequence whitelist includes multiple behavior sequences that need to be monitored. For example, the behavior sequences that need to be monitored may include but are not limited to one or more of the following: pop-up advertising pop-ups on the interface of third-party applications, pop-up advertising pop-ups on the desktop, pop-up advertising pop-ups on the lock screen interface, the application setting icon transparency, the application setting icon hiding, the application setting lock screen disabled, the third-party application using system capabilities to achieve self-startup, the third-party application is pulled up again when running (not pulled up on the desktop), impersonating system applications, impersonating system contact data providers, setting for barrier-free startup, etc. The behavior sequence corresponding to the behavior. Each behavior sequence in the behavior sequence whitelist can also carry the corresponding package name (pkg) and / or behavior sequence identifier (bid), so the behavior sequence whitelist can be a table (bid list) including behavior sequence identifiers of multiple behavior sequences that need to be monitored. The number of behavior sequences in the above-mentioned behavior sequence whitelist can be one or more. Each behavior sequence carries its own package name, each package name represents an illegal application that needs to be monitored, and each package name can correspond to one or more behavior sequence identifiers. Each behavior sequence identifier can represent the illegal behavior that can be performed by the illegal application of the corresponding package name, and each illegal behavior can be described by a behavior parameter. The behavior parameters include but are not limited to: startup path, startup terminal name, timestamp and other information. Specifically, the behavior sequence collector can compare the behavior sequence reported by the logic function module with the behavior sequence whitelist. If the behavior sequence reported by the logic function module is in the behavior sequence whitelist, it means that the behavior sequence is an illegal behavior sequence that needs to be collected, that is, it is necessary to start monitoring the behavior sequence, then the behavior sequence collector can report the behavior sequence to the system manager. If the behavior sequence reported by the logic function module is not in the behavior sequence whitelist, it means that the behavior sequence is not an illegal behavior sequence at present, or it is an illegal behavior sequence that has not yet been identified. It does not need to be collected temporarily, and no attention is required, that is, there is no need to start monitoring the behavior sequence. The behavior sequence collector can directly discard the behavior sequence and no longer report it, and it will not trigger the monitoring process for illegal behavior sequences. This can avoid reporting invalid behavior sequences and avoid wasting resources. Exemplary: The behavior sequence whitelist may include the package name: pkg1, and the package name of pkg1 corresponds to the behavior sequence identifiers bid: 1, bid: 2, bid: 3. Among them, bid: 1, bid: 2, bid: 3 respectively represent the three behaviors of attempting background pop-ups on the lock screen interface, background pop-ups on the desktop, and attempting background pop-ups on other third-party applications. Each behavior is described by the corresponding behavior parameters. If the behavior sequence reported by WMS includes: pkg1, bid: 1, and the behavior parameters of the behavior of attempting background pop-ups on the lock screen interface, and the behavior sequence is a behavior sequence that exists in the behavior sequence whitelist, it means that the behavior sequence is an illegal behavior sequence that needs to be reported. The behavior sequence collector can then report the illegal behavior sequence of pkg1, bid: 1, and the behavior parameters of the behavior of attempting background pop-ups on the lock screen interface to the system manager. Optionally, before reporting the illegal behavior sequence, the behavior sequence collector may format the illegal behavior sequence and then report it to meet the demand of data transmission. Optionally, the above-mentioned behavior sequence whitelist can be a configuration file including illegal behavior sequences that need to be monitored sent by the security cloud platform to the system manager on the terminal side, which is parsed by the system manager and then sent to the behavior sequence collector of the application framework layer for screening; optionally, the behavior sequence whitelist can also be pre-set in the system manager of the terminal device, parsed and then sent to the behavior sequence collector of the application framework layer, and subsequently regularly updated according to the configuration file of illegal behavior sequences that need to be monitored sent by the security cloud platform to ensure the accuracy of illegal behavior sequence reporting. The embodiments of the present application are not limited to this. Optionally, when there is no behavior sequence whitelist in the behavior sequence collector, for example, when the terminal device is newly turned on or restored to factory settings, the system manager has not received the configuration file of illegal behavior sequences that need to be monitored issued by the security cloud platform, resulting in the lack of a behavior sequence whitelist in the behavior sequence collector. The behavior sequence collector can discard all behavior sequences and all system events reported by all logical function modules to save system resources and power consumption. Optionally, if the behavior sequence collector does not have a behavior sequence whitelist, the terminal device can count and filter the behavior sequences of the application through the system manager, obtain the behavior sequences that need to be monitored, and generate a behavior sequence whitelist. Optionally, if the behavior sequence collector already has a behavior sequence whitelist, the system manager can also count and filter the behavior of the application, obtain the behavior sequences that need to be monitored and the behavior sequences that do not need to be monitored, and use this to update the existing behavior sequence whitelist, such as adding new behavior sequences that need to be monitored to the behavior sequence whitelist, or deleting behavior sequences that do not need to be monitored in the behavior sequence whitelist, so as to achieve dynamic update of the behavior sequence whitelist, so that the illegal behavior sequences reported by the behavior sequence collector are more accurate and reasonable, avoiding the waste of resources caused by monitoring too many behavior sequences, and avoiding the missed monitoring caused by monitoring too few behavior sequences, thereby balancing resource allocation and user experience. From the perspective of the entire process of application management, taking the execution of pop-up behavior as an example, the control process for illegal applications can specifically include: when the logical function module needs to execute a pop-up behavior, the WMS first queries the control manager to see whether there is a control path corresponding to the behavior sequence of the pop-up behavior. If the control path corresponding to the pop-up behavior already exists in the control manager, it means that the pop-up behavior has been controlled, and the behavior sequence corresponding to the pop-up behavior does not need to be reported to the system manager, and there is no need to start monitoring the pop-up behavior, so as to avoid waste of resources caused by invalid monitoring. WMS can directly control according to the queried control rules. At this time, regardless of whether the pop-up behavior is intercepted or not, the control information corresponding to this query will be generated and recorded, and then uploaded to the system manager. Optionally, the control information may include: the package name of the application of the pop-up behavior, the control path and control result of the pop-up behavior (the control result of the pop-up behavior can be controlled, intercepted, or not intercepted or not controlled). Among them, the control path is the control method of the behavior sequence, and each control path can correspond to a behavior sequence. The control path is described in detail below, which will not be repeated here. If there is no control path for the pop-up behavior in the control manager, such as when the terminal device is newly turned on or has just been restored to factory settings, it means that the corresponding control rules have not yet been instantiated for the pop-up behavior. In other words, when WMS queries the behavior sequence of the pop-up behavior in the control manager and there is no corresponding control path, WMS will still execute the pop-up behavior as usual. Optionally, the control information of the pop-up behavior can also be recorded by the control manager and then uploaded to the system manager. For example, the control information at this time may include, but is not limited to: the package name of the application of the pop-up behavior, the control path of the pop-up behavior, and the control result (the control result of the pop-up behavior is not controlled or not intercepted). Optionally, the control information of the above pop-up behavior can be uploaded to the system manager in real time, or the accumulated control information of various behaviors can be uploaded uniformly at certain intervals, such as once a day or once every hour. Before the control information is uploaded to the system manager, the control information of various behavior sequences is stored by the control manager. After uploading, the control manager can clear the uploaded control information to free up space. When the system manager receives the control information uploaded by the control manager, including the control information that is not controlled or intercepted, it can filter the illegal behaviors that need to be monitored according to the preset monitoring conditions, and then generate a behavior sequence whitelist for the screened illegal behavior sequences that need to be controlled and send it to the behavior sequence collector. Afterwards, the behavior sequence collector can filter the illegal behavior sequences that need to be reported according to the behavior sequence whitelist, thereby triggering the monitoring process. Optionally, the control manager can also report the control information obtained when querying the above-mentioned various behavior sequences to the management database through the system manager, that is, the big data analysis platform (such as Hiview). The big data analysis platform can perform statistical results and analysis based on the control information of the various behavior sequences reported. For example, the big data analysis platform counts the number of interceptions and / or non-interceptions of each reported behavior sequence, and obtains the effect analysis results of successful and failed interceptions. Optionally, the effect analysis results can be used to adjust the control strategy. Among them, the control strategy is used to describe which behaviors of the application are intercepted and which behaviors are not intercepted. Next, the above monitoring conditions are explained: when the behavior characteristics of illegal behaviors reach the degree of control set by the system manager, it means that the illegal behavior sequence meets the monitoring conditions, and it is determined that the illegal behavior sequence needs to be added to the behavior sequence whitelist. Taking the monitoring condition that the number of pop-up windows of a newly installed application (newly installed application) exceeds five times within one hour as an example, when the system manager queries the control information of the control manager, it is found that there is a newly installed application pkg3 installed within three days. The newly installed application pkg3 has five pop-up windows within one hour (for example, corresponding to bid: 1), then it is determined that the pop-up behavior of the newly installed application meets the monitoring conditions, so the system manager can add the package name of the illegal behavior sequence and the behavior sequence identifier corresponding to the package name (for example, the serial number of the bid) to the behavior sequence whitelist, for example, the package name pkg3 corresponding to the pop-up behavior and the bid: 1 of the pop-up behavior are added to the behavior sequence whitelist, and optionally, the behavior parameters of the pop-up window can also be added to the behavior sequence whitelist. Afterwards, the system manager can send the behavior sequence whitelist to the behavior sequence collector. Optionally, taking the illegal behavior as a pop-up behavior as an example, the above monitoring conditions may also include but are not limited to: a. The number of pop-up windows exceeds the preset number within the preset time period. For example, the number of pop-up windows exceeds ten times within one hour; if an application has more than twelve pop-up windows within one hour, it means that the monitoring conditions are met, and the behavior sequence and corresponding package name of the pop-up behavior can be added to the behavior sequence whitelist. b. The number of pop-up windows of a newly installed application exceeds the preset number within the preset period after installation. For example, the application framework layer reports to the system manager that the package name of the newly installed application is pkg2. Within three days after installation, if the pop-up sequence with the package name pkg2 appears more than five times per hour, the behavior sequence identifier of pkg2 and the corresponding pop-up behavior will be updated to the behavior sequence whitelist, and the behavior sequence corresponding to the pop-up behavior executed by pkg2 will be reported by the behavior sequence collector to the system manager for monitoring. c. The number of pop-up windows of the newly upgraded application (newly upgraded application) exceeds the preset number within the preset period after the upgrade. For example, the application framework layer reports the registration of the newly upgraded application as pkg3 to the system manager. Within three days after the upgrade, if the pop-up sequence with the package name pkg3 appears more than five times per hour, then the behavior sequence of pkg3 and the corresponding pop-up behavior will be updated to the behavior sequence whitelist, and the behavior sequence corresponding to the pop-up behavior executed by pkg3 will be reported to the system manager by the behavior sequence collector. Optionally, when a newly installed application or a newly upgraded application has been monitored for three days, there may be two monitoring results for the application: one is that there is no illegal behavior and it will not affect user use; the other is that the corresponding control policy has been identified through three days of monitoring and can be directly controlled according to the control policy without monitoring. At this time, the system manager can delete the behavior sequence related to the package name of the application in the behavior sequence whitelist and no longer report the related behavior sequence of the application, thereby saving system resources. Optionally, taking the illegal behavior as pop-up behavior as an example, if a newly installed application or a newly upgraded application is monitored for three days and no illegal behavior that needs to be monitored is found, the system manager can reduce the frequency of reporting illegal behavior sequences. If the monitoring frequency of a newly installed application or a newly upgraded application within three days is to monitor the number of pop-up windows once an hour, then after three days, the number of pop-up windows can be changed to monitor once a day. During the daily monitoring process, if the pop-up window of the application is found to be active again, for example, more than ten pop-ups appear in one day, then high-frequency monitoring can be restarted. For example, the number of pop-ups can be monitored once an hour in the next three days. If the number of pop-ups within one hour meets the monitoring conditions, for example, more than five pop-ups appear within one hour, monitoring of the pop-up behavior can be started to avoid missing monitoring. Optionally, if there are some special marked risky applications, the system manager can also parse the configuration information sent by the security cloud to obtain the application identification of the marked risky application. When scanning the system applications and finding that the marked risky application is installed, the monitoring process of the application can be forcibly started for three days to avoid missed monitoring. Optionally, the system manager can also re-screen the behavior sequences that need to be monitored based on the behavior characteristics of illegal behaviors and in combination with some system events. Among them, system events can be obtained by monitoring events in the application framework layer. Taking the temperature of the terminal device and / or the power in the uncharged state as an example of a system event, the above monitoring conditions can also include the temperature being at a low temperature level on the basis that the behavior characteristics of the illegal behavior meet the requirements. For example, the temperature level of the terminal device can also be divided into level 3, level 2 and level 1 from high to low. Among them, the temperature range covered by level 3 is 60 degrees (inclusive) to 30 degrees (exclusive); level 2 is second, and the temperature range covered is 30 degrees (exclusive) to 20 degrees (inclusive); level 1 is the lowest temperature level, covering a temperature range of 20 degrees (exclusive) to -20 degrees (inclusive). Then if the temperature of the terminal device is at level 2 or below, it can be considered that triggering the monitoring process will not cause the terminal device to overheat. If the number of pop-up windows meets five times, it can be determined that the monitoring process needs to be started, that is, the illegal behavior sequence is added to the behavior sequence whitelist. Optionally, whether the terminal device starts monitoring can also be screened according to the temperature level of the terminal device as shown in Table 1. For example, the temperature level of the terminal device can be as shown in Table 1 below: Table 1 The entry temperature indicates the temperature threshold for entering the temperature level during the heating process, and the fallback temperature indicates the temperature threshold for exiting the temperature level during the cooling process. For example, when the temperature level of the terminal device is 2 or below, it can be considered that triggering the monitoring process will not cause the terminal device to overheat, so it can be determined that the monitoring process needs to be started, and the illegal behavior sequence is added to the behavior sequence whitelist. Optionally, the above monitoring conditions may also include that charging is disconnected and the power is greater than a preset power upper limit threshold value, based on the fact that the behavioral characteristics of the illegal behavior meet the requirements. For example, when the terminal device is not charging (charging is disconnected) and the power is too low, for example, the power is 20%, then the power consumed by the monitoring process will accelerate the power consumption of the entire terminal device, resulting in a shortened standby time. Therefore, setting the monitoring process to start when charging is disconnected and the power is greater than 30% (an example of a preset power upper limit threshold value) can avoid the situation where the power is consumed too quickly when the power is too low, shortening the standby time, and giving priority to ensuring the standby time, thereby improving the user experience. Optionally, the system manager can add to the monitoring conditions: the temperature of the terminal device is lower than 38 degrees, and the power of the terminal device is greater than 30% or is in a charging state (also called a charging connection state). For example, when the system manager finds that a newly installed application pops up more than five times within an hour, if the temperature of the terminal device is lower than 38 degrees, the charging is disconnected, and the power is 50%, it means that the monitoring conditions are met. If the system manager finds that a newly installed application pops up more than five times within an hour, but the temperature of the terminal device exceeds 38 degrees, for example, reaches 40 degrees, or the power is 10% and the charging is disconnected, it means that the monitoring conditions are not met. When the monitoring conditions are not met, the system manager will not add the behavior sequence of the pop-up window to the behavior sequence whitelist, that is, it will not start monitoring the pop-up window behavior. This can avoid the consumption of the little remaining power, and can also avoid damage to the device caused by continuous overheating of the terminal device and the user feeling that the experience is not high, such as being hot. It should be noted that in the above examples, the specific values ​​and distribution methods of power and temperature are examples and are not intended to limit the technical solutions of the embodiments of the present application. The two system events of power and temperature are also examples of system events. In actual use, users can add other system events to the monitoring conditions as needed to further filter the behavior sequences to be monitored, thereby optimizing the monitoring conditions and making the triggering of the monitoring behavior sequences more reasonable. I will not go into details here. Optionally, if the system manager finds that the behavior characteristics of the behavior sequence do not meet the above monitoring conditions, it can continue to obtain new management and control information in the next cycle and continue to filter according to the monitoring conditions. When the application corresponding to the originally monitored behavior sequence is uninstalled, the system manager can stop collecting illegal behavior sequences corresponding to the package name of the application. For example, the system manager deletes all behavior sequences corresponding to the package name of the uninstalled application in the behavior sequence whitelist, thereby saving storage space and avoiding consuming too many monitoring resources. Optionally, the behaviors that need to be monitored included in the above-mentioned behavior sequence whitelist may be identified as illegal behaviors, the behavior sequences that need to be monitored may be illegal behavior sequences, and the illegal behavior sequences may include illegal dynamic behavior sequences and / or illegal static behavior sequences. Optionally, illegal static behaviors include, but are not limited to: impersonating an unconnected contact data provider, setting as barrier-free startup, setting as the default input method, setting as default mandatory, multiple threads pulling each other to keep alive, the presence of transparent / floating windows, hiding desktop icons, hiding activities in the recently run list, impersonating system applications, application installation sources, and one or more of the other static features. Optionally, triggering the collection of illegal behavior sequences, that is, triggering the monitoring process of illegal applications, may be triggered by reporting of illegal dynamic behaviors. Optionally, the above-mentioned behavior sequence whitelist may include illegal dynamic behavior sequences but not illegal static behavior sequences. When the system manager monitors illegal dynamic behavior, it can start monitoring system events and scanning illegal static behavior. Among them, scanning illegal static behavior can obtain the illegal static behavior sequence of the application. Specifically, it can include: when the logical function module performs illegal dynamic behavior, such as performing pop-up behavior, the behavior sequence collector determines that the illegal dynamic behavior sequence of the illegal dynamic behavior is in the behavior sequence whitelist based on the behavior sequence whitelist, and needs to be reported, then the collected illegal dynamic behavior sequence can be reported to the system manager. At the same time, the system manager starts monitoring system events (usually system broadcast events). Optionally, the system manager can also scan illegal static behavior to obtain illegal static behavior sequences. Among them, illegal dynamic behavior can be described by illegal dynamic behavior sequences, and illegal static behavior can be described by illegal static behavior sequences. The above-mentioned system events may include system events such as locking or unlocking the screen, lighting the screen or stopping the screen. In other words, the system manager does not need to scan all illegal static behavior sequences and system events at the beginning. Since system events can only be effectively used when illegal behaviors occur, starting the collection of system events and illegal static behaviors when triggered by illegal dynamic behaviors can avoid the waste of resources caused by obtaining invalid system events and illegal static behaviors, thereby saving system resources. It should be noted that the illegal behavior sequence reported by the behavior sequence collector to the system manager indicates that the application that performs the illegal behavior is a suspicious application. The next step is to identify the suspicious application as an illegal application, thereby triggering the illegal application control process; or the system manager can combine the monitored system events, filter out the illegal behavior sequences that do not need to be identified and the behavior sequences required by other recognition engines, and then select the illegal behavior sequences that need to be controlled to identify illegal applications and trigger the illegal application control process. 2. Distribute illegal behavior sequences: Specifically, the system manager can pre-process the illegal behavior sequences reported by the application management layer according to the behavior sequence distribution rules issued by the security cloud platform, including but not limited to behavior sequence aggregation, formatting, filtering and distribution, to obtain illegal applications to be identified that need to be identified. Among them, filtering illegal behavior sequences can be to screen out behavior sequences that need to be identified and input them into the end-side AI model, and distribute other data that do not need to be identified to their corresponding recognition engines, such as distributing anti-fraud behavior sequences to anti-fraud recognition engines, or distributing virus application behavior sequences to virus application recognition engines. In some embodiments, the reporting process of illegal behavior sequences can be specifically shown in Figure 4. As shown in Figure 4, each logical function module will report the behavior sequence it executes to the behavior sequence collector. Specifically, the behavior sequence collector can report illegal dynamic behavior sequences to the illegal application data analysis module (IAppRogueBehaviorDataAnalyzer) of the system manager. For example, WMS will report the behavior sequence of the lock screen background pop-up window, the behavior sequence of the desktop background pop-up window, and the behavior sequence of the third-party application interface pop-up window to the illegal application data analysis module through the behavior sequence collector. The power consumption manager will report the behavior sequence of the system application launching the third-party application and the behavior sequence of the third-party application self-starting in the background. A system event monitoring module (SystemEventMonitor) can be set in the system manager to monitor system events reported by the application framework layer. Optionally, the system events reported here include but are not limited to: lock screen or unlock screen, screen on or off, network connection or disconnection, Home or back button, battery, volume, charging connection or disconnection, Wifi connection or not, Bluetooth connection or not, new application installation, application upgrade and application uninstallation. An application characteristic analysis module (ApplicationCharacterizationAnalysis) may also be set in the system manager to obtain an illegal static behavior sequence representing illegal static behaviors through a corresponding interface (eg, a getAppStaticCharacter(pkg) interface). You can also set up an auto-start application monitoring module (AutoStartAppsMonitor) in the system manager to monitor auto-start applications. Optionally, a behavior sequence distribution module can also be set up in the system butler. The behavior sequence distribution module can pre-process the illegal dynamic behavior sequences output by the illegal application data analysis module, the system events output by the system event monitoring module, the self-started applications output by the self-started application monitoring module, and the illegal static behavior sequences output by the application feature analysis module, such as behavior sequence aggregation, formatting and filtering, and then distribute the filtered illegal behavior sequences that need to be monitored to the end-side AI model (also known as the end-side decision-making middle platform) and the management database. Optionally, the control information of the above-mentioned different behavior sequences can be reported to the system butler through the control manager, and the system butler's behavior sequence distribution module sends the control information to the management database. Optionally, the behavior sequence distribution module formats the illegal behavior sequences to adapt to the needs of data transmission. It should be noted that the above trigger control process can be to add the illegal applications corresponding to the above illegal behavior sequence to the risk control center for control, or to input the illegal behavior sequence into the end-side AI model for direct identification, so as to obtain the risk level corresponding to the illegal behavior sequence, and finally implement different control strategies according to the risk level. For details about the risk control center and control strategy, please refer to the description below, which will not be repeated here. 3. Trigger and identify risk levels: The terminal device can use the end-side AI model of the application layer to identify the input illegal behavior sequence and obtain the risk level of the illegal application to which the illegal behavior sequence belongs. Exemplarily, the risk level can be divided into level one, level two, level three and level four, or even more levels; it can also be divided into high level (high risk), medium level (medium risk) and low level (low risk). Different risk levels correspond to different management and control strategies. The higher the risk level, the stricter the management and control strategy. In the embodiment of the present application, the number of risk levels is not limited, and the risk level can be divided into a larger number of risk levels according to the sophistication requirements of the management and control. Optionally, the end-side AI model may be a trained model issued by the smart cloud platform. The end-side AI model may perform fixed rule recognition and / or AI recognition on the input illegal behavior sequence. Optionally, after the system manager inputs the illegal behavior sequence into the end-side AI model, the trigger management module integrated in the end-side AI model determines whether to trigger the identification process. Specifically, the above illegal behavior sequence includes illegal dynamic behavior sequence, illegal static behavior sequence and system events. The trigger management module can monitor the illegal behavior sequence that meets the control conditions based on the illegal dynamic behavior sequence and illegal static behavior sequence combined with the system event, and then execute the subsequent identification process. Optionally, system events include, but are not limited to: one or more of: screen lock or unlock, screen on or off, network connection or disconnection, Home or back button, battery level, volume, charging connection or disconnection, Wifi connection or not, Bluetooth connection or not, new application installation, application upgrade, and application uninstallation. Specifically, since many illegal behaviors are triggered when system events are monitored, for example: when a new application is installed, it will trigger an interface that displays whether to start the antivirus software, which can be linked to the antivirus software; when an application is newly uninstalled, it will trigger a pop-up window to download and install other similar applications; when the network is disconnected, it will trigger a pop-up window to download free Wifi applications; when the battery power is lower than the threshold, it will trigger a pop-up window of reference programs such as the battery manager; when the Home button or the return button is clicked, it will trigger an ad pop-up window on the desktop; when the screen is locked, an ad pop-up window will pop up, and the ad pop-up window that pops up when the screen is locked will be directly displayed on the unlock page; when the screen is on, an ad pop-up window will be displayed, etc. Then the system manager can collect illegal behavior sequences when these system events occur, obtain illegal behavior sequences that need to be controlled, and thus trigger the identification process. This implementation method can combine system events to clarify the scenarios that need to be identified and controlled, so that the accuracy of illegal behavior sequences being identified is higher, thereby improving the control accuracy of illegal applications. Optionally, before the end-side AI model performs fixed rule recognition and / or AI recognition, the input illegal behavior sequence may be first identified based on a preset illegal list issued by the security cloud platform: Optionally, the preset illegal list may include an illegal blacklist and / or an illegal whitelist. The illegal blacklist may include at least one package name of an illegal application whose risk level has been identified, that is, the illegal blacklist may include at least one package name of an illegal application and the risk level corresponding to each package name. The illegal whitelist may also include at least one package name that has been identified as not an illegal application. Specifically, the end-side AI model can first search for the package name corresponding to the illegal behavior sequence in the preset illegal list. If the package name of the illegal behavior sequence exists in the illegal blacklist, there is no need to perform fixed rule recognition or AI recognition. The risk level of the package name corresponding to the illegal behavior sequence in the illegal blacklist can be directly obtained. The risk level is also the risk level of the illegal application to which the illegal behavior sequence belongs. If the package name of the illegal behavior sequence exists in the illegal whitelist, it means that the illegal application to which the illegal behavior sequence belongs is actually not illegal, but legal. For example, although pop-ups appear continuously in common chat apps, they are message pop-ups, which are the behavior expected by users. The terminal device can remove the illegal application corresponding to the illegal behavior sequence from the risk control center and no longer monitor the illegal application. Optionally, the preset illegal list may also include a list of virus applications. Among them, the virus application list may include a virus blacklist and a virus whitelist. The virus blacklist represents a list of applications that are determined to be virus applications, and the virus whitelist represents a list of applications that are determined not to be virus applications. If the package name of the illegal behavior sequence exists in the virus blacklist, it can be directly determined that the package name of the illegal behavior sequence corresponds to the highest risk level, or the risk level specific to the virus application, and the most stringent control policy corresponding to the virus application is executed. If the package name of the illegal behavior sequence exists in the virus whitelist, it can be directly determined that the package name of the illegal behavior sequence does not correspond to the highest risk level, and other control policies other than the most stringent control policy corresponding to the virus application can be executed. Optionally, the above-mentioned virus application list may be the result of killing through a virus engine. The virus engine may be a module separated from the end-side AI model, or a module integrated in the end-side AI model specifically for killing viruses. The embodiment of the present application is not limited to this. Optionally, if the package name of the illegal behavior sequence does not exist in the above-mentioned preset illegal list, it means that the illegal behavior sequence is a behavior sequence generated by an unrecognized application and needs to be identified. The end-side AI model can be used to perform fixed rule identification and / or AI identification to obtain the identification result. First, fixed rule identification is introduced: Usually, the system manager can receive the configuration file including fixed rules issued by the security cloud platform and parse it to obtain the fixed rules, or it can use the fixed rules preset in the system manager, and then judge the input illegal behavior sequence according to the fixed rules. Optionally, if the fixed rules cannot identify the risk level, the illegal behavior sequence can continue to be AI identified to obtain the risk level. Fixed rules may include, but are not limited to, the number of pop-up windows in a fixed time period exceeds the first number threshold for high risk, exceeds the second number threshold and is less than the first number threshold for medium risk, exceeds the third number threshold and is less than the second number threshold for low risk, where the first number threshold is greater than the second number threshold, and the second number threshold is greater than the third number threshold. Next, we will introduce AI recognition: the function module that performs AI recognition can be the function module of AI recognition in the end-side AI model trained by the smart cloud platform. The function module of AI recognition can perform feature analysis on the input illegal behavior sequence to obtain the recognition result. Optionally, the above-mentioned process of determining whether to trigger the identification process and identifying the list according to the preset illegal list can be executed by using separate functional modules, or can be integrated with fixed rule identification and AI identification in the end-side AI model for execution. When integrated in the end-side AI model for execution, the entire identification process can be decoupled from the control process, and only the illegal behavior sequence needs to be input into the end-side AI model, thereby realizing the decoupling of the identification process and facilitating deployment. Optionally, the end-side AI model may also use fixed rule recognition to obtain a rule recognition result on the one hand, and use AI recognition to obtain an AI recognition result on the other hand, and then select one of the rule recognition result and the AI ​​recognition result as the final recognition result. Optionally, the end-side AI model may first adopt fixed rule recognition. If the rule recognition result can be obtained, the fixed rule recognition is more efficient. If the fixed rule cannot be recognized, the illegal behavior sequence can continue to be AI recognized to improve the recognition rate. It should be noted that the identification result may include the identification of the illegal application corresponding to the illegal behavior sequence (for example, the package name of the illegal application) and the risk level. Optionally, the identification result may also carry the identification date, risk level score, and identification source. Different risk levels may correspond to different risk scores. Optionally, the format of the identification result output may be exemplarily expressed as a blacklist field: The blacklist fields include: AI recognition results; { "date":"2000-01-17", [identification date]; “pkgname”:”pkg5”, [application package name]; “level”:”1”, [risk level 1: illegal application; risk level 0, not illegal application]; "score":"50",[risk score]; “source”:”user_model” [Identification source: end / cloud-model / rule cloud_rule; cloud_model; user_rule; user_model]. In the above blacklist field, risk level 1 indicates illegal applications, and risk level 0 indicates non-illegal applications; the risk score indicates the frequency or probability of illegal behavior. The higher the risk score, the higher the risk level and the stricter the corresponding control rules. cloud_rule indicates that the source of identification is the result of fixed rule identification on the cloud side; cloud_model indicates that the source of identification is the result of AI identification on the cloud side; user_rule indicates that the source of identification is the result of fixed rule identification on the terminal side; user_model indicates that the source of identification is the result of AI identification on the terminal side. If the end-side AI model identifies an illegal application, the illegal application and the corresponding risk level are added to the illegal blacklist so that the next time the behavior sequence appears, there is no need to identify it, and the identification result can be obtained directly by querying the illegal blacklist in the preset illegal list. Optionally, the end-side AI model may first identify the illegal behavior sequence to obtain a preliminary identification result, and then modify the preliminary identification result according to the virus application list. For example, see Table 2: If the package name of the application does not exist in the virus application list (empty or NA), the final identification result shall be based on the preliminary identification result. That is, if the preliminary identification result is high risk, the final identification result shall be high risk; if the preliminary identification result is medium risk, the final identification result shall be medium risk; if the preliminary identification result is low risk, the final identification result shall be low risk; if the preliminary identification result is not a risky application (i.e., an illegal application whitelist), the final identification result shall be not a risky application. If the virus application list indicates that the application is on the virus blacklist (determined to be a virus), and the preliminary identification result of the illegal application is empty, the final identification result is high risk, which means it is treated as a virus; if the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is empty, the final identification result is not a virus application. If the virus application list indicates that the application is not a virus (white list of virus applications), and the preliminary identification result of the illegal application is high risk or medium risk, the final identification result is medium risk. Table 2 After obtaining the final recognition result, the terminal device can be managed and controlled based on the final recognition result. Optionally, after the identified illegal application is added to the illegal blacklist, when the illegal behavior of the illegal application occurs, the control rule instantiation can be triggered to obtain the control rule corresponding to the illegal application, and then control is performed according to the control rule. Optionally, the end-side AI model can also report the illegal behavior sequence to the smart cloud platform at a regular interval, and the smart cloud platform retrains or corrects the end-side AI model according to the illegal behavior sequence reported by the terminal device, so that the end-side AI model is more accurate. After the smart cloud platform collects a variety of different illegal behavior sequences (i.e., group data) reported by more terminal devices, it can train the end-side AI model more comprehensively and accurately. The updated end-side AI model can be sent to the end side at an appropriate time. Usually, management tools such as aiSplitAPK are set up on the smart cloud platform, which can be used to manage the end-side AI model, such as managing the download or update of the end-side AI model. When the smart cloud platform sends the updated end-side AI model to the end side, even if some illegal behaviors that have not appeared before appear on the current terminal device, and these illegal behaviors have been reported by other terminal devices, then the terminal device currently receiving the updated end-side AI model does not need to wait until the illegal behavior occurs itself and spends a certain amount of time and resources to identify it by itself, and can accurately identify the illegal application through the new end-side AI model and manage it in time. This approach can achieve end-to-end cloud integration and rapid identification when faced with the situation where illegal applications are generated too quickly, thus playing a long-term role in combating illegal applications. In other words, the end-side AI model and the cloud-side AI model can collaborate with each other to form an end-cloud combined AI recognition engine. Next, the end-cloud combined AI recognition engine is described based on functional deployment. Among them, the end-side AI model includes a data middle platform, which can obtain the dotting data through the data dotting interface and upload it to the smart cloud platform for model training and data analysis on the smart cloud platform. Among them, the dotting data is the collected illegal behavior sequence, such as illegal dynamic behavior sequence, illegal static behavior sequence and system event. Optionally, the illegal dynamic behavior sequence may include a sequence of behaviors such as pop-up window events, chart hiding and transparency, system application pulling up third-party applications, and third-party application background starting activity; illegal static behavior sequences include but are not limited to: application installation source, whether it is set as a device manager application and other static features corresponding to the sequence; it may also include: user feedback data, such as user processing information after risk control reminders, user cleaning background / uninstalling application information after pop-up windows. Optionally, dotting data access can be in the "point management" system, applying for the corresponding dotting data ID, software version (version) and each dotting field that needs to be dotted, after which the data analysis tool will send the dotting data to the data middle platform through a preset interface. Optionally, the data middle platform can also store the dotting data, support data query, and aging. The end-side AI model also includes a trigger decision module, which decides whether to trigger the end-side recognition process by monitoring system events, such as providing a time fence as a condition for triggering the recognition process. For example, the time fence can include a newly installed application within three days from the time of installation. The end-side AI model is an in-process identification model, that is, when illegal behavior occurs on a single device, when the triggering decision module decides to meet the conditions for triggering the identification process, identification can be performed locally to execute subsequent control processes. For specific identification methods, please refer to the detailed description of the fixed rules and / or AI identification described above, which will not be repeated here. In-process identification means that the illegal behavior is identified on the local device during the occurrence of the behavior, without waiting for the identification results on the cloud side. The local in-process identification can promptly identify the risk level corresponding to the illegal behavior sequence, which is convenient for timely control and improves the user experience. The cloud-side AI model is a post-recognition model, and the cloud-side AI model can also include fixed rule recognition and / or AI recognition on the cloud side. The cloud-side AI model uses group data reported by multiple terminal devices as the basis for model training and fixed rule extraction, so the recognition result is more accurate. The cloud-side AI model can also display and distribute the recognition results, which can include the package name and the corresponding risk level, and can be used to update the preset illegal list of the security cloud platform. Optionally, users can also manually review and correct the recognition results of the cloud-side AI model, and update the preset illegal list of the security cloud platform with the corrected results. Big data analysis and rule extraction: Big data analysis is performed based on the data provided by the data center to extract business rules. The rules have limited coverage but strong certainty, fast speed and quick effectiveness. The AI ​​recognition engine supports big data parameter updates. Next, we will compare the accuracy of cloud-side recognition and device-side recognition with specific data: First, define recall and precision: see Table 3 for details: Table 3 Among them, recall rate = TP / (TP+FN), that is, the recall rate is the number of correctly predicted illegal behaviors / the number of all real illegal behaviors; Precision = FP / (TP+FP), i.e. correctly predicted illegal behaviors / all predicted illegal behaviors; And the accuracy rate = 1-error rate. According to statistics, the recall rate of post-identification on the cloud side is >90%; the accuracy rate (=1-false recognition rate) is >95%; the accuracy rate of in-process identification on the terminal side is >85%, and the accuracy rate of cloud-based identification is even higher. 4. Illegal application control: After the risk level is identified, different control strategies can be implemented according to the risk level. In order to implement differentiated control strategies, in the embodiment of the present application, different control path identifiers (path IDs) are defined to represent different control paths, and then control is implemented through the control paths. Specifically, a control path identifier is defined for each control path (path ID). The control path can be represented by a non-repeating identifier, such as a non-repeating integer, and each control path corresponds to an illegal behavior. Optionally, different illegal behaviors can also include different startup methods or startup paths for behaviors that are not expected by the user. For example, control path 1001 corresponds to a pop-up window on the lock screen interface; control path 1002 corresponds to a pop-up window on the desktop background; control path 1003 corresponds to a pop-up window on the interface of a third-party application. Although these three control paths all represent pop-up behaviors, the corresponding startup methods are different. Optionally, the definition of the control path can be exemplified in Table 4: Table 4 In Table 4 above, the behavior source represents the logical function module where the illegal behavior is executed. In Table 4, the source of the control paths 1001, 1002, and 1003 is the window manager. Table 4 defines the illegal behavior of pop-up windows in three different startup paths (from the lock screen interface, from the desktop / background, and from the interface of a third-party application). Therefore, the illegal behaviors of the three startup methods can be managed separately to achieve fine-grained management of pop-up window behaviors. The starting control risk level in Table 4 indicates from which risk level to the higher risk level, a consistent control strategy is implemented. In Table 4, whether the default is intercepted indicates whether the illegal behavior is intercepted or not intercepted (released) in the default state. Taking the content shown in Table 4 as an example, the control path 1001 represents starting from low risk, including medium risk and high risk, and the illegal behavior of the lock screen interface pop-up window is intercepted by default. If the risk level corresponding to the control path 1002 is medium risk, it means starting from medium risk, including high risk, and the illegal behavior of the desktop / background pop-up window is intercepted by default. Optionally, the default flag bit of whether to intercept is "yes" or "Y" to indicate interception, and can also be represented by characters such as "1" or "true". Of course, if the corresponding default interception is not intercepted, then the corresponding flag bit can be "no", "N", "0" or "false" and other characters indicating negative interception, indicating that it is not intercepted and is in a state of release. Optionally, the control path shown in Table 4 is only an example, and the control paths actually defined include more types. For example, it also includes various illegal behaviors performed by other logical function modules, such as background keep alive, launching together with system applications, etc., and the control path identifiers of different illegal behaviors are different. In some embodiments, each control path can be represented by a globally unique integer. The control path can support expansion and continuous evolution. For example, when it is necessary to add control of new illegal behaviors, a new control path can be used to uniquely represent the newly added illegal behavior, and the control path that has been used before or has been abandoned will not be reused. If an unused control path needs to be abandoned, this unused control path will no longer be reused for other illegal behaviors, thereby ensuring the uniqueness of the control path. In this way, even in the process of system version iteration, when new and old system versions are cross-used between different terminal devices, the uniqueness of the control path can ensure that the control strategy is compatible with the new and old versions, and no logical confusion will occur. In addition, for abandoned control paths, the corresponding illegal behaviors will no longer be controlled and released by default, that is, the illegal behaviors will no longer be intercepted, which can reduce invalid interception behaviors and save system resources. Optionally, the evolution of the control path can also be reflected in the subdivision of the control path. For example, the initial control path of the pop-up behavior is 100, and 100 represents the pop-up behavior of all startup methods. But later it was discovered that not all pop-up behaviors can meet the usage requirements by executing the same control method. Then the pop-up behavior can be subdivided into three types according to the startup method: lock screen interface pop-up, desktop / background pop-up, and third-party application interface pop-up as shown in Table 4, and the three new control path identifiers 1001, 1002, and 1003 are added to represent them one by one, so that differentiated control can be performed for different startup methods of pop-up behaviors, and fine-grained control can be achieved, making the control strategy more accurate and improving the user experience. The original control path 100 can be discarded and no longer used. The previous article introduced the control path. Next, we will introduce the relationship between the control path and different risk levels. Take the example of identifying risk levels including high risk, medium risk and low risk: For high-risk applications, you can join the risk control center. If it is an application with the highest risk level, it is also treated as a virus application. For example, for high-risk applications, the control paths that need to be controlled may include: shutting down the network, disabling permissions, shutting down notifications, prohibiting background pop-ups, prohibiting self-starting, prompting uninstallation, etc. Optionally, high-risk applications can be controlled directly according to the control rules of high-risk applications without user perception. Optionally, the interface of the risk control center as shown in Figure 5 can also pop up, and the user can operate the controls corresponding to different illegal behaviors in the interface to adjust the control strategy. The user can also click the "Uninstall" control to directly uninstall the high-risk application. The control path corresponding to the illegal behavior that needs to be controlled can be added to the instantiation result of the high-risk application. Among them, the instantiation result is used to characterize the specific strategy when the application executes control. The specific process of instantiation can be described in detail in the following description, which will not be repeated here. Here we first explain the risk control center, which is a user experience interface (User Experience, UX) of the system manager, as shown in Figure 5. Figure 5 shows a risk details interface of an illegal application with a high risk level. In Figure 5, the illegal application is a film and television application as an example. The interface can include the name of the illegal application (advertising application), the risk level (high), and multiple illegal behavior controls (for example, including but not limited to: connecting to the network, privacy permissions, background pop-ups, notifications, and installing other applications in the application, etc.). Users can click on different controls to adjust the control strategy. For example, when the user clicks on the control to close the background pop-up window, it means that there is no need to control the background pop-up behavior of the advertising application, that is, the user allows advertising pop-ups to appear. It should be noted that when the user does not manually operate the risk details interface, the settings of each control in the risk details interface can be the default state, that is, follow the default high-risk application control rules. For medium-risk applications, you can also join the risk control center for management and control. For medium-risk applications, the illegal behaviors that need to be controlled are not as strict as those for high-risk applications, and the control paths that need to be controlled are not as many as those for high-risk applications. For example, for medium-risk applications, the control paths that need to be controlled may include: turning off notifications, prohibiting background pop-ups, and prohibiting automatic startup. Optionally, after identifying the risk level, the medium-risk application can display the control interface of the risk control center on the interface of the terminal device according to the risk level, so that the user can clearly perceive that the application is being controlled. Optionally, the control interface of the risk control center for medium-risk applications can refer to the risk details interface shown in Figure 6, including the application identification, risk level and controls corresponding to multiple control paths. For example, when the risk level of a film and television application is identified as medium risk, the control interface of the risk control center in FIG6 is displayed. At this time, the user can clearly perceive that the system manager has performed risk control on the current film and television application, which can improve the user experience. FIG6 also shows icons of multiple control paths and switch controls corresponding to each control path. Optionally, the initial setting of the switch controls corresponding to each control path in the control interface of the risk control center can be set according to the default control strategy of the medium-risk application. When the user observes the control interface of the risk control center, he can manually modify the settings of the switch controls corresponding to each control path according to his own needs, thereby modifying the control strategy of the medium-risk application. When the user operates the switch control of the control path, the default control strategy will be updated. For example, the user can turn on the switch control of a control path to intercept the control path, or turn off the switch control of a control path to open the control path. For example, if the user clicks the switch control of the close notification as shown in FIG6, the control of the close notification is canceled, and when the notification message arrives, it will not be intercepted, and the notification message can be displayed normally. For low-risk applications, if they are legal and compliant applications that are widely used by users, such as applications with a large number of downloads (such as applications ranked in the top 3,000 in terms of downloads), it means that the application is a widely verified legal application and does not need to be added to the risk control center, let alone display the control interface of the risk control center, which can save control resources. Then the control paths corresponding to low-risk applications can also be reduced relative to medium-risk and high-risk applications. For example, the system manager can control some pop-up behaviors that users do not expect, such as prohibiting background pop-ups. The previous article introduced the management and control principles for applications of different risk levels. Next, we will introduce how to implement management and control strategies for applications of different risk levels based on the management paths. Specifically, the terminal device can receive the control rule configuration file issued by the security cloud platform through the system manager. The system manager can parse the control rule configuration file to obtain the control path set corresponding to different risk levels, and then obtain the control path set corresponding to the application program of different risk levels based on the risk level corresponding to the application program, thereby realizing the instantiation of the control rules. The control rules in the above control rule configuration file may include general control rules. Taking the different risk levels including high risk, medium risk and low risk as an example, the general control rules may include: control path set 1 corresponding to low risk, control path set 2 corresponding to medium risk and control path set 3 corresponding to high risk. For example, it can be expressed in the following form: Low risk (low): [1001, 1002, 1003...], indicating the control paths that low-risk applications need to control (control path set 1); Medium risk (middle): [2001, 2002, 2003...], indicating the control paths (control path label set 2) that need to be controlled for medium risk level applications; Medium risk (high): [2100001, 2100002, 2100003...], indicating the control paths (control path set 3) that need to be controlled for high-risk applications. In some embodiments, common control rules can also be divided into fixed common rules (CommonPolicy) corresponding to fixed identification rules and AI common rules (aiCommonPolicy) identified by AI. If the risk level is identified by fixed rules, it is controlled according to the fixed common rules. If the risk level is identified by AI, it can be controlled according to the AI ​​common rules. Which one is executed can be determined based on the identification source in the identification result. Optionally, the control paths for different risk levels of fixed common rules and AI common rules may be consistent, or there may be certain differences. Optionally, in addition to the general control rules, the above control rules may also include special control rules. Special control rules may include some control rules for specific applications, such as separate control rules for blacklist applications. Special control rules include, but are not limited to, any one or more combinations of package name, risk level, control date, added control path, and removed control path. Exemplarily, the logic of generating a control strategy for pkg1 (that is, the process of instantiating control rules) includes: obtaining the collection of control paths corresponding to the current risk level of the current pkg1 from the general control rules issued by the cloud side, then adding the control paths added in the special control rules for pkg1 issued by the cloud side, and finally deleting the control paths removed from the special control rules for pkg1 issued by the cloud side, to obtain the final set of all paths that need to be controlled corresponding to pkg1. This process is called control rule instantiation, and the final set of all paths that need to be controlled corresponding to pkg1 is the result of instantiating the control rules for pkg1. Taking the package name pkg1 as an example, the special control rules of pkg1 may include: package name, risk level, control date, added control paths (indicating paths that currently require more control), and removed control paths (indicating paths that currently do not require control). For example: The package name is: pkg1; The risk level is: low risk; The control date is: 20221008; The added control paths are: 2001, 2003; The removed control path is 1001. Then the logic of the control rule instantiation process of pkg1 can be: the control path set 1 corresponding to low risk [1001, 1002, 1003], plus the added control path: [2001, 2003], minus the removed control path

[1001] , and the final control path is [1002, 1003, 2001, 2003]. This method can adjust the control strategy for each application separately, realize more fine-grained differentiated control of applications, and improve control efficiency and accuracy. This process can be called control rule instantiation, and the result of instantiation is the package name of the application and the corresponding control path set that needs to be controlled. In the above control strategies, since the results obtained by AI recognition have not been manually reviewed and confirmed, the corresponding control strategies may be different from the control strategies corresponding to the applications in the illegal blacklist. The control rules can be configured differently for these two situations. The specific method can be to define differentiated control rules based on different identification sources. It should be noted that if the user targets an application that has already generated instantiation results, the user can adjust the control strategy through the risk control center. Specifically, the user can turn on or off the control corresponding to a certain control path on the risk details page corresponding to the application, and the system manager will update the control path set in the instantiation result according to the user operation. For example, when the user changes the notification control from off to on, it means that the user does not want to see the notification, and the system manager will delete the control path corresponding to the notification from the originally instantiated control path set; when the user changes the background pop-up control from on to off, it means that the user allows the background pop-up, and the system manager will add the control path corresponding to the background pop-up to the originally instantiated control path set. After that, the updated new control path set will be sent to the control manager to implement control. Optionally, after the control rules are instantiated, the instantiation results can be stored in the system housekeeper. When the system housekeeper discovers the first occurrence of illegal behavior, it can trigger the instantiation results to be sent to the control manager. The control manager can store the instantiation results, that is, store the control rule table, and provide an interface for WMS, iAWare and other logical function modules to query. When the logical function module performs illegal behavior again, it can first query the control rule table in the control manager. If the queried control path exists in the control rule table, it means that the illegal behavior corresponding to the control path needs to be controlled, and the illegal behavior will not continue to be executed, thereby achieving control of the illegal behavior. If the queried control path does not exist in the control rule table, it means that the illegal behavior corresponding to the control path does not need to be controlled, and the illegal behavior will continue to be executed. The above is a detailed description of different processes of the technical solution of the embodiment of the present application. Next, in order to systematically illustrate the application management process of the technical solution of the embodiment of the present application, please refer to Figure 7: S701. The logic function module searches the package today control table for the control path corresponding to the output behavior sequence. Among them, the package today's control table is the result of the system housekeeper instantiation received by the control manager on the current date, that is, the control path set of each package that needs to be controlled. S702: When the control path corresponding to the queried behavior sequence does not exist in the package today's control table, the output behavior sequence is reported to the behavior sequence collector. When the control path corresponding to the queried behavior sequence exists in the package today's control table, there is no need to report the behavior sequence to the behavior sequence collector, and the behavior corresponding to the behavior sequence is no longer executed, that is, the behavior corresponding to the behavior sequence is intercepted. At the same time, the control manager also records the package names and times of uncontrolled behavior sequences and the package names and times of controlled behavior sequences, and adds them to the package today control table for regular reporting to the system manager and / or big data analysis platform. S703: When the behavior sequence collector determines that the behavior sequence identifier of the reported behavior sequence exists in the behavior sequence whitelist, the behavior sequence is reported to the system manager of the application layer. If the behavior sequence identifier of the behavior sequence does not exist in the behavior sequence whitelist, it is discarded. S704. The system manager receives the preset illegal list sent by the security cloud platform. S705, the behavior sequence distribution module distributes the behavior sequence to be identified for comparison with the preset illegal list. If the behavior sequence to be identified exists in the preset illegal list, the system manager obtains the risk level corresponding to the behavior sequence in the preset illegal list. S706. If the behavior sequence to be identified does not exist in the preset illegal list, the behavior sequence is input into the end-side AI model for identification to obtain a risk level. S707. The risk control center receives the configuration file including the control rules issued by the security cloud platform and obtains the control model. S708. The end-side AI model or system manager can input the identified risk level into the management and control model to trigger the instantiation of the management and control rules. S709: Perform virus detection on illegal behaviors of newly installed applications to obtain risk levels, and input the risk levels into the control model to trigger the instantiation of control rules. The triggering of control rule instantiation here is the process of generating a control path set of control paths that need to be intercepted corresponding to the risk level. If the newly installed application is a virus application, the risk level is high risk; if the newly installed application is not on the virus application list, the risk level can be medium risk. S710. The control model is instantiated according to the input risk level and control rules, and the instantiation result is sent to the control manager for generating or updating the package today's control table. For a detailed description of the steps in FIG. 7 , please refer to the related description in the previous text, which will not be repeated here. The control process of the embodiment of the present application can also refer to the timing diagram shown in FIG8, including: S801. The security cloud platform sends the cloud-side configuration information to the system manager. The configuration information may include a control strategy; optionally, the configuration information may also include a preset illegal list and behavior sequence distribution rules. The configuration information may be sent once a day or according to other cycles. S802: Triggering the control of illegal applications. It can be triggered by the user in the process of using the terminal device. For example, when the user is using the terminal device, the terminal device scans a newly installed application, scans illegal behavior during idle time, the terminal AI model identifies illegal applications, the application in the illegal blacklist pops up in the background for the first time, and the risk control center triggers control. S803. Add illegal applications to the risk management center. S804. The risk control center instantiates according to the control strategy in the configuration information to obtain an instantiation result. S805. The risk control center sends the instantiation result to the control manager. The instantiation result may be a control strategy configured by the risk control center, which includes a package name and a corresponding control path set. S806. When the illegal behavior is triggered again, the logic function module queries the control policy in the control manager to obtain the control result of the illegal behavior. Among them, the control results include the control path of illegal behaviors and the corresponding control results of control or non-control. S807. The control manager returns the control result to the logic function module. For example, 1 represents control (interception), and 0 represents no control (no interception, release). S808. The logic function module obtains the returned control result and executes or does not execute the illegal behavior according to the returned control result. S809, the control manager collects control information. The control information may include: package name, control path, and number of times the packet is allowed or blocked. S810. The control manager collects statistics on multiple control information and reports them to the big data analysis platform, that is, the management database. The control manager can report control information once a day, or report it when receiving an instruction to report, or report it according to other cycles. After step S808 in FIG. 8 , the specific control rule execution process can also be seen in FIG. 9 , including: S901. When executing an illegal behavior, the logic function module identifies the control path corresponding to the illegal behavior. For example, the logic function module identifies when illegal behavior is initiated or maintained, and identifies the corresponding control path. S902. Call the security module to query the control path. The logic function module queries the security service to see whether the control path exists. S903. Query and obtain the control result of the control path. For example, the control result of illegal behavior control can be determined by calling the security module to query the control rules (checkBehaviorControlPolicy). If the return value is false, the control result is no control (no interception); if it is true, or not false, the control result is control (interception). Optionally, the control result can be expressed as: package name (pkgName), control path (path ID) and control result (Activity). The security module here can be the control manager mentioned above. S904. Return the control result. S905, executing control or not controlling according to the control result. If the control result is control, the logic function module ends the current process and terminates the execution of illegal behavior; if the control result is no control, the logic function module continues to execute illegal behavior. S906. Summarize the management and control results. S907. When the security module is called for the first time each day, the management and control results summarized on the previous day are reported to the management database. When the security module triggers the query control rule for the first time every day, it summarizes the interception statistics of each package in the previous day and reports it to the cloud. Optionally, the format of the reported data can be: package name, control path, control result (control / no control), number of times. Specifically, taking the logical function module as WMS and the illegal behavior as a pop-up window as an example, the control of illegal behavior is exemplified, as shown in FIG10, including: S1001. Trigger a pop-up window. S1002: Determine whether the pop-up behavior is a pop-up behavior initiated by the foreground. If yes, execute S1003; if no, execute S1004. S1003. Execute the pop-up window behavior normally. S1004: Determine whether the pop-up window behavior is manually initiated by the user. If yes, execute S1003; if no, execute S1005. S1005: Determine whether to lock the screen pop-up window. If yes, execute S1006; if not, execute S1007. S1006. Execute a pop-up window or not according to the control result queried from the pop-up window behavior. S1007, determine whether there is a pop-up window on the desktop background. If so, execute S1006; if not, execute S1008. S1008: Determine whether a pop-up window appears on the interface of the third-party application. If so, execute S1006; if not, execute S1009. S1009: Determine whether it is another type of pop-up window. If so, determine that the control result is not controlled, and execute S1006. In the embodiment shown in FIG10 , when WMS starts a pop-up window in the foreground of the application and it is clear that the pop-up window is started by the user, it does not need to notify the security module, that is, it will not query the control results and directly execute the pop-up window. Only for the lock screen pop-up window, the desktop background pop-up window, and the pop-up window on the interface of the third-party application, it is necessary to query the control results through the control path, so as to execute the pop-up window or not according to the control results. In addition, for other uncertain pop-up window types, it is not necessary to control them, but only collect the control results of the uncontrolled ones for data statistics and analysis. Next, taking the logical function module iAware and the illegal behavior application self-start as an example, the control of illegal behavior is exemplified, as shown in FIG. 11, including: S1101, the application starts automatically. S1102. iAware queries whether the application is an application in an illegal blacklist. Specifically, the package name or control path of the self-started application may be queried in an illegal blacklist to determine whether it exists in the illegal blacklist and obtain the query result. S1103: Determine whether the query result is an illegal application. If not, execute S1104; if so, execute S1105. S1104. iAware activates corresponding control rules according to the query results. S1105. iAware prohibits the application from automatically starting. Specifically, during the cold start phase of the application, iAware self-start control is entered. First, the illegal blacklist is searched through the control path and package name, and then the application is identified. When the application is identified as an illegal application, true is returned, indicating that the application needs to be intercepted and the startup process of the application is terminated; when the application is identified as not an illegal application, false is returned, and iAware follows the control rules of the application, such as continuing the startup process. In order to comprehensively and systematically introduce the technical solution of the embodiment of the present application, reference may also be made to the architecture diagram shown in FIG12 , including: S1201. The security cloud platform issues behavior sequence distribution rules to the system manager. S1202. The security cloud platform sends the control rules for illegal behavior to the system manager. S1203. The security cloud platform sends a preset illegal list to the system manager. S1204. The smart cloud platform receives the behavior sequence reported by the terminal side and collects the behavior characteristics. S1205. The smart cloud platform performs behavioral characteristic analysis based on the data collected based on the behavioral characteristics. S1206. The smart cloud platform trains an AI model based on the results of the behavior feature analysis. The AI ​​model may include a device-side AI model and a cloud-side AI model. S1207. The smart cloud platform sends the trained end-side AI model to the terminal device. The end-side AI model carries fixed recognition rules. The smart cloud platform can also use the trained cloud-testing AI model to identify the risk level of illegal behavior sequences on the cloud side. S1208: The smart cloud platform performs behavioral feature analysis based on the collected behavioral sequences and obtains an initial illegal list, which may include an illegal blacklist and an illegal whitelist, and may also include an initial virus application list. S1209. The security cloud platform receives the results of manual review and correction of the initial illegal list, and obtains a preset illegal list or an updated preset illegal list. S1210. The logic function module queries the illegal behavior sequence in the control manager to obtain the control result corresponding to the illegal behavior sequence. S1211A: When the control result is no control, the illegal behavior sequence is reported to the behavior sequence collector. Then, S1212 is executed. S1211B. When the control result is control, the illegal behavior corresponding to the illegal behavior sequence will no longer be executed. S1212: The behavior sequence collector reports the illegal behavior sequence to the behavior sequence distribution module of the system manager. S1213. The behavior sequence distribution module filters illegal behavior sequences and sends the illegal behavior sequences that need to be monitored to the end-side AI model for identification. S1214. The end-side AI model identifies the risk level corresponding to the illegal behavior sequence. S1215. The system manager obtains the final risk level based on the identified risk level and the preset illegal list. S1214 and S1215 can also be that the system manager first queries the preset illegal list. If there is an illegal behavior sequence in the preset illegal list, the subsequent process can be executed according to the corresponding risk level in the preset illegal list; if there is no illegal behavior sequence in the preset illegal list, continue to input the end-side AI model for identification to obtain the risk level. S1216. When the illegal behavior sequence is triggered next time, the system manager triggers the instantiation of the control rules according to the risk level and sends the instantiation results to the control manager. S1217. When the illegal behavior sequence is triggered again, the control rules in the control manager are queried to obtain the control result, which is used to control the illegal behavior sequence. S1218. The control manager collects the control results and reports them to the system manager. S1219. The system manager reports the management and control results to the big data analysis platform. S1220. The big data analysis platform sends the statistical control results to the security cloud platform for generating new or updated behavior sequence distribution rules, control rules, and preset illegal lists, etc. It should be noted that the order of numbering of each step in FIG12 is only an example and is not used to limit the order of execution of the steps. In fact, the execution steps between the steps in FIG12 are interlaced with each other, and can be in any order when the steps are not conflicting. For a detailed description of each step in FIG12, please refer to the relevant description in the previous text, which will not be repeated here. It should be noted that the timing for sending various data of Cloud Testing to the end side can be when the end side sends it during idle time or at a scheduled time, as long as it does not affect the control of illegal applications on the end side. In order to clearly and completely explain the technical solution of the present application, the application management method provided by the present application can also be explained with reference to the following embodiments. The method can be applied to a terminal device. The following is an exemplary description with the execution subject being a terminal device. For details, see FIG. 13. The application management method includes: S1301: Obtain a first illegal behavior sequence, where the first illegal behavior sequence represents a first illegal behavior of an illegal application. The above-mentioned first illegal behavior sequence is an expression form of the first illegal behavior. Among them, the first illegal behavior can be an illegal behavior generated by an illegal application, such as the behavior of an advertisement pop-up window executed by APP1 (illegal application) (first illegal behavior). The first illegal behavior sequence can be an illegal behavior sequence reported to the system manager through the behavior sequence collector before the first illegal behavior is executed; optionally, the first illegal behavior sequence can also be a behavior sequence of illegal behaviors reported to the application layer through other paths. As long as it is a behavior sequence of illegal behaviors that need to be identified, the embodiment of the present application does not limit this. S1302: Use the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level. Optionally, the detailed description and acquisition timing of the terminal-side AI model can be found in the previous description and will not be repeated here. The terminal device can use the end-side AI model to identify the risk level of the first illegal behavior sequence input into the end-side AI model, thereby obtaining the target risk level corresponding to the first illegal behavior sequence. The target risk level is also the risk level of the illegal application corresponding to the first illegal behavior sequence, and the target risk level can characterize the degree of impact of the illegal application on the user. If the target risk level is high, it means that the illegal application has a large impact on the user and the user experience is poor; if the target risk level is low, it means that the illegal application has a relatively small impact on the user and the user experience is slightly poor. S1303. Generate target control rules corresponding to illegal applications according to the target risk level. Specifically, the terminal device can obtain the target control rules for the illegal application according to the target risk level. Specifically, different risk levels can correspond to different control rules. For example, the corresponding control rules for illegal applications with high risk levels will be more stringent, such as intercepting more types of illegal behaviors; the corresponding control rules for illegal applications with low risk levels will be looser, such as intercepting fewer types of illegal behaviors. Optionally, the terminal device can parse the configuration file including the control rules, and obtain the target control rules corresponding to the target risk level based on the analysis; or it can trigger the instantiation of the control rules based on the determination of the target risk level, and then obtain the target control rules corresponding to the target risk level. The embodiments of the present application do not limit this. Optionally, the target control rules may include identifiers of illegal behaviors that need to be intercepted by illegal applications, and / or identifiers of illegal behaviors that do not need to be intercepted by illegal applications. Among them, the number of identifiers of illegal behaviors that need to be intercepted can be one or more, and the number of identifiers of illegal behaviors that do not need to be intercepted can also be one or more. In the embodiment of the present application, the number of identifiers of behaviors in the target control rules is not limited. Of course, whether a behavior performed by an application is an illegal behavior is not absolutely certain, and it may also change with factors such as user habits. Therefore, it can be understood that the statement of illegal behaviors that do not need to be intercepted mentioned in this article is not contradictory. Although it does not need to be intercepted, there may be no negative impact on the user's use. However, in order to reflect the processing method for the same type of behavior, it can also be called illegal behavior. The name of illegal behavior here is not used to limit whether the illegal behavior is intercepted. S1304. Control the first illegal behavior according to the target control rules. The terminal device can control the above-mentioned first illegal behavior according to the above-mentioned target control rules. Specifically, before executing the illegal behavior, the terminal device can first check whether the illegal behavior in the target control rules needs to be intercepted or not. If the identifier of the first illegal behavior is in the identifiers of illegal behaviors that need to be intercepted, the first illegal behavior can be intercepted; if the identifier of the first illegal behavior is not in the identifiers of illegal behaviors that need to be intercepted, the first illegal behavior may not be intercepted, that is, the first illegal behavior is released. Or: if the identifier of the first illegal behavior is in the identifiers of illegal behaviors that do not need to be intercepted, the first illegal behavior can be released; if the identifier of the first illegal behavior is not in the identifiers of illegal behaviors that do not need to be intercepted, the first illegal behavior can be intercepted. In the embodiment shown in FIG. 13 above, the terminal device uses an end-side AI model to identify the target risk level of illegal applications corresponding to the first illegal behavior sequence, and then manages the illegal applications according to the target control strategy generated by the target risk level. The illegal behaviors occurring on the end side can be identified and controlled in a timely manner. Compared with the traditional method of manually marking illegal applications, illegal behaviors can be intercepted in a timely manner without waiting for the results of manual marking, thereby improving the user experience. When the end-side AI model is a model trained and issued by the cloud testing server, even if some illegal behaviors that have not appeared before appear on the current terminal device, and these illegal behaviors have been reported by other terminal devices, the terminal device currently receiving the updated end-side AI model does not need to wait until the illegal behavior occurs itself and spend a certain amount of time and resources to identify it by itself. The above method can accurately identify the illegal application through the new end-side AI model and control it in time. This method can achieve the combination of end and cloud, and quickly identify illegal applications when illegal applications are generated too quickly, which has the effect of long-term combating illegal applications. Optionally, based on the embodiment shown in FIG. 13 above, the application management method may further include: controlling a second illegal behavior according to a target control rule, the second illegal behavior is an illegal behavior of an illegal application, and the second illegal behavior is different from the first illegal behavior. The second illegal behavior mentioned above is other illegal behavior generated by illegal applications, which may also interfere with users in some scenarios. Then, after the terminal device identifies the target risk level of the illegal application, the target control strategy obtained based on the target risk level can not only control the first illegal behavior that has already appeared on the terminal device, but also control the second illegal behavior that has not yet appeared on the first terminal device. Therefore, there is no need to wait until the second illegal behavior occurs on the terminal device itself and spend a certain amount of time and resources to identify it by itself. Instead, the target control strategy generated by the identified target risk level can achieve control of the second illegal behavior that has not yet appeared but will affect the user. Therefore, the control of illegal applications is more timely and comprehensive, improving the user experience. In some embodiments, the target control rule includes a target control path set formed by a first control path and a second control path, the first control path is a control path corresponding to the first illegal behavior, and the second control path is a control path corresponding to the second illegal behavior. Step S1303 may be implemented by: obtaining multiple control path sets, the multiple control path sets correspond to multiple risk levels, and the target risk level is one of the multiple risk levels; and determining the target control path set corresponding to the target risk level from the multiple control path sets according to the target risk level. Specifically, the above-mentioned target control rules can be expressed in the form of control paths. For the introduction of control paths, please refer to the description in the previous article and will not be repeated here. Specifically, the target control rules can be a target control path set, and the target control path set includes control paths corresponding to illegal behaviors that need to be intercepted. For example, it can include a first control path corresponding to a first illegal behavior, and can also include a second control path corresponding to a second illegal behavior. Optionally, the target control path set can also include control paths corresponding to other illegal behaviors that need to be intercepted. The control path is used as a marker of illegal behavior to achieve the control of illegal applications, which facilitates the systematic management of the control path and improves the control efficiency. In some embodiments, multiple control path sets include multiple general control path sets and at least one special control path set, the multiple general control path sets correspond to multiple risk levels one-to-one, and each of the at least one special control path set corresponds to the identification of an application; the above-mentioned step of: determining a target control path set corresponding to the target risk level from multiple control path sets according to the target risk level, may specifically include: determining a target general control path set corresponding to the target risk level from multiple general control path sets; determining a target special control path set that matches the identification of an illegal application from at least one special control path set; generating a target control path set based on the target general control path set and the target special control path set. It should be noted that the multiple control path sets may include multiple general control path sets, which correspond to multiple risk levels one by one; the multiple control path sets may also include at least one special control path set, each special control path set represents a set of control paths that the corresponding application needs to handle specially. The above-mentioned general control path set is the general control rule mentioned above, and the special control path set is the special control rule mentioned above. The terminal device first selects a target general control path set from multiple general control path sets corresponding to multiple risk levels according to the target risk level, that is, extracts the common features of applications of the target risk level, and then finds the target special control path set corresponding to the illegal application from at least one special control path set in combination with the illegal application, that is, extracts the individual features of the illegal application, and finally merges the target general control path set and the target special control path set to obtain a target control path set that matches the illegal application. This method combines the common and individual features of the risk level of illegal applications, and can comprehensively and accurately implement the control of illegal applications, further improving the user experience. In some embodiments, the target special control path set includes a target addition control path and / or a target removal control path, the target addition control path represents the illegal behavior of illegal applications that need to be intercepted, and the target removal control path represents the illegal behavior of illegal applications that do not need to be intercepted; based on the target general control path set and the target special control path set, a target control path set is generated, including: adding a target addition control path to the target general control path set, and / or deleting a target removal control path from the target general control path set to obtain a target control path set. Each of the above-mentioned special control path sets may include some control paths of the corresponding application that are different from the general control path set, may include an add control path that needs to be added, and may also include a remove control path that needs to be deleted. Then the target special control path set may include a target add control path and / or a target remove control path. Specifically, the terminal device can add a target addition control path based on the target general control path set, and / or delete a target removal control path from the target general control path set to obtain a final target control path set. This method combines the common and individual characteristics of the risk level of illegal applications, and can fully implement the control of illegal applications. The implementation method is simple and accurate. In some embodiments, multiple general control path sets include multiple fixed general sets and multiple artificial intelligence AI general sets, and the multiple fixed general sets, the multiple AI general sets and the multiple risk levels correspond one to one. The multiple fixed general sets are sets corresponding to the multiple risk levels obtained by fixed rule identification, and the multiple AI general sets are sets corresponding to the multiple risk levels obtained by AI identification; determining a target general control path set corresponding to the target risk level from the multiple general control path sets includes: determining a target general control path set corresponding to both the target risk level and the target identification source from the multiple general control path sets, the target identification source characterizing the identification method of the target risk level is fixed rule identification or AI identification; when the target identification source is fixed rule identification, the target general control path set is a target fixed general set, and the target fixed general set is one of the multiple fixed general sets; when the target identification source is AI identification, the target general control path set is a target AI general set, and the target AI general set is one of the multiple AI general sets. The above-mentioned multiple general control path sets can also be sets corresponding to different identification sources. It should be noted that the identification source can include fixed rule identification and AI identification. Among them, fixed rule identification means that the general control path set is a set corresponding to the risk level identified by using fixed rules; AI identification means that the general control path set is a set corresponding to the risk level identified by using an AI model. For example, when multiple risk levels include high risk, medium risk and low risk, multiple general management and control path sets may include three general management and control path sets of high risk, medium risk and low risk whose identification sources are fixed rules; and / or, three general management and control path sets of high risk, medium risk and low risk whose identification sources are AI. Optionally, fixed rule identification can also include end-side fixed rule identification and cloud-side fixed rule identification; AI identification can include end-side AI identification and cloud-side AI identification. Among them, the end-side fixed rule identification identifies that the universal control path set is a set corresponding to the risk level identified by the fixed rule method on the end side (terminal device side); the cloud-side fixed rule identification identifies that the universal control path set is a set corresponding to the risk level identified by the fixed rule method on the cloud side (cloud-side server); the end-side AI identification indicates that the universal control path set is a set corresponding to the risk level identified by the end-side AI model; the cloud-side AI identification indicates that the universal control path set is a set corresponding to the risk level identified by the cloud-side AI model. Then the target identification source can characterize the identification method of the target risk level as end-side fixed rule identification, end-side AI identification, cloud-side fixed rule identification or cloud-side AI identification. For example, when multiple risk levels include high risk, medium risk and low risk, multiple general management and control path sets may include three general management and control path sets of high risk, medium risk and low risk identified by fixed rules on the end side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by AI on the end side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by fixed rules on the cloud side; and / or, three general management and control path sets of high risk, medium risk and low risk identified by AI on the cloud side. The identification source containing the "end side" identifier indicates that the identification process occurs on the terminal device, and the identification source containing the "cloud side" identifier indicates that the identification process occurs on the cloud side server. The fixed rules or AI models used on the end side and the cloud side may be different. When selecting the target universal control path set, the target universal control path set may also be selected in combination with the identification source, so that the obtained target universal control path set is more accurate, thereby making the control of illegal applications more precise. In some embodiments, an end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: if the identifier of the illegal application corresponding to the first illegal behavior sequence is not in a preset illegal list, the end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level; the preset illegal list includes the identifier of at least one identified application, and the identified application is an application with an identified risk level. In some embodiments, the method further includes: if the identifier of the illegal application corresponding to the first illegal behavior sequence exists in a preset illegal list, determining the risk level of the identifier of the illegal application of the first illegal behavior sequence in the preset illegal list as the target risk level. It should be noted that the cloud-side server may store a preset illegal list of one or more applications with identified risk levels, which may then be sent to the terminal device for use. The terminal device may receive the preset illegal list at idle time. Before identification, the terminal device can first use the end-side AI model to identify the risk level of the first illegal behavior sequence, and can also check whether the illegal application is an application with an identified risk level. If the identifier of the illegal application corresponding to the first illegal behavior sequence is not in the preset illegal list, it means that the risk level of the illegal application has not yet been identified, and the end-side AI model will continue to be used for identification. If the identifier of the illegal application corresponding to the first illegal behavior sequence is in the preset illegal list, it means that the risk level of the illegal application has been identified, and there is no need to use the end-side AI model for repeated identification, which can save system resources and power consumption, and improve identification efficiency. In some embodiments, an end-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: using a trigger management module in the end-side AI model to determine whether the first illegal behavior sequence meets the trigger condition; if so, using an identification module in the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level. The terminal device identifies the risk level of the first illegal behavior sequence only when the behavioral characteristics of the first illegal behavior sequence meet the trigger conditions. Obtaining the target risk level can filter out situations that need to be identified, avoid situations that do not need to be identified, reduce invalid identification processes, and thus save system resources and power consumption. In some embodiments, the recognition module in the terminal-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain a target risk level, including: using the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain a target risk level. The terminal device can identify the first illegal behavior sequence through fixed rule identification and / or AI identification by the identification module to obtain the target risk level, and the implementation method is flexible. In some embodiments, an identification module is used to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain a target risk level, including: using a fixed rule identification submodule in the identification module to perform fixed rule identification on the first illegal behavior sequence to obtain an initial risk level; if the initial risk level is not empty, the initial risk level is determined as the target risk level, and the target identification source is determined to be fixed rule identification; if the initial risk level is empty, the AI ​​identification submodule in the identification module is continued to be used to perform AI identification on the first illegal behavior sequence to obtain a target risk level, and the target identification source is determined to be AI identification. The terminal device can first use fixed rules for identification. If the initial risk level obtained is empty, it means that the fixed rules cannot obtain the identification result. Then continue to use the AI ​​identification submodule for identification to obtain the identification result, which can ensure the recognition rate. If the initial risk level obtained by using fixed rules for identification is not empty, it means that the fixed rules have obtained the identification result, and there is no need to use the AI ​​identification submodule for identification. The efficiency of fixed rules for identification is higher than that of the AI ​​identification submodule. In some embodiments, an identification module is used to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain a target risk level, including: using an identification module to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain an initial risk level; determining the target risk level based on the initial risk level and a virus application list, the virus application list indicating whether the risk level of the application is the highest level. The detailed description of the virus application list can be found in the above description, which will not be repeated here. The terminal device combines the initial risk level obtained by its own identification with the known virus application list, thereby correcting the identification result and obtaining a more accurate target risk level. In some embodiments, multiple risk levels include high risk, medium risk, low risk and no risk. The target risk level is determined based on the initial risk level and the virus application list, including: if there is no identification of illegal applications in the virus application list, the initial risk level is determined to be the target risk level; if there is an identification of illegal applications in the virus blacklist in the virus application list, and the initial risk level is empty, the target risk level is determined to be high risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is empty, the target risk level is determined to be no risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is high risk or medium risk, the target risk level is determined to be medium risk. If the package name of the application is not in the virus application list (empty or NA), the final identification result is based on the identification result of the terminal side. If the virus application list indicates that the application is on the virus blacklist (determined to be a virus), and the preliminary identification result of the illegal application is empty, the final identification result is high risk, that is, it is treated as a virus with the highest risk level. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application on the terminal side is empty, the final identification result is not a virus application, for example, it can be risk-free. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is high risk or medium risk, the final identification result is medium risk. The terminal device reasonably combines the initial risk level obtained by its own identification with the known virus application list, so as to accurately correct the identification result and obtain a more accurate target risk level. In some embodiments, target control rules corresponding to illegal applications are generated according to the target risk level, including: if the target risk level is high risk or low risk, the step of generating target control rules corresponding to illegal applications according to the target risk level is executed; if the target risk level is medium risk, when the first illegal behavior of the illegal application is monitored, the step of generating target control rules corresponding to the illegal application according to the target risk level is executed. If the target risk level of the illegal application is high risk or low risk, the instantiation of the control rules for the illegal application can be directly triggered when the risk level is identified. The description of the instantiation of the control rules can also be found in the description of the aforementioned embodiment, which will not be repeated here. If the target risk level of the illegal application is medium risk, it is still impossible to determine whether the illegal application will really affect the current user at this time. Then, when the first illegal behavior of the illegal application is monitored again, it can be determined that the illegal application is active and will affect the user. Only then is the instantiation of the control rules for the illegal application triggered, which can avoid the instantiation of invalid control rules, thereby saving resources. In some embodiments, obtaining a first illegal behavior sequence includes: collecting a suspected behavior sequence; determining whether the suspected behavior sequence matches a behavior sequence whitelist, the behavior sequence whitelist including behavior sequence identifiers corresponding to M behavior sequences that need to be monitored, where M is a non-negative integer; if so, determining that the suspected behavior sequence is the first illegal behavior sequence; if not, discarding the suspected behavior sequence. When the terminal device monitors the behavior sequence, it will insert the behavior series that need to be monitored. These behavior sequences that need to be monitored are called suspected behavior sequences, which are used to characterize suspected behaviors. After the terminal device collects the suspected behavior sequence, it can be compared with the behavior sequence whitelist. If the suspected behavior sequence matches the behavior sequence whitelist, it means that the suspected behavior sequence needs to be reported and identified. If the suspected behavior sequence does not match the behavior sequence whitelist, it means that the suspected behavior sequence does not need to be reported for identification. Among them, the suspected behavior sequence and the behavior sequence whitelist match, which may be that the identifier of the suspected behavior sequence is in the behavior sequence whitelist; the suspected behavior sequence and the behavior sequence whitelist do not match, which may be that the identifier of the suspected behavior sequence is not in the behavior sequence whitelist. The description of the behavior sequence whitelist and behavior sequence collector can also be found in the previous article. The suspected behavior sequence is the behavior sequence reported to the behavior sequence collector by the logic function module in the previous article. The suspected behavior sequence is screened by the behavior sequence collector, and the behavior sequence that matches the behavior sequence whitelist is reported and identified as the first illegal behavior sequence. The unmatched ones are directly discarded, which can avoid reporting a large number of invalid behavior sequences, save system resources, and improve data processing efficiency. In some embodiments, before determining whether the suspected behavior sequence matches the behavior sequence whitelist, it also includes: obtaining an initial behavior sequence; determining whether the behavior characteristics of the initial behavior sequence meet the monitoring conditions; if so, adding the behavior sequence identifier of the initial behavior sequence to the behavior sequence whitelist. The method of obtaining the behavior sequence whitelist can also be referred to in the previous article, which will not be repeated here. The terminal device adds the behavior sequences that meet the monitoring conditions to the behavior sequence whitelist, and can filter out the behavior sequences that need to be reported based on the behavior characteristics and monitoring conditions of the behavior sequences and generate a behavior sequence whitelist to filter the reported behavior sequences, thereby improving the accuracy of the reported behavior sequences and thus improving the rationality of application management and control. In some embodiments, the monitoring conditions include a combination of one or more of the following conditions: the installation duration of the illegal application corresponding to the initial behavior sequence is less than or equal to a preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a first preset time period exceeds the first preset number threshold; the upgrade duration of the illegal application is less than or equal to the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within the first preset time period exceeds the first preset number threshold; the installation duration and / or upgrade duration of the illegal application is greater than the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a second preset time period exceeds the second preset number threshold; the identifier of the illegal application exists in the list of applications to be monitored, and the device identifier of the terminal device matches the device identifier corresponding to the identifier of the illegal application in the list of applications to be monitored, the list of applications to be monitored includes multiple identifiers of applications to be monitored that need to be monitored, and the list of applications to be monitored is a list issued by Cloud Testing; the identifier of the illegal application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the illegal application, and the blacklist of identified illegal applications includes at least one identifier of an illegal application; The identifier of the illegal application exists in the blacklist of identified illegal applications, and the control path corresponding to the initial behavior sequence does not exist in the existing control path corresponding to the illegal application; the temperature of the terminal device is lower than the preset temperature threshold, and / or the battery power of the terminal device in an uncharged state is greater than the preset power threshold; wherein the first preset time period is a time period less than one day, and the second preset time period is a time period less than or equal to one day. In the above monitoring conditions, by setting different monitoring conditions for newly installed or newly upgraded applications and applications that have been installed or upgraded for a long time, it is possible to comprehensively and reasonably screen out suspected behaviors that need to be monitored and trigger application monitoring, as well as the list of applications to be monitored and the blacklist of identified illegal applications, which can help quickly and accurately screen out suspected behaviors that need to be monitored. This method avoids invalid monitoring processes and makes the monitoring triggering method of applications more reasonable and complete, thereby improving resource utilization. Combining battery power as a monitoring condition can avoid the situation where the battery is too low and the power consumption is too fast due to monitoring suspected behaviors, shortening the standby time, and giving priority to ensuring the standby time, thereby improving the user experience; combining temperature as a monitoring condition can avoid the consumption of the remaining power, and can also avoid the situation where the terminal device is continuously overheated and the device is damaged and the user feels that the experience is not high, such as being hot. In some embodiments, the first illegal behavior is controlled according to the target control rule, including: querying whether the first control path exists in the target control path set; if it exists, intercepting the first illegal behavior; if it does not exist, allowing the first illegal behavior. In some embodiments, the method also includes: querying whether there is a third control path in the target control path set, the third control path is the control path corresponding to the third illegal behavior, the third illegal behavior is the illegal behavior of the illegal application, the third illegal behavior is the same as or different from the first illegal behavior or the second illegal behavior; if it exists, intercepting the third illegal behavior; if it does not exist, allowing the third illegal behavior. When the terminal device is about to initiate an illegal behavior, it can query whether there is a control path corresponding to the illegal behavior in the target control path set. For example, when initiating the third illegal behavior, it can query whether there is a third control path. If it exists, it means that the third illegal behavior needs to be intercepted, so the third illegal behavior can be intercepted directly; if it does not exist, it means that the third illegal behavior does not need to be intercepted, so it can be released and the process of initiating the third illegal behavior can continue, thereby realizing precise control of illegal behaviors. In some embodiments, the method further includes: recording a control record of the illegal behavior, the control record indicating whether the illegal behavior is intercepted; and uploading the control record according to a preset reporting cycle. The preset reporting period can be a fixed period, such as one day, or a fixed state, such as when the terminal device is idle, or when the cloud server needs to report, and the reporting timing can be handled flexibly. The control record here is the record of the control information mentioned above. The specific description of the control information is not repeated here. Before the illegal behavior is initiated, the target control path set is queried, and the corresponding control information will be generated and recorded. After that, the control record can be uploaded to the cloud-side server, so that the cloud-side server can modify the various models and lists mentioned above according to the control record to improve accuracy. The above describes in detail an example of the method provided by the present application. It is understandable that, in order to implement the above functions, the corresponding device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application. The present application can divide the functional modules of the device for application management according to the above method example. For example, each function can be divided into each functional module, or two or more functions can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. FIG14 shows a schematic diagram of the structure of an application management device provided by the present application. The device 1400 includes: The acquisition module 1401 is configured to acquire a first illegal behavior sequence, where the first illegal behavior sequence represents a first illegal behavior of an illegal application. The processing module 1402 is used to use the terminal-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level. The control module 1403 is used to generate a target control rule corresponding to the illegal application according to the target risk level, and to control the first illegal behavior according to the target control rule. Optionally, the control module 1403 is further used to control a second illegal behavior according to the target control rule, where the second illegal behavior is an illegal behavior of an illegal application, and the second illegal behavior is different from the first illegal behavior. Optionally, the target control rule includes a target control path set formed by a first control path and a second control path, the first control path is the control path corresponding to the first illegal behavior, and the second control path is the control path corresponding to the second illegal behavior; the control module 1403 is specifically used to obtain multiple control path sets, and determine the target control path set corresponding to the target risk level from the multiple control path sets according to the target risk level, the multiple control path sets correspond to multiple risk levels, and the target risk level is one of the multiple risk levels. Optionally, the multiple control path sets include multiple general control path sets and at least one special control path set, the multiple general control path sets correspond one-to-one to the multiple risk levels, and each of the at least one special control path set corresponds to the identification of an application; the control module 1403 is specifically used to determine a target general control path set corresponding to the target risk level from the multiple general control path sets; determine a target special control path set that matches the identification of the illegal application from at least one special control path set; and generate a target control path set based on the target general control path set and the target special control path set. Optionally, the target special control path set includes a target addition control path and / or a target removal control path, the target addition control path represents the illegal behavior of illegal applications that need to be intercepted, and the target removal control path represents the illegal behavior of illegal applications that do not need to be intercepted; the control module 1403 is specifically used to add a target addition control path to the target general control path set, and / or delete a target removal control path from the target general control path set to obtain a target control path set. Optionally, the multiple general control path sets include multiple fixed general sets and multiple artificial intelligence AI general sets, and the multiple fixed general sets, the multiple AI general sets and the multiple risk levels correspond one to one. The multiple fixed general sets are sets corresponding to the multiple risk levels obtained by fixed rule identification, and the multiple AI general sets are sets corresponding to the multiple risk levels obtained by AI identification; the control module 1403 is specifically used to determine, from the multiple general control path sets, a target general control path set corresponding to both the target risk level and the target identification source, the target identification source characterizing the identification method of the target risk level is fixed rule identification or AI identification; when the target identification source is fixed rule identification, the target general control path set is a target fixed general set, and the target fixed general set is one of the multiple fixed general sets; when the target identification source is AI identification, the target general control path set is a target AI general set, and the target AI general set is one of the multiple AI general sets. Optionally, processing module 1402 is specifically used to use an end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level when the identifier of the illegal application corresponding to the first illegal behavior sequence is not in the preset illegal list; the preset illegal list includes the identifier of at least one identified application, and the identified application is an application with an identified risk level. Optionally, the processing module 1402 is specifically configured to determine the risk level of the illegal application identifier of the first illegal behavior sequence in the preset illegal list as the target risk level when the illegal application identifier corresponding to the first illegal behavior sequence exists in the preset illegal list. Optionally, the processing module 1402 is specifically used to use the trigger management module in the end-side AI model to determine whether the first illegal behavior sequence meets the trigger condition; if so, use the identification module in the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain the target risk level. Optionally, the processing module 1402 is specifically configured to use the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain a target risk level. Optionally, the processing module 1402 is specifically used to use the fixed rule identification submodule in the identification module to perform fixed rule identification on the first illegal behavior sequence to obtain an initial risk level; if the initial risk level is not empty, the initial risk level is determined as the target risk level, and the target identification source is determined to be fixed rule identification; if the initial risk level is empty, the AI ​​identification submodule in the identification module continues to be used to perform AI identification on the first illegal behavior sequence to obtain the target risk level, and the target identification source is determined to be AI identification. Optionally, the processing module 1402 is specifically used to use the identification module to perform fixed rule identification and / or AI identification on the first illegal behavior sequence to obtain an initial risk level; determine the target risk level based on the initial risk level and the virus application list, and the virus application list represents whether the risk level of the application program is the highest level. Optionally, multiple risk levels include high risk, medium risk, low risk and no risk, and processing module 1402 is specifically used to determine that the initial risk level is the target risk level if there is no identification of illegal applications in the virus application list; if there is an identification of illegal applications in the virus blacklist in the virus application list, and the initial risk level is empty, the target risk level is determined to be high risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is empty, the target risk level is determined to be no risk; if there is an identification of illegal applications in the virus whitelist in the virus application list, and the initial risk level is high risk or medium risk, the target risk level is determined to be medium risk. Optionally, the management and control module 1403 is specifically used to execute the step of generating target management and control rules corresponding to illegal applications according to the target risk level if the target risk level is high risk or low risk; if the target risk level is medium risk, then when the first illegal behavior of the illegal application is monitored, execute the step of generating target management and control rules corresponding to the illegal application according to the target risk level. Optionally, acquisition module 1401 is specifically used to collect suspected behavior sequences; determine whether the suspected behavior sequence matches a behavior sequence whitelist, the behavior sequence whitelist includes behavior sequence identifiers corresponding to M behavior sequences that need to be monitored, M is a non-negative integer; if so, determine that the suspected behavior sequence is the first illegal behavior sequence; if not, discard the suspected behavior sequence. Optionally, the acquisition module 1401 is specifically configured to acquire an initial behavior sequence; determine whether the behavior characteristics of the initial behavior sequence meet the monitoring conditions; and if so, add the behavior sequence identifier of the initial behavior sequence to the behavior sequence whitelist. Optionally, the monitoring conditions include a combination of one or more of the following conditions: the installation duration of the illegal application corresponding to the initial behavior sequence is less than or equal to a preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a first preset time period exceeds the first preset number threshold; the upgrade duration of the illegal application is less than or equal to the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within the first preset time period exceeds the first preset number threshold; the installation duration and / or upgrade duration of the illegal application is greater than the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a second preset time period exceeds the second preset number threshold; the identifier of the illegal application exists in the list of applications to be monitored, and the device identifier of the terminal device and the identifier of the illegal application are in the list of applications to be monitored. The corresponding device identifier matches, the list of monitored applications includes multiple identifiers of monitored applications that need to be monitored, and the list of monitored applications is a list issued by Cloud Testing; the identifier of the illegal application exists in the identified illegal application blacklist, and there is no corresponding control path for the illegal application, and the identified illegal application blacklist includes at least one illegal application identifier; the identifier of the illegal application exists in the identified illegal application blacklist, and there is no control path corresponding to the initial behavior sequence in the existing control path corresponding to the illegal application; the temperature of the terminal device is lower than the preset temperature threshold, and / or the battery power of the terminal device in the uncharged state is greater than the preset power threshold; wherein the first preset time period is a time period less than one day, and the second preset time period is a time period less than or equal to one day. Optionally, the control module 1403 is specifically used to query whether there is a first control path in the target control path set; if so, intercept the first illegal behavior; if not, allow the first illegal behavior. Optionally, the control module 1403 is specifically used to query whether there is a third control path in the target control path set, the third control path is the control path corresponding to the third illegal behavior, the third illegal behavior is the illegal behavior of the illegal application, the third illegal behavior is the same as or different from the first illegal behavior or the second illegal behavior; if it exists, the third illegal behavior is intercepted; if it does not exist, the third illegal behavior is released. Optionally, the control module 1403 is also used to record control records of illegal behaviors, where the control records indicate whether the illegal behaviors are intercepted; and the control records are uploaded according to a preset reporting cycle. The specific manner in which device 1400 executes the application management method and the beneficial effects produced can be found in the relevant description of the method embodiment, which will not be repeated here. An embodiment of the present application also provides an electronic device, including the above-mentioned processor. The electronic device provided in this embodiment may be the terminal device 100 shown in Figure 1, which is used to execute the above-mentioned application management method. In the case of an integrated unit, the terminal device may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the terminal device, for example, it can be used to support the terminal device to execute the steps performed by the display unit, the detection unit and the processing unit. The storage module can be used to support the terminal device to execute stored program codes and data, etc. The communication module can be used to support the communication between the terminal device and other devices. Among them, the processing module can be a processor or a controller. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processor (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other terminal devices, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc. In one embodiment, when the processing module is a processor and the storage module is a memory, the terminal device involved in this embodiment may be a device having the structure shown in FIG. 1 . An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the application management method described in any of the above embodiments. The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the application management method in the above-mentioned embodiment. Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here. In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, the replaced units may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code. The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An application management method, characterized in that: Applied to a terminal device, the method comprises: Acquire a first illegal behavior sequence, where the first illegal behavior sequence represents a first illegal behavior of an illegal application; Using the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain a target risk level; generating a target control rule corresponding to the illegal application according to the target risk level; The first illegal behavior is controlled according to the target control rules.

2. The method according to claim 1, characterized in that The method further comprises: A second illegal behavior is controlled according to the target control rule, where the second illegal behavior is an illegal behavior of the illegal application, and the second illegal behavior is different from the first illegal behavior.

3. The method according to claim 2, characterized in that The target control rule includes a target control path set formed by a first control path and a second control path, wherein the first control path is a control path corresponding to the first illegal behavior, and the second control path is a control path corresponding to the second illegal behavior; Generating target control rules corresponding to the illegal application according to the target risk level includes: Acquire multiple control path sets, where the multiple control path sets correspond to multiple risk levels, and the target risk level is one of the multiple risk levels; The target control path set corresponding to the target risk level is determined from the multiple control path sets according to the target risk level.

4. The method according to claim 3, characterized in that The multiple control path sets include multiple general control path sets and at least one special control path set, the multiple general control path sets correspond to the multiple risk levels one by one, and each of the at least one special control path set corresponds to an identifier of an application; The determining, according to the target risk level, from the multiple control path sets, the target control path set corresponding to the target risk level includes: Determining a target general management and control path set corresponding to the target risk level from the multiple general management and control path sets; Determine a target special control path set that matches the identifier of the illegal application from the at least one special control path set; The target control path set is generated according to the target general control path set and the target special control path set.

5. The method according to claim 4, characterized in that The target special control path set includes a target addition control path and / or a target removal control path, wherein the target addition control path represents the illegal behavior of the illegal application that needs to be intercepted, and the target removal control path represents the illegal behavior of the illegal application that does not need to be intercepted; The generating the target control path set according to the target general control path set and the target special control path set includes: The target addition control path is added to the target general control path set, and / or the target removal control path is deleted from the target general control path set to obtain the target control path set.

6. The method according to claim 4 or 5, characterized in that: The multiple general control path sets include multiple fixed general sets and multiple artificial intelligence AI general sets, and the multiple fixed general sets, the multiple AI general sets and the multiple risk levels correspond one to one. The multiple fixed general sets are sets corresponding to the multiple risk levels identified by using fixed rules, and the multiple AI general sets are sets corresponding to the multiple risk levels identified by using AI; The determining, from the plurality of general control path sets, a target general control path set corresponding to the target risk level comprises: Determine, from the plurality of universal control path sets, the target universal control path set corresponding to both the target risk level and the target identification source, wherein the target identification source indicates that the identification method of the target risk level is fixed rule identification or AI identification; When the target identification source is the fixed rule identification, the target universal control path set is a target fixed universal set, and the target fixed universal set is one of the multiple fixed universal sets; When the target identification source is the AI ​​identification, the target universal management path set is a target AI universal set, and the target AI universal set is one of the multiple AI universal sets.

7. The method according to claim 1, characterized in that The risk level of the first illegal behavior sequence is identified by using the end-side AI model to obtain a target risk level including: If the identifier of the illegal application corresponding to the first illegal behavior sequence is not in the preset illegal list, using the terminal-side AI model to identify the risk level of the first illegal behavior sequence to obtain the target risk level; The preset illegal list includes at least one identifier of an identified application, and the identified application is an application with an identified risk level.

8. The method according to claim 7, characterized in that The method further comprises: If the identifier of the illegal application corresponding to the first illegal behavior sequence exists in the preset illegal list, the risk level of the identifier of the illegal application of the first illegal behavior sequence in the preset illegal list is determined to be the target risk level.

9. The method according to claim 7 or 8, characterized in that: The using the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain the target risk level includes: Using the trigger management module in the end-side AI model, determining whether the first illegal behavior sequence meets the trigger condition; If so, the identification module in the terminal-side AI model is used to identify the risk level of the first illegal behavior sequence to obtain the target risk level.

10. The method according to claim 9, characterized in that The using the recognition module in the end-side AI model to identify the risk level of the first illegal behavior sequence to obtain the target risk level includes: The recognition module is used to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain the target risk level.

11. The method according to claim 10, characterized in that The using the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain the target risk level includes: Using a fixed rule recognition submodule in the recognition module to perform fixed rule recognition on the first illegal behavior sequence to obtain an initial risk level; If the initial risk level is not empty, the initial risk level is determined as the target risk level, and the target identification source is determined to be fixed rule identification; If the initial risk level is empty, the AI ​​recognition submodule in the recognition module continues to perform AI recognition on the first illegal behavior sequence to obtain the target risk level, and determines that the target recognition source is AI recognition.

12. The method according to claim 10, characterized in that The using the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain the target risk level includes: Using the recognition module to perform fixed rule recognition and / or AI recognition on the first illegal behavior sequence to obtain an initial risk level; The target risk level is determined according to the initial risk level and the virus application list, wherein the virus application list indicates whether the risk level of the application program is the highest level.

13. The method according to claim 12, characterized in that The multiple risk levels include high risk, medium risk, low risk and no risk. The target risk level is determined according to the initial risk level and the virus application list, including: If the identifier of the illegal application does not exist in the virus application list, determining the initial risk level to be the target risk level; If the identifier of the illegal application exists in the virus blacklist in the virus application list, and the initial risk level is empty, then determining the target risk level to be high risk; If the identifier of the illegal application exists in the virus whitelist in the virus application list, and the initial risk level is empty, then the target risk level is determined to be no risk; If the identifier of the illegal application exists in the virus whitelist in the virus application list, and the initial risk level is high risk or medium risk, the target risk level is determined to be medium risk.

14. The method according to any one of claims 1 to 13, characterized in that Generating target control rules corresponding to the illegal application according to the target risk level includes: If the target risk level is high risk or low risk, executing the step of generating a target control rule corresponding to the illegal application according to the target risk level; If the target risk level is medium risk, then when the first illegal behavior of the illegal application is monitored, the step of generating a target control rule corresponding to the illegal application according to the target risk level is performed.

15. The method according to any one of claims 7 to 13, characterized in that The obtaining of the first illegal behavior sequence includes: Collect suspected behavior sequences; Determine whether the suspected behavior sequence matches a behavior sequence whitelist, where the behavior sequence whitelist includes behavior sequence identifiers corresponding to M behavior sequences that need to be monitored, where M is a non-negative integer; If yes, determining that the suspected behavior sequence is the first illegal behavior sequence; If not, the suspected behavior sequence is discarded.

16. The method according to claim 15, characterized in that Before determining whether the suspected behavior sequence matches the behavior sequence whitelist, the method further includes: Get the initial behavior sequence; Determining whether the behavior characteristics of the initial behavior sequence meet monitoring conditions; If so, the behavior sequence identifier of the initial behavior sequence is added to the behavior sequence whitelist.

17. The method according to claim 16, characterized in that The monitoring conditions include one or more combinations of the following conditions: The installation duration of the illegal application corresponding to the initial behavior sequence is less than or equal to a preset number of days threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within a first preset time period exceeds a first preset number threshold; The upgrade duration of the illegal application is less than or equal to a preset number of days, and the number of executions of the behavior corresponding to the initial behavior sequence within a first preset time period exceeds the first preset number of executions; The installation duration and / or upgrade duration of the illegal application is greater than the preset day threshold, and the number of executions of the behavior corresponding to the initial behavior sequence within the second preset time period exceeds the second preset number threshold; The identifier of the illegal application exists in the list of applications to be monitored, and the device identifier of the terminal device and the device identifier corresponding to the identifier of the illegal application in the list of applications to be monitored match, the list of applications to be monitored includes identifiers of multiple applications to be monitored that need to be monitored, and the list of applications to be monitored is a list issued by Cloud Testing; The identifier of the illegal application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the illegal application, and the blacklist of identified illegal applications includes at least one identifier of the illegal application; The identifier of the illegal application exists in the blacklist of identified illegal applications, and the control path corresponding to the initial behavior sequence does not exist in the existing control path corresponding to the illegal application; The temperature of the terminal device is lower than a preset temperature threshold, and / or the battery power of the terminal device in an uncharged state is greater than a preset power threshold; The first preset time period is a time period that is less than one day, and the second preset time period is a time period that is less than or equal to one day.

18. The method according to claim 3, characterized in that The controlling the first illegal behavior according to the target control rule includes: Querying whether the first control path exists in the target control path set; If so, intercepting the first illegal behavior; If not, the first illegal behavior will be allowed.

19. The method according to claim 3, characterized in that The method further comprises: querying whether there is a third control path in the target control path set, the third control path is a control path corresponding to a third illegal behavior, the third illegal behavior is an illegal behavior of the illegal application, and the third illegal behavior is the same as or different from the first illegal behavior or the second illegal behavior; If so, intercepting the third illegal behavior; If not present, the third illegal behavior is allowed.

20. The method according to claim 18 or 19, characterized in that The method further comprises: A control record recording the illegal behavior, wherein the control record indicates whether the illegal behavior is intercepted; Upload the control records according to the preset reporting cycle.

21. An electronic device, characterized in that: include: Processors, memory, and interfaces; The processor, the memory and the interface cooperate with each other so that the electronic device executes the method as claimed in any one of claims 1 to 20.

22. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 20.

Images