CN105975861A - Application detection method and device - Google Patents
Application detection method and device Download PDFInfo
- Publication number
- CN105975861A CN105975861A CN201610366158.XA CN201610366158A CN105975861A CN 105975861 A CN105975861 A CN 105975861A CN 201610366158 A CN201610366158 A CN 201610366158A CN 105975861 A CN105975861 A CN 105975861A
- Authority
- CN
- China
- Prior art keywords
- application
- file
- degree
- learning model
- deep learning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses an application detection method and device. The method comprises the specific implementation steps that model data is read from a local deep study model file stored in a mobile terminal, and a deep study model is constructed through the read model data; feature extraction is conducted on a to-be-detected application program installation file; extracted features are subjected to conversion processing to be converted into feature data matched with input of the deep study model; the feature data is input to the deep study model to be matched, and the matching degree of the to-be-detected application program installation file and a preset application type is obtained; a detection result associated with the matching degree is displayed. According to the method, the network traffic that the mobile terminal consumes in the application detection process is decreased.
Description
Technical field
The application relates to field of computer technology, is specifically related to information security field, particularly relates to
Applying detection method and apparatus.
Background technology
In field of mobile terminals, Mobile solution quantity is fiery to be increased, some characteristic of application program
Use to user can produce many and diverse influences.Some type of application program may be with
The unwanted characteristic of some users or function, some type of application program even brings safety hidden
Suffer from.It is analyzed accordingly, it would be desirable in time application program is installed file, to determine whether it is
Certain type of application.At present, at detection application program, prior art installs whether file belongs to
During certain application type, generally by installation files passe to high in the clouds, then specifically performed by high in the clouds
Detection to this installation file operates.
But, this mode needs to upload installation file and detection process performs beyond the clouds, file
Upload and need to consume the substantial amounts of flow of mobile terminal, and upload the required time and also result in
Detecting speed when detecting local file relatively slow, mobile terminal can not real-time exhibition detection
Result.
Summary of the invention
The purpose of the application is to propose the applying detection method and apparatus of a kind of improvement, solves
The technical problem that background section above is mentioned.
First aspect, this application provides a kind of applying detection method, and described method includes: from
It is stored in reading model data in the degree of deep learning model file that mobile terminal is local, and utilizes institute
The model data construction deep learning model read；Application program to be detected is installed file carry out
Feature extraction；The feature extracted is carried out conversion process, learns with the described degree of depth to be converted into
The characteristic that the input of model matches；The input of described characteristic is learnt to the described degree of depth
Model mates, and obtains described application program to be detected and installs file and default application type
Matching degree；Show the testing result being associated with described matching degree.
In certain embodiments, described method also includes: by pre-recorded cloud server
It is more newly requested, with to institute that address periodically sends degree of deep learning model file to cloud server address
State degree of deep learning model file to be updated.
In certain embodiments, described method also includes: in response to user to described mobile terminal
The model modification order sent, by pre-recorded cloud server address to cloud server
It is more newly requested, to enter described degree of deep learning model file that address sends degree of deep learning model file
Row updates.
In certain embodiments, the testing result that described displaying is associated with described matching degree, bag
Include: determine that described application program to be detected is installed file and belonged to described default according to described matching degree
The probability of application type, and show testing result with Probability Forms.
In certain embodiments, the testing result that described displaying is associated with described matching degree, bag
Include: described matching degree is compared with the matching degree threshold value pre-set；When described matching degree
During more than described matching degree threshold value, determine that testing result is that described application program to be detected installs literary composition
Part belongs to described default application type and is shown, and otherwise determines that testing result is described to be checked
Survey application program installation file be not belonging to described default application type and be shown.
In certain embodiments, described to described application program to be detected install file carry out feature
Extract, including: extract described application program and the file structure feature of file is installed.
In certain embodiments, described default application type is following any one: insert containing advertisement
Part application, containing paying plug-in application, containing statistics plug-in application, containing collecting plug-in application, plug-in
Application, harassing and wrecking application, risk application, spy's application.
Second aspect, this application provides a kind of applying detection device, and described device includes: read
Take unit, for from being stored in reading model the degree of deep learning model file that mobile terminal is local
Data, and utilize read model data construction deep learning model；Extraction unit, is used for
Application program to be detected is installed file and carries out feature extraction；Converting unit, for being extracted
Feature carry out conversion process, to be converted into what the input with described degree of deep learning model matched
Characteristic；Matching unit, for by described characteristic input extremely described degree of deep learning model
Mate, obtain described application program to be detected and mating of file and default application type is installed
Degree；Display unit, for showing the testing result being associated with described matching degree.
In certain embodiments, the first model modification unit, for by pre-recorded high in the clouds
It is more newly requested that server address periodically sends degree of deep learning model file to cloud server address,
So that described degree of deep learning model file is updated.
In certain embodiments, described device also includes: the second model modification unit, is used for ringing
The model modification order that should send to described mobile terminal in user, by pre-recorded high in the clouds
It is more newly requested, with right that server address sends degree of deep learning model file to cloud server address
Described degree of deep learning model file is updated.
In certain embodiments, described display unit is further used for: true according to described matching degree
Fixed described application program to be detected is installed file and is belonged to the probability of described default application type, and with
Probability Forms shows testing result.
In certain embodiments, described display unit is further used for: by described matching degree with pre-
The matching degree threshold value first arranged compares；When described matching degree is more than described matching degree threshold value,
Determine that testing result is that described application program to be detected installation file belongs to described default application type
And be shown, otherwise determine that testing result is that described application program to be detected installation file does not belongs to
In described default application type and be shown.
In certain embodiments, described extraction unit is further used for: extract described application program
The file structure feature of file is installed.
In certain embodiments, described default application type is following any one: insert containing advertisement
Part application, containing paying plug-in application, containing statistics plug-in application, containing collecting plug-in application, plug-in
Application, harassing and wrecking application, risk application, spy's application.
The applying detection method and apparatus that the application provides, is learnt by the degree of depth formed in this locality
Model carries out process to the data installing file extraction from application program to be detected and obtains matching degree,
And utilize matching degree generate final testing result and show so that it is made without upon execution
Data are uploaded, and save customer flow, and the application type of detection is not limited to malicious application, suitable
With wider.
Accompanying drawing explanation
By reading retouching in detail with reference to made non-limiting example is made of the following drawings
Stating, other features, purpose and advantage will become more apparent upon:
Fig. 1 is that the application can apply to exemplary system architecture figure therein；
Fig. 2 is the flow chart of an embodiment of the applying detection method according to the application；
Fig. 3 is the schematic diagram of an application scenarios of the applying detection method according to the application；
Fig. 4 is the structural representation of an embodiment of the applying detection device according to the application；
Fig. 5 is adapted for the computer for the terminal unit or server realizing the embodiment of the present application
The structural representation of system.
Detailed description of the invention
With embodiment, the application is described in further detail below in conjunction with the accompanying drawings.It is appreciated that
, specific embodiment described herein is used only for explaining related invention, rather than to this
Bright restriction.It also should be noted that, for the ease of describe, accompanying drawing illustrate only with
About the part that invention is relevant.
It should be noted that in the case of not conflicting, the embodiment in the application and embodiment
In feature can be mutually combined.Describe this below with reference to the accompanying drawings and in conjunction with the embodiments in detail
Application.
Fig. 1 shows applying detection method or the reality of applying detection device that can apply the application
Execute the exemplary system architecture 100 of example.
As it is shown in figure 1, system architecture 100 can include terminal unit 101,102,103,
Network 104 and server 105.Network 104 is in order at terminal unit 101,102,103 and
The medium of communication link is provided between server 105.Network 104 can include various connection class
Type, the most wired, wireless communication link or fiber optic cables etc..
User can use terminal unit 101,102,103 by network 104 and server 105
Alternately, to receive or to send message etc..Can be provided with on terminal unit 101,102,103
Various telecommunication customer ends are applied, such as web browser applications, mobile security class application etc..
Terminal unit 101,102,103 can be to have various mobile electronic equipment, including
But it is not limited to smart mobile phone, panel computer, E-book reader, MP3 player (Moving
Picture Experts Group Audio Layer III, dynamic image expert's compression standard audio layer
Face 3), (Moving Picture Experts Group Audio Layer IV, dynamic image is special for MP4
Family's compression standard audio frequency aspect 4) player, pocket computer on knee etc..
Server 105 can be to provide the server of various service, such as to terminal unit 101,
102, degree of deep learning model file required on 103 provides the background server supported.Backstage takes
Business device can be to the degree of deep learning model file acquisition request received or more newly requested etc. carry out point
Analysis etc. process, and result (such as corresponding degree of deep learning model file) is fed back to end
End equipment.
It should be noted that the applying detection method that the embodiment of the present application is provided can be by terminal
Equipment 101,102,103 performs；Correspondingly, applying detection device can be arranged at terminal and sets
In standby 101,102,103.
It should be understood that the number of terminal unit, network and the server in Fig. 1 is only signal
Property.According to realizing needs, can have any number of terminal unit, network and server.
With continued reference to Fig. 2, it is shown that according to an embodiment of the applying detection method of the application
Flow process 200.Described applying detection method, comprises the following steps:
Step 201, reads mould from being stored in the degree of deep learning model file that mobile terminal is local
Type data, and utilize read model data construction deep learning model.
In the present embodiment, on the electronic equipment that applying detection method is applied to it, storage has deep
Degree learning files.This electronic equipment can be mobile terminal device.This degree of deep learning model file
Can obtain from cloud server beforehand through network.Such as, electronic equipment is permissible
The application program installation kit for carrying out applying detection, this degree of depth study mould is downloaded in advance from high in the clouds
Type file can be compressed in this installation kit.Afterwards, electronic equipment is at this installation literary composition locally-installed
Part, such that it is able to it is local that degree of deep learning model file is stored in electronic equipment in advance.The most such as,
Original application program installation kit can not also comprise above-mentioned degree of deep learning model file, and permissible
Further according to user command from cloud service after installing application program by original installation kit
Device obtains this degree of deep learning model file and stores this ground, in order to follow-up use.Need
Illustrating, this degree of deep learning model file is typically less file (such as below 10M),
With sequential storage on mobile terminals, and the storage of mobile terminal can be unlikely to too much to take
Space.
Generally, electronic equipment can receive whether application file to be detected detects it
After belonging to the request of default application type, read from the degree of deep learning model file of above-mentioned storage
Model data, afterwards, utilizes model data to be re-configured to degree of deep learning model.Wherein, should
Degree of deep learning model may be used for characteristic according to application to be detected calculate application to be detected with
Preset the matching degree of application type.Wherein, reading model data and tectonic model generally can lead to
Cross the instruction of the loading to degree of deep learning model file to realize.By to degree of deep learning model file
Load instruction, the object of degree of deep learning model can be generated, then call the side that this object is corresponding
Method can realize characteristic being inputted at degree of deep learning model the characteristic to input
Reason.
Step 202, installs file to application program to be detected and carries out feature extraction.
In the present embodiment, application program to be detected is installed file by electronic equipment, can be according to
Certain rule carries out feature extraction to it.For example, it is possible to the entirety of this installation file is all made
It is characterized, now can directly obtain this installation file as feature, for subsequent step
Process.Again for example, it is possible to extract in installation software specific part data as feature.
In some optional implementations of the present embodiment, step 202 can be extracted application journey
Sequence is installed the file structure feature of file and is extracted.Under this implementation, electronic equipment is only
The architectural feature of each subfile characterized included in application program installation file is carried out
Extract.For example, it is possible to the filename length of each subfile, the distribution characteristics of file size,
Can also be that the subfile quantity under each catalogue is added up.It should be noted that file
Architectural feature includes but not limited to feature enumerated above.
Step 203, carries out conversion process to the feature extracted, and learns with the degree of depth to be converted into
The characteristic that the input of model matches.
In the present embodiment, the feature extracted based on step 202, electronic equipment is the most right
It carries out conversion process, converts thereof into the spy that the input with above-mentioned degree of deep learning model matches
Levy data.The feature that step 202 is extracted, its data structure may not with the degree of depth
The form inputting parameter in learning model agrees with mutually.Such as, the feature of original extraction is probably word
Symbol string, and degree of deep learning model receivable input parameter only supports binary character string, because of
Character string is converted into binary system according to certain rule by these needs, in order to subsequent treatment.
Step 204, mates characteristic input to degree of deep learning model, obtains to be checked
Survey application program and the matching degree of file and default application type is installed.
In the present embodiment, obtaining and the input of above-mentioned degree of deep learning model based on step 203
After the characteristic matched, the input of this feature data can be learnt by electronic equipment to this degree of depth
Model processes.Characteristic can be entered by degree of deep learning model by a series of operational rules
Row matching treatment, may finally obtain application program to be detected and install file and default application type
Matching degree.
Answer it should be noted that above-mentioned default application type can be a class with common denominator
Use program.Such as, distinguishing from security standpoint, this default application type can be Malware class
Type, it is also possible to be non-risk software type, it is also possible to be non-malware type.Subordinate act pattern
Distinguishing, this default application type can be harassing and wrecking software types, it is also possible to is externally hung software type,
Can also is that spyware type.The package types built-in from application program divides, it is also possible to be
Containing ad plug-in application, containing pay plug-in application, containing statistics plug-in application, containing collect plug-in unit should
Any one in.
Step 205, shows the testing result being associated with matching degree.
In the present embodiment, obtain application program to be detected based on step 204 and file is installed with pre-
If after the matching degree of application type, this matching degree can characterize application program to be detected and install file
And the similarity between default application type.Therefore, based on this matching degree, electronic equipment is permissible
Generate testing result and be shown.
In some optional implementations of the present embodiment, step 205 specifically can specifically perform:
Determine that application program to be detected is installed file and belonged to the probability of default application type according to matching degree,
And show testing result with Probability Forms.Under this implementation, electronic equipment can first base
Determine that application program to be detected is installed file and belonged to the probability of default application type in matching degree.Real
In trampling, directly matching degree can be regarded as probability, it is also possible to matching degree is carried out certain conversion,
Obtain corresponding probability.Such as, the decimal that matching degree is probably between 0 to 1, electronics
Equipment can convert thereof into the Probability Forms of percent and be shown.In detailed process, also may be used
To be modified waiting other to process, repeat no more here.
In some optional implementations of the present embodiment, step 205 can also be in the following manner
Perform: matching degree is compared with the matching degree threshold value pre-set；When matching degree more than
During degree of joining threshold value, application program to be detected installation file is belonged to default application type as detection
Result is also shown, and otherwise is not belonging to preset application class by application program to be detected installation file
Type is as testing result and is shown.In this implementation, electronic equipment can set in advance
Put matching degree threshold value, such as 0.5.Obtaining after matching degree, can by obtained matching degree with
This matching degree threshold value compares.Afterwards, can determine that testing result is gone forward side by side according to comparative result
Row is shown.Such as, when matching degree is more than matching degree threshold value, determine that testing result is to be detected
Application program is installed file and is belonged to default application type, and shows this testing result；Otherwise, really
Determining testing result is that application program to be detected installation file is not belonging to preset application type, and shows
Corresponding testing result.
In some optional implementations of the present embodiment, above-mentioned degree of deep learning model file is permissible
It is updated.Due to this degree of deep learning model file with for carrying out the application program of applying detection
Can be independent, therefore can be only deep to this in the case of application program not being updated
Degree learning model file.
Optionally, above-mentioned renewal operation can be fixed by pre-recorded cloud server address
It is more newly requested that phase sends degree of deep learning model file to cloud server address, to learn the degree of depth
Model file is updated.In this approach, the update cycle can be previously provided with, work as the time
When reaching the update cycle, electronic equipment can automatically send renewal by cloud server address please
Ask, update with implementation model file.Which can automatically updating with implementation model file, subtract
Few user operation.
Optionally, above-mentioned renewal operation may is that the mould sent in response to user to mobile terminal
Type more newer command, is sent to cloud server address by pre-recorded cloud server address
Degree of deep learning model file is more newly requested, to be updated degree of deep learning model file.At this
Under mode, electronic equipment can be by carrying out degree of deep learning model file the response of user operation
Update, thus realize the user's manual renewal to model file so that user can to update into
Row controls, and is the most just updated, and saves flow.
It is the application scenarios of applying detection method according to the present embodiment with continued reference to Fig. 3, Fig. 3
A schematic diagram.In the application scenarios of Fig. 3, user first passes through control 301 and selects to treat
The software (i.e. XXX.apk) of detection, and the application class of required detection is selected by control 302
Type (i.e. externally hung software), clicks on control 303 afterwards and sends detection instruction.Receiving detection instruction
After, mobile terminal device 300 can utilize the model data read in degree of deep learning model file
Construct degree of deep learning model, afterwards the software selected by user extracted feature and be converted
Become the characteristic inputting match parameters with degree of deep learning model, then the feature that will be changed
Data input to degree of deep learning model, are calculated this software to utilize degree of deep learning model to carry out
Matching degree with externally hung software.When this matching degree (such as 0.9) is more than the matching degree pre-set
During threshold value (such as 0.5), determine that testing result is that this software belongs to externally hung software, and by this inspection
Survey result to be shown, so that user knows by control 304.It should be noted that should
Merely illustrative by scene, multiple application programs can also be installed file on backstage by practice and carry out
Batch detection.
The method that above-described embodiment of the application provides is by the degree of deep learning model formed in this locality
The characteristic installing file extraction from application program to be detected is carried out process and obtains matching degree,
And utilize matching degree generate final testing result and show so that need not upon execution pass through
Network carries out data and uploads, and saves customer flow, and the application type of detection is not limited to malice
Application, the scope of application is wider.
With further reference to Fig. 4, as to the realization of method shown in above-mentioned each figure, the application provides
One embodiment of a kind of applying detection device, this device embodiment and the method shown in Fig. 2
Embodiment is corresponding, and this device specifically can apply in various electronic equipment.
As shown in Figure 4, the applying detection device 400 described in the present embodiment includes: read unit
401, extraction unit 402, converting unit 403, matching unit 404 and display unit 405.
Wherein, unit 401 is read for from being stored in the degree of deep learning model file that mobile terminal is local
Middle reading model data, and utilize read model data construction deep learning model；Extract
Unit 402 carries out feature extraction for application program to be detected is installed file；Converting unit 403
For the feature extracted is carried out conversion process, to be converted into and the input of degree of deep learning model
The characteristic matched；Matching unit 404 is for learning mould by characteristic input to the degree of depth
Type mates, and obtains application program to be detected and installs the matching degree of file and default application type；
And display unit 405 is for showing the testing result being associated with matching degree.
In the present embodiment, the reading unit 401 of applying detection device 400, extraction unit 402,
The concrete process of converting unit 403, matching unit 404 and display unit 405 is referred to Fig. 2
Step 201, step 202, step 203, step 204 and step 205 in corresponding embodiment,
Here repeat no more.
In some optional implementations of the present embodiment, device 400 also includes: the first model
Updating block (not shown), is used for by pre-recorded cloud server address periodically to high in the clouds
It is more newly requested, with to degree of deep learning model file that server address sends degree of deep learning model file
It is updated.The concrete process of this implementation is referred in Fig. 2 correspondence embodiment accordingly
Implementation, repeats no more here.
In some optional implementations of the present embodiment, device 400 also includes: the second model
Updating block (not shown), for the model modification order sent to mobile terminal in response to user,
By pre-recorded cloud server address to cloud server address transmission degree of deep learning model
File is more newly requested, to be updated degree of deep learning model file.This implementation concrete
Process is referred in Fig. 2 correspondence embodiment corresponding implementation, repeats no more here.
In some optional implementations of the present embodiment, display unit 405 is further used for:
Determine that application program to be detected is installed file and belonged to the probability of default application type according to matching degree,
And show testing result with Probability Forms.The concrete process of this implementation is referred to Fig. 2 pair
Answer corresponding implementation in embodiment, repeat no more here.
In some optional implementations of the present embodiment, display unit 405 is further used for:
Matching degree is compared with the matching degree threshold value pre-set；When matching degree is more than matching degree threshold
During value, determine that testing result is that application program to be detected installation file belongs to default application type also
It is shown, otherwise determines that testing result is that application program to be detected installation file is not belonging to preset
Application type is also shown.The concrete process of this implementation is referred to the enforcement of Fig. 2 correspondence
In example, corresponding implementation, repeats no more here.
In some optional implementations of the present embodiment, extraction unit 402 is further used for:
Extract application program and the file structure feature of file is installed.The concrete process of this implementation is permissible
Exist with reference to implementation corresponding in Fig. 2 correspondence embodiment, repeat no more here.
In some optional implementations of the present embodiment, default application type is following any one
Item: containing ad plug-in application, containing paying plug-in application, containing adding up plug-in application, inserting containing collecting
Part application, plug-in application, harassing and wrecking application, risk application, spy's application.This implementation
Concrete process is referred in Fig. 2 correspondence embodiment corresponding implementation, repeats no more here.
Below with reference to Fig. 5, it illustrates the terminal unit be suitable to for realizing the embodiment of the present application
Or the structural representation of the computer system 500 of server.
As it is shown in figure 5, computer system 500 includes CPU (CPU) 501, its
Can be according to the program being stored in read only memory (ROM) 502 or from storage part 508
It is loaded into the program in random access storage device (RAM) 503 and performs various suitable action
And process.In RAM 503, also storage has system 500 to operate required various program sums
According to.CPU 501, ROM 502 and RAM 503 are connected with each other by bus 504.Input
/ output (I/O) interface 505 is also connected to bus 504.
It is connected to I/O interface 505: include the importation 506 of keyboard, mouse etc. with lower component；
Including such as cathode ray tube (CRT), liquid crystal display (LCD) etc. and speaker etc.
Output part 507；Storage part 508 including hard disk etc.；And include such as LAN card,
The communications portion 509 of the NIC of modem etc..Communications portion 509 is via such as
The network of the Internet performs communication process.Driver 510 is connected to I/O interface also according to needs
505.Detachable media 511, such as disk, CD, magneto-optic disk, semiconductor memory etc.,
Be arranged on as required in driver 510, in order to the computer program read from it according to
Needs are mounted into storage part 508.
Especially, according to embodiment of the disclosure, the process described above with reference to flow chart is permissible
It is implemented as computer software programs.Such as, embodiment of the disclosure and include a kind of computer journey
Sequence product, it includes the computer program being tangibly embodied on machine readable media, described meter
Calculation machine program comprises the program code for performing the method shown in flow chart.In such enforcement
In example, this computer program can be downloaded and installed from network by communications portion 509,
And/or be mounted from detachable media 511.
Flow chart in accompanying drawing and block diagram, it is illustrated that according to the various embodiment of the application system,
Architectural framework in the cards, function and the operation of method and computer program product.This point
On, each square frame in flow chart or block diagram can represent a module, program segment or code
A part, a part for described module, program segment or code comprise one or more for
Realize the executable instruction of the logic function of regulation.It should also be noted that at some as replacement
In realization, the function marked in square frame can also be sent out to be different from the order marked in accompanying drawing
Raw.Such as, two square frames succeedingly represented can essentially perform substantially in parallel, they
Sometimes can also perform in the opposite order, this is depending on involved function.It is also noted that
It is, the square frame in each square frame in block diagram and/or flow chart and block diagram and/or flow chart
Combination, can realize by the special hardware based system of the function or operation that perform regulation,
Or can realize with the combination of specialized hardware with computer instruction.
Being described in the embodiment of the present application involved unit can be real by the way of software
Existing, it is also possible to realize by the way of hardware.Described unit can also be arranged on process
In device, for example, it is possible to be described as: a kind of processor includes reading unit, extraction unit, turning
Change unit, matching unit and display unit.Wherein, the title of these unit is under certain conditions
Being not intended that the restriction to this unit itself, such as, extraction unit is also described as " right
Application program to be detected is installed file and is carried out the unit of feature extraction ".
As on the other hand, present invention also provides a kind of nonvolatile computer storage media,
This nonvolatile computer storage media can be described in above-described embodiment included in device
Nonvolatile computer storage media；Can also be individualism, be unkitted allocate in terminal non-
Volatile computer storage medium.Above-mentioned nonvolatile computer storage media storage have one or
The multiple program of person, when one or more program is performed by an equipment so that described
Equipment: from being stored in reading model data the degree of deep learning model file that mobile terminal is local,
And utilize read model data construction deep learning model；Application program to be detected is installed
File carries out feature extraction；The feature extracted is carried out conversion process, to be converted into described
The characteristic that the input of degree of deep learning model matches；By the input of described characteristic to described
Degree of deep learning model mates, and obtains described application program to be detected installation file and answers with presetting
By the matching degree of type；Show the testing result being associated with described matching degree.
Above description is only the preferred embodiment of the application and saying institute's application technology principle
Bright.It will be appreciated by those skilled in the art that invention scope involved in the application, do not limit
In the technical scheme of the particular combination of above-mentioned technical characteristic, also should contain simultaneously without departing from
In the case of described inventive concept, above-mentioned technical characteristic or its equivalent feature carry out combination in any
And other technical scheme formed.Such as features described above and (but not limited to) disclosed herein
The technical characteristic with similar functions is replaced mutually and the technical scheme that formed.
Claims (14)
1. an applying detection method, it is characterised in that described method includes:
From being stored in reading model data the degree of deep learning model file that mobile terminal is local, and
Utilize the model data construction deep learning model read；
Application program to be detected is installed file and carries out feature extraction；
The feature extracted is carried out conversion process, to be converted into and described degree of deep learning model
The characteristic that input matches；
The input of described characteristic is mated to described degree of deep learning model, obtain described in treat
Detection application program installs the matching degree of file and default application type；
Show the testing result being associated with described matching degree.
Method the most according to claim 1, it is characterised in that described method also includes:
Periodically sent the degree of depth to cloud server address by pre-recorded cloud server address
Learning model file is more newly requested, to be updated described degree of deep learning model file.
Method the most according to claim 1, it is characterised in that described method also includes:
The model modification order sent to described mobile terminal in response to user, by pre-recorded
Cloud server address to cloud server address send degree of deep learning model file update please
Ask, so that described degree of deep learning model file is updated.
Method the most according to claim 1, it is characterised in that described displaying and described
The testing result that degree of joining is associated, including:
Determine that described application program to be detected is installed file and belonged to described default according to described matching degree
The probability of application type, and show testing result with Probability Forms.
Method the most according to claim 1, it is characterised in that described displaying and described
The testing result that degree of joining is associated, including:
Described matching degree is compared with the matching degree threshold value pre-set；
When described matching degree is more than described matching degree threshold value, determine that testing result is described to be checked
Survey application program installation file belong to described default application type and be shown, otherwise determine inspection
Surveying result is that described application program to be detected is installed file and is not belonging to described default application type and goes forward side by side
Row is shown.
Method the most according to claim 1, it is characterised in that described to described to be detected
Application program is installed file and is carried out feature extraction, including:
Extract described application program and the file structure feature of file is installed.
7. according to the method one of claim 1-6 Suo Shu, it is characterised in that described presetting should
It is following any one by type: containing ad plug-in application, containing paying plug-in application, containing statistics
Plug-in application, containing collect plug-in application, plug-in application, harassing and wrecking application, risk application, spy
Application.
8. an applying detection device, it is characterised in that described device includes:
Read unit, for from being stored in reading the degree of deep learning model file that mobile terminal is local
Take model data, and utilize read model data construction deep learning model；
Extraction unit, carries out feature extraction for application program to be detected is installed file；
Converting unit, for carrying out conversion process to the feature extracted, to be converted into described
The characteristic that the input of degree of deep learning model matches；
Matching unit, for carrying out the input of described characteristic to described degree of deep learning model
Join, obtain described application program to be detected and the matching degree of file and default application type is installed；
Display unit, for showing the testing result being associated with described matching degree.
Device the most according to claim 8, it is characterised in that described device also includes:
First model modification unit, for by pre-recorded cloud server address periodically to
It is more newly requested, to learn the described degree of depth that cloud server address sends degree of deep learning model file
Model file is updated.
Device the most according to claim 8, it is characterised in that described device also includes:
Second model modification unit, for the model sent to described mobile terminal in response to user
More newer command, sends deep by pre-recorded cloud server address to cloud server address
Degree learning model file is more newly requested, to be updated described degree of deep learning model file.
11. devices according to claim 8, it is characterised in that described display unit enters
One step is used for:
Determine that described application program to be detected is installed file and belonged to described default according to described matching degree
The probability of application type, and show testing result with Probability Forms.
12. devices according to claim 8, it is characterised in that described display unit enters
One step is used for:
Described matching degree is compared with the matching degree threshold value pre-set；
When described matching degree is more than described matching degree threshold value, determine that testing result is described to be checked
Survey application program installation file belong to described default application type and be shown, otherwise determine inspection
Surveying result is that described application program to be detected is installed file and is not belonging to described default application type and goes forward side by side
Row is shown.
13. devices according to claim 8, it is characterised in that described extraction unit enters
One step is used for:
Extract described application program and the file structure feature of file is installed.
14. one of-13 described devices according to Claim 8, it is characterised in that described preset
Application type is following any one: containing ad plug-in application, containing paying plug-in application, containing system
Meter plug-in application, containing collect plug-in application, plug-in application, harassing and wrecking application, risk application,
Spy is applied.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610366158.XA CN105975861A (en) | 2016-05-27 | 2016-05-27 | Application detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610366158.XA CN105975861A (en) | 2016-05-27 | 2016-05-27 | Application detection method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105975861A true CN105975861A (en) | 2016-09-28 |
Family
ID=56956889
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610366158.XA Pending CN105975861A (en) | 2016-05-27 | 2016-05-27 | Application detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105975861A (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108345504A (en) * | 2018-02-02 | 2018-07-31 | 曙光信息产业(北京)有限公司 | A kind of method for mapping resource and device |
| CN110163225A (en) * | 2018-02-11 | 2019-08-23 | 顺丰科技有限公司 | It is a kind of that package detection and recognition methods, apparatus and system are mixed based on cloud platform |
| CN110347397A (en) * | 2018-04-04 | 2019-10-18 | 武汉斗鱼网络科技有限公司 | A kind of method, apparatus and electronic equipment that caffe is deployed to mobile terminal |
| WO2019216938A1 (en) * | 2018-05-07 | 2019-11-14 | Google Llc | Application development platform and software development kits that provide comprehensive machine learning services |
| CN112149836A (en) * | 2019-06-28 | 2020-12-29 | 杭州海康威视数字技术股份有限公司 | Machine learning program updating method, device and equipment |
| WO2021018189A1 (en) * | 2019-07-30 | 2021-02-04 | 杭州海康威视数字技术股份有限公司 | Method and device for object recognition |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102567661A (en) * | 2010-12-31 | 2012-07-11 | 北京奇虎科技有限公司 | Program recognition method and device based on machine learning |
| CN103369520A (en) * | 2012-03-27 | 2013-10-23 | 百度在线网络技术（北京）有限公司 | Intention prejudging system and method for application program suspicious behavior of mobile terminal |
| CN103853979A (en) * | 2010-12-31 | 2014-06-11 | 北京奇虎科技有限公司 | Program identification method and device based on machine learning |
| CN104123500A (en) * | 2014-07-22 | 2014-10-29 | 卢永强 | Android platform malicious application detection method and device based on deep learning |
| US20150227741A1 (en) * | 2014-02-07 | 2015-08-13 | Cylance, Inc. | Application Execution Control Utilizing Ensemble Machine Learning For Discernment |
| CN105205396A (en) * | 2015-10-15 | 2015-12-30 | 上海交通大学 | Detecting system for Android malicious code based on deep learning and method thereof |
| CN105550583A (en) * | 2015-12-22 | 2016-05-04 | 电子科技大学 | Random forest classification method based detection method for malicious application in Android platform |
-
2016
- 2016-05-27 CN CN201610366158.XA patent/CN105975861A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102567661A (en) * | 2010-12-31 | 2012-07-11 | 北京奇虎科技有限公司 | Program recognition method and device based on machine learning |
| CN103853979A (en) * | 2010-12-31 | 2014-06-11 | 北京奇虎科技有限公司 | Program identification method and device based on machine learning |
| CN103369520A (en) * | 2012-03-27 | 2013-10-23 | 百度在线网络技术（北京）有限公司 | Intention prejudging system and method for application program suspicious behavior of mobile terminal |
| US20150227741A1 (en) * | 2014-02-07 | 2015-08-13 | Cylance, Inc. | Application Execution Control Utilizing Ensemble Machine Learning For Discernment |
| CN104123500A (en) * | 2014-07-22 | 2014-10-29 | 卢永强 | Android platform malicious application detection method and device based on deep learning |
| CN105205396A (en) * | 2015-10-15 | 2015-12-30 | 上海交通大学 | Detecting system for Android malicious code based on deep learning and method thereof |
| CN105550583A (en) * | 2015-12-22 | 2016-05-04 | 电子科技大学 | Random forest classification method based detection method for malicious application in Android platform |
Non-Patent Citations (1)
| Title |
|---|
| SONG HAN等: "DEEP COMPRESSION:COMPRESSING DEEP NEURAL NETWORKS WITH PRUNING,TRAINED QUANTIZATION AND HUFFMAN CODING", 《ICLR 2016》 * |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108345504A (en) * | 2018-02-02 | 2018-07-31 | 曙光信息产业(北京)有限公司 | A kind of method for mapping resource and device |
| CN110163225A (en) * | 2018-02-11 | 2019-08-23 | 顺丰科技有限公司 | It is a kind of that package detection and recognition methods, apparatus and system are mixed based on cloud platform |
| CN110347397A (en) * | 2018-04-04 | 2019-10-18 | 武汉斗鱼网络科技有限公司 | A kind of method, apparatus and electronic equipment that caffe is deployed to mobile terminal |
| WO2019216938A1 (en) * | 2018-05-07 | 2019-11-14 | Google Llc | Application development platform and software development kits that provide comprehensive machine learning services |
| CN112106081A (en) * | 2018-05-07 | 2020-12-18 | 谷歌有限责任公司 | Application development platform and software development suite for providing comprehensive machine learning service |
| US12093675B2 (en) | 2018-05-07 | 2024-09-17 | Google Llc | Application development platform and software development kits that provide comprehensive machine learning services |
| CN112149836A (en) * | 2019-06-28 | 2020-12-29 | 杭州海康威视数字技术股份有限公司 | Machine learning program updating method, device and equipment |
| CN112149836B (en) * | 2019-06-28 | 2024-05-24 | 杭州海康威视数字技术股份有限公司 | Machine learning program updating method, device and equipment |
| WO2021018189A1 (en) * | 2019-07-30 | 2021-02-04 | 杭州海康威视数字技术股份有限公司 | Method and device for object recognition |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105975861A (en) | Application detection method and device | |
| CN105447204A (en) | Website recognition method and apparatus | |
| CN105095755A (en) | File recognition method and apparatus | |
| CN105740707A (en) | Malicious file identification method and device | |
| WO2017107422A1 (en) | Method and device for user gender identification | |
| US10496696B2 (en) | Search method and apparatus | |
| CN107066609A (en) | Image display method and device | |
| CN106295333A (en) | For detecting the method and system of malicious code | |
| CN112634170A (en) | Blurred image correction method and device, computer equipment and storage medium | |
| CN106682124A (en) | Image recognition method, device and equipment | |
| JP7261732B2 (en) | Method and apparatus for determining character color | |
| CN107315958A (en) | The legality identification method and device of data object | |
| CN105740331A (en) | Information push method and device | |
| CN112037223B (en) | Image defect detection method and device and electronic equipment | |
| CN105100119A (en) | URL detection method and device | |
| CN105306495A (en) | User identification method and device | |
| CN107517193A (en) | Malicious websites recognition methods and device | |
| CN106447295A (en) | Sign-off file template generation method and apparatus thereof | |
| CN111741002A (en) | Method and device for training network intrusion detection model | |
| CN107437088B (en) | File identification method and device | |
| CN110826619A (en) | File classification method and device of electronic files and electronic equipment | |
| CN107368407A (en) | Information processing method and device | |
| CN112631884A (en) | Pressure measurement method and device based on data synchronization, computer equipment and storage medium | |
| CN105260459A (en) | Search method and apparatus | |
| CN105956173A (en) | Page content acquisition method and apparatus |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20160928 |
|
| RJ01 | Rejection of invention patent application after publication |