CN106557306A

CN106557306A - Method, device and equipment for determining application package matching path

Info

Publication number: CN106557306A
Application number: CN201510629277.5A
Authority: CN
Inventors: 王俊豪
Original assignee: Beijing Kingsoft Internet Security Software Co Ltd
Current assignee: Beijing Kingsoft Internet Security Software Co Ltd
Priority date: 2015-09-28
Filing date: 2015-09-28
Publication date: 2017-04-05
Anticipated expiration: 2035-09-28
Also published as: CN106557306B

Abstract

The embodiment of the invention discloses a method, a device and equipment for determining a matching path of an application program package. The method comprises the steps of obtaining information data which are uploaded by a plurality of terminals and are associated with the writing action of the application program package; counting the number of terminals of a path containing the writing of the application program package from the information data; judging whether the counted number of the terminals reaches a first preset threshold value or not; or counting the number of files in a path written by the application program corresponding to the application program package from the information data; judging whether the counted number of the files reaches a second preset threshold value or not; and determining the matching relation between the application program package and the path according to the judgment result. By adopting the embodiment of the invention, the paths matched with the application program package can be more accurately and comprehensively counted, and the misjudgment probability of the unloading residual path is reduced.

Description

A kind of determination method in application package matching path, device and equipment

Technical field

The present invention relates to field of terminal technology, more particularly to a kind of application package matching path determination method, Device and equipment.

Background technology

Present terminal can install the application of various ways, application be carried out the behaviour such as unloading also dependent on user's request Make.When it is a certain using it is unloaded after, terminal can exist with this using associated plurality of unloading surviving path, When needing further further to clear up unloading surviving path, the path that need to currently clear up need to be first determined whether Whether it is unloading surviving path, the path that need to currently clear up in defined feature table is generally remained to server lookup Corresponding application bag, and judge whether the corresponding application bag in the path is deleted, if the result for judging is It is then to show that the path that need to currently clear up as unloads surviving path.

Generally server sets up persistence characteristic data base according to the information data of terminal to report, that is, determine certain all the way Corresponding specific application bag under footpath.However, current server judges the mode of the corresponding application bag in path not It is enough accurate, if a certain application bag has the behavior for reading and writing the path in practice, but due to reporting the end of the behavior End number is less or not up to threshold value, then server cannot then count on above-mentioned application bag pass corresponding with the path System, so as to bottom pour ladle phenomenon occurs in the persistence characteristic data base of statistics, terminal is possible to according to bottom pour ladle Persistence characteristic data base judges the path by accident for unloading surviving path.If the above-mentioned misjudged path of terminal deletion, It is possible to affect the normal operation of application program.

The content of the invention

Embodiments provide a kind of determination method in application package matching path, device and equipment. Using the embodiment of the present invention, the path matched by application package can be comprehensively counted accurately more, be subtracted The little probability of miscarriage of justice to unloading surviving path.

Embodiment of the present invention first aspect provides a kind of determination method that application package matches path.The party Method may include following steps：

Obtain the information data being associated with the write behavior of the application package that multiple terminals are uploaded；

The terminal quantity in the path comprising application package write is counted from described information data；

Whether the terminal quantity that judgement is counted reaches the first predetermined threshold value；Or

Count from described information data in the path of the corresponding application program write of the application package Quantity of documents；

Whether the quantity of documents that judgement is counted reaches the second predetermined threshold value；

The matching relationship of the application package and the path is determined according to the judged result.

As optional embodiment, the writing line with the application package that the multiple terminals of the acquisition are uploaded For be associated information data, including：

Obtain that multiple terminals in preset time period upload is associated with the write behavior of the application package Information data, wherein, the preset time period includes N number of unit interval.

As optional embodiment, count in the data from described information and write comprising the application package The terminal quantity in the path for entering, including：

The path of the application package write in each unit interval is counted from described information data Terminal quantity；

Terminal quantity maximum is filtered out in the terminal quantity counted from described each unit interval；

Wherein, whether the terminal quantity for judging to count reaches the first predetermined threshold value, including：

Judge whether the terminal quantity maximum reaches the first predetermined threshold value.

As optional embodiment, the application package is counted in the data from described information corresponding Quantity of documents in the path of application program write, including：

The corresponding application of application package described in each unit interval is counted from described information data Quantity of documents in the path of program write；

Quantity of documents maximum is filtered out in quantity of documents from described each unit interval；

Wherein, whether the quantity of documents for judging to count reaches the second predetermined threshold value, including：

Judge whether the quantity of documents maximum reaches the second predetermined threshold value.

It is as optional embodiment, described to determine the application package with the road according to the judged result The matching relationship in footpath, including：

If judging the terminal quantity maximum not less than the first predetermined threshold value, or the quantity of documents being most Big value is not less than the second predetermined threshold value, it is determined that the application package matches the path.

Used as optional embodiment, methods described also includes：

If judging, the terminal quantity maximum is less than the first predetermined threshold value and the quantity of documents maximum Less than the second predetermined threshold value, then application package write paths behavior or the application package pair are counted The frequency of occurrences of the behavior in the path of the application program write answered；

Judge whether the frequency of occurrences reaches the 3rd predetermined threshold value；

If the result for judging is yes, it is determined that the application package matches the path.

As optional embodiment, the statistics application package write paths behavior or the application journey The frequency of occurrences of the behavior in the path of the corresponding application program write of sequence bag, including：

It is accumulated at application package write paths behavior or the application package in the preset time period The occurrence number of the behavior in the path of corresponding application program write；

According to the preset time period and the occurrence number, the frequency of occurrences is calculated.

Used as optional embodiment, methods described also includes：

The corresponding characteristic information in the path is inquired about in persistence characteristic data base；

If the application package is included in the corresponding characteristic information in the path, the feature is believed Breath is identified.

Used as optional embodiment, methods described also includes：

Early warning information is sent according to the characteristic information of mark.

Embodiment of the present invention second aspect provides the determining device that a kind of application package matches path.The dress Putting may include with lower module：

Acquisition module, for obtaining being associated with the write behavior of the application package for multiple terminals uploads Information data；

First statistical module, for counting from described information data comprising application package write The terminal quantity in path；

First judge module, for judging whether the terminal quantity for counting reaches the first predetermined threshold value； Or

Second statistical module, for the corresponding application of the application package is counted from described information data Quantity of documents in the path of program write；

Second judge module, for judging whether the quantity of documents for counting reaches the second predetermined threshold value；

Determining module, it is true for the judged result according to first judge module or second judge module Determine the matching relationship of the application package and the path.

Used as optional embodiment, the acquisition module is additionally operable to：

Used as optional embodiment, first statistical module includes：

First statistic unit, for described in each unit interval answering is counted from described information data The terminal quantity in the path write with program bag；

First screening unit, for filtering out in the terminal quantity that counts from described each unit interval Terminal quantity maximum；

Wherein, first judge module is additionally operable to：

Used as optional embodiment, second statistical module includes：

Second statistic unit, should described in each unit interval for counting from described information data With the quantity of documents in the path of the corresponding application program write of program bag；

Second screening unit, for filtering out file in the quantity of documents from described each unit interval Quantity maximum；

Wherein, second judge module is additionally operable to：

Used as optional embodiment, the determining module is additionally operable to：

Used as optional embodiment, described device also includes：

3rd statistical module, for judging that the terminal quantity maximum is less than when first judge module First predetermined threshold value and second judge module judge that the quantity of documents maximum is default less than second Threshold value, then count application package write paths behavior or the corresponding application program of the application package The frequency of occurrences of the behavior in the path of write；

3rd judge module, for judging whether the frequency of occurrences reaches the 3rd predetermined threshold value；

Wherein, the determining module is additionally operable to：

If the judged result of the 3rd judge module is yes, it is determined that the application package matches the road Footpath.

Used as optional embodiment, the 3rd statistical module includes：

Accumulated unit, for be accumulated in the preset time period application package write paths behavior or The occurrence number of the behavior in the path of the corresponding application program write of the application package；

Computing unit, for according to the preset time period and the occurrence number, calculating the appearance Frequency.

Used as optional embodiment, described device also includes：

Enquiry module, after determining that the application package matches the path for the determining module, The corresponding characteristic information in the path is inquired about in persistence characteristic data base；

Mark module, for inquiring in the corresponding characteristic information in the path without bag when the enquiry module Containing the application package, then the characteristic information is identified.

Used as optional embodiment, described device also includes：

Sending module, the characteristic information for being identified according to the mark module send early warning information.

The embodiment of the present invention third aspect provides a kind of equipment, and the equipment at least includes transceiver, memorizer And processor, wherein：

The transceiver is for carrying out data transmission with front end or rear end；

The memorizer is used to store batch processing code, and the processor calls described program code, uses Operate below performing：

In the embodiment of the present invention, it is associated by obtaining the write behavior of the application package that multiple terminals are uploaded Information data, terminal quantity or the application of application package write paths can be gone out from information data collect statistics Quantity of documents in the corresponding application program write paths of program bag, and by judging terminal quantity or number of files Whether amount respectively reaches predetermined threshold value, determines the matching relationship of application package and respective path such that it is able to The path matched by application package is comprehensively counted accurately more, the mistake to unloading surviving path is reduced Sentence probability.

Description of the drawings

In order to be illustrated more clearly that the technical scheme of the embodiment of the present invention, below will be to needed for embodiment description Accompanying drawing to be used is briefly described, it should be apparent that, drawings in the following description are some of the present invention Embodiment, for those of ordinary skill in the art, without having to pay creative labor, also Other accompanying drawings can be obtained according to these accompanying drawings.

Fig. 1 is a kind of flow process of an embodiment of the determination method in the application package matching path in the present invention Figure；

Fig. 2 is a kind of stream of another embodiment of the determination method in the application package matching path in the present invention Cheng Tu；

Fig. 3 is a kind of structure of an embodiment of the determining device in the application package matching path in the present invention Schematic diagram；

Fig. 4 is a kind of knot of another embodiment of the determining device in the application package matching path in the present invention Structure schematic diagram；

Fig. 5 is a kind of structural representation of an embodiment of the equipment in the present invention.

Specific embodiment

Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clearly Chu, it is fully described by, it is clear that described embodiment is a part of embodiment of the invention, rather than all Embodiment.Based on the embodiment in the present invention, those of ordinary skill in the art are not making creative labor The every other embodiment obtained under the premise of dynamic, belongs to the scope of protection of the invention.

Below with reference to the accompanying drawings embodiments of the invention are described.Device described in the embodiment of the present invention sets The standby equipment that may include that server etc. can be processed to data and be stored, and can be by before network connection End terminal and rear end equipment etc., described in the embodiment of the present invention, device is by taking server as an example.

Referring to Fig. 1, it is an a kind of embodiment of the determination method in application package matching path in the present invention Flow chart.Wherein, embodiment of the present invention methods described can be realized by device correspondence.The method may include following Step.

Step S101, obtains the letter being associated with the write behavior of the application package that multiple terminals are uploaded Breath data.

In one embodiment, the write behavior for a little monitoring application package can be buried by arranging in terminal. One of situation therein is, when terminal monitoring is to the behavior of written document under path of any application package, The information data being associated with the behavior, such as the bag name of application package, and the path that correspondence is write can be obtained Pathname, the first-class information data of filename and file write.And above- mentioned information data can be passed through Network periodically or according to the acquisition of server request reports server, when server is reported, Information Number The information such as terminal iidentification are may also include according in.Server can be to multiple terminal to report with regard to arbitrary application program The associated information data of bag write behavior is stored, and the write behavior of wherein application package may include should The path write when mounted with program bag, the generally path are canonical path, such as application package write User terminal /android/data；I.e. the application package is pacified under path in user terminal/android/data Dress, the write behavior of application package may also include the corresponding application program of application package and operationally write The behavior in path, wherein, the path can select path, i.e. not usually canonical path, such as to apply for user The file such as picture that program is operationally downloaded or audio frequency and video can be written in the path that user independently selects, if User is selected, then the path that the path of application program write can be write with application package is identical, is Acquiescence write paths, i.e. application program operationally, file can be write the path of application package write, Also writable other paths.

Step S102, counts the end in the path comprising application package write from described information data End quantity.

In one embodiment, after the information data being associated with the write behavior of application package is got, The terminal quantity in the path comprising the application package write can be counted from information data.Wherein, apply The path of program bag write is application package installation path, is generally canonical path in the user terminal, by In installation path terminal uniqueness, when statistics application program bag writes the information data of the behavior in the path, Can statistical monitoring write to application package the path behavior terminal quantity, i.e., in above-mentioned terminal monitor Having arrived application package needs to be mounted under the path, so as to judge application program according to the terminal quantity Bag and the matching relationship in the path.

Step S103, judges whether the terminal quantity for counting reaches the first predetermined threshold value.

In one embodiment, when the terminal quantity that application package write paths are counted from information data, Can determine whether whether the terminal quantity for counting reaches the first predetermined threshold value.Wherein, can be according to the application program Download and currently the download that the terminal quantity for burying a little determines the first predetermined threshold value, i.e. application program is set Or pouplarity is higher, and the terminal quantity that current setting is buried a little is higher, then the radix for counting is bigger, Can the first predetermined threshold value be arranged higher.

Step S104, counts the corresponding application program write of the application package from described information data Path in quantity of documents.

In one embodiment, after the associated information data of application package write behavior is obtained, may be used also The quantity of documents in the path of the corresponding application program write of application package is counted from information data.Tool Body, the corresponding application program of application package operationally, writable path file, such as when this applies journey Sequence need will download file write user terminal a certain path when, user terminal when the behavior is monitored, The information datas such as application name, filename, file header, pathname in recordable behavior, when many When individual user terminal recorded identical behavior, wherein, identical behavior refers to application name and write Pathname is identical, it is not necessary to which file characteristic is identical.The behavior that server can be reported from user terminal is associated Data in count the quantity of documents that above-mentioned application program writes above-mentioned path, i.e., by from different user end Quantity of documents in application program write paths is counted in end, it may be determined that whether the application program and the path Match somebody with somebody.

Wherein, the path of the corresponding application program write of application package and the path of application package write can It is identical, also can be different.Such as when the file downloaded is write a certain path by application program, can store to user The path of selection, can also store to default path, and default path can be the installation path of application program, i.e., should The path write with program bag, is alternatively other default paths, such as application program by the picture of download preserve to During user terminal, can be by the application program identification pair under the picture library path of the picture write user terminal downloaded In the subpath answered.

Step S105, judges whether the quantity of documents for counting reaches the second predetermined threshold value.

In one embodiment, when count in the information data from multiple terminal to report application program write road During the quantity of documents in footpath, can determine whether whether this document quantity reaches the second predetermined threshold value.Wherein, can be according to setting Put and bury the frequent degree of user terminal quantity a little and application program write file and determine the second default threshold Value.That is the frequency of the application program written document is higher, and the user terminal quantity that setting is buried a little is higher, then show The radix of statistics is bigger, can arrange the second higher predetermined threshold value.

Step S106, determines the matching relationship of the application package and the path according to the judged result.

In one embodiment, the path that either statistics application program bag writes, or application package pair The path of the application program write answered, is required to determine the matching relationship of application package and path.One should Multiple paths can be associated with program bag, application program can be judged one by one according to aforesaid way many with what is be associated The matching relationship in individual path, i.e., after the application package is unloaded, the path that can be matched is residual as unloading Stay path.Meanwhile, a path can also match multiple associated application packages, if under the path Individual application package is unloaded, if the path also matches other application programs bag, the path can not be defined To unload surviving path.If not determining the matching relationship in path and a certain application package in time, it is possible to When an application program under path is unloaded, does not find out but there are in fact under the path of matching relationship During other application programs bag, it is likely that be not that the path definition for unloading surviving path is remained to download by this, Bottom pour ladle phenomenon is occurred in that.The embodiment of the present invention is to be solved be just to determine application package with it is all and its The matching relationship in associated path, so as to avoid bottom pour ladle phenomenon.

According to aforesaid way, can preset according to whether the corresponding terminal quantity of write behavior for judging reaches first Whether the corresponding quantity of documents of write behavior of threshold value or judgement reaches the judged result of the second predetermined threshold value, really Determine the matching relationship of application package and path.Specifically, if terminal quantity is not less than the first predetermined threshold value, Or quantity of documents is not less than the second predetermined threshold value, then can determine that application package and route matching.That is writing line It is more for corresponding terminal quantity, show that application package is bigger with the matching degree in the path, works as number of terminals After amount reaches the first predetermined threshold value, then application package and the route matching are can determine that.In the same manner, write behavior Corresponding quantity of documents is more, shows that application package is bigger with the matching degree in path, when quantity of documents reaches To after the second predetermined threshold value, then application package and the route matching are can determine that.

In one embodiment, can count simultaneously and judge above-mentioned terminal quantity and quantity of documents, can also select One is judged, if terminal quantity reaches the first predetermined threshold value, or quantity of documents reaches the second predetermined threshold value, Or terminal quantity and quantity of documents are while when meeting predetermined threshold value, can determine that application package with corresponding road Footpath matches.

Referring to Fig. 2, it is a kind of another embodiment of the determination method in application package matching path in the present invention Flow chart.Wherein, embodiment of the present invention methods described can be realized by device correspondence.The method may include with Lower step.

Step S201, obtains the write behavior phase with application package that multiple terminals are uploaded in preset time period The information data of association, wherein, the preset time period includes N number of unit interval.

In one embodiment, server can obtain multiple terminals in preset time period are uploaded and application program The information data that the write behavior of bag is associated.Such as preset time period can be 1 day, 1 week etc..Wherein, preset Time period may include N number of unit interval, wherein, N is integer and N >=1.If preset time period is 1 day and unit interval are 1 day, then obtain the information data that terminal the previous day reports.If preset time period It it is 1 day for N days and unit interval, wherein N is more than 1, then the information data for counting is a number Value intersection, the i.e. intersection include the information data of daily acquisition.

In one embodiment, the write behavior for a little monitoring application package can be buried by arranging in terminal. One of situation therein is, when the behavior of written document under path of any application bag is monitored, can to obtain Take the information data being associated with the behavior, such as the bag name of application package, and the road in the corresponding path write Footpath title, the first-class information data of filename and file write.And above- mentioned information data can be passed through network Server is reported periodically or according to the acquisition of server request, when server is reported, in information data May also include the information such as terminal iidentification.Server can be write with regard to arbitrary application package to multiple terminal to report Enter the associated information data of behavior to be stored, the write behavior of wherein application package may include to apply journey The path that sequence bag is write when mounted, the generally path are canonical path, such as application package write user Terminal /android/data；I.e. the application package is installed under path in user terminal/android/data, The write behavior of application package may also include the corresponding application program of application package operationally write paths Behavior, wherein, the path can select path, i.e. not usually canonical path, such as application program for user The file such as the picture operationally downloaded or audio frequency and video can be written in the path that user independently selects, if user Selected, then the path that the path of application program write can be write with application package is identical, is acquiescence Write paths, i.e. application program operationally, file can be write the path of application package write, also may be used Write other paths.

Step S202, counts the application package in each unit interval from described information data The terminal quantity in the path of write.

In one embodiment, can be counted between each unit interval respectively from the intersection of the information data for obtaining The terminal quantity in the path write every interior application package.If unit interval is 1 day, Preset Time Section is N days, then count the terminal quantity in the path of application package write daily in N days respectively.Can system The intersection of terminal quantity is counted out, intersection includes the terminal quantity of daily statistics.

Step S203, filters out terminal quantity in the terminal quantity for counting from described each unit interval Maximum.

In one embodiment, after the intersection of terminal quantity is counted from information data, can be from each list Terminal quantity maximum is got in the terminal quantity counted in the time interval of position.If unit interval is 1 My god, preset time period is N days, then obtain the end in the associated information data of behavior of daily terminal to report End quantity, then can then obtain N number of or less than N number of terminal quantity for N days, form intersection.Wherein, can sieve The maximum in N number of terminal quantity is selected, if maximum can reach the first predetermined threshold value, be can determine that Application package is matched with path.

Step S204, judges whether the terminal quantity maximum reaches the first predetermined threshold value.

In one embodiment, after terminal quantity maximum is filtered out, can determine whether the terminal quantity for counting Whether maximum reaches the first predetermined threshold value.Wherein, can have been set according to the download of the application program and currently Put the terminal quantity for burying a little and determine that the download or pouplarity of the first predetermined threshold value, i.e. application program are higher, And the terminal quantity that current setting is buried a little is higher, then the radix for counting is bigger, can set the first predetermined threshold value Put higher.

Step S205, counts application package described in each unit interval from described information data Quantity of documents in the path of corresponding application program write.

In one embodiment, can be counted between each unit interval respectively from the intersection of the information data for obtaining Every the quantity of documents in the path of the interior corresponding application program write of application package.If unit interval is 1 My god, preset time period is N days, then count the file in the path of application program write daily in N days respectively. The intersection of terminal quantity can be counted, intersection includes the quantity of documents of daily statistics.

Step S206, filters out quantity of documents maximum in the quantity of documents from described each unit interval Value.

In one embodiment, after the intersection of quantity of documents is counted from information data, can be from each list Terminal quantity maximum is got in the terminal quantity counted in the time interval of position.If unit interval is 1 My god, preset time period is N days, then obtain the text in the associated information data of behavior of daily terminal to report Number of packages amount, then can then obtain N number of or less than N number of quantity of documents for N days, form intersection.Wherein, can sieve The maximum in N number of quantity of documents is selected, if maximum can reach the second predetermined threshold value, be can determine that Application package is matched with path.

Step S207, judges whether the quantity of documents maximum reaches the second predetermined threshold value.

In one embodiment, when quantity of documents maximum is filtered out, can determine whether whether this document quantity reaches To the second predetermined threshold value.Wherein, user terminal quantity a little and application program write can be buried according to arranging The frequent degree of file determines the second predetermined threshold value.That is the frequency of the application program written document is higher, and setting is buried The user terminal quantity of point is higher, then show that the radix for counting is bigger, can arrange the second higher predetermined threshold value.

Step S208, if the judged result of step S204 and step S207 is no, statistics is described should The behavior in the path write with the behavior of program bag write paths or the corresponding application program of the application package The frequency of occurrences.

In one embodiment, if judging, the maximum or quantity of documents maximum of terminal quantity are not up to right The predetermined threshold value answered, also exist application program written document under a certain path quantity is low or the application program Bag corresponding terminal quantity under a certain path is few, such as using user it is few situations such as, now, representing should Application package is mismatched with the path.Need further to be judged.The application package is counted first The appearance frequency of the behavior in the path of write paths behavior or the corresponding application program write of the application package Rate.Specifically, the occurrence number of above-mentioned behavior can be added up in preset time period, you can calculate appearance frequency Rate is occurrence number/preset time period.When the behavior that application package or application program write a certain path frequently goes out Existing, even if the behavior corresponding terminal quantity or quantity of documents of statistics are not up to predetermined threshold value, still showing should It is possible to match the path with program bag.

Step S209, judges whether the frequency of occurrences reaches the 3rd predetermined threshold value.

In one embodiment, after the frequency of occurrences of application package write behavior is obtained, can determine whether that this goes out Whether existing frequency is not less than the 3rd predetermined threshold value, if being not less than the 3rd predetermined threshold value, in showing write behavior Application package matches the path.Wherein, the 3rd predetermined threshold value can be arranged to generic threshold value, also dependent on Specific application program arranges specific threshold.

Step S210, if the judged result of step S204 or step S207 or step S209 is yes, really The fixed application package matches the path.

In one embodiment, when the result that either step in above-mentioned steps judges is yes, then can determine that application Program bag matches the path.

Step S211, inquires about the corresponding characteristic information in the path in persistence characteristic data base.

In one embodiment, after the matching relationship of application package and path is determined, further can exist The corresponding characteristic information of query path in persistence characteristic data base.Wherein, store in persistence characteristic data base The corresponding characteristic information in path and path, specifically, may include corresponding several application journeys in characteristic information Sequence bag, and the APMB package information of several application packages, such as application package title etc..That is persistence characteristic Database purchase path matches corresponding relation with application package.

Step S212, if the application package is not included in the corresponding characteristic information in the path, will The characteristic information is identified.

In one embodiment, after it is determined that a certain path is matched with a certain application package, if in residual The application package is included during the corresponding characteristic information in path is not inquired in property data base, that is, bottom pour ladle occurs Phenomenon, then can be identified to characteristic information in time, so as to the bottom pour ladle phenomenon for avoiding surviving path is made to system Into harm.

Step S213, sends early warning information according to the characteristic information of mark.

In one embodiment, server can send pre- according to the characteristic information identified in persistence characteristic data base Alarming information, can send early warning information to background devices, to inform path and bottom pour ladle journey that bottom pour ladle specifically occur Degree etc., so as to background devices can carry out manual intervention, carries out path correspondence plus bag, or further detects the road Whether footpath is matched with application package, so as to exclude bottom pour ladle situation in time, to avoid causing not system Necessary loss.

Referring to Fig. 3, it is an a kind of embodiment of the determining device in application package matching path in the present invention Structural representation.Wherein, embodiment of the present invention described device is capable of achieving the method in above-described embodiment.The dress Putting may include acquisition module 301, the first statistical module 302, the first judge module 303, the second statistical module 304th, the second judge module 305, determining module 306.

Wherein, acquisition module 301, for obtaining the writing line with the application package that multiple terminals are uploaded For the information data being associated.

In one embodiment, the write behavior for a little monitoring application package can be buried by arranging in terminal. One of situation therein is, when terminal monitoring is to the behavior of written document under path of any application package, The information data being associated with the behavior, such as the bag name of application package, and the path that correspondence is write can be obtained Pathname, the first-class information data of filename and file write.And above- mentioned information data can be passed through Network periodically or according to the acquisition of server request reports server, when server is reported, Information Number The information such as terminal iidentification are may also include according in.Server can be by acquisition module 301 to multiple terminal to report The associated information data of behavior is write with regard to arbitrary application package obtained, wherein application package Write behavior may include the path that application package is write when mounted, and the generally path is canonical path, As application package write user terminal /android/data；I.e. the application package is in user terminal / android/data is installed under path, and the write behavior of application package may also include application package correspondence Application program operationally write paths behavior, wherein, the path can select path for user, that is, lead to Often canonical path, the file such as picture that such as application program is operationally downloaded or audio frequency and video can be written into use In the path that family independently selects, if user is selected, journey same can be applied in the path of application program write The path of sequence bag write is identical, is to give tacit consent to write paths, i.e. application program operationally, can write file The path of application package write, also writable other paths.

First statistical module 302, writes comprising the application package for counting from described information data Path terminal quantity.

In one embodiment, it is associated with the write behavior of application package when acquisition module 301 gets Information data after, the first statistical module 302 can be counted from information data and be write comprising the application package The terminal quantity in the path for entering.Wherein, the path of application package write is application package installation path, It is generally canonical path in the user terminal, as installation path is in the uniqueness of terminal, when statistics application journey Sequence bag writes the information data of the behavior in the path, can statistical monitoring the row in the path is write to application package For terminal quantity, i.e., monitored in above-mentioned terminal application package need under the path be mounted, So as to the matching relationship of application package and the path can be judged according to the terminal quantity.

First judge module 303, for judging whether the terminal quantity for counting reaches the first default threshold Value.

In one embodiment, write when the first statistical module 302 counts application package from information data Enter the terminal quantity in path, the first judge module 303 can determine whether whether the terminal quantity for counting reaches first Predetermined threshold value.Wherein, can the terminal quantity that buried a little be set according to the download of the application program and currently true The download or pouplarity of fixed first predetermined threshold value, i.e. application program is higher, and current setting is buried a little Terminal quantity it is higher, then the radix for counting is bigger, can arrange higher by the first predetermined threshold value.

Second statistical module 304, for counting from described information data, the application package is corresponding to answer With the quantity of documents in the path of program write.

In one embodiment, the associated information of application package write behavior is obtained in acquisition module 301 After data, the second statistical module 304 can also count the corresponding application journey of application package from information data Quantity of documents in the path of sequence write.Specifically, the corresponding application program of application package operationally, Writable path file, such as when the application program needs the file that will be downloaded to write a certain path of user terminal When, user terminal when the behavior is monitored, can record behavior in application name, filename, text The information datas such as part head, pathname, when multiple user terminals recorded identical behavior, wherein, phase With behavior refer to that the pathname of application name and write is identical, it is not necessary to file characteristic is identical.Service Above-mentioned application program is counted in the data that the behavior that device can be reported from user terminal is associated and writes above-mentioned path Quantity of documents, i.e., by quantity of documents in application program write paths is counted from different user terminals, Can determine that whether the application program is matched with the path.

Second judge module 305, for judging whether the quantity of documents for counting reaches the second default threshold Value.

In one embodiment, when the second statistical module 304 is counted from the information data of multiple terminal to report When going out the quantity of documents of application program write paths, whether the second judge module 305 can determine whether this document quantity Reach the second predetermined threshold value.Wherein, user terminal quantity a little can be buried and the application program is write according to arranging The frequent degree for entering file determines the second predetermined threshold value.That is the frequency of the application program written document is higher, arranges The user terminal quantity buried a little is higher, then show that the radix for counting is bigger, can arrange the default threshold of higher second Value.

Determining module 306, for according to first judge module 303 or second judge module 305 Judged result determines the matching relationship of the application package and the path.

In one embodiment, the path that either statistics application program bag writes, or application package pair The path of the application program write answered, is required to determining module 306 and determines matching for application package and path Relation.One application package can be associated multiple paths, can judge application program one by one according to aforesaid way With the matching relationship in associated plurality of path, i.e., after the application package is unloaded, the road that can be matched Footpath is used as unloading surviving path.Meanwhile, a path can also match multiple associated application packages, if An application package under the path is unloaded, if the path also matches other application programs bag, Ze Gai roads Footpath can not be defined as unloading surviving path.If do not determine path and a certain application package in time matches pass System a, it is possible to when application program under path is unloaded, does not find out but there are in fact matching and close Under the path of system during other application programs bag, it is likely that be not the path definition for unloading surviving path by this To download residual, that is, occur in that bottom pour ladle phenomenon.The embodiment of the present invention is to be solved to be just to determine application program The matching relationship with all paths associated there is wrapped, so as to avoid bottom pour ladle phenomenon.

According to aforesaid way, the corresponding terminal quantity of write behavior that can be judged according to the first judge module 303 Whether reaching the corresponding quantity of documents of write behavior that the first predetermined threshold value or the second judge module 305 judge is The no judged result for reaching the second predetermined threshold value, determines the matching relationship of application package and path.Specifically, If terminal quantity is not less than the first predetermined threshold value, or quantity of documents is not less than the second predetermined threshold value, then can determine that Application package and route matching.Write the corresponding terminal quantity of behavior more, show application package with The matching degree in the path is bigger, after terminal quantity reaches the first predetermined threshold value, then can determine that application program Bag and the route matching.In the same manner, write the corresponding quantity of documents of behavior more, show application package and road The matching degree in footpath is bigger, after quantity of documents reaches the second predetermined threshold value, then can determine that application package with The route matching.

Referring to Fig. 4, it is a kind of another embodiment of the determining device in application package matching path in the present invention Structural representation.Wherein, embodiment of the present invention described device is capable of achieving the method in above-described embodiment.Should Device may include that acquisition module 401, the first statistical module 402, the first judge module 403, second count mould Block 404, the second judge module 405, the 3rd statistical module 406, the 3rd judge module 407, determining module 408th, enquiry module 409, mark module 410, sending module 411.

Wherein, acquisition module 401, for obtaining multiple terminals in preset time period are uploaded and application package The associated information data of write behavior, wherein, the preset time period includes N number of unit interval.

In one embodiment, server can obtain multiple terminals in preset time period by acquisition module 401 The information data being associated with application package write behavior that is uploading.As preset time period can for 1 day, 1 Week etc..Wherein, preset time period may include N number of unit interval, wherein, N is integer and N >=1. If preset time period was for 1 day and unit interval is 1 day, the Information Number that acquisition terminal the previous day reports According to.If preset time period was for N days and unit interval is 1 day, wherein N is more than 1, then count Information data is the information data that a numerical value intersection, the i.e. intersection include daily acquisition.

In the embodiment of the present invention, the first statistical module 402 may include that the first statistic unit 4021, first is screened Unit 4022.

Wherein, the first statistic unit 4021, for counting from described information data between each unit interval Every the terminal quantity in the path of the interior application package write.

In one embodiment, the first statistic unit 4021 can be united from the intersection of the information data for obtaining respectively Count the terminal quantity in the path that the application package in each unit interval writes.If unit interval For 1 day, preset time period was N days, then count the path of application package write daily in N days respectively Terminal quantity.The intersection of terminal quantity can be counted, intersection includes the terminal quantity of daily statistics.

First screening unit 4022, for sieving in the terminal quantity that counts from described each unit interval Select terminal quantity maximum.

In one embodiment, when the first statistic unit 4021 counts the conjunction of terminal quantity from information data After collection, get in the terminal quantity that the first screening unit 4022 can be counted from each unit interval Terminal quantity maximum.If unit interval is 1 day, preset time period is N days, then obtain daily eventually Terminal quantity in the information data that the behavior that end reports is associated, then can then obtain N number of for N days or be less than N Individual terminal quantity, forms intersection.Wherein, the maximum in N number of terminal quantity can be filtered out, if most Big value can reach the first predetermined threshold value, then can determine that application package is matched with path.

First judge module 403, for judging whether the terminal quantity maximum reaches the first predetermined threshold value.

In one embodiment, after the first screening unit 4022 filters out terminal quantity maximum, first sentences Disconnected module 403 can determine whether whether the terminal quantity maximum for counting reaches the first predetermined threshold value.Wherein, may be used The terminal quantity for burying a little is set according to the download of the application program and currently and has determined the first predetermined threshold value, i.e., The download or pouplarity of application program is higher, and the terminal quantity that current setting is buried a little is higher, then The radix of statistics is bigger, can arrange higher by the first predetermined threshold value.

In the embodiment of the present invention, the second statistical module 404 may include that the second statistic unit 4041, second is screened Unit 4042.

Wherein, the second statistic unit 4041, for counting from described information data between each unit interval Quantity of documents in the path of the corresponding application program write of the application package described in.

In one embodiment, the second statistic unit 4041 can be united from the intersection of the information data for obtaining respectively Count the quantity of documents in the path that the corresponding application program of application package in each unit interval writes. If unit interval is 1 day, preset time period is N days, then count daily application program in N days respectively The file in the path of write.The intersection of terminal quantity can be counted, intersection includes the file of daily statistics Quantity.

Second screening unit 4042, for filtering out in the quantity of documents from described each unit interval Quantity of documents maximum.

In one embodiment, when the second statistic unit 4041 counts the conjunction of quantity of documents from information data After collection, get in the terminal quantity that the second screening unit 4042 can be counted from each unit interval Terminal quantity maximum.If unit interval is 1 day, preset time period is N days, then obtain daily eventually Quantity of documents in the information data that the behavior that end reports is associated, then can then obtain N number of for N days or be less than N Individual quantity of documents, forms intersection.Wherein, the maximum in N number of quantity of documents can be filtered out, if most Big value can reach the second predetermined threshold value, then can determine that application package is matched with path.

Second judge module 405, for judging whether the quantity of documents maximum reaches the second predetermined threshold value.

In one embodiment, when the second screening unit 4042 filters out quantity of documents maximum, second sentences Disconnected module 405 can determine whether whether this document quantity reaches the second predetermined threshold value.Wherein, can be buried a little according to setting User terminal quantity and the frequent degree of application program write file determine the second predetermined threshold value.I.e. should The frequency of application program written document is higher, and the user terminal quantity that setting is buried a little is higher, then show the base for counting Number is bigger, can arrange the second higher predetermined threshold value.

3rd statistical module 406, for when the judgement of the first judge module 403 and the second judge module 405 When being as a result no, statistics application package write paths behavior or the application package it is corresponding should The frequency of occurrences of the behavior in the path write with program.

In one embodiment, if the first judge module 403 is judged the maximum of terminal quantity or second sentenced Disconnected module 405 judges that quantity of documents maximum is not up to corresponding predetermined threshold value, also there is the application program Under a certain path, the quantity of written document is low or the application package corresponding terminal quantity under a certain path Less, situations such as such as using user few, now, does not represent the application package with path mismatch.Need Further to be judged.3rd statistical module 406 counts application package write paths behavior or institute State the frequency of occurrences of the behavior in the path of the corresponding application program write of application package.Specifically, can be pre- If adding up the occurrence number of above-mentioned behavior in the time period, you can calculate the frequency of occurrences for occurrence number/default when Between section.When the behavior that application package or application program write a certain path is frequently occurred, even if the row of statistics It is that corresponding terminal quantity or quantity of documents are not up to predetermined threshold value, still shows that application package is possible to matching The path.

3rd judge module 407, for judging whether the frequency of occurrences reaches the 3rd predetermined threshold value.

In one embodiment, when the 3rd statistical module 406 counts the appearance that application package writes behavior After frequency, whether the 3rd judge module 407 can determine whether the frequency of occurrences not less than the 3rd predetermined threshold value, if not Less than the 3rd predetermined threshold value, then in showing write behavior, application package matches the path.Wherein, the 3rd is pre- If threshold value can be arranged to generic threshold value, specific threshold is set also dependent on specific application program.

Determining module 408, for judging mould when the first judge module 403 or the second judge module 405 or the 3rd The judge module of block 407 is for when being, it is determined that the application package matches the path.

In one embodiment, the result that arbitrary module judges in by above-mentioned judge module be it is yes, then really Cover half block 408 can determine that application package matches the path.

Enquiry module 409, for the corresponding characteristic information in the path is inquired about in persistence characteristic data base.

In one embodiment, after the matching relationship that determining module 408 determines application package and path, Enquiry module 409 can the further corresponding characteristic information of query path in persistence characteristic data base.Wherein, The corresponding characteristic information in path and path is stored in persistence characteristic data base, specifically, in characteristic information Corresponding several application packages, and the APMB package information of several application packages are may include, journey is such as applied Sequence bag title etc..That is persistence characteristic database purchase path and application package matches corresponding relation.

Mark module 410, if for institute is not included in the corresponding characteristic information in path described in enquiry module 409 Application package is stated, then the characteristic information is identified.

In one embodiment, after it is determined that a certain path is matched with a certain application package, if inquiry mould Block 409 includes the application package during the corresponding characteristic information in path is not inquired in persistence characteristic data base, There is bottom pour ladle phenomenon, then in time characteristic information can be identified, so as to avoid the bottom pour ladle of surviving path existing As the harm caused to system.

Sending module 411, the characteristic information for being identified according to mark module 410 send early warning information.

In one embodiment, sending module 411 can be according to the characteristic information identified in persistence characteristic data base Send early warning information, early warning information can be sent to background devices, with inform path that bottom pour ladle specifically occur and Bottom pour ladle degree etc., so as to background devices can carry out manual intervention, carries out path correspondence plus bag, or further examines Survey whether the path is matched with application package, so as to bottom pour ladle situation can be excluded in time, to avoid to system Cause unnecessary loss.

Referring to Fig. 5, it is a kind of structural representation of an embodiment of equipment in the present invention.The equipment may include Said apparatus in the embodiment of the present invention.Wherein, the equipment may include transceiver 501, communication bus 502, At least one memorizer 503, and processor 504.Transceiver 501 may include radio receiving transmitting module and have Line transceiver module, for front end user terminal and rear end maintenance terminal transmission data etc..Communication bus 502 For realizing the connection communication between these components, memorizer 503 can be high-speed RAM memorizer, also may be used To be non-labile memorizer (non-volatile memory), such as at least one disk memory.Memorizer Batch processing code is stored in 503, processor 504 can be used to perform following behaviour by calling the program code Make：

Used as optional embodiment, it is uploading with the application program that the processor 504 obtains multiple terminals The concrete mode of the associated information data of the write behavior of bag is：

Used as optional embodiment, the processor 504 is counted from described information data answers comprising described The concrete mode of terminal quantity in the path write with program bag is：

Used as optional embodiment, the processor 504 counts the application journey from described information data The concrete mode of the quantity of documents in the path of sequence bag corresponding application program write is：

Wherein, the processor 504 judges whether the quantity of documents for counting reaches the second predetermined threshold value Concrete mode be：

Used as optional embodiment, the processor 504 determines the application program according to the judged result Wrap and with the concrete mode of the matching relationship in the path be：

Used as optional embodiment, the processor 504 calls the program code of memorizer 503, is additionally operable to Perform following operation：

As optional embodiment, the processor 504 count application package write paths behavior or The concrete mode of the frequency of occurrences of the behavior in the path of the corresponding application program write of the application package is：

Used as optional embodiment, the processor 504 calls the program code that memorizer 503 is stored, also For performing following operation：

Device embodiment described above is only schematic, wherein described as separating component explanation Unit can be or may not be it is physically separate, as the part that unit shows can be or Can not be physical location, you can local to be located at one, or can also be distributed on multiple NEs. Some or all of module therein can be selected according to the actual needs to realize the mesh of this embodiment scheme 's.Those of ordinary skill in the art are not in the case where performing creative labour is paid, you can to understand and implement.

Step in present invention method can carry out order adjustment according to actual needs, merge and delete.

Unit or subelement in embodiment of the present invention terminal or equipment can be merged according to actual needs, Divide and delete.

Through the above description of the embodiments, those skilled in the art can be understood that each enforcement Mode can add the mode of required general hardware platform to realize by software, naturally it is also possible to by hardware. Based on such understanding, the part that above-mentioned technical proposal is substantially contributed to prior art in other words can be with Embodied in the form of software product, the computer software product can be stored in computer-readable storage medium In matter, such as ROM/RAM, magnetic disc, CD etc. are used so that a computer equipment including some instructions (can be personal computer, server, or network equipment etc.) performs each embodiment or embodiment Some parts described in method.

Embodiments described above, does not constitute the restriction to the technical scheme protection domain.It is any upper Modification, equivalent and improvement for being made within the spirit and principle of embodiment etc. are stated, this is should be included in Within the protection domain of technical scheme.

Claims

1. a kind of application package matches the determination method in path, it is characterised in that include：

2. method as claimed in claim 1, it is characterised in that the multiple terminals of the acquisition upload with it is described The information data that the write behavior of application package is associated, including：

3. method as claimed in claim 2, it is characterised in that count bag in the data from described information The terminal quantity in the path containing application package write, including：

4. method as claimed in claim 2, it is characterised in that count institute in the data from described information The quantity of documents in the path of the corresponding application program write of application package is stated, including：

5. such as claim 3 or 4 methods describeds, it is characterised in that described to be determined according to the judged result The matching relationship in the application package and the path, including：

6. method as claimed in claim 5, it is characterised in that methods described also includes：

7. method as claimed in claim 6, it is characterised in that the statistics application package writes road The frequency of occurrences of the behavior in the path of footpath behavior or the corresponding application program write of the application package, including：

8. method as claimed in claim 5, it is characterised in that methods described also includes：

9. a kind of application package matches the determining device in path, it is characterised in that include：

10. a kind of equipment, it is characterised in that including transceiver, memorizer and processor, wherein：