CN107895119A

CN107895119A - Program installation packet inspection method, device and electronic equipment

Info

Publication number: CN107895119A
Application number: CN201711461925.6A
Authority: CN
Inventors: 钱吕见; 卢加磊
Original assignee: Beijing Qihoo Technology Co Ltd
Current assignee: Beijing Qihoo Technology Co Ltd
Priority date: 2017-12-28
Filing date: 2017-12-28
Publication date: 2018-04-10

Abstract

The invention discloses a kind of program installation packet inspection method, device and electronic equipment, belong to field of computer technology.Methods described includes：Obtain the view data in program installation kit, utilize the characteristic vector of the default each view data of first model extraction, the characteristic vector of extraction is inputted into default second model, characteristic value corresponding to each view data is obtained, judges whether described program installation kit includes bad image according to resulting characteristic value.The first good model of training in advance and the second models coupling are used to detect the program installation kit for including bad image, are effectively improved recall rate and accuracy of detection.

Description

Program installation packet inspection method, device and electronic equipment

Technical field

The present invention relates to field of computer technology, more particularly to a kind of program installation packet inspection method, device and electronics to set It is standby.

Background technology

With the arrival in mobile Internet epoch, the commercially available broad development of smart mobile phone.At the same time, the APK of Huang is related to Cell phone software is becoming increasingly rampant.This kind of APK cell phone softwares generally comprise following behavior：(1) include pornographic, exposure picture or regard Frequently, so as to induce user to click on, operation of deducting fees is triggered；(2) networking is forced, so as to steal flow；(3) short message of maliciously deducting fees is sent Or send short messages privately；(4) malicious plugins are installed；(5) advertisement；(6) user profile etc. is stolen.These behaviors are seriously damaged The interests of user have been done harm to, or even the huge property loss of user can be caused.Therefore, this kind of APK cell phone softwares for relating to Huang are identified, with Remind in time, warn user, be advantageous to ensure user benefit.

In the prior art, the method for carrying out detection to relating to yellow image and being mainly based upon skin color characteristic matching, this side Method only judges whether image relates to Huang by the percentage of skin in image, and discrimination is low, and error rate is higher.

The content of the invention

In view of the above problems, it is proposed that the present invention so as to provide one kind overcome above mentioned problem or at least in part solve on State program installation packet inspection method, device and the electronic equipment of problem.

In a first aspect, the embodiments of the invention provide a kind of program to install packet inspection method, methods described includes：Obtain journey View data in sequence installation kit；Pass through the characteristic vector of each described image data of default first model extraction；By described in Characteristic vector inputs default second model, obtains characteristic value corresponding to each described image data；According to resulting feature Value judges whether described program installation kit includes bad image.

Preferably, second model is obtained ahead of time by following manner：Image pattern is obtained, described image sample includes Multiple first view data and multiple second view data, the multiple first view data both correspond to default first mark Label, the multiple second view data both correspond to the second label；Pass through institute in the first model extraction described image sample There is the characteristic vector of view data；Disaggregated model training is carried out to the characteristic vector of all view data in described image sample, Obtain second model.

Preferably, the characteristic vector of all view data carries out disaggregated model training in the sample to described image, obtains The step of to second model, including：Using default logistic regression algorithm to all view data in described image sample Characteristic vector be trained, logistic regression disaggregated model is obtained, using the logistic regression disaggregated model as second mould Type.

Preferably, the characteristic vector by all view data in the first model extraction described image sample it Before, in addition to：All view data in described image sample are zoomed into pre-set dimension.

Preferably, the characteristic value obtained by the basis judges whether described program installation kit includes the step of bad image Suddenly, including：By the obtained characteristic value compared with predetermined threshold value, if the characteristic value more than the predetermined threshold value be present, Then judge that described program installation kit includes bad image；If in the absence of the characteristic value more than the predetermined threshold value, judge described in Program installation kit does not include bad image.

Preferably, first model is AlexNet deep learning network models.

Preferably, the characteristic vector is 4096 dimensional feature vectors corresponding to described image data.

Second aspect, the embodiments of the invention provide a kind of program to install package detection device, and described device includes：Data obtain Modulus block, characteristic vector pickup module, characteristic value calculating module and detection module.Data acquisition module, for obtaining program peace View data in dress bag.Characteristic vector pickup module, for passing through each described image data of default first model extraction Characteristic vector.Characteristic value calculating module, for the characteristic vector to be inputted into default second model, obtain each figure The characteristic value as corresponding to data.Detection module, for judging whether described program installation kit includes according to resulting characteristic value Bad image.

Preferably, described device also includes：Sample acquisition module, sample characteristics extraction module and training module.Sample obtains Modulus block, for obtaining image pattern, described image sample includes multiple first view data and multiple second view data, institute State multiple first view data and both correspond to default first label, the multiple second view data both corresponds to the second mark Label.Sample characteristics extraction module, for the feature by all view data in the first model extraction described image sample Vector.Training module, for carrying out disaggregated model training to the characteristic vector of all view data in described image sample, obtain Second model.

Preferably, the training module is specifically used for：Using default logistic regression algorithm to institute in described image sample The characteristic vector for having view data is trained, and obtains logistic regression disaggregated model, using the logistic regression disaggregated model as Second model.

Preferably, described device also includes：Pretreatment module, for all view data in described image sample are equal Zoom to pre-set dimension.

Preferably, the detection module is specifically used for：By the obtained characteristic value compared with predetermined threshold value, if depositing In the characteristic value more than the predetermined threshold value, then judge that described program installation kit includes bad image, if described in the absence of being more than The characteristic value of predetermined threshold value, then judge that described program installation kit does not include bad image.

Preferably, first model is AlexNet deep learning network models.

The third aspect, the embodiments of the invention provide a kind of electronic equipment, including processor and memory, the memory The processor is couple to, the memory store instruction, when executed by the processor sets the electronics It is standby to perform following operate：Obtain the view data in program installation kit；Pass through the default each described image of first model extraction The characteristic vector of data；The characteristic vector is inputted into default second model, obtained special corresponding to each described image data Value indicative；Judge whether described program installation kit includes bad image according to resulting characteristic value.

Fourth aspect, the embodiments of the invention provide a kind of computer-readable recording medium, is stored thereon with computer journey Sequence, the program realize the step described in above-mentioned program installation packet inspection method when being executed by processor.

The technical scheme provided in the embodiment of the present application, has at least the following technical effects or advantages：

In the technical scheme of the embodiment of the present invention, by obtaining the view data in program installation kit, utilization is default The characteristic vector of each view data of first model extraction, then the characteristic vector of extraction is inputted into default second model, obtain Characteristic value corresponding to each view data, then according to resulting characteristic value described program installation kit will be judged whether comprising not Plan deliberately picture.Compared to prior art, technical scheme provided in an embodiment of the present invention, by good the first model and second of training in advance Models coupling is used to detect the program installation kit for including bad image, is effectively improved recall rate and accuracy of detection.

Described above is only the general introduction of technical solution of the present invention, in order to better understand the technological means of the present invention, And can be practiced according to the content of specification, and in order to allow above and other objects of the present invention, feature and advantage can Become apparent, below especially exemplified by the embodiment of the present invention.

Brief description of the drawings

By reading the detailed description of hereafter preferred embodiment, it is various other the advantages of and benefit it is common for this area Technical staff will be clear understanding.Accompanying drawing is only used for showing the purpose of preferred embodiment, and is not considered as to the present invention Limitation.And in whole accompanying drawing, identical part is denoted by the same reference numerals.In the accompanying drawings：

Fig. 1 shows a kind of flow chart for program installation packet inspection method that first embodiment of the invention provides；

Fig. 2 shows the step flow chart for the model of training second that first embodiment of the invention provides；

Fig. 3 shows a kind of schematic diagram for program installation package detection device that second embodiment of the invention provides；

Fig. 4 shows the schematic diagram for the second model training part that second embodiment of the invention provides；

Fig. 5 shows the schematic diagram for the electronic equipment that third embodiment of the invention provides.

Embodiment

The embodiments of the invention provide a kind of program installation packet inspection method, device and electronic equipment, included for improving The recall rate and accuracy of detection of the program installation kit of bad image.Wherein, described program installation packet inspection method includes：Obtain View data in program installation kit；Pass through the characteristic vector of each described image data of default first model extraction；By institute State characteristic vector and input default second model, obtain characteristic value corresponding to each described image data；According to resulting spy Value indicative judges whether described program installation kit includes bad image.

The exemplary embodiment of the disclosure is more fully described below with reference to accompanying drawings.Although the disclosure is shown in accompanying drawing Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure without should be by embodiments set forth here Limited.On the contrary, these embodiments are provided to facilitate a more thoroughly understanding of the present invention, and can be by the scope of the present disclosure Completely it is communicated to those skilled in the art.

Fig. 1 is referred to, the flow chart of packet inspection method is installed for the program that first embodiment of the invention provides.It is of the invention real The program installation packet inspection method for applying example offer can apply to user terminal, can also be applied to server.Wherein, program is pacified Dress bag is the program installation kit of open source system.Program provided by the invention will be pacified by taking Android installation kit APK file as an example below Dress packet inspection method illustrates.As shown in figure 1, it the described method comprises the following steps：

Step S101, obtain the view data in APK file；

APK is AndroidPackage abbreviation, i.e. Android installation kit, it will be appreciated that for being installed on Android system Application software.Android applications are to use written in Java, utilize Android software development kit (Software Development Kit, SDK) compiled code, and all data and resource file are packaged into an APK file, this is One entitled .apk of suffix compressed file, all the elements of an Android application program are contained in APK file, are Android platform is used for the file for installing application program.APK file is exactly a zip compressed package, after de-packaging operation, just The file structure of APK file can be obtained.Under the res catalogues for being used to deposit resource file in APK file structure, storage has this Image resource used in individual Android application.Therefore, de-packaging operation is carried out to APK file, it is possible to obtain in APK file and deposit All view data.

As a kind of embodiment, step S101 can include：De-packaging operation is carried out to APK file, obtained in APK file All view data of storage.Specifically, can be by APK file input sample solution packet interface, obtain that APK file includes is all View data, so as to perform subsequent step to all view data in APK file, according to all view data to APK texts Part is detected.

As another embodiment, step S101 can include：De-packaging operation is carried out to APK file, from APK file bag In all view data included, the view data of predetermined number is randomly selected.So as to the view data of the predetermined number to extraction Subsequent step is performed, the APK file is detected according to the view data of these predetermined numbers.Wherein, preset data can be with Determined according to test of many times, to reach higher accuracy of detection.

That is, the first above-mentioned embodiment is by the way of full inspection, to all view data in APK file Detected.And second above-mentioned of embodiment is all view data for being included to APK file by the way of sampling observation Carry out random sampling, the detection sample of the view data of the predetermined number of selection as the APK file.In contrast, using complete The mode of inspection detects, and recall rate is higher.And detected by the way of sampling observation, detection speed is faster.

Step S102, pass through the characteristic vector of each described image data of default first model extraction；

The view data that step S101 is obtained inputs default first model, obtain the feature of each view data to Amount.In the embodiment of the present invention, the first model trained is pre-stored within electronic equipment, corresponding for extracting view data Characteristic vector.Specifically, the first model is deep learning network model, neutral net is built using depth learning technology to carry The characteristic vector of image is taken, as characteristic vector corresponding to view data.For example, LeNet network models, Alexnet network moulds The convolutional Neurals such as type, Googlenet network models, VGG network models and Deep Residual Learning network models Network model.

As a kind of optional embodiment, the first model can use AlexNet deep learning network models.AlexNet Deep learning network model has 8 layers of network structure, including 5 layers of convolutional layer and 3 layers of full articulamentum.Wherein, convolutional layer includes The convolution kernel of 11*11,5*5 and 3*3 size, and 3 layers of full articulamentum include 4096,4096 and 1000 the number of hidden nodes respectively. In image classification challenge task on ImageNet, the AlexNet network structure models that Alex is proposed have won 2012 Champion.The model Top-5 at that time error rate be 16.4%, positive effect be better than before LeNet network models.Cause This, compared to other convolutional neural networks models, AlexNet deep learning network models were advantageous within the relatively short time Reach preferable effect, so as to be advantageous to take into account detection time and accuracy of detection simultaneously.

As a kind of optional embodiment, characteristic vector can be 4096 dimensional feature vectors corresponding to view data.

Specifically, when the first model is using the AlexNet deep learning network models trained, step S101 is obtained View data input to the AlexNet network models trained.A forward direction computing is done using AlexNet network models, so 4096 dimension values of the full articulamentum of the 7th layer of network are extracted afterwards as characteristic vector corresponding to view data.Optionally, can incite somebody to action The characteristic vector extracted is deposited among corresponding document system, in order to further according to the eigenvector recognition pair extracted Whether the APK file answered relates to Huang.

In addition, in order to subsequently extract the feature of image well, as a kind of optional embodiment, step is being performed Before S102, first view data can be pre-processed.Specifically, the pre-treatment step can include：By acquired figure As data zoom to pre-set dimension.In the present embodiment, pre-set dimension can be arranged as required to.For example, pre-set dimension can be with For 256*256 pixel sizes.

Step S103, the characteristic vector is inputted into default second model, obtained corresponding to each described image data Characteristic value；

In the embodiment of the present invention, the second model trained is also pre-stored within electronic equipment, for according to image The characteristic vector of data obtains characteristic value corresponding to the view data.This feature value is used to represent that the view data belongs to not plan deliberately The probability of picture, in order to further determine whether the view data is bad image according to this feature value, so that it is determined that the image Whether APK file corresponding to data relates to Huang.It should be noted that in the embodiment of the present invention, bad graphical representation pornographic image.

Specifically, as shown in Fig. 2 the step of training the second model can include：

Step S201, obtains image pattern, and described image sample includes multiple first view data and multiple second images Data, the multiple first view data both correspond to default first label, and the multiple second view data both corresponds to Second label；

In the present embodiment, image pattern can extract from default APK file sample.Wherein, multiple first images Data are the first certain amount of pornographic image extracted from APK file sample, and multiple second view data are from APK file The the second certain amount of non-pornographic image extracted in sample.First label is the label for identifying pornographic image, and second marks Sign as the label for identifying non-pornographic image.For example, can be extracted from APK file sample 13350 pornographic images and 13350 non-pornographic images, and these images are correspondingly corresponding with the first label and the second label.

Step S202, pass through the characteristic vector of all view data in the first model extraction described image sample；

It is understood that the first model used in step S202 and the first model phase used in above-mentioned steps S102 Together.Step S202 is that feature extraction object is different from step S102 difference, is to the institute in image pattern in step S202 There is view data to carry out feature extraction, and in step S102 be the view data to the step S101 APK files to be detected obtained Carry out feature extraction.Therefore, step S202 embodiment is similar with above-mentioned steps S102 embodiment, is specifically referred to Above-mentioned steps S102, here is omitted.

Step S203, disaggregated model training is carried out to the characteristic vector of all view data in described image sample, obtained Second model.

Wherein, the second model is used to carry out regression forecasting to the view data of Unknown Label.As a kind of embodiment, institute The characteristic vector to all view data in described image sample stated carries out disaggregated model training, obtains second model Step, it can include：The characteristic vector of all view data in described image sample is entered using default logistic regression algorithm Row training, obtains logistic regression disaggregated model, using the logistic regression disaggregated model as second model.

Logistic regression algorithm, also known as logistic regression analysis, it is one kind in classification and prediction algorithm.Pass through historical data Performance probability that future outcomes are occurred be predicted.Recurrence is a kind of extremely intelligible model, is equivalent to y=f (x), Show independent variable x and dependent variable y relation.Most common problem just like prestige when attending, hear, ask, cut, judge patient afterwards It is whether sick or sick what, it is therein to hope, hear, asking, cutting and be just obtained from variable x, i.e. characteristic, judge whether sick It is equivalent to obtain dependent variable y, i.e. prediction classification.Train the logistic regression disaggregated model for relating to yellow detection for APK file main It is that the characteristic vector of all view data in image pattern is inputed into logistic regression algorithm, logistic regression algorithm passes through under gradient Constantly iteration so that be fitted given label as much as possible for drop strategy, when training to a certain extent, it is possible to obtain logic Return disaggregated model.Optionally, then it is stored in corresponding file system.For example, distributed file system can be stored in In (Hadoop Distributed File System, HDFS).Hereafter, it is possible to the classification mould trained is read from HDFS Type carries out regression forecasting as the second model to the view data of Unknown Label.

For example, the second model detailed process of training can be：By the pornographic image of manual identification and non-pornographic image data The AlexNet deep learning network models that collection input trains, AlexNet deep learning network models export these view data 4096 dimensional feature vectors, 4096 dimensional feature vectors of these view data are inputted into default logistic regression algorithm, trained To logistic regression disaggregated model, using the logistic regression disaggregated model of output as the second model, distributed file system is stored in In HDFS.

When the second model is the logistic regression disaggregated model trained, in above-mentioned steps S103, step S102 is carried The characteristic vector of view data take, Unknown Label inputs to the disaggregated model, one recurrence of the disaggregated model final output Fractional value.Characteristic value using the recurrence fractional value as the view data, to represent that the view data belongs to the general of pornographic image Rate.Specifically, the recurrence fractional value can be numerical value of the scope between 0 to 1.

Certainly, in addition to logistic regression algorithm, in the other embodiment of the present invention, other algorithms can also be used to figure The characteristic vector of all view data is trained in decent, obtains can be used for corresponding to the view data of Unknown Label The disaggregated model that label is predicted, as the second above-mentioned model.

In addition, in order to subsequently extract the feature of image well, can be to image sample before step S202 is performed All view data in this are pre-processed.Correspondingly, pre-treatment step can include：By all images in image pattern Data zoom to pre-set dimension.It is understood that in order to ensure accuracy of detection, if being held during the second model is trained The pre-treatment step is gone, then in the detection process of APK file to be detected, before above-mentioned steps S102 is performed, also should Identical pretreatment is carried out to the view data that step S101 is obtained.

As a kind of optional embodiment, the second model in above-mentioned steps S103 can also train in real time, i.e. institute Above-mentioned steps S201 to step S203 can be included by stating APK detection methods.It should be noted that above-mentioned steps S201 is to step S203 should be performed before above-mentioned steps S103, specifically with step S101 and step S102 sequencing, in the present embodiment not Limit.

Step S104, judge whether the APK file includes bad image according to resulting characteristic value.

Characteristic value corresponding to each view data represents that the view data belongs to the probability of bad image.Specifically, can To be handled according to preset rules the characteristic value obtained by step S103, whether APK file corresponding to judgement is comprising bad Image, that realizes APK file relates to yellow detection.Specifically, preset rules can be arranged as required to.

, can be by the resulting characteristic value compared with predetermined threshold value, if existing big as a kind of embodiment In the characteristic value of the predetermined threshold value, then judge that the APK file includes bad image, be more than the predetermined threshold value if being not present Characteristic value, then judge that the APK file does not include bad image.Specifically, predetermined threshold value can be set according to test of many times.

Characteristic value corresponding to view data is more than predetermined threshold value, then it represents that the view data belongs to bad image.Namely Say, if in the view data for the APK file that step S101 is obtained, characteristic value corresponding to a view data be present and be more than default threshold Value, then judge that the APK file includes bad image, i.e. the APK file relates to Huang, belongs to pornographic class APK file.If step S101 is obtained In the view data of the APK file taken, it is more than predetermined threshold value, i.e., all view data in the absence of characteristic value corresponding to view data Corresponding characteristic value then judges that the APK file does not include bad image no more than predetermined threshold value, i.e. the APK file does not relate to Huang, Belong to non-pornographic class APK file.So as to realize the purpose that yellow detection is related to APK file.

For example, the process for APK file relate to yellow detection is specifically as follows：By APK file input sample solution packet interface, The view data that the APK file includes is exported, these view data are the view data of Unknown Label.Further by these not Know the view data input AlexNet deep learning network models of label, extract the 4096 of the view data of these Unknown Labels Dimensional feature vector.The logistic regression disaggregated model being previously obtained, the figure that will be extracted are read from distributed file system HDFS As 4096 dimensional feature vectors of data are inputted in the logistic regression disaggregated model, you can output regression fractional value, i.e. features described above Value, by the recurrence fractional value compared with predetermined threshold value, when the recurrence fractional value that view data be present is more than predetermined threshold value, It is bad image to show view data corresponding to the recurrence fractional value, that is to say, that the APK file includes bad image.When this When recurrence fractional value is not more than predetermined threshold value, it is non-bad image to show view data corresponding to the recurrence fractional value.If APK is literary When all view data that part includes are non-bad image, then illustrate that the APK file does not include bad image, i.e., do not relate to Huang.

As another embodiment, can be obtained big by the resulting characteristic value compared with predetermined threshold value In the quantity of the characteristic value of the predetermined threshold value, if the quantity more than the characteristic value of the predetermined threshold value exceedes specified quantity, Judge that the APK file includes bad image, if the quantity more than the characteristic value of the predetermined threshold value is no more than specified quantity, Judge that the APK file does not include bad image.Specifically, predetermined threshold value and specified quantity can be set according to test of many times. For example, specified quantity can be 3, so when the quantity of the characteristic value more than the predetermined threshold value is no more than 3, it is believed that should APK file is the APK file of non-pornographic class.Because the APK file for relating to Huang generally includes substantial amounts of porny, when what is detected When belonging to the quantity of pornographic image and being no more than specified quantity, it may be possible to wrong report situation occur, can thus provide a system to one Fixed serious forgiveness.

Further, as a kind of optional embodiment, bad image is included in judgement APK file, that is, judges APK texts Part belongs to after pornographic class APK file, and methods described can also include：Export default information warning.Default information warning It is to relate to the APK file of Huang for reminding user's APK file.Specifically, can be by the display unit on electronic equipment to pre- If information warning shown, to be alerted in time to user.

Further, can also include as a kind of optional embodiment, methods described：At interval of preset time period, obtain Test sample is taken, wherein, the test sample includes the APK file of more than one known class, and the test sample is made For APK file to be detected, the view data in described acquisition APK file is performed, it is every by default first model extraction The characteristic vector of individual described image data, the characteristic vector is inputted into default second model, obtains each described image number According to corresponding characteristic value, the step of whether APK file includes bad image is judged according to resulting characteristic value, according to institute State classification corresponding to test sample and judge whether testing result meets preparatory condition, if being unsatisfactory for preparatory condition, according to Test sample optimizes to second model.

Specifically, preset time period can be arranged as required to, for example, could be arranged to 1 day, 7 days, 15 days or one Month.The APK file of known class is the APK file of handmarking, i.e., manual examination and verification are carried out to selected newly-increased APK file, right All view data included in these APK files are marked, and the classification of these APK files is carried out according to auditing result Mark.For example, the classification for the APK file that test sample includes can be divided into pornographic class and non-pornographic class, pornographic class APK file To include the APK file of bad image, non-pornographic class APK file is the APK file not comprising bad image.

The APK file of the known class included to test sample performs above-mentioned steps S101 to step S104 and can obtained To corresponding testing result., can be with as a kind of embodiment when the APK file of test sample including multiple known class Whether the accuracy for judging testing result according to classification corresponding to the test sample reaches desired value, if reaching desired value, Judge that testing result meets preparatory condition, if being not reaching to desired value, judge that testing result is unsatisfactory for preparatory condition.It can manage Solution, when the testing result to test sample meets preparatory condition, then need not be optimized to the second model.

In test sample, all view data that each APK file includes are corresponding with label.Now, according to the survey This embodiment optimized to second model of sample can be：All view data that test sample is included are equal Correspondingly it is added in the image pattern for training second model, again according to above-mentioned steps S201 to S203 pairs of step New image pattern is trained, and second model is updated according to training result, i.e., point obtained with re -training Class model, as the second model after renewal.

Or the embodiment optimized according to the test sample to second model can also be：By described in The view data that the wrong APK file of testing result includes in test sample is added to the image pattern for training the second model In, new image pattern is trained according to above-mentioned steps S201 to step S203 again, second model is carried out more Newly, i.e., the disaggregated model obtained with re -training, as the second model after renewal.

In addition, when test sample is the APK file of known class, can basis as another embodiment Classification corresponding to the test sample judges whether testing result is correct, if correctly, judging that testing result meets preparatory condition, If incorrect, judge that testing result is unsatisfactory for preparatory condition.It is understood that when the testing result to test sample meets During preparatory condition, then the second model need not be optimized.

The second model is carried out by periodically the verifying to testing result using test sample, and according to the result Optimization, advantageously ensure that the accuracy of testing result.

Fig. 3 is referred to, the module frame chart of package detection device is installed for the program that second embodiment of the invention provides.The program Installation package detection device is used for the program installation packet inspection method for realizing that first embodiment provides.In the embodiment of the present invention, journey Sequence installation package detection device can run on user terminal, can also run on server.Wherein, program installation kit is to increase income The program installation kit of system.Package detection device will be installed to program provided by the invention by taking Android installation kit APK file as an example below Illustrate.As shown in figure 3, program installation package detection device includes：Data acquisition module 301, characteristic vector pickup module 302nd, characteristic value calculating module 303 and detection module 304.

Wherein, data acquisition module 301, for obtaining the view data in APK file；

Characteristic vector pickup module 302, for the feature by each described image data of default first model extraction Vector；

Characteristic value calculating module 303, for the characteristic vector to be inputted into default second model, obtain each figure The characteristic value as corresponding to data；

Detection module 304, for judging whether the APK file includes bad image according to resulting characteristic value.

As a kind of optional embodiment, as shown in figure 4, described device also includes：Sample acquisition module 401, sample are special Levy extraction module 402 and training module 403.

Sample acquisition module 401, for obtaining image pattern, described image sample includes multiple first view data and more Individual second view data, the multiple first view data both correspond to default first label, the multiple second picture number According to both corresponding to the second label；

Sample characteristics extraction module 402, for passing through all picture numbers in the first model extraction described image sample According to characteristic vector；

Training module 403, for carrying out disaggregated model instruction to the characteristic vector of all view data in described image sample Practice, obtain second model.

As a kind of optional embodiment, the training module 403 is specifically used for：Utilize default logistic regression algorithm pair The characteristic vector of all view data is trained in described image sample, obtains logistic regression disaggregated model, by the logic Disaggregated model is returned as second model.

As a kind of optional embodiment, described device also includes：Pretreatment module.Pretreatment module, for by described in All view data in image pattern zoom to pre-set dimension.

As a kind of optional embodiment, the detection module 304 is specifically used for：By the obtained characteristic value with presetting Threshold value is compared, if the characteristic value more than the predetermined threshold value be present, judges that the APK file includes bad image, if In the absence of the characteristic value more than the predetermined threshold value, then judge that the APK file does not include bad image.

As a kind of optional embodiment, first model is AlexNet deep learning network models.

As a kind of optional embodiment, the characteristic vector is 4096 dimensional feature vectors corresponding to described image data.

As a kind of optional embodiment, described device also includes：Output module, for exporting default information warning. It is to relate to the APK file of Huang that information warning, which is used to remind user's APK file,.Specifically, the display on electronic equipment can be passed through Unit is shown to default information warning.

As a kind of optional embodiment, described device also includes：Optimization module.The optimization module is used for：At interval of Preset time period, test sample is obtained, wherein, the test sample includes the APK file of more than one known class, by institute Test sample is stated as APK file to be detected, performs the view data in described acquisition APK file, passes through default the The characteristic vector of each described image data of one model extraction, the characteristic vector is inputted into default second model, obtained every Characteristic value corresponding to individual described image data, judge whether the APK file includes bad image according to resulting characteristic value The step of, judge whether testing result meets preparatory condition according to classification corresponding to the test sample, if being unsatisfactory for default bar Part, then second model is optimized according to the test sample.

Pass through above-mentioned data acquisition module 301, characteristic vector pickup module 302, characteristic value calculating module 303 and inspection The APK file for surveying the known class that module 304 includes to test sample is handled, you can to obtain corresponding detection knot Fruit., can be according to the test specimens as a kind of embodiment when test sample includes the APK file of multiple known class Classification corresponding to this judges whether the accuracy of testing result reaches desired value, if reaching desired value, judges that testing result expires Sufficient preparatory condition, if being not reaching to desired value, judge that testing result is unsatisfactory for preparatory condition.It is understood that when to surveying When the testing result of sample sheet meets preparatory condition, then the second model need not be optimized.

In test sample, all view data that each APK file includes are corresponding with label.Now, according to the survey This embodiment optimized to second model of sample can be：All view data that test sample is included are equal Correspondingly it is added in the image pattern for training second model, again through above-mentioned sample acquisition module 401, sample Characteristic extracting module 402 and training module 403 are trained to new image pattern, according to training result to second model It is updated, i.e., the disaggregated model obtained with re -training, as the second model after renewal.

Or the embodiment optimized according to the test sample to second model can also be：By described in The view data that the wrong APK file of testing result includes in test sample is added to the image pattern for training the second model In, again through above-mentioned sample acquisition module 401, sample characteristics extraction module 402 and training module 403 to new image pattern It is trained, second model is updated, i.e., the disaggregated model obtained with re -training, as the second mould after renewal Type.

In the technical scheme of the embodiment of the present invention, by obtaining the view data in APK file, default first is utilized The characteristic vector of each view data of model extraction, then the characteristic vector of extraction is inputted into default second model, obtain each Characteristic value corresponding to view data, whether the obtained characteristic value is then determined into APK file compared with predetermined threshold value Comprising bad image, that realizes APK file relates to yellow detection.Compared to prior art, technical scheme provided in an embodiment of the present invention In, default second model is by the way that multiple the first view data marked in advance and the second view data are formed into sample graph Picture, it is trained what is obtained using the characteristic vector of the first model extraction sample image, then to the characteristic vector of sample image, and First model employs deep learning network model, so is used to detect comprising not plan deliberately by the first model and the second models coupling The APK file of picture, recall rate and accuracy of detection can be effectively improved.

Third embodiment of the invention additionally provides a kind of electronic equipment, as shown in figure 5, for convenience of description, illustrate only The part related to the embodiment of the present invention, particular technique details do not disclose, refer to present invention method part.The electricity Sub- equipment can be user terminal, or server.Wherein, user terminal can be Android system is installed include hand Machine, tablet personal computer, PDA (Personal DigitalAssistant, personal digital assistant), POS (Point of Sales, pin Sell terminal), any terminal device such as vehicle-mounted computer, so that terminal is mobile phone as an example：

Fig. 5 is illustrated that the block diagram of the part-structure of the mobile phone related to electronic equipment provided in an embodiment of the present invention.Ginseng Fig. 5 is examined, mobile phone includes：Radio frequency (Radio Frequency, RF) circuit 510, memory 520, input block 530, display unit 540th, sensor 550, voicefrequency circuit 560, Wireless Fidelity (wireless-fidelity, Wi-Fi) module 570, processor 580, And the grade part of power supply 590.It will be understood by those skilled in the art that the handset structure shown in Fig. 5 is not formed to mobile phone Limit, can include than illustrating more or less parts, either combine some parts or different parts arrangement.

Each component parts of mobile phone is specifically introduced with reference to Fig. 5：

RF circuits 510 can be used for receive and send messages or communication process in, the reception and transmission of signal, especially, by base station After downlink information receives, handled to processor 580；In addition, it is sent to base station by up data are designed.Generally, RF circuits 510 Including but not limited to antenna, at least one amplifier, transceiver, coupler, low-noise amplifier (Low Noise Amplifier, LNA), duplexer etc..In addition, RF circuits 510 can also be communicated by radio communication with network and other equipment. Above-mentioned radio communication can use any communication standard or agreement, including but not limited to global system for mobile communications (Global System of Mobile communication, GSM), general packet radio service (General Packet Radio Service, GPRS), CDMA (Code Division Multiple Access, CDMA), WCDMA (Wideband Code Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE), Email, Short Message Service (Short Messaging Service, SMS) etc..

Memory 520 can be used for storage software program and module, and processor 580 is stored in memory 520 by operation Software program and module, so as to perform the various function application of mobile phone and data processing.Memory 520 can mainly include Storing program area and storage data field, wherein, storing program area can storage program area, the application journey needed at least one function Sequence (such as sound-playing function, image player function etc.) etc.；Storage data field can store uses what is created according to mobile phone Data (such as voice data, phone directory etc.) etc.., can be with addition, memory 520 can include high-speed random access memory Including nonvolatile memory, for example, at least a disk memory, flush memory device or other volatile solid-states Part.

Input block 530 can be used for the numeral or character information for receiving input, and produce with the user of mobile phone set with And the key signals input that function control is relevant.Specifically, input block 530 may include that contact panel 531 and other inputs are set Standby 532.Contact panel 531, also referred to as touch-screen, collect user on or near it touch operation (such as user use The operation of any suitable object such as finger, stylus or annex on contact panel 531 or near contact panel 531), and root Corresponding attachment means are driven according to formula set in advance.Optionally, contact panel 531 may include touch detecting apparatus and touch Two parts of controller.Wherein, the touch orientation of touch detecting apparatus detection user, and the signal that touch operation is brought is detected, Transmit a signal to touch controller；Touch controller receives touch information from touch detecting apparatus, and is converted into touching Point coordinates, then give processor 580, and the order sent of reception processing device 580 and can be performed.Furthermore, it is possible to using electricity The polytypes such as resistive, condenser type, infrared ray and surface acoustic wave realize contact panel 531.Except contact panel 531, input Unit 530 can also include other input equipments 532.Specifically, other input equipments 532 can include but is not limited to secondary or physical bond One or more in disk, function key (such as volume control button, switch key etc.), trace ball, mouse, action bars etc..

Display unit 540 can be used for display by user input information or be supplied to user information and mobile phone it is various Menu.Display unit 540 may include display panel 541, optionally, can use liquid crystal display (Liquid Crystal Display, LCD), the form such as Organic Light Emitting Diode (Organic Light-Emitting Diode, OLED) it is aobvious to configure Show panel 541.Further, contact panel 531 can cover display panel 541, when contact panel 531 is detected thereon or attached After near touch operation, processor 580 is sent to determine the type of touch event, is followed by subsequent processing device 580 according to touch event Type corresponding visual output is provided on display panel 541.Although in Figure 5, contact panel 531 and display panel 541 It is the part independent as two to realize the input of mobile phone and input function, but in some embodiments it is possible to by touch-control Panel 531 is integrated with display panel 541 and realizes input and the output function of mobile phone.

Mobile phone may also include at least one sensor 550, such as optical sensor, motion sensor and other sensors. Specifically, optical sensor may include ambient light sensor and proximity transducer, wherein, ambient light sensor can be according to ambient light Light and shade adjust the brightness of display panel 541, proximity transducer can close display panel 541 when mobile phone is moved in one's ear And/or backlight.As one kind of motion sensor, accelerometer sensor can detect in all directions (generally three axles) acceleration Size, size and the direction of gravity are can detect that when static, (for example horizontal/vertical screen is cut available for the application of identification mobile phone posture Change, dependent game, magnetometer pose calibrating), Vibration identification correlation function (such as pedometer, tap) etc.；May be used also as mobile phone The other sensors such as the gyroscope of configuration, barometer, hygrometer, thermometer, infrared ray sensor, will not be repeated here.

Voicefrequency circuit 560, loudspeaker 561 and microphone 562 can provide the COBBAIF between user and mobile phone.Audio-frequency electric Electric signal after the voice data received conversion can be transferred to loudspeaker 561, sound is converted to by loudspeaker 561 by road 560 Signal output；On the other hand, the voice signal of collection is converted to electric signal by microphone 562, is turned after being received by voicefrequency circuit 560 Voice data is changed to, then after voice data output processor 580 is handled, through RF circuits 510 to be sent to such as another mobile phone, Or voice data is exported to memory 520 further to handle.

WiFi belongs to short range wireless transmission technology, and mobile phone can help user's transceiver electronicses postal by WiFi module 570 Part, browse webpage and access streaming video etc., it has provided the user wireless broadband internet and accessed.Although Fig. 5 is shown WiFi module 570, but it is understood that, it is simultaneously not belonging to must be configured into for mobile phone, can not change as needed completely Become in the essential scope of invention and omit.

Processor 580 is the control centre of mobile phone, using various interfaces and the various pieces of connection whole mobile phone, is led to Cross operation or perform the software program and/or module being stored in memory 520, and call and be stored in memory 520 Data, the various functions and processing data of mobile phone are performed, so as to carry out integral monitoring to mobile phone.Optionally, processor 580 can wrap Include one or more processing units；Preferably, processor 580 can integrate application processor and modem processor, wherein, should Operating system, user interface and application program etc. are mainly handled with processor, modem processor mainly handles radio communication. It is understood that above-mentioned modem processor can not also be integrated into processor 580.

Mobile phone also includes the power supply 590 (such as battery) to all parts power supply, it is preferred that power supply 590 can pass through electricity Management system and processor 580 are logically contiguous, so as to realize management charging, electric discharge and power consumption by power-supply management system The functions such as management.

Although being not shown, mobile phone can also include camera, bluetooth module etc., will not be repeated here.

In embodiments of the present invention, the processor 580 included by the electronic equipment also has following functions：

Obtain the view data in program installation kit；

Pass through the characteristic vector of each described image data of default first model extraction；

The characteristic vector is inputted into default second model, obtains characteristic value corresponding to each described image data；

Judge whether described program installation kit includes bad image according to resulting characteristic value.

Fourth embodiment of the invention provides a kind of computer-readable recording medium, is stored thereon with computer program, this If the functional module that the program installation package detection device in invention second embodiment integrates is real in the form of software function module Now and as independent production marketing or in use, it can be stored in a computer read/write memory medium.Based on so Understanding, the present invention realize above-mentioned first embodiment program installation packet inspection method in all or part of flow, can also The hardware of correlation is instructed to complete by computer program, described computer program can be stored in a computer-readable storage In medium, the computer program when being executed by processor, can be achieved above-mentioned each embodiment of the method the step of.Wherein, it is described Computer program includes computer program code, the computer program code can be source code form, object identification code form, Executable file or some intermediate forms etc..The computer-readable medium can include：The computer program can be carried Any entity or device, recording medium, USB flash disk, mobile hard disk, magnetic disc, CD, computer storage, the read-only storage of code (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, electricity Believe signal and software distribution medium etc..It should be noted that the content that the computer-readable medium includes can be according to department Legislation and the requirement of patent practice carry out appropriate increase and decrease in method administrative area, such as in some jurisdictions, according to legislation and Patent practice, computer-readable medium do not include electric carrier signal and telecommunication signal.

Algorithm and display be not inherently related to any certain computer, virtual system or miscellaneous equipment provided herein. Various general-purpose systems can also be used together with teaching based on this.As described above, required by constructing this kind of system Structure be obvious.In addition, the present invention is not also directed to any certain programmed language.It should be understood that it can utilize various Programming language realizes the content of invention described herein, and the description done above to language-specific is to disclose this hair Bright preferred forms.

In the specification that this place provides, numerous specific details are set forth.It is to be appreciated, however, that the implementation of the present invention Example can be put into practice in the case of these no details.In some instances, known method, structure is not been shown in detail And technology, so as not to obscure the understanding of this description.

Similarly, it will be appreciated that in order to simplify the disclosure and help to understand one or more of each inventive aspect, Above in the description to the exemplary embodiment of the present invention, each feature of the invention is grouped together into single implementation sometimes In example, figure or descriptions thereof.However, the method for the disclosure should be construed to reflect following intention：I.e. required guarantor The application claims of shield features more more than the feature being expressly recited in each claim.It is more precisely, such as following Claims reflect as, inventive aspect is all features less than single embodiment disclosed above.Therefore, Thus the claims for following embodiment are expressly incorporated in the embodiment, wherein each claim is in itself Separate embodiments all as the present invention.

Those skilled in the art, which are appreciated that, to be carried out adaptively to the module in the equipment in embodiment Change and they are arranged in one or more equipment different from the embodiment.Can be the module or list in embodiment Member or component be combined into a module or unit or component, and can be divided into addition multiple submodule or subelement or Sub-component.In addition at least some in such feature and/or process or unit exclude each other, it can use any Combination is disclosed to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so to appoint Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (including adjoint power Profit requires, summary and accompanying drawing) disclosed in each feature can be by providing the alternative features of identical, equivalent or similar purpose come generation Replace.

In addition, it will be appreciated by those of skill in the art that although some embodiments in this include institute in other embodiments Including some features rather than further feature, but the combination of the feature of different embodiments means to be in the scope of the present invention Within and form different embodiments.For example, in the following claims, embodiment claimed it is any it One mode can use in any combination.

The all parts embodiment of the present invention can be realized with hardware, or to be run on one or more processor Software module realize, or realized with combinations thereof.It will be understood by those of skill in the art that it can use in practice Microprocessor or digital signal processor (DSP) are realized in gateway according to embodiments of the present invention, proxy server, system Some or all parts some or all functions.The present invention is also implemented as being used to perform side as described herein The some or all equipment or program of device (for example, computer program and computer program product) of method.It is such Realizing the program of the present invention can store on a computer-readable medium, or can have the shape of one or more signal Formula.Such signal can be downloaded from internet website and obtained, and either be provided or with any other shape on carrier signal Formula provides.

It should be noted that the present invention will be described rather than limits the invention for above-described embodiment, and ability Field technique personnel can design alternative embodiment without departing from the scope of the appended claims.In the claims, Any reference symbol between bracket should not be configured to limitations on claims.Word "comprising" does not exclude the presence of not Element or step listed in the claims.Word "a" or "an" before element does not exclude the presence of multiple such Element.The present invention can be by means of including the hardware of some different elements and being come by means of properly programmed computer real It is existing.In if the unit claim of equipment for drying is listed, several in these devices can be by same hardware branch To embody.The use of word first, second, and third does not indicate that any order.These words can be explained and run after fame Claim.

The invention discloses A1, a kind of program installation packet inspection method, methods described includes：

Obtain the view data in program installation kit；

A2, the program installation packet inspection method as described in A1, second model are obtained ahead of time by following manner：

Image pattern is obtained, described image sample includes multiple first view data and multiple second view data, described Multiple first view data both correspond to default first label, and the multiple second view data both corresponds to the second label；

Pass through the characteristic vector of all view data in the first model extraction described image sample；

Disaggregated model training is carried out to the characteristic vector of all view data in described image sample, obtains second mould Type.

A3, the program installation packet inspection method as described in A2, the spy of all view data in the sample to described image Sign vector carries out disaggregated model training, the step of obtaining second model, including：

The characteristic vector of all view data in described image sample is trained using default logistic regression algorithm, Logistic regression disaggregated model is obtained, using the logistic regression disaggregated model as second model.

A4, the program installation packet inspection method as described in A2, it is described to pass through the first model extraction described image sample In all view data characteristic vector before, in addition to：

All view data in described image sample are zoomed into pre-set dimension.

A5, the program installation packet inspection method as described in A1, the characteristic value obtained by the basis judge described program peace The step of whether dress bag includes bad image, including：

By the obtained characteristic value compared with predetermined threshold value, if the characteristic value more than the predetermined threshold value be present, Then judge that described program installation kit includes bad image；If in the absence of the characteristic value more than the predetermined threshold value, judge described in Program installation kit does not include bad image.

A6, the program installation packet inspection method as described in A1, first model is AlexNet deep learning network moulds Type.

A7, the program installation packet inspection method as described in A1, the characteristic vector is 4096 corresponding to described image data Dimensional feature vector.

The invention discloses B8, a kind of program installation package detection device, described device includes：

Data acquisition module, for obtaining the view data in program installation kit；

Characteristic vector pickup module, for the feature by each described image data of default first model extraction to Amount；

Characteristic value calculating module, for the characteristic vector to be inputted into default second model, obtain each described image Characteristic value corresponding to data；

Detection module, for judging whether described program installation kit includes bad image according to resulting characteristic value.

B9, the program installation package detection device as described in B8, described device also include：

Sample acquisition module, for obtaining image pattern, described image sample includes multiple first view data and multiple Second view data, the multiple first view data both correspond to default first label, the multiple second view data Both correspond to the second label；

Sample characteristics extraction module, for passing through all view data in the first model extraction described image sample Characteristic vector；

Training module, for carrying out disaggregated model training to the characteristic vector of all view data in described image sample, Obtain second model.

B10, the program installation package detection device as described in B9, the training module are specifically used for：

B11, the program installation package detection device as described in B9, described device also include：

Pretreatment module, for all view data in described image sample to be zoomed into pre-set dimension.

B12, the program installation package detection device as described in B8, the detection module are specifically used for：

B13, the program installation package detection device as described in B8, first model is AlexNet deep learning network moulds Type.

B14, the program installation package detection device as described in B8, the characteristic vector is 4096 corresponding to described image data Dimensional feature vector.

The invention discloses C15, a kind of electronic equipment, including processor and memory, the memory is couple to described Processor, the memory store instruction, when executed by the processor perform the electronic equipment following Operation：

Obtain the view data in program installation kit；

The invention discloses D16, a kind of computer-readable recording medium, computer program is stored thereon with, the program quilt The step of being realized during computing device any one of A1-A7.

Claims

1. a kind of program installs packet inspection method, it is characterised in that methods described includes：

Obtain the view data in program installation kit；

2. the method as described in claim 1, it is characterised in that second model is obtained ahead of time by following manner：

Image pattern is obtained, described image sample includes multiple first view data and multiple second view data, the multiple First view data both corresponds to default first label, and the multiple second view data both corresponds to the second label；

Disaggregated model training is carried out to the characteristic vector of all view data in described image sample, obtains second model.

3. method as claimed in claim 2, it is characterised in that the feature of all view data in the sample to described image Vector carries out disaggregated model training, the step of obtaining second model, including：

The characteristic vector of all view data in described image sample is trained using default logistic regression algorithm, obtained Logistic regression disaggregated model, using the logistic regression disaggregated model as second model.

4. method as claimed in claim 2, it is characterised in that described by the first model extraction described image sample Before the characteristic vector of all view data, in addition to：

All view data in described image sample are zoomed into pre-set dimension.

5. the method as described in claim 1, it is characterised in that the characteristic value obtained by the basis judges described program installation The step of whether bag includes bad image, including：

By the obtained characteristic value compared with predetermined threshold value, if the characteristic value more than the predetermined threshold value be present, sentence Determine described program installation kit and include bad image；If in the absence of the characteristic value more than the predetermined threshold value, described program is judged Installation kit does not include bad image.

6. the method as described in claim 1, it is characterised in that first model is AlexNet deep learning network models.

7. the method as described in claim 1, it is characterised in that the characteristic vector is 4096 dimension corresponding to described image data Characteristic vector.

8. a kind of program installs package detection device, it is characterised in that described device includes：

Characteristic vector pickup module, for the characteristic vector by each described image data of default first model extraction；

Characteristic value calculating module, for the characteristic vector to be inputted into default second model, obtain each described image data Corresponding characteristic value；

9. a kind of electronic equipment, it is characterised in that including processor and memory, the memory is couple to the processor, The memory store instruction, the electronic equipment is set to perform following operate when executed by the processor：

Obtain the view data in program installation kit；

10. a kind of computer-readable recording medium, is stored thereon with computer program, it is characterised in that the program is by processor The step of being realized during execution any one of claim 1-7.