CN115098385A

CN115098385A - Android application sandbox operation environment testing method

Info

Publication number: CN115098385A
Application number: CN202210760330.5A
Authority: CN
Inventors: 潘苏强; 高雁
Original assignee: Guangxi Huayao Network Technology Co ltd
Current assignee: Guangxi Huayao Network Technology Co ltd
Priority date: 2022-06-29
Filing date: 2022-06-29
Publication date: 2022-09-23

Abstract

The invention relates to the technical field of sandbox operation environment testing, and discloses a method for testing the sandbox operation environment of an android application program, which comprises the following steps: acquiring running environment state information of an android application program; constructing a sandbox operation environment inference model based on a probability graph method; training and optimizing the sandbox operation environment inference model by using an improved EM algorithm; calculating the probability of whether the program running environment is the sandbox environment in real time based on the sandbox running environment inference model after training optimization; and constructing a sandbox environment probability linear extraction model, solving the model to obtain the linear data of the operating environment, and judging whether the operating environment of the current android program is the sandbox environment or not according to the linear data of the environment. According to the method, whether the running environment is the sandbox environment or not is taken as the hidden variable, the probability that the android application program running environment is the sandbox environment is obtained by reversely deducing the probability of the hidden variable, and the detection accuracy and the detection speed of the sandbox running environment are improved.

Description

Android application sandbox operation environment testing method

Technical Field

The invention relates to the technical field of sandbox operation environment test identification, in particular to a method for testing an android application sandbox operation environment.

Background

Sandboxes provide an isolated environment for running programs in the field of computer security, often for use in providing experimentation for programs that are untrusted, destructive, or unable to determine their intent. However, more and more android users are attracted by the rapid development of moba games in recent years, the android application originally applied to the mobile end can be transplanted to the PC end for use by the sandbox (sandbox) technologies such as android simulators, fairness and user experience of the moba games are damaged, although relevant research attempts are made to detect the sandbox environment, most of the applications are simply judged according to specific characteristics at that time, the problem of high error and the like exists, and aiming at the problem, the patent provides a testing method for the operating environment of the sandbox for the accurate and rapid detection of whether the android application operates in the sandbox environment or not, and fairness and the user experience are guaranteed.

Disclosure of Invention

In view of the above, the invention provides a method for testing an android application sandbox operating environment, and aims to (1) construct a sandbox operating environment inference model based on a probability graph method of conditional probability and bayesian probability, wherein the sandbox operating environment inference model takes operating environment state information as an observation variable, whether an operating environment is a sandbox environment or not as a hidden variable, the probability that the android application operating environment is the sandbox environment at any moment is obtained by reversely inferring the hidden variable probability, the operating environment linear data of the android application operating in a mobile terminal system is extracted based on an operating environment sandbox probability time sequence data set, and if the operating environment linear data exceeds a threshold value, the operating environment of the android application is judged to be the sandbox environment, so that the sandbox operating environment detection accuracy is improved; (2) the method has the advantages that the traditional EM algorithm is improved, and a better algorithm iteration initial value can be quickly determined and obtained, so that a local optimal solution near the initial value is obtained based on the better initial value, the iteration times of the algorithm are reduced, the condition that the training effect of the model parameter vector is unstable due to the fact that the traditional EM iteration algorithm randomly selects the initial value, the iteration times of the algorithm are more, and the model parameter vector is easy to cause is avoided, the stability of the model parameter is improved, and a more stable and better model parameter vector can be quickly obtained.

The object is achieved, and the method for testing the operating environment of the android application sandbox provided by the invention comprises the following steps:

s1: detecting the running environment of the android application program when the android application program runs, and acquiring running environment state information, wherein the running environment state information comprises process information and mobile terminal state information;

s2: constructing a sandbox operation environment inference model based on a probability graph method, wherein the sandbox operation environment inference model takes operation environment state information as an observation variable, whether an operation environment is a sandbox environment or not as a hidden variable, and the probability that the android application operation environment is the sandbox environment is obtained by reversely inferring the probability of the hidden variable;

s3: acquiring running environment state information and corresponding sandbox environment judgment results according to the step S1 to form a sandbox running environment judgment training set, performing parameter training optimization based on the training set on the sandbox running environment inference model by using an improved EM (effective electromagnetic) algorithm, shortening the model training time, and obtaining the sandbox running environment inference model after training optimization;

s4: calculating the probability of whether the program running environment is the sandbox environment or not in real time based on the trained and optimized sandbox running environment inference model to obtain a sandbox probability time sequence data set of the running environment, wherein the time sequence range in the sandbox probability time sequence data set of the running environment is the time range of the running of the android application program;

s5: and constructing a sandbox environment probability linear extraction model based on the sandbox probability time sequence data set of the operating environment, solving the model to obtain operating environment linear data, and if the operating environment linear data exceeds a specified threshold value, indicating that the operating environment of the current android program is the sandbox environment, otherwise, indicating that the operating environment is not the sandbox environment.

As a further improvement of the method of the invention:

optionally, the step S1 is to detect an operating environment of the android application program during running, and obtain operating environment state information, where the operating environment state information includes process information and mobile terminal state information, and the method includes:

when an android application program runs, acquiring running environment state information by using a monitoring process built in the android application program, wherein the running environment state information comprises process information and mobile terminal state information, and the acquiring flow of the running environment state information is as follows:

s11: setting a process switch value of a monitoring process to be {0, 1}, wherein when the android application program runs, the process switch value of the monitoring process is updated to be 1 to indicate that the monitoring process is started, and when the android application program does not run, the process switch value of the monitoring process is updated to be 0 to indicate that the monitoring process is closed;

s12: when the android application program runs, updating the process switch value of the monitoring process to 1, which indicates that the monitoring process is started; the method comprises the steps that a monitoring process traverses a process list in a mobile terminal system at the current moment to obtain process information of a running environment state, wherein the format of each process in the process information is { Name, parameter, return, stack and time }, the process represents the process, the Name represents the process Name, the parameter represents the process parameter, the return represents the process return value, the stack represents the stack called by the process, and the time represents the time generated by the process;

in the embodiment of the invention, the process information comprises registry information and a communication process in a mobile terminal system, and the mobile terminal system is a system where an android application program is located when the android application program runs;

s13: the method comprises the steps that a monitoring process collects mobile terminal state information of a mobile terminal system at the current moment, wherein the mobile terminal state information comprises the CPU utilization rate, the memory utilization rate and the network utilization rate of the mobile terminal system;

s14: and taking the collected process information and the state information of the mobile terminal as the running environment state information of the android application program running at the current moment.

Optionally, the constructing a sandbox operating environment inference model based on a probability map method in the step S2, where the sandbox operating environment inference model uses operating environment state information as an observation variable, and whether an operating environment is a sandbox environment is a hidden variable includes:

constructing a sandbox operating environment inference model, wherein the sandbox operating environment inference model takes operating environment state information as an observation variable and takes whether an operating environment is a sandbox environment or not as a hidden variable, the operating environment state information is input into the sandbox operating environment inference model, and the model output is a probability value that the operating environment is the sandbox environment;

the Sandbox operating environment inference model comprises an input layer and a probability calculation layer, wherein the input layer is used for receiving operating environment state information and sending the operating environment state information to the probability calculation layer, the probability calculation layer is a probabilistic graph model G ═ (E, V), the E represents a node in the probabilistic graph model, the node comprises a process node pro, a mobile terminal state information node host and a Sandbox environment judgment node Sandbox, the V represents an edge in the probabilistic graph model, the edge is a directed edge, the directed edge pro → the Sandbox represents a probability P (Sandbox | pro) of the Sandbox environment Sandbox under the condition that the process pro exists in the mobile terminal system, wherein each process node pro in the probabilistic graph model G comprises process information of the process, the process node dbpro and the Sandbox environment judgment node are connected to form an edge, each mobile terminal state information node host in the probabilistic graph model G is any { CPU usage rate in the mobile terminal state information, a numerical representation of memory usage, network usage, in the form of { obj: number, wherein obj belongs to the { CPU utilization rate, memory utilization rate and network utilization rate }, the number is a numerical value corresponding to the utilization rate, and the mobile terminal state information node host is connected with the Sandbox environment judgment node Sandbox to form a side;

deducing the running environment state information F of the model input layer for the input sandbox running environment:

F＝{(pro _1，F ，pro _2，F ，...，pro _i，F ，...，pro _n，F )，(CPU _F ，Memory _F ，Net _F )}

wherein:

pro _i，F for running the ith process in the environment state information FN represents the total number of processes in the running environment state information F;

CPU _F ，Memory _F ，Net _F the running environment state information F is the numerical representation of the CPU utilization rate, the memory utilization rate and the network utilization rate;

wherein any pro _i，F Belongs to PRO, wherein PRO represents the set of process nodes in the probability computation layer and any CPU _F ，Memory _F ，Net _F Belongs to HOST, HOST is a set of mobile terminal state information nodes in a probability calculation layer, an input layer receives and analyzes operation environment state information F, and process information (pro) in F _1，F ，pro _2，F ，...，pro _i，F ，...，pro _n，F ) And mobile terminal status information (CPU) _F ，Memory _F ，Net _F ) And distributing the data to nodes in a probability calculation layer, wherein the probability calculation layer calculates the probability P (Sandbox | F) that the android application program running environment is Sandbox environment Sandbox when the running environment state information of the mobile terminal system is F:

host _F ＝P(Sandbox|CPU _F )+P(Sandbox|Memory _F )+P(Sandbox|Net _F )

wherein:

δ (·) is a sigmoid function;

b _i is pro _i，F Offset value, w, of the node in the probability computation layer _i Is pro _i，F The method comprises the following steps that weights of nodes in a probability calculation layer are obtained, bias values of different process nodes in a process node set PRO in the probability calculation layer and a parameter vector theta to be solved with the weights as a model are (B, W), B is a bias vector formed by the bias values of the different process nodes in the model, and W is a weight vector formed by the weights of the different process nodes in the model;

P(Sandbox|pro _i，F ) Indicating the presence of a process pro _i，F In the case of (a) in (b),the probability that the operation environment is a Sandbox environment Sandbox;

P(Sandbox|CPU _F ) Indicating CPU usage as CPU _F Under the condition of (1), the operation environment is the probability of the Sandbox environment Sandbox;

P(Sandbox|Memory _F ) Indicating Memory usage as Memory _F Under the condition of (2), the running environment is the probability of the Sandbox environment Sandbox;

P(Sandbox|Net _F ) Indicating network usage as Net _F Under the condition of (2), the running environment is the probability of the Sandbox environment Sandbox;

the prior probability P (Sandbox | pro) _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F ) And the model parameter vector theta is a model parameter to be trained and optimized; compared with the traditional algorithm, the method and the device have the advantages that the sandbox operation environment judgment training set for sandbox operation environment judgment is constructed on the basis of the conditional probability and the Bayesian probability, the available model is quickly obtained on the basis of the prior probability of the training set and the EM iterative algorithm, and therefore the probability calculation of whether the program operation environment is the sandbox environment is achieved.

Optionally, the step S3, collecting the operating environment state information and the corresponding sandbox environment determination result to form a sandbox operating environment determination training set, including:

collecting the running environment state information according to the method of the step S1, manually judging the corresponding sandbox environment judgment result, and forming a sandbox running environment judgment training set by the running environment state information and the corresponding sandbox environment judgment result, wherein the format of the formed sandbox running environment judgment training set data is as follows:

data＝{data1，data2}

data1＝{process _j ＝(pro _j ，label _j )|j∈[1，J]}

data2＝{(Info _r，k ，label _r，k )|k∈[1，K]，r＝1，2，3}

wherein:

data1 is a process information data set, and data2 is a mobile terminal state information data set;

label is the judgment result of the sandbox environment, label is {0, 1},label _j 0 indicates that the operation environment of the jth process in the process information data set is not the sandbox environment, and label _j 1 represents that the operation environment of the jth process in the process information data set is a sandbox environment;

process _j indicating the jth process, pro, in the process information dataset _j Process information representing the jth process in the process information data set, wherein J represents the total number of processes in the process information data set;

Info _r，k the usage rate of the kth mobile terminal system in the mobile terminal state information data set in the index r is represented, r is 1, 2 and 3, the index 1 represents a CPU, the index 2 represents a memory, the index 3 represents a network, and K represents the total number of the mobile terminal systems in the mobile terminal state information data set.

Optionally, in the step S3, performing training optimization on parameters of the sandbox operating environment inference model based on a training set by using an improved EM algorithm, to obtain a trained and optimized sandbox operating environment inference model, including:

carrying out parameter training optimization based on a training set on the Sandbox operation environment inference model by utilizing an improved EM algorithm to obtain a Sandbox operation environment inference model after training optimization, wherein the parameters to be optimized comprise prior probability P (Sandbox | pro) _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F ) And a model parameter vector theta, wherein the parameter training optimization process comprises the following steps:

s31: taking the process information and the state information of the mobile terminal in the training set as nodes of a probability calculation layer in a Sandbox operation environment inference model, setting a Sandbox environment judgment node Sandbox, and calculating the prior probability P (Sandbox | pro) among different nodes according to the data in the training set _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F )；

S32: setting the current iteration number of the model parameter vector as

Wherein

Is 0, at first

The model parameter vector of the sub-iteration is theta

S33: constructing a model parameter vector optimized objective function Loss:

wherein:

the probability that the operation environment of the jth process in the process information data set output by the model for the sandbox operation environment is the sandbox environment is deduced,

deducing the probability that the kth mobile terminal system is in the sandbox environment according to the utilization rate of the kth mobile terminal system in the mobile terminal state information data set on the index r by the sandbox operation environment inference model;

randomly generating 20 groups of model parameter vectors, respectively taking the 20 groups of generated model parameter vectors as model parameter vectors of a sandbox operation environment inference model, calculating objective function values of different sandbox operation environment inference models, and selecting the model parameter vector which enables the model objective function value to be minimum as an initial model parameter vector theta ⁰ ；

S34: e, executing model parameter vector iteration in the step E, and calculating the expectation of a sandbox operation environment inference model based on the sandbox operation environment judgment training set data:

wherein:

e (-) represents the desired calculation;

d, indicating index data in the sandbox operating environment judgment training set data, wherein the index data comprises process information and the utilization rates of different indexes in the mobile terminal system;

the label that whether the android application program running environment is the sandbox environment is represented by {0, 1}, the label that whether the android application program running environment is the sandbox environment is represented by 0, the label that the android application program running environment is not the sandbox environment is represented by 1, and the android application program running environment is the sandbox environment;

s35: executing M steps of model parameter vector iteration, and solving to obtain the result

The largest model parameter vector is taken as

Sub-iterative model parameter vector

S36: judgment of

Whether the secondary iteration reaches a termination condition or not, and if the secondary iteration reaches the termination condition, outputting

Constructing a sandbox running environment inference model after training optimization as a model parameter vector obtained by training optimization; if the end condition is not reached, order

Returning to step S34, the termination condition is:

wherein:

t represents transposition;

if G < epsilon, the termination condition is reached, where epsilon is a preset termination threshold, and epsilon > 0.

In the embodiment of the invention, the traditional EM iterative algorithm can not ensure to obtain a global optimal solution, namely the obtained solution can change along with different initial values and has the characteristic of 'initial sensitivity', therefore, the scheme introduces an initial value selection method based on an objective function, randomly generates 20 groups of model parameter vectors by constructing an objective function optimized by model parameter vectors, instantiates the generated model parameter vectors into a sandbox operation environment inference model, calculates the objective function values of the different sandbox operation environment inference models, selects the model parameter vector with the minimum model objective function value as an initial model parameter vector, wherein the model parameter vector with the minimum model objective function value can ensure that the inference error of the sandbox operation environment inference model can be minimized, thereby obtaining a local optimal solution near the initial value based on a better initial value, the situation that the training effect of the model parameter vector is unstable due to the fact that the traditional EM iterative algorithm randomly selects the initial value is avoided.

Optionally, in the step S4, calculating a probability of whether the program operating environment is a sandbox environment based on the training optimized sandbox operating environment inference model to obtain an operating environment sandbox probability time series data set, where the calculating includes:

inputting the collected running environment state information into a sandbox running environment inference model after training optimization, calculating the probability of whether a program running environment is the sandbox environment based on the sandbox running environment inference model after training optimization to obtain a running environment sandbox probability time sequence data set, wherein the time sequence range in the running environment sandbox probability time sequence data set is the time range of android application program running, and the representation form of the running environment sandbox probability time sequence data set D is as follows:

D＝{P(Sandbox|F(t ₀ ))，P(Sandbox|F(t ₁ ))，...，P(Sandbox|F(t _s ))}

wherein:

F(t ₀ ) Is t ₀ Running Environment State information at time P (Sandbox | F (t) ₀ ) ) represents t ₀ Probability that the running environment of the program at the moment is the sandbox environment, and the android application program is in the step t ₀ At time t, the operation is started _s And ending the operation at the moment.

Optionally, the constructing a sandbox environment probability linear extraction model in the step S5, solving the model to obtain operating environment linear data, and if the operating environment linear data exceeds a specified threshold, it is determined that the operating environment of the current android program is the sandbox environment, otherwise, the sandbox environment is not the current android program, including:

constructing a sandbox environment probability linear extraction model, wherein the sandbox environment probability linear extraction model is as follows:

Y＝aX+c

wherein:

x is timing information [ t ₀ ，...，t _s ]Android applications at t ₀ At time t, the operation is started _s Ending the operation at the moment;

y represents sandbox environment probability information, namely time sequence information [ t ₀ ，...，t _s ]The probability that the program running environment in the system is a Sandbox environment, and Y ═ P (Sandbox | F (t) ₀ ))，...，P(Sandbox|F(t _s ))]；

a and c are linear data of the operating environment to be solved;

solving the linear data of the operating environment in the constructed sandbox environment probability linear extraction model, wherein the solving formula is as follows:

wherein:

x _t denotes time t, y _t Probability that the program running environment at the time t is a sandbox environment, n _t Is timing information t ₀ ，...，t _s ]The total number of time instants in between;

if a obtained by solving is larger than the threshold A, C is larger than the threshold C, wherein A, C are positive numbers, which indicates that along with the increase of the running time, the probability that the program running environment is the sandbox environment is larger and larger, and the probability that the program running environment is the sandbox environment at the initial moment is larger, so that the current android application running environment is the sandbox environment, otherwise, the current android application running environment is not the sandbox environment.

In order to solve the above problem, the present invention further provides an apparatus for testing an operating environment of an android application sandbox, which is characterized in that the apparatus includes:

the data acquisition module is used for detecting the running environment of the android application program when the android application program runs, acquiring running environment state information and constructing a sandbox running environment judgment training set;

the sandbox running environment inference device is used for constructing a sandbox running environment inference model based on a probability graph method, performing parameter training optimization based on a training set on the sandbox running environment inference model by using an improved EM (effective magnetic field) algorithm to obtain a sandbox running environment inference model after training optimization, and calculating the probability of whether a program running environment is the sandbox environment or not in real time based on the sandbox running environment inference model after training optimization to obtain a sandbox probability time sequence data set of the running environment;

and the sandbox environment judgment device is used for constructing a sandbox environment probability linear extraction model based on the sandbox probability time sequence data set of the operating environment, solving the model to obtain operating environment linear data, and if the operating environment linear data exceeds a specified threshold value, indicating that the operating environment of the current android program is the sandbox environment, otherwise, not judging that the operating environment of the current android program is the sandbox environment.

In order to solve the above problem, the present invention also provides an electronic device, including:

a memory storing at least one instruction; and

and the processor executes the instructions stored in the memory to realize the android application program sandbox operating environment testing method.

In order to solve the above problem, the present invention further provides a computer-readable storage medium, where at least one instruction is stored, and the at least one instruction is executed by a processor in an electronic device to implement the method for testing the operating environment of the android application sandbox described above.

Compared with the prior art, the invention provides a method for testing the sandbox operating environment of the android application program, which has the following advantages:

firstly, the traditional EM algorithm is improved, so that the improved EM algorithm is utilized to carry out parameter training optimization based on a training set on the sandbox operating environment inference model to obtain the sandbox operating environment inference model after training optimization, and the parameter training optimization process comprises the following steps: taking the process information and the state information of the mobile terminal in the training set as nodes of a probability calculation layer in a Sandbox operation environment inference model, setting a Sandbox environment judgment node Sandbox, and calculating the prior probability P (Sandbox | pro) among different nodes according to the data in the training set _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F ) (ii) a Setting the current iteration number of the model parameter vector as

Wherein

Is 0, to

The model parameter vector of the sub-iteration is

Constructing a model parameter vector optimized objective function Loss:

wherein:

deducing the probability that the model deduces the sandbox running environment according to the utilization rate of the kth mobile terminal system in the state information data set of the mobile terminal on the index r and the output kth mobile terminal system is the sandbox environment; randomly generating 20 groups of model parameter vectors, respectively taking the 20 groups of generated model parameter vectors as model parameter vectors of a sandbox operation environment inference model, calculating objective function values of different sandbox operation environment inference models, and selecting the model parameter vector which enables the model objective function value to be minimum as an initial model parameter vector theta ⁰ (ii) a E, executing model parameter vector iteration in the step E, and calculating the expectation of a sandbox operation environment inference model based on the sandbox operation environment judgment training set data:

wherein: e (-) represents the desired calculation; d, representing index data in the sandbox operating environment judgment training set data, wherein the index data comprises process information and the utilization rates of different indexes in the mobile terminal system; the label that whether the android application program running environment is the sandbox environment is represented by {0, 1}, the label that whether the android application program running environment is the sandbox environment is represented by 0, the label that the android application program running environment is not the sandbox environment is represented by 1, and the android application program running environment is the sandbox environment; executing M-step model parameter vector iteration, and solving to obtain the result

The largest model parameter vector is taken as

Sub-iterative model parameter vector

Judgment of

And E, returning to the step E, wherein the termination condition is as follows:

wherein: t represents transposition; if G < epsilon, the termination condition is reached, where epsilon is a preset termination threshold, and epsilon > 0. In the embodiment of the invention, the traditional EM iterative algorithm can not ensure to obtain a global optimal solution, namely the obtained solution can change along with different initial values and has the characteristic of 'initial sensitivity', therefore, the scheme introduces an initial value selection method based on an objective function, randomly generates 20 groups of model parameter vectors by constructing an objective function optimized by model parameter vectors, instantiates the generated model parameter vectors into a sandbox operation environment inference model, calculates the objective function values of the different sandbox operation environment inference models, selects the model parameter vector with the minimum model objective function value as an initial model parameter vector, wherein the model parameter vector with the minimum model objective function value can ensure that the inference error of the sandbox operation environment inference model can be minimized, thereby obtaining a local optimal solution near the initial value based on a better initial value, the conditions that the traditional EM iterative algorithm randomly selects an initial value, the iteration times of the algorithm are more, and the training effect of the model parameter vector is easy to be unstable are avoided, so that the stability of the model parameter is improved, and a more stable and better model parameter vector can be quickly obtained.

Meanwhile, the scheme provides a linear extraction model of sandbox environment probability, collected running environment state information is input into a sandbox running environment inference model after training optimization, and the probability of whether a program running environment is the sandbox environment or not is calculated based on the sandbox running environment inference model after training optimization to obtain a sandbox probability time sequence data set of the running environment, wherein the time sequence range in the sandbox probability time sequence data set of the running environment is the time range of android application program running, and then the representation form of the sandbox probability time sequence data set D of the running environment is as follows:

D＝{P(Sandbox|F(t ₀ ))，P(Sandbox|F(t ₁ ))，...，P(Sandbox|F(t _s ))}

wherein: f (t) ₀ ) Is t ₀ Running Environment State information at time P (Sandbox | F (t) ₀ ) ) represents t ₀ The probability that the program running environment is the sandbox environment at the moment, and the android application program is in the state of t ₀ At time t, the operation is started _s And ending the operation at the moment. Meanwhile, the method constructs a sandbox environment probability linear extraction model, wherein the sandbox environment probability linear extraction model is as follows:

Y＝aX+c

wherein: x is timing information [ t ₀ ，...，t _s ]Android application at t ₀ At time t, the operation is started _s Ending the operation at the moment; y represents sandbox environment probability information, namely time sequence information [ t ₀ ，...，t _s ]The probability that the program running environment in (i) is a Sandbox environment, Y ═ P (Sandbox | F (t) ₀ ))，...，P(Sandbox|F(t _s ))](ii) a a and c are linear data of the operating environment to be solved; solving the linear data of the operating environment in the built sandbox environment probability linear extraction model, wherein the solving formula is as follows:

wherein: x is the number of _t Denotes time t, y _t Probability that the program running environment at the time t is a sandbox environment, n _t Is timing information t ₀ ，...，t _s ]The total number of time instants in between; if a obtained by solving is larger than a threshold value A, C is larger than a threshold value C, wherein A, C is positive, the probability that the program running environment is a sandbox environment is larger and larger along with the increase of the running time, and the probability that the program running environment is the sandbox environment at the initial moment is larger, so that the current android application running environment is the sandbox environment, otherwise, the identification and judgment of the android application running environment based on the time sequence data and the probability graph model are realized, the calculation transformation of the feature dimension is not involved in the scheme, the model calculation complexity is low, an available model can be obtained by fast training, and the judgment of the running environment can be realized more quickly.

Drawings

Fig. 1 is a schematic flowchart illustrating a method for testing an android application sandbox operating environment according to an embodiment of the present invention;

fig. 2 is a functional block diagram of an apparatus for testing an android application sandbox operating environment according to an embodiment of the present invention;

fig. 3 is a schematic structural diagram of an electronic device for implementing a method for testing an android application sandbox operating environment according to an embodiment of the present invention.

The implementation, functional features and advantages of the present invention will be further described with reference to the accompanying drawings.

Detailed Description

It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The embodiment of the application provides a method for testing the operating environment of an android application sandbox. The execution main body of the android application sandbox operation environment testing method comprises but is not limited to at least one of electronic devices, such as a server and a terminal, which can be configured to execute the method provided by the embodiment of the application. In other words, the android application sandbox operating environment testing method may be executed by software or hardware installed in the terminal device or the server device, and the software may be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like.

Example 1:

s1: the method comprises the steps of detecting the running environment of the android application program when the android application program runs, and obtaining running environment state information, wherein the running environment state information comprises process information and mobile terminal state information.

Detecting the operating environment of the android application program in the step S1, and acquiring operating environment state information, wherein the operating environment state information includes process information and mobile terminal state information, and includes:

in the embodiment of the invention, the process information comprises registry information and a communication process in a mobile terminal system, and the mobile terminal system is a system in which an android application program operates;

S2: and constructing a sandbox operation environment inference model based on a probability graph method, wherein the sandbox operation environment inference model takes the operation environment state information as an observation variable, takes whether the operation environment is the sandbox environment or not as a hidden variable, and obtains the probability that the android application program operation environment is the sandbox environment by reversely inferring the hidden variable probability.

In the step S2, a sandbox operating environment inference model is constructed based on a probability map method, where the sandbox operating environment inference model takes operating environment state information as an observation variable and whether an operating environment is a sandbox environment as a hidden variable includes:

constructing a sandbox operating environment inference model, wherein the sandbox operating environment inference model takes operating environment state information as an observation variable and takes whether an operating environment is a sandbox environment or not as a hidden variable, inputting the operating environment state information into the sandbox operating environment inference model, and outputting the model as a probability value that the operating environment is the sandbox environment;

the Sandbox operation environment inference model comprises an input layer and a probability calculation layer, wherein the input layer is used for receiving operation environment state information and sending the operation environment state information to the probability calculation layer, the probability calculation layer is a probabilistic graph model G ═ (E, V), the E represents a node in the probabilistic graph model, the node comprises a process node pro, a mobile terminal state information node host and a Sandbox environment judgment node Sandbox, the V represents an edge in the probabilistic graph model, the edge is a directed edge, the directed edge pro → the Sandbox represents the probability P (Sandbox | pro) of the Sandbox environment Sandbox under the condition that the process pro exists in the mobile terminal system, each process node pro in the probabilistic graph model G comprises process information of the process, the process node db pro and the Sandbox environment judgment node Sanox are connected to form an edge, each mobile terminal state information node host in the probabilistic graph model G is any { CPU usage rate in the mobile terminal state information, memory usage, network usage } in the form of { obj: a number, wherein obj belongs to the CPU utilization rate, the memory utilization rate and the network utilization rate, the number is a numerical value corresponding to the utilization rate, and the mobile terminal state information node host is connected with the Sandbox environment judgment node Sandbox to form a side;

and deducing the running environment state information F of the model input layer for the input sandbox running environment:

wherein:

pro _i，F the process information of the ith process in the running environment state information F is obtained, and n represents the total number of the processes in the running environment state information F;

wherein any pro _i，F Belongs to PRO, wherein PRO represents the process node set in the probability calculation layer and any CPU _F ，Memory _F ，Net _F Belongs to HOST, HOST is a set of mobile terminal state information nodes in a probability calculation layer, an input layer receives and analyzes the running environment state information F, and process information (pro) in the F is analyzed _1，F ，pro _2，F ，...，pro _i，F ，...，pro _n，F ) And mobile terminal status information (CPU) _F ，Memory _F ，Net _F ) And distributing the data to nodes in a probability calculation layer, wherein when the running environment state information of the mobile terminal system is calculated to be F by the probability calculation layer, the probability P (Sandbox | F) that the android application program running environment is a Sandbox environment Sandbox is obtained:

host _F ＝P(Sandbox|CPU _F )+P(Sandbox|Memory _F )+P(Sandbox|Net _F )

wherein:

δ (·) is a sigmoid function;

b _i is pro _i，F Bias value, w, of the node in the probabilistic computation layer _i Is pro _i，F The method comprises the following steps that the weight of a node in a probability calculation layer, bias values of different process nodes in a process node set PRO in the probability calculation layer and a parameter vector theta to be solved with the weight as a model are (B, W), B is a bias vector formed by the bias values of the different process nodes in the model, and W is a weight vector formed by the weights of the different process nodes in the model;

P(Sandbox|pro _i，F ) Indicating the presence of a process pro _i，F Under the condition of (2), the running environment is the probability of the Sandbox environment Sandbox;

P(Sandbox|Memory _F ) Indicating Memory usage as a Memory _F Under the condition of (2), the running environment is the probability of the Sandbox environment Sandbox;

the prior probability P (Sandbox | pro) _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F ) And the model parameter vector theta is a model parameter to be trained and optimized; compared with the traditional algorithm, the method and the device have the advantages that the sandbox operation environment judgment training set for sandbox operation environment judgment is constructed based on the conditional probability and the Bayesian probability, the available model is quickly obtained based on the prior probability of the training set and the EM iterative algorithm, and therefore whether the program operation environment is the sandbox environment is determinedAnd (5) calculating the rate.

S3: and (4) acquiring the running environment state information and the corresponding sandbox environment judgment result according to the step S1 to form a sandbox running environment judgment training set, performing parameter training optimization based on the training set on the sandbox running environment inference model by using an improved EM (effective electromagnetic) algorithm, shortening the model training time, and obtaining the sandbox running environment inference model after training optimization.

The step S3 of collecting operating environment state information and corresponding sandbox environment judgment results to form a sandbox operating environment judgment training set, including:

data＝{data1，data2}

data1＝{process _j ＝(pro _j ，label _j )|j∈[1，J]}

data2＝{(Info _r，k ，label _r，k )|k∈[1，K]，r＝1，2，3}

wherein:

label is a sandbox environment judgment result, and is {0, 1}, label _j 0 means that the operation environment of the jth process in the process information data set is not a sandbox environment, and label _j 1 represents that the operation environment of the jth process in the process information data set is a sandbox environment;

Info _r，k the index r represents the utilization rate of the kth mobile terminal system in the mobile terminal state information data set, wherein r is 1, 2 and 3, the index 1 represents a CPU, the index 2 represents a memory, the index 3 represents a network, and K represents the mobile terminal system in the mobile terminal state information data setThe total number of (c).

In the step S3, the improved EM algorithm is used to perform parameter training optimization based on a training set on the sandbox operating environment inference model, so as to obtain a trained and optimized sandbox operating environment inference model, which includes:

S32: setting the current iteration number of the model parameter vector as

Wherein

Is 0, to

The model parameter vector of the sub-iteration is

S33: constructing a model parameter vector optimized objective function Loss:

wherein:

deducing the probability that the model deduces the sandbox running environment according to the utilization rate of the kth mobile terminal system in the state information data set of the mobile terminal on the index r and the output kth mobile terminal system is the sandbox environment;

randomly generating 20 sets of model parameter vectors, respectively taking the 20 sets of generated model parameter vectors as model parameter vectors of a sandbox operating environment inference model, calculating objective function values of the obtained inference models of different sandbox operating environments, and selecting the model parameter vector which enables the model objective function value to be minimum as an initial model parameter vector theta ⁰ ；

S34: and E, performing model parameter vector iteration of the step E, judging the expectation of a training set data calculation sandbox operation environment inference model based on the sandbox operation environment:

wherein:

e (-) represents the desired calculation;

the method comprises the steps that 1, a label which indicates whether an android application program running environment is a sandbox environment or not is set, 0 indicates that the android application program running environment is not the sandbox environment, and 1 indicates that the android application program running environment is the sandbox environment;

s35: executing M-step model parameter vector iteration, and solving to obtain the result

The largest model parameter vector is taken as

Sub-iterative model parameter vector

S36: judgment of the first

Constructing a model for deducing the running environment of the sandbox after the training optimization as a model parameter vector obtained by the training optimization; if the end condition is not reached, order

Returning to step S34, the termination condition is:

wherein:

t represents transposition;

S4: and calculating the probability of whether the program running environment is the sandbox environment or not in real time based on the sandbox running environment inference model after training optimization to obtain a sandbox probability time sequence data set of the running environment, wherein the time sequence range in the sandbox probability time sequence data set of the running environment is the time range of the running of the android application program.

In the step S4, calculating the probability of whether the program operating environment is a sandbox environment based on the trained and optimized sandbox operating environment inference model to obtain an operating environment sandbox probability time series data set, including:

D＝{P(Sandbox|F(t ₀ ))，P(Sandbox|F(t ₁ ))，...，P(Sandbox|F(t _s ))}

wherein:

F(t ₀ ) Is t ₀ Running Environment State information at time of day, P (Sandbox | F (t) ₀ ) ) represents t ₀ Probability that the running environment of the program at the moment is the sandbox environment, and the android application program is in the step t ₀ At time t, the operation is started _s And ending the operation at the moment.

S5: and constructing a sandbox environment probability linear extraction model based on the sandbox probability time sequence data set of the operating environment, solving the model to obtain operating environment linear data, and if the operating environment linear data exceeds a specified threshold value, indicating that the operating environment of the current android program is the sandbox environment, otherwise, not the sandbox environment.

And S5, constructing a sandbox environment probability linear extraction model, solving the model to obtain running environment linear data, and if the running environment linear data exceeds a specified threshold, indicating that the running environment of the current android program is the sandbox environment, otherwise, indicating that the running environment is not the sandbox environment, including:

Y＝aX+c

wherein:

y represents sandbox environment probability information, namely time sequence information [ t0]The probability that the program running environment in (i) is a Sandbox environment, Y ═ P (Sandbox | F (t) ₀ ))，...，P(Sandbox|F(t _s ))]；

a and c are linear data of the operating environment to be solved;

wherein:

if the solved a is greater than the threshold A and the solved C is greater than the threshold C, wherein A, C are positive numbers, which indicates that the probability that the program running environment is the sandbox environment is greater and greater along with the increase of the running time, and the probability that the program running environment is the sandbox environment at the initial moment is greater, so that the current android application running environment is the sandbox environment; otherwise it is not.

In the embodiment of the invention, the same android application program is operated in 100 different mobile terminal systems, wherein the program operating environments of 60 mobile terminal systems are sandbox environments, the operating environment state time sequence data of 100 mobile terminal systems are respectively collected to form an experimental data set when the android application program is operated, and the sandbox operating environment test comparison algorithm of the android application program is set to comprise a support vector machine method, a DS evidence method and the method provided by the invention, wherein the training comparison algorithm is deployed in the same terminal environment, the training data set is sandbox operating environment judgment training set data, and the experimental data set is respectively input into different comparison algorithms, wherein the sandbox environment detection accuracy of the support vector machine method is 80 percent, namely the program operating environments of 80 percent of the 100 different mobile terminal systems are judged correctly, the sandbox environment detection time is 8 seconds, and the model training deployment training time is 2 hours; the sandbox environment detection accuracy of the DS evidence method is 66%, the sandbox environment detection time is 12 seconds, and the model training deployment training time is 35 minutes; according to the method, the sandbox environment detection accuracy is 83%, the sandbox environment detection time is 8 seconds, and the model training deployment training time is 37 minutes; compared with the set comparison algorithm, the method provided by the invention can achieve the highest sandbox environment detection accuracy, and compared with the support vector machine method which needs a large amount of time to train and deploy the model, the DS evidence method is easy to have the situation that the relied evidence is contradictory when processing the operation environment state information of the mobile terminal system, so that the detection time is too long, and the detection accuracy is lower, the method provided by the invention utilizes the Bayesian probability and the improved EM iterative algorithm to solve the model parameters, can quickly deploy and train to obtain the available model, takes the operation environment state information as the observation variable, takes whether the operation environment is the sandbox environment as the hidden variable, obtains the probability that the android application operation environment is the sandbox environment at any moment by reversely deducing the hidden variable probability, extracts the operation environment linear data of the android application which operates in the mobile terminal system based on the operation environment sandbox probability time sequence data set, and if the linear data of the operating environment exceeds the threshold value, judging that the operating environment of the android application program is a sandbox environment, so that the detection accuracy and the detection speed of the sandbox operating environment are improved.

Example 2:

fig. 2 is a functional block diagram of an apparatus for testing an execution environment of an android application sandbox according to an embodiment of the present invention, which is capable of implementing the method for testing an execution environment of an android application sandbox in embodiment 1.

The device 100 for testing the operating environment of the android application sandbox can be installed in electronic equipment. According to the realized function, the device for testing the sandbox operating environment of the android application program can comprise a data acquisition module 101, a sandbox operating environment inference device 102 and a sandbox environment judgment device 103. The module of the present invention, which may also be referred to as a unit, refers to a series of computer program segments that can be executed by a processor of an electronic device and that can perform a fixed function, and that are stored in a memory of the electronic device.

The data acquisition module 101 is used for detecting the running environment of the android application program when the android application program runs, acquiring running environment state information, and constructing a sandbox running environment judgment training set;

the sandbox operation environment inference device 102 is used for constructing a sandbox operation environment inference model based on a probability map method, performing parameter training optimization based on a training set on the sandbox operation environment inference model by using an improved EM (effective electromagnetic) algorithm to obtain a sandbox operation environment inference model after training optimization, and performing real-time calculation on the probability of whether a program operation environment is the sandbox environment or not based on the sandbox operation environment inference model after training optimization to obtain an operation environment sandbox probability time sequence data set;

the sandbox environment judgment device 103 is configured to construct a sandbox environment probability linear extraction model based on the operational environment sandbox probability time series data set, solve the model to obtain operational environment linear data, and indicate that the operational environment of the current android program is the sandbox environment if the operational environment linear data exceeds a specified threshold, otherwise, the operational environment is not.

In detail, when the modules in the device 100 for testing the operating environment of the android application sandbox in the embodiment of the present invention are used, the same technical means as the method for testing the operating environment of the android application sandbox in fig. 1 is adopted, and the same technical effects can be produced, which is not described herein again.

Example 3:

The electronic device 1 may include a processor 10, a memory 11 and a bus, and may further include a computer program, such as an android application sandbox operating environment test program 12, stored in the memory 11 and operable on the processor 10.

The memory 11 includes at least one type of readable storage medium, which includes flash memory, removable hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), magnetic memory, magnetic disk, optical disk, etc. The memory 11 may in some embodiments be an internal storage unit of the electronic device 1, such as a removable hard disk of the electronic device 1. The memory 11 may also be an external storage device of the electronic device 1 in other embodiments, such as a plug-in mobile hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device 1. Further, the memory 11 may also include both an internal storage unit and an external storage device of the electronic device 1. The memory 11 may be used to store not only the application software installed in the electronic device 1 and various data, such as the code of the android application sandbox operating environment test program 12, but also temporarily store data that has been output or is to be output.

The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or may be composed of a plurality of integrated circuits packaged with the same or different functions, including one or more Central Processing Units (CPUs), microprocessors, digital Processing chips, graphics processors, and combinations of various control chips. The processor 10 is a Control Unit of the electronic device, connects various components of the electronic device by using various interfaces and lines, and executes various functions and processes data of the electronic device 1 by running or executing programs or modules (android application sandbox running environment test programs and the like) stored in the memory 11 and calling data stored in the memory 11.

The bus may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is arranged to enable connection communication between the memory 11 and at least one processor 10 or the like.

Fig. 3 shows only an electronic device with components, and it will be understood by those skilled in the art that the structure shown in fig. 3 does not constitute a limitation of the electronic device 1, and may comprise fewer or more components than those shown, or some components may be combined, or a different arrangement of components.

For example, although not shown, the electronic device 1 may further include a power supply (such as a battery) for supplying power to each component, and preferably, the power supply may be logically connected to the at least one processor 10 through a power management device, so as to implement functions of charge management, discharge management, power consumption management, and the like through the power management device. The power supply may also include any component of one or more dc or ac power sources, recharging devices, power failure detection circuitry, power converters or inverters, power status indicators, and the like. The electronic device 1 may further include various sensors, a bluetooth module, a Wi-Fi module, and the like, which are not described herein again.

Further, the electronic device 1 may further include a network interface, and optionally, the network interface may include a wired interface and/or a wireless interface (such as a WI-FI interface, a bluetooth interface, etc.), which are generally used to establish a communication connection between the electronic device 1 and another electronic device.

Optionally, the electronic device 1 may further comprise a user interface, which may be a Display (Display), an input unit (such as a Keyboard), and optionally a standard wired interface, a wireless interface. Alternatively, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, or the like. The display, which may also be referred to as a display screen or display unit, is suitable for displaying information processed in the electronic device 1 and for displaying a visualized user interface, among other things.

It is to be understood that the described embodiments are for purposes of illustration only and that the scope of the appended claims is not limited to such structures.

The android application sandbox operating environment test program 12 stored in the memory 11 of the electronic device 1 is a combination of a plurality of instructions, and when running in the processor 10, the following steps can be implemented:

detecting the running environment of the android application program when the android application program runs, and acquiring running environment state information;

constructing a sandbox operation environment inference model based on a probability graph method;

acquiring running environment state information and a corresponding sandbox environment judgment result to form a sandbox running environment judgment training set, and performing parameter training optimization based on the training set on the sandbox running environment inference model by using an improved EM (effective electromagnetic) algorithm to obtain a sandbox running environment inference model after training optimization;

calculating the probability of whether the program running environment is the sandbox environment or not in real time based on the sandbox running environment inference model after training optimization to obtain a sandbox probability time sequence data set of the running environment;

and constructing a sandbox environment probability linear extraction model based on the sandbox probability time sequence data set of the operating environment, solving the model to obtain operating environment linear data, and if the operating environment linear data exceeds a specified threshold value, indicating that the operating environment of the current android program is the sandbox environment, otherwise, not the sandbox environment.

Specifically, the specific implementation method of the processor 10 for the instruction may refer to the description of the relevant steps in the embodiments corresponding to fig. 1 to fig. 3, which is not repeated herein.

It should be noted that the above-mentioned numbers of the embodiments of the present invention are merely for description, and do not represent the merits of the embodiments. And the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, apparatus, article, or method. The term "comprising" is used to specify the presence of stated features, integers, steps, operations, elements, components, groups, integers, operations, elements, components, groups, elements, groups, integers, operations, elements, groups, etc., without limitation to any particular feature or element.

Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium (e.g., ROM/RAM, magnetic disk, optical disk) as described above and includes instructions for enabling a terminal device (e.g., a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present invention.

The above description is only a preferred embodiment of the present invention, and not intended to limit the scope of the present invention, and all modifications of equivalent structures and equivalent processes, which are made by using the contents of the present specification and the accompanying drawings, or directly or indirectly applied to other related technical fields, are included in the scope of the present invention.

Claims

1. An android application sandbox operating environment testing method is characterized by comprising the following steps:

s1: detecting the running environment of a program when the android application program runs, and acquiring running environment state information, wherein the running environment state information comprises process information and mobile terminal state information;

s3: acquiring running environment state information and corresponding sandbox environment judgment results according to the step S1 to form a sandbox running environment judgment training set, and performing parameter training optimization based on the training set on the sandbox running environment inference model by using an improved EM algorithm to obtain a sandbox running environment inference model after training optimization, wherein the improved EM algorithm process comprises the following steps:

S32: setting the current iteration number of the model parameter vector as

Wherein

Is 0, at first

The model parameter vector of the sub-iteration is

S33: constructing a model parameter vector optimized objective function Loss:

wherein:

randomly generating 20 sets of model parameter vectors, respectively taking the 20 sets of generated model parameter vectors as model parameter vectors of a sandbox operating environment inference model, judging data in a training set by the sandbox operating environment, calculating objective function values of the inferred models of different sandbox operating environments, and selecting the model parameter vector which enables the objective function value of the model to be minimum as an initial model parameter vector theta ⁰ ；

wherein:

e (-) represents the desired calculation;

d, representing index data in the sandbox operating environment judgment training set data, wherein the index data comprises process information and the utilization rates of different indexes in the mobile terminal system;

The largest model parameter vector is taken as

Sub-iterative model parameter vector

S36: judgment of

Returning to step S34, the termination condition is:

wherein:

t represents transposition;

if G is less than epsilon, the ending condition is reached, wherein epsilon is a preset ending threshold value, and epsilon is more than 0;

2. The method for testing the sandbox operating environment of the android application as claimed in claim 1, wherein the step S1 detects an operating environment of the android application during operation to obtain operating environment state information, where the operating environment state information includes process information and mobile terminal state information, and includes:

s12: when the android application program runs, updating the process switch value of the monitoring process to be 1, and indicating that the monitoring process is started; the method comprises the steps that a monitoring process traverses a process list in a mobile terminal system at the current moment to obtain process information of an operating environment state, wherein the format of each process in the process information is { Name, parameter, return, stack and time }, the process represents the process, the Name represents the process Name, the parameter represents the process parameter, the return represents the process return value, the stack represents the stack called by the process, and the time represents the time generated by the process;

3. The method for testing the sandbox operating environment of the android application of claim 2, wherein the step S2 is to construct the sandbox operating environment inference model based on a probability map method, wherein the sandbox operating environment inference model takes the operating environment state information as an observation variable and whether the operating environment is a sandbox environment as a hidden variable, and comprises:

the Sandbox operation environment inference model comprises an input layer and a probability calculation layer, wherein the input layer is used for receiving operation environment state information and sending the operation environment state information to the probability calculation layer, the probability calculation layer is a probabilistic graph model G ═ (E, V), the E represents a node in the probabilistic graph model, the node comprises a process node pro, a mobile terminal state information node host and a Sandbox environment judgment node Sandbox, the V represents an edge in the probabilistic graph model, the edge is a directed edge, the directed edge pro → the Sandbox represents the probability P (Sandbox | pro) of the Sandbox environment Sandbox under the condition that the process pro exists in the mobile terminal system, each process node pro in the probabilistic graph model G comprises process information of the process, the process node db pro and the Sandbox environment judgment node Sanox are connected to form an edge, each mobile terminal state information node host in the probabilistic graph model G is any { CPU usage rate in the mobile terminal state information, memory usage, network usage } in the form of { obj: number, wherein obj belongs to the { CPU utilization rate, memory utilization rate and network utilization rate }, the number is a numerical value corresponding to the utilization rate, and the mobile terminal state information node host is connected with the Sandbox environment judgment node Sandbox to form a side;

F＝{(pro _1，F ，pro _2，F ，…，pro _i，F ，…，pro _n，F )，(CPU _F ，Memory _F ，Net _F )}

wherein:

wherein any pro _i，F Belongs to PRO, wherein PRO represents the process node set in the probability calculation layer and any CPU _F ，Memory _F ，Net _F Belongs to HOST, HOST is a set of mobile terminal state information nodes in a probability calculation layer, an input layer receives and analyzes operation environment state information F, and process information (pro) in F _1，F ，pro _2，F ，...，pro _i，F ，...，pro _n，F ) And mobile terminal status information (CPU) _F ，Memory _F ，Net _F ) And distributing the data to nodes in a probability calculation layer, wherein the probability calculation layer calculates the probability P (Sandbox | F) that the android application program operating environment is a Sandbox environment Sandbox when the operating environment state information of the mobile terminal system is F:

host _F ＝P(Sandbox|CPU _F )+P(Sandbox|Memory _F )+P(Sandbox|Net _F )

wherein:

δ (·) is a sigmoid function;

P(Sandbox|pro _i，F ) Indicating the presence of a process pro _i，F Under the condition of (1), the operation environment is the probability of the Sandbox environment Sandbox;

P(Sandbox|Memory _F ) Indicating Memory usage as Memory _F Under the condition of (1), the operation environment is the probability of the Sandbox environment Sandbox;

P(Sandbox|Net _F ) Indicating network usage as Net _F Under the condition of (1), the operation environment is the probability of the Sandbox environment Sandbox;

the prior probability P (Sandbox | pro) _i，F )、P(Sandbox|CPU _F )、P(Sandbox|Memory _F )、P(Sandbox|Net _F ) And the model parameter vector theta is the model parameter to be trained and optimized.

4. The method for testing the sandbox operating environment of the android application of claims 2-3, wherein the step of S3 collecting the operating environment state information and the corresponding sandbox environment determination result forms a sandbox operating environment determination training set, which includes:

data＝{data1，data2}

data1＝{process _j ＝(pro _j ，label _j )|j∈[1，J]}

data2＝{(Info _r，k ，label _r，k )|k∈[1，K]，r＝1，2，3}

wherein:

data1 is a progress information data set, and data2 is a mobile terminal state information data set;

Info _r，k and the index 1 represents a CPU, the index 2 represents a memory, the index 3 represents a network, and K represents the total number of the mobile terminal systems in the mobile terminal state information data set.

5. The method of claim 1, wherein the step S4 of calculating the probability of whether the program operating environment is a sandbox environment based on the training optimized sandbox operating environment inference model to obtain the operating environment sandbox probability time series data set includes:

D＝{P(Sandbox|F(t ₀ ))，P(Sandbox|F(t ₁ ))，…，P(Sandbox|F(t _s ))}

wherein:

6. The method for testing the sandbox operating environment of the android application as claimed in claim 1, wherein the step S5 is to construct a probabilistic linear extraction model of the sandbox environment, solve the model to obtain linear data of the operating environment, and if the linear data of the operating environment exceeds a specified threshold, it indicates that the operating environment of the current android application is the sandbox environment, otherwise it is not the sandbox environment, including:

Y＝aX+c

wherein:

x is timing information [ t ₀ ，...，t _s ]Android application at t ₀ At time t, the operation is started _s Ending the operation at the moment;

y represents sandbox environment probability information, namely time sequence information [ t ₀ ，...，t _s ]The probability that the program running environment in (i) is a Sandbox environment, Y ═ P (Sandbox | F (t) ₀ ))，…，P(Sandbox|F(t _s ))]；

a and c are linear data of the operating environment to be solved;

wherein:

x _t denotes time t, y _t Probability that the program running environment at the time t is a sandbox environment, n _t Is timing information [ t ₀ ，...，t _s ]The total number of time instants in between;

7. An android application sandbox operating environment testing apparatus, the apparatus comprising:

the sandbox operation environment inference device is used for constructing a sandbox operation environment inference model based on a probability map method, performing parameter training optimization based on a training set on the sandbox operation environment inference model by using an improved EM (effective electromagnetic) algorithm to obtain a sandbox operation environment inference model after training optimization, and calculating the probability of whether a program operation environment is the sandbox environment or not in real time based on the sandbox operation environment inference model after training optimization to obtain an operation environment sandbox probability time sequence data set;

the sandbox environment judgment device is used for constructing a sandbox environment probability linear extraction model based on an operation environment sandbox probability time sequence data set, solving the model to obtain operation environment linear data, and if the operation environment linear data exceeds a specified threshold value, the operation environment of the current android program is the sandbox environment, otherwise, the operation environment is not, so that the sandbox operation environment testing method of the android application program according to any one of claims 1 to 6 is achieved.