CN115640576B - Malicious application identification method, terminal equipment and readable storage medium - Google Patents

Abstract

Embodiments of the present application provide a malicious application identification method, a terminal device, and a readable storage medium. The method includes: for each background pop-up behavior of the target application, determining the background pop-up behavior that has a pop-up related event in the first period before the background pop-up behavior as a related event pop-up behavior; according to the related event pop-up behavior Determine the pre-sequence anomaly score of the target application based on its proportion in the background pop-up behavior; for each background pop-up behavior of the target application, according to the corresponding The abnormal score determines the subsequent abnormal score of the target application; based on the previous abnormal score and the subsequent abnormal score, it is judged whether the target application is a malicious application. When judging whether the target application is a malicious application, the correlation between the background pop-up behavior and specific system events, the correlation between the background pop-up behavior and the target feedback event, and high accuracy are considered.

Description

Malicious application identification method, terminal device and readable storage medium

technical field

The present application relates to the technical field of information security, in particular to a method for identifying a malicious application, a terminal device and a readable storage medium.

Background technique

In the process of using the terminal, it is a normal business practice to pop up advertisements inside the app. But there are many pop-up ads of malicious apps that pop up outside other apps or outside the lock screen.

The traditional solution is to count the number of times an application pops up advertisements in a day, and classify the applications according to these times.

However, this method will have the problem of missing identification, and the statistical characteristics of some external pop-up advertisement behaviors of malicious applications are very low, making it difficult to identify.

For the problem that malicious applications are difficult to identify, the current solutions include static detection methods, application control based on list or big data rules, and sandbox simulation operation methods, but these solutions have certain defects.

Wherein, the static detection method performs application identification and classification according to application codes and installation packages.

However, the static detection method is more suitable for virus detection. When detecting an application, it cannot be considered as a malicious application just because it contains the code of the bomb advertisement.

Moreover, when performing static detection on an application, there is still a problem of lack of information data on the actual operation of the application.

In addition, the method of application management and control based on the list or big data has a strong lag, consumes a lot of manpower, and cannot be controlled in a timely manner.

Among them, big data rules often need to calculate the average value of a large number of users, so there is an obvious lag.

However, the sandbox simulation operation method does not conform to the real behavior rules, and current applications can circumvent this method by anti-sandboxing.

Contents of the invention

The purpose of the embodiments of the present application is to provide a method for identifying a malicious application, a terminal device, and a readable storage medium, so as to improve the accuracy of identifying a malicious application. The specific technical scheme is as follows:

In a first aspect, the present application provides a method for identifying a malicious application, the method comprising:

For each background pop-up behavior of the target application within the preset time period, determine whether there is a pop-up related event in the first period before the background pop-up behavior, and if so, determine the background pop-up behavior as a related event pop-up behavior ; The pop-up associated event is a system event with a pop-up associated score greater than a preset associated score; the pop-up associated score represents the degree of association between the system event and the background pop-up behavior;

According to the proportion of the associated event pop-up behavior in the background pop-up behavior, determine the pre-sequence abnormality score of the target application;

For each background pop-up behavior of the target application within the preset time period, determine whether there is a target feedback event in the second time period after the background pop-up behavior, and if so, according to the abnormal analysis corresponding to each target feedback event Value, to determine the subsequent abnormal score of the target application; wherein, the target feedback event includes a predetermined user behavior event and/or system state change event;

Based on the preceding anomaly score and the subsequent anomaly score, it is determined whether the target application is a malicious application.

In a possible embodiment, the pop-up association score of the background pop-up behavior is determined based on the following manner:

For each background pop-up behavior of the target application within the preset time period, obtain system events in the third period before the background pop-up behavior; for each type of system event before any background pop-up behavior , determine the associated score of a single pop-up window for this type of system event based on the following formula:

in, Behavior A and system events for this background pop-up window The associated score of a single pop-up window, is the preset score of the jth system event before the background pop-up behavior, is the weight of the jth system event; the size of the preset score is negatively correlated with the size of j ;

The weights satisfy the following formula:

Wherein, T is the third time period, and t is the time difference between the system event and the background pop-up behavior;

According to the single pop-up associated score of any type of system event in each background pop-up behavior, the pop-up associated score of this type of system event is determined based on the following formula:

in, A score is associated with the pop-up window.

In a possible embodiment, the preset association score is determined based on the following manner:

Obtaining the first normal application sample set;

Determining the background pop-up behavior of each normal application in the first normal application sample set and the pop-up correlation score of various predetermined system events, and calculating the quantile of the preset ratio based on the determined pop-up correlation score number, as the preset association score.

In a possible embodiment, the preceding abnormal score is determined based on the following formula:

Among them, R1 is the abnormal score of the preorder, is a preset weight coefficient, N is the number of pop-up window behaviors in the background, and n is the number of pop-up window behaviors in the associated event.

In a possible embodiment, the step of determining the subsequent abnormal score of the target application according to the abnormal score corresponding to each target feedback event includes:

Summing the product of the number of occurrences of each type of the target feedback event and the corresponding abnormal score to obtain the abnormal score of the feedback event of the target application;

The ratio of the abnormal score of the feedback event to the number of pop-up window behaviors in the background is used as the abnormal score of the subsequent sequence.

In a possible embodiment, for any type of target feedback event, the abnormal score is determined based on the following manner:

Obtaining the second normal application sample set and the first malicious application sample set;

Obtaining the first proportion of normal applications in the second normal application sample set that appear the target feedback event after the background pop-up behavior occurs, and the malicious application in the first malicious application sample set that appears the target after the background pop-up behavior occurs The second proportion of feedback events;

The ratio of the first proportion to the second proportion is used as the abnormal score.

In a possible embodiment, the step of judging whether the target application is a malicious application based on the preceding anomaly score and the subsequent anomaly score includes:

Judging whether the pre-sequence abnormality score is greater than the pre-sequence threshold, and whether the subsequent-sequence abnormality score is greater than the post-sequence threshold;

If the preceding anomaly score is greater than the preceding threshold, and the subsequent anomaly score is greater than the subsequent threshold, the target application is a high-risk malicious application;

If the preceding anomaly score is greater than the preceding threshold, or the subsequent anomaly score is greater than the subsequent threshold, the target application is a medium-risk malicious application;

Otherwise, the target application is not a malicious application.

In a possible embodiment, the preceding threshold and the subsequent threshold are determined based on the following manner:

Obtaining a second malicious application sample set;

determining a pre-sequence anomaly score and a post-sequence anomaly score of each malicious application in the second malicious application sample set;

Select the pre-sequence threshold greater than the second threshold from the pre-sequence abnormal scores of the second malicious application sample set, and select the sequence greater than the third threshold from the subsequent anomaly scores of the second malicious application sample set The postorder threshold.

In a possible embodiment, the background pop-up window behavior data of any malicious application in the second malicious application sample set is smaller than the model effective threshold when the background pop-up window behavior data is used for model training.

In a second aspect, the present application provides a terminal device, where the terminal device includes:

The first determining module is used to determine whether there is a pop-up related event in the first period before the background pop-up behavior for each background pop-up behavior of the target application within a preset period of time, and if so, the background pop-up behavior Determined as a related event pop-up behavior; the pop-up related event is a system event with a pop-up related score greater than a preset related score; the pop-up related score represents the degree of association between the system event and the background pop-up behavior;

The second determination module is used to determine the pre-sequence abnormal score of the target application according to the proportion of the associated event pop-up behavior in the background pop-up behavior;

The third determination module is used to determine whether there is a target feedback event in the second period after the background pop-up behavior for each background pop-up behavior of the target application within the preset time period, and if so, according to each The abnormal score corresponding to the target feedback event determines the subsequent abnormal score of the target application; wherein the target feedback event includes a predetermined user behavior event and/or system state change event;

A judging module, configured to judge whether the target application is a malicious application based on the preceding anomaly score and the subsequent anomaly score.

In a third aspect, the present application provides a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described in any one of the above-mentioned first aspects are implemented. .

Beneficial effects of the embodiment of the application:

The malicious application identification method provided by the embodiment of the present application is based on the fact that malicious applications usually monitor system behaviors to perform background pop-up behaviors, and according to whether the target application exists in the first period before each background pop-up behavior within the preset period. For pop-up related events, determine the related event pop-up behavior in the background pop-up behavior, and then determine the pre-order abnormal score of the target application according to the proportion of the related event pop-up behavior in the background pop-up behavior. And based on the characteristics that the background pop-up behavior of malicious applications usually leads to user behavior events and/or system state change events, according to the abnormal score of the target feedback event after each background pop-up behavior of the target application within a preset period, Determine the post-order anomaly score of the target application. Therefore, when judging whether the target application is a malicious application based on the pre-sequence anomaly score and the post-sequence anomaly score, the association between the background pop-up behavior and specific system events, and the correlation between the background pop-up behavior and the target feedback event are considered at the same time. high accuracy. At the same time, the method requires a small amount of data and low computing power consumption when judging whether the target application is a malicious application.

Of course, implementing any product or method of the present application does not necessarily need to achieve all the above-mentioned advantages at the same time.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present application, and those skilled in the art can also obtain other embodiments according to these drawings.

Fig. 1 is an example diagram of the background pop-up interface provided by the embodiment of the present application;

FIG. 2 is a schematic flowchart of a malicious application identification method provided by an embodiment of the present application;

FIG. 3 is an example diagram of system events before any background pop-up behavior provided by the embodiment of the present application;

FIG. 4 is a schematic structural diagram of functional modules of a terminal device provided in an embodiment of the present application.

Detailed ways

In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with basically the same function and effect. For example, the first instruction and the second instruction are for distinguishing different user instructions, and their sequence is not limited. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

It should be noted that, in this application, words such as "exemplarily" or "for example" are used as examples, illustrations or illustrations. Any embodiment or design described herein as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a concrete manner.

In addition, "at least one" means one or more, and "plurality" means two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (one) of a, b and c may represent: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

In order to more clearly describe the method for identifying a malicious application provided by the embodiment of the present application, the following first describes the possible application scenarios of the embodiment of the present application as examples.

As an example, the method for identifying a malicious application provided in the embodiment of the present application is applied to a terminal, and the terminal can identify whether an installed application is a malicious application. Wherein, the terminal includes but is not limited to a mobile phone, a tablet computer, etc., and this embodiment of the present application does not limit the scope of the terminal.

Furthermore, the malicious application identification method provided by the embodiment of the present application can also be applied to a cloud server to identify whether an application installed on a terminal served by the cloud side is a malicious application.

Taking a mobile phone as an example, when the user is using the mobile phone, some applications installed on the mobile phone will pop up advertisements. Among them, playing advertisements inside the mobile phone application itself is a normal business practice, but some applications will display advertisements outside other applications, or outside the lock screen interface. Such applications are malicious applications. A mobile phone applying the malicious application identification method provided in the embodiment of the present application can identify which applications on the mobile phone are malicious applications.

FIG. 1 is an example diagram of the background pop-up window interface provided by the embodiment of the present application. It can be seen that an advertisement interface pops up on the mobile phone interface shown in FIG. 1 , and this behavior is the background pop-up window behavior involved in the embodiment of the present application.

In order to avoid the background pop-up behavior shown in Figure 1 on the terminal, it is necessary to identify malicious applications installed on the terminal.

The traditional solution is to count the number of times an application pops up advertisements in a day, and classify the applications according to these times.

However, this method will have the problem of missing identification, and the statistical characteristics of some external pop-up advertisement behaviors of malicious applications are very low, making it difficult to identify.

For the problem that malicious applications are difficult to identify, the current solutions include static detection methods, application control based on list or big data rules, and sandbox simulation operation methods, but these solutions have certain defects.

Wherein, the static detection method performs application identification and classification according to application codes and installation packages.

However, the static detection method is more suitable for virus detection. When detecting an application, it cannot be considered as a malicious application just because it contains the code of the bomb advertisement.

Moreover, when performing static detection on an application, there is still a problem of lack of information data on the actual operation of the application.

In addition, the method of application management and control based on the list or big data has a strong lag, consumes a lot of manpower, and cannot be controlled in a timely manner.

Among them, big data rules often need to calculate the average value of a large number of users, so there is an obvious lag.

However, the sandbox simulation operation method does not conform to the real behavior rules, and current applications can circumvent this method by anti-sandboxing.

In view of this, an embodiment of the present application provides a method for identifying a malicious application. FIG. 2 is a schematic flowchart of the method for identifying a malicious application provided in an embodiment of the application. As shown in FIG. 2 , the method includes the following steps:

Step S201: For each background pop-up behavior of the target application within a preset time period, determine whether there is a pop-up related event in the first time period before the background pop-up behavior, and if so, determine the background pop-up behavior as a related event Popup behavior.

Among them, the pop-up related event is a system event with a pop-up related score greater than a preset related score, and the pop-up related score represents the degree of correlation between the system event and the background pop-up behavior.

The background pop-up behavior involved in the embodiment of the present application specifically refers to the behavior of generating a background pop-up window and accessing an advertising website. As an example, the background pop-up window behavior may include lock screen background pop-up windows, desktop background pop-up windows, background pop-up windows on third-party applications, and other behaviors.

The malicious application identification method provided by the embodiment of the present application judges whether the target application is a malicious application based on one or more background pop-up behaviors of the target application within a preset period of time. The preset time period is only used to determine the range of data required to execute the malicious application identification method provided by the embodiment of the present application, so that the method can be executed, and the embodiment of the present application does not specifically limit the preset time period.

As an example, the terminal can extract historical data stored for a period of time for the target application, and judge whether the target application is a malicious application based on background pop-up behaviors that occur during this period.

In practical applications, malicious applications usually monitor specific system events that occur on the terminal to target pop-up windows. Exemplarily, when some malicious applications monitor the lock screen operation, they will perform targeted pop-up windows.

Therefore, the embodiment of the present application deduces system events with a correlation coefficient greater than a preset score as system events that may be monitored by the target application, that is, pop-up related events, according to the degree of association between system events and background pop-up window behavior. Wherein, the correlation degree refers to the possibility of the system event being monitored by the target application corresponding to the background pop-up behavior.

If a pop-up related event occurs within the first period of time before any background pop-up behavior of the target application, it is inferred that the background pop-up behavior is a background pop-up behavior performed by the target application based on monitoring system events, that is, association Event popup behavior.

It should be understood that the background pop-up behavior is generally not related to system events that occurred long ago, and it is not necessary to judge whether the background pop-up behavior is a related event pop-up behavior based on these system events. Therefore, the first time period is the time period during which the monitored system event may occur when the malicious application pops up a window based on the monitoring of the system event. The embodiment of the present application does not specifically limit the first time period.

As an example, system events include, but are not limited to, one or more of the following:

Home (home) button, swipe up gesture, unlock screen, charging connection, charging disconnection, screen on, off screen, wifi (wireless local area network) disconnection, app installation, app uninstallation.

Step S202: According to the proportion of the related event pop-up behavior in the background pop-up behavior, determine the pre-order anomaly score of the target application.

Specifically, the higher the proportion of the associated event pop-up behavior in the background pop-up behavior, the higher the pre-order anomaly score of the target application.

It is worth noting that if the target application has multiple pop-up related events before the background pop-up behavior, the risk of the target application being a malicious application will not increase significantly.

Therefore, the malicious application identification method provided by the embodiment of the present application pays more attention to the possibility of each background pop-up behavior based on the monitoring of system events when determining the pre-order anomaly score of the target application, so it does not evaluate the background pop-up behavior. The previous pop-up related events are counted, but only the proportion of the related event pop-up behavior in the background pop-up behavior is considered, thereby reducing computing power consumption.

Step S203: For each background pop-up behavior of the target application within the preset time period, determine whether there is a target feedback event in the second time period after the background pop-up behavior, and if so, according to the abnormal score corresponding to each target feedback event , to determine the post-order anomaly score of the target application.

Wherein, the target feedback event includes a predetermined user behavior event and/or system state change event.

In practical applications, background pop-up behavior will cause changes in the system status of the terminal, or reduce the user experience of the user when using the terminal, so that the user can make some feedback behaviors to improve the user experience.

Exemplarily, the pop-up behavior in the background may occupy system resources and cause freezing, and the user may uninstall the application after seeing the pop-up advertisement to avoid the pop-up behavior in the background from happening again.

Therefore, the embodiment of the present application predetermines user behavior events and/or system state change events that may be caused by background pop-up behaviors as target feedback events, and determines the target application according to the abnormal score of the target feedback event after the background pop-up behavior Subsequent outlier score of .

As an example, user behavior events include, but are not limited to, one or more of the following:

Background cleaning, uninstalling applications, launching background cleaning applications, shutting down and restarting.

As an example, system state change events include, but are not limited to, one or more of the following:

The system is heavily loaded, freezes, power consumption increases, memory usage increases, and the number of processes increases.

It should be understood that the system state of the terminal usually changes in real time. Therefore, the event that the coefficient state changes to a certain extent can be regarded as a system state change event that may be caused by the pop-up window behavior in the background. Exemplarily, an increase in power consumption by a certain percentage, or an increase in memory usage by a certain value may be regarded as a system state change event.

Similar to the first time period above, the second time period is the time period during which the target feedback event caused by pop-up window behavior in the background may occur, and the embodiment of the present application does not specifically limit the second time period.

Step S204: Based on the preceding anomaly score and the subsequent anomaly score, determine whether the target application is a malicious application.

Specifically, the higher the pre-sequence anomaly score and the subsequent anomaly score, the higher the possibility that the target application is a malicious application.

The malicious application identification method provided in the embodiment of the present application,

Based on the characteristics that malicious applications usually monitor system behaviors to perform background pop-up behaviors, according to whether there is a pop-up related event in the first period before each background pop-up behavior of the target application within the preset period, in the background pop-up behavior The associated event pop-up behavior is determined, and then the pre-order abnormal score of the target application is determined according to the proportion of the associated event pop-up behavior in the background pop-up behavior. And based on the characteristics that the background pop-up behavior of malicious applications usually leads to user behavior events and/or system state change events, according to the abnormal score of the target feedback event after each background pop-up behavior of the target application within a preset period, Determine the post-order anomaly score of the target application. Therefore, when judging whether the target application is a malicious application based on the pre-sequence anomaly score and the post-sequence anomaly score, the association between the background pop-up behavior and specific system events, and the correlation between the background pop-up behavior and the target feedback event are considered at the same time. high accuracy. At the same time, the method requires a small amount of data and low computing power consumption when judging whether the target application is a malicious application.

In one embodiment of the present application, the pop-up association score of background pop-up behavior is determined based on the following method, which specifically includes the following steps:

Step 1: For each background pop-up behavior of the target application within a preset time period, obtain system events in the third period before the background pop-up behavior.

Step 2: For each type of system event before any background pop-up behavior, determine the single pop-up associated score of this type of system event based on the following formula:

in, Behavior A and system events for this background pop-up window The associated score of a single pop-up window, It is the default score of the jth system event before the background pop-up behavior, is the weight of the jth system event; the size of the preset score is negatively correlated with the size of j ;

The weight satisfies the following formula:

Among them, T is the third time period, and t is the time difference between the system event and the pop-up window behavior in the background;

It should be understood that the closer the occurrence of a system event to the pop-up behavior in the background, the shorter the time difference between it and the pop-up behavior in the background, and the stronger the correlation between this system event and the pop-up behavior in the background. Therefore, this system event The score and weight values are higher.

As an example, the score of the system event closest to A is set to 2, and the scores of other such system events are all set to 1.

Step 3: According to the single pop-up associated score of any type of system event in each background pop-up behavior, determine the pop-up associated score of this type of system event based on the following formula:

in, Associate the score with the popup.

For ease of understanding, the determination of pop-up related scores will be described below with specific examples. A certain background pop-up behavior of the target application is recorded as A ₁ , and the system behavior of charging connection is recorded as S _i .

FIG. 3 is an example diagram of system events before any background pop-up window behavior _provided by the embodiment of the present application. The illustrated S1 is the first charging connection event that occurred in _the third period T before A1 , and S2 _{is The} second charging connection event _that occurred before A1 , S _... is other charging connection events that occurred _before A1 , and the time differences between S1 _, S2 and A1 are t1 and _t2 respectively.

In the calculation shown in Figure 3 the When , the scores of S ₁ , S ₂ and S _... are 2, 1, 1 respectively, and the weights are (T-t1)/T , (T-t2)/T , (Tt...)/T , based on which it can be calculated Out _of Si .

Calculate S _i for a background pop-up window behavior Afterwards, the pop-up correlation score of each background pop-up behavior is summed to obtain the pop-up correlation score of S _i .

As an example, assuming that there are three background pop-up behaviors A ₁ , A ₂ and A ₃ within the preset time period, the pop-up correlation score of S _i is .

After calculating the pop-up correlation scores between various system events and the background pop-up behavior of the target software, combined with the description of the previous step S201, the system events whose pop-up correlation scores are greater than the preset correlation scores are determined as The pop-up event associated with the target application.

Exemplarily, the preset correlation value is recorded as Thresh , assuming that there are three types of system events S _i , S _m and S _{n and} , , , the associated pop-up events of the target application include S _i and S _m .

In one embodiment of the present application, the third period of time is greater than the first period of time.

The embodiment of the present application obtains the system events before each background pop-up behavior of the target application, and determines the pop-up correlation score of the system event according to the sequence of these system events and the time difference with the background pop-up behavior, which has high accuracy. sex. Therefore, when a system event with a pop-up related score greater than a preset related score is determined as a pop-up related event, the determined pop-up related event has a high probability of being monitored by a target application and has high accuracy.

In one embodiment of the present application, the preset correlation score is determined based on the following method:

obtaining the first normal application sample set;

Determining the background pop-up window behavior of each normal application in the first normal application sample set and the predetermined pop-up window correlation score of various system events, and calculating the quantile of the preset ratio based on the determined pop-up window correlation score, As a default associated score.

It should be understood that background pop-up events related to system behavior also exist in normal applications, so the preset correlation score can be determined using normal applications as samples. Specifically, when calculating the pop-up window correlation score included in the first normal application sample set, the calculation method may refer to the foregoing description.

Each type of system event has a pop-up correlation score for each normal application, and one of these pop-up correlation scores can be selected as a default correlation score. As an example, the top 75% quantile is selected from the pop-up window association scores of the first normal application sample set as the preset association score.

Since the method for identifying a malicious application provided in the embodiment of the present application is used to identify a malicious application, if a normal application is identified as a malicious application, user experience will be significantly affected. Therefore, selecting the quantile of the preset proportion from the pop-up correlation scores of the normal application sample set as the preset correlation score can avoid misidentifying normal applications as malicious applications and improve the practicability of malicious application identification methods.

In one embodiment of the present application, the preorder anomaly score is determined based on the following formula:

Among them, R1 is the preorder abnormal score, is the preset weight coefficient, N is the number of pop-up window behaviors in the background, and n is the number of pop-up window behaviors associated with events.

specific, .

When judging whether the target application is a malicious application, since the pop-up behavior of the associated event has a greater impact on the malicious degree of the target application, a weight coefficient can be set to increase the impact of the pop-up behavior of the associated event on the pre-sequence anomaly score, and improve the calculation Accuracy when preorder outlier scores.

In one embodiment of the present application, according to the abnormal score corresponding to each target feedback event, the subsequent abnormal score of the target application is determined, which can be specifically achieved through the following steps:

Sum the product of the number of occurrences of each type of target feedback event and the corresponding abnormal score to obtain the abnormal score of the feedback event of the target application;

The ratio of the abnormal score of the feedback event to the number of pop-up window behaviors in the background is used as the abnormal score of the subsequent sequence.

In actual application scenarios, different target feedback events may be triggered depending on the degree of maliciousness of the background pop-up behavior.

Therefore, different anomaly scores can be determined for different target feedback events according to the actual situation, and the size of the anomaly score is positively correlated with the maliciousness of the background pop-up window behavior usually corresponding to the target feedback event.

Exemplarily, if the user cannot uninstall the target application after the pop-up behavior in the background, or even cannot find the target application corresponding to the pop-up behavior in the background, the user may choose to restart the terminal directly. This kind of pop-up behavior in the background is more malicious.

Therefore, if a restart occurs after the pop-up behavior in the background, it may indicate that the pop-up behavior in the background is more malicious, and a higher abnormal score can be determined for the restart.

As an example, when determining the abnormal score corresponding to the target feedback event, shutdown and restart score x ₀ , uninstall the application score x ₁ , launch the background clear application score x ₂ , background cleanup score x ₃ , and other target feedback events Average score x ₄ .

Exemplarily, x ₀ =15, x ₁ =10, x ₂ =3, x ₃ =2, x ₄ =1.

Specifically, the more target feedback events that occur after the background pop-up behavior of the target application, the greater the abnormal score corresponding to the target feedback event, and the higher the subsequent abnormal score of the target application.

Take the abnormal score scoring method in the example above as an example. In this case, the subsequent abnormal score of the target application satisfies the following formula:

Among them, R2 is the post-order abnormal score, is the number of shutdown restarts, is the number of times the app was uninstalled, is the number of times the app was cleared from the background when launched, is the number of background cleanups, The number of times the event was fed back for other targets.

In the embodiment of the present application, when calculating the subsequent abnormal score of the target application, the number of target feedback events that occur after the pop-up behavior in the background is taken into account, as well as the malicious degree of the pop-up behavior in the background that may be reflected by the target feedback event, the calculated Subsequent outlier scores have higher accuracy.

In one embodiment of the present application, for any type of target feedback event, the abnormal score is determined based on the following method:

Obtaining the second normal application sample set and the first malicious application sample set;

Obtain the first proportion of normal applications in the second normal application sample set that have target feedback events after background pop-up behaviors occur, and the second proportion of malicious applications in the first malicious application sample set that have target feedback events after background pop-up behaviors occur;

The ratio of the first proportion to the second proportion is taken as the abnormal score.

Taking uninstalling apps as an example, assume that the proportion of normal applications in the second normal application sample set that is uninstalled after the background pop-up behavior occurs is a, and the proportion of malicious applications in the first malicious application sample set that is uninstalled after the background pop-up behavior occurs is b , then the abnormal score corresponding to the target feedback event of uninstalling the application is a/b.

In the embodiment of the present application, based on the proportions of normal applications and malicious applications in application samples that appear target feedback events after background pop-up behaviors occur, the abnormal score corresponding to target feedback events is determined with high accuracy.

In one embodiment of the present application, based on the pre-sequence anomaly score and the post-sequence anomaly score, it is determined whether the target application is a malicious application, specifically through the following steps:

Judging whether the pre-sequence abnormality score is greater than the pre-sequence threshold, and whether the subsequent-sequence abnormality score is greater than the post-sequence threshold;

If the pre-sequence anomaly score is greater than the pre-sequence threshold, and the post-sequence anomaly score is greater than the post-sequence threshold, the target application is a high-risk malicious application;

If the pre-sequence anomaly score is greater than the pre-sequence threshold, or the subsequent anomaly score is greater than the post-sequence threshold, the target application is a medium-risk malicious application;

Otherwise, the target app is not malicious.

In the malicious application identification method provided by the embodiment of the present application, both the pre-sequence anomaly score and the post-sequence anomaly score of the target application are relatively high, that is, the pre-sequence anomaly score is greater than the pre-sequence threshold, and the post-sequence anomaly score is greater than the post-sequence anomaly score. When the threshold is exceeded, it is inferred that the target application is a high-risk malicious application. If only one of the pre-sequence anomaly score and the post-sequence anomaly score of the target application is higher, that is, the pre-sequence anomaly score is greater than the pre-sequence threshold, or the post-sequence anomaly score is greater than the post-sequence threshold, only the target application is inferred It is a medium-risk malicious application. It can avoid misidentifying a medium-risk malicious application as a high-risk malicious application, and improves the practicability of the method for identifying a malicious application.

In another embodiment of the present application, the classification model can be trained by using normal application samples and malicious application samples whose pre-sequence anomaly score and post-sequence anomaly score have been determined, and then use the trained classification model to judge whether the target application belongs to Malicious application.

In one embodiment of the present application, the pre-sequence threshold and the post-sequence threshold are determined based on the following manner:

Obtaining a second malicious application sample set;

determining the pre-sequence anomaly score and the post-sequence anomaly score of each malicious application in the second malicious application sample set;

A pre-order threshold greater than the second threshold is selected from the pre-order anomaly scores of the second malicious application sample set, and a post-order threshold greater than the third threshold is selected from the post-order anomaly scores of the second malicious application sample set.

Specifically, you can refer to the description of steps S201-S203 above to calculate the pre-sequence anomaly score and post-sequence anomaly score of each malicious application in the second malicious application sample set, and select the pre-sequence threshold and post-sequence threshold from these scores. threshold.

As an example, the first 75% quantile is selected from the pre-order anomaly scores of the second malicious application sample set as the pre-order threshold, and the first 75% quantile is selected from the post-order anomaly scores as the post-order threshold.

The embodiment of the present application calculates the pre-order anomaly score and the post-order anomaly score of each malicious application in the malicious application sample set, and selects a larger value as the pre-order threshold and the post-order threshold to determine the pre-order threshold and post-order threshold. The threshold accuracy is higher. Therefore, when judging whether a target application is a malicious application according to the pre-sequence threshold and the post-sequence threshold, the accuracy is relatively high, and normal applications can be prevented from being mistakenly identified as malicious applications, thereby improving the accuracy and practicability of the method for identifying malicious applications.

In an embodiment of the present application, the background pop-up window behavior data of any malicious application in the second malicious application sample set is smaller than the model effective threshold when the background pop-up window behavior data is used for model training.

Among them, the effective threshold of the model can be obtained according to the bad case (bad case) analysis.

Specifically, the identification of target applications with sufficient data volume can generally be solved by models, and the malicious application identification method provided by the embodiment of the present application is also suitable for identifying target applications with low-frequency background pop-up behaviors. Therefore, with a low data volume The malicious application determines the pre-sequence threshold and the post-sequence threshold for the sample, which is more in line with the application scenario of the embodiment of the present application.

For the aforementioned malicious application identification method, the present application also provides a terminal device. FIG. 4 is a schematic structural diagram of the functional modules of the terminal device provided in the embodiment of the present application. Referring to FIG. 4 , the terminal device includes:

The first determination module 401 is used to determine whether there is a pop-up related event in the first period before the background pop-up behavior for each background pop-up behavior of the target application within a preset period of time, and if so, the background pop-up window Behavior is determined as a related event pop-up behavior; a pop-up related event is a system event with a pop-up related score greater than a preset related score; the pop-up related score represents the degree of correlation between the system event and the background pop-up behavior;

The second determination module 402 is used to determine the pre-order abnormal score of the target application according to the proportion of the associated event pop-up behavior in the background pop-up behavior;

The third determining module 403 is used to determine whether there is a target feedback event in the second period after the background pop-up behavior for each background pop-up behavior of the target application within a preset period of time, and if so, according to each target feedback event The corresponding abnormal score determines the subsequent abnormal score of the target application; wherein, the target feedback event includes a predetermined user behavior event and/or system state change event;

A judging module 404, configured to judge whether the target application is a malicious application based on the preceding anomaly score and the subsequent anomaly score.

In one embodiment of the present application, the pop-up association score of background pop-up behavior is determined based on the following method:

For each background pop-up behavior of the target application within the preset time period, obtain system events in the third period before the background pop-up behavior;

For each type of system event before any background pop-up behavior, determine the single pop-up correlation score of this type of system event based on the following formula:

in, Behavior A and system events for this background pop-up window The associated score of a single pop-up window, It is the default score of the jth system event before the background pop-up behavior, is the weight of the jth system event; the size of the preset score is negatively correlated with the size of j ;

The weight satisfies the following formula:

Among them, T is the third time period, and t is the time difference between the system event and the pop-up window behavior in the background;

According to the single pop-up associated score of any type of system event in each background pop-up behavior, the pop-up associated score of this type of system event is determined based on the following formula:

in, Associate the score with the popup.

In one embodiment of the present application, the preset correlation score is determined based on the following method:

Obtaining the first normal application sample set;

Determining the background pop-up window behavior of each normal application in the first normal application sample set and the predetermined pop-up window correlation score of various system events, and calculating the quantile of the preset ratio based on the determined pop-up window correlation score, As a default associated score.

In one embodiment of the present application, the second determination module 402 is specifically configured to determine the preorder abnormality score based on the following formula:

Among them, R1 is the preorder abnormal score, is the preset weight coefficient, N is the number of pop-up window behaviors in the background, and n is the number of pop-up window behaviors associated with events.

In an embodiment of the present application, the third determination module 403 is specifically used to:

Sum the product of the number of occurrences of each type of target feedback event and the corresponding abnormal score to obtain the abnormal score of the feedback event of the target application;

The ratio of the abnormal score of the feedback event to the number of pop-up window behaviors in the background is used as the abnormal score of the subsequent order.

In one embodiment of the present application, for any type of target feedback event, the abnormal score is determined based on the following method:

Obtaining the second normal application sample set and the first malicious application sample set;

Obtain the first proportion of normal applications in the second normal application sample set that have target feedback events after background pop-up behaviors occur, and the second proportion of malicious applications in the first malicious application sample set that have target feedback events after background pop-up behaviors occur;

The ratio of the first proportion to the second proportion is taken as the abnormal score.

In an embodiment of the present application, the judging module 404 is specifically used for:

Determine whether the pre-sequence abnormal score is greater than the pre-sequence threshold, and whether the post-sequence abnormal score is greater than the post-sequence threshold;

If the pre-sequence anomaly score is greater than the pre-sequence threshold, and the post-sequence anomaly score is greater than the post-sequence threshold, the target application is a high-risk malicious application;

If the pre-sequence anomaly score is greater than the pre-sequence threshold, or the subsequent anomaly score is greater than the post-sequence threshold, the target application is a medium-risk malicious application;

Otherwise, the target app is not malicious.

In one embodiment of the present application, the preceding threshold and the subsequent threshold are determined based on the following manner:

Obtaining a second malicious application sample set;

determining the pre-sequence anomaly score and the post-sequence anomaly score of each malicious application in the second malicious application sample set;

A pre-order threshold greater than the second threshold is selected from the pre-order anomaly scores of the second malicious application sample set, and a post-order threshold greater than the third threshold is selected from the post-order anomaly scores of the second malicious application sample set.

In an embodiment of the present application, the background pop-up window behavior data of any malicious application in the second malicious application sample set is smaller than the model effective threshold when the background pop-up window behavior data is used for model training.

In a specific implementation, the present application also provides a computer storage medium, wherein the computer storage medium can store a program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the parts in the above-mentioned embodiments or all steps. The storage medium may be a magnetic disk, an optical disk, a read-only memory (English: read-only memory, ROM for short), or a random access memory (English: random access memory, RAM for short), etc.

In a specific implementation, an embodiment of the present application also provides a computer program product, the computer program product includes executable instructions, and when the executable instructions are executed on a computer, the computer executes part or part of the above method embodiments. All steps.

Various embodiments of the mechanisms disclosed in this application may be implemented in hardware, software, firmware, or a combination of these implementation methods. Embodiments of the present application may be implemented as a computer program or program code executed on a programmable system comprising at least one processor, a storage system (including volatile and non-volatile memory and/or storage elements) , at least one input device, and at least one output device.

Program code can be applied to input instructions to perform the functions described herein and to generate output information. The output information may be applied to one or more output devices in known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a Digital Signal Processor (DSP), a microcontroller, an Application Specific Integrated Circuit (ASIC), or a microprocessor .

The program code can be implemented in a high-level procedural language or an object-oriented programming language to communicate with the processing system. Program code can also be implemented in assembly or machine language, if desired. In fact, the mechanisms described in this application are not limited in scope to any particular programming language. In either case, the language may be a compiled or interpreted language.

In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments can also be implemented as instructions carried by or stored on one or more transitory or non-transitory machine-readable (e.g., computer-readable) storage media, which can be executed by one or more processors read and execute. For example, instructions may be distributed over a network or via other computer-readable media. Thus, a machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including, but not limited to, floppy disks, compact discs, compact discs, Compact Disc Read Only Memory , CD-ROMs), magneto-optical disk, read-only memory (ReadOnlyMemory, ROM), random access memory (RAM), erasable programmable read-only memory (ErasableProgrammable Read Only Memory, EPROM), electrically erasable programmable only memory Read memory (Electrically Erasable Programmable Read Only Memory, EEPROM), magnetic card or optical card, flash memory, or use the Internet to transmit information by means of electricity, light, sound or other forms of propagation signals (for example, carrier waves, infrared signals, digital signals, etc.) tangible machine-readable storage. Thus, a machine-readable medium includes any type of machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

In the drawings, some structural or methodological features may be shown in a particular arrangement and/or order. However, it should be understood that such specific arrangements and/or orderings may not be required. Rather, in some embodiments, these features may be arranged in a different manner and/or order than shown in the figures of the description. Additionally, the inclusion of structural or methodological features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments these features may not be included or may be combined with other features.

It should be noted that each unit/module mentioned in each device embodiment of this application is a logical unit/module. Physically, a logical unit/module can be a physical unit/module, or a physical unit/module. A part of the module can also be realized with a combination of multiple physical units/modules, the physical implementation of these logical units/modules is not the most important, the combination of functions realized by these logical units/modules is the solution The key to the technical issues raised. In addition, in order to highlight the innovative part of this application, the above-mentioned device embodiments of this application do not introduce units/modules that are not closely related to solving the technical problems proposed by this application, which does not mean that the above-mentioned device embodiments do not exist other units/modules.

It should be noted that in the examples and descriptions of this patent, relative terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply There is no such actual relationship or order between these entities or operations. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Although this application has been shown and described with reference to certain preferred embodiments thereof, those skilled in the art will understand that various changes in form and details may be made therein without departing from this disclosure. The spirit and scope of the application.

Claims (11)

1. A method for identifying a malicious application, comprising: For each background pop-up behavior of the target application within the preset time period, determine whether there is a pop-up related event in the first period before the background pop-up behavior, and if so, determine the background pop-up behavior as a related event pop-up behavior ; The pop-up associated event is a system event with a pop-up associated score greater than a preset associated score; the pop-up associated score represents the degree of association between the system event and the background pop-up behavior; According to the proportion of the associated event pop-up behavior in the background pop-up behavior, determine the pre-sequence abnormality score of the target application; For each background pop-up behavior of the target application within the preset time period, determine whether there is a target feedback event in the second time period after the background pop-up behavior, and if so, according to the abnormal analysis corresponding to each target feedback event Value, to determine the subsequent abnormal score of the target application; wherein, the target feedback event includes a predetermined user behavior event and/or system state change event; Based on the preceding anomaly score and the subsequent anomaly score, it is determined whether the target application is a malicious application. 2. The method according to claim 1, wherein the pop-up associated score of the background pop-up behavior is determined based on the following method: For each background pop-up behavior of the target application within the preset time period, acquiring system events within a third time period before the background pop-up behavior; For each type of system event before any background pop-up behavior, determine the single pop-up correlation score of this type of system event based on the following formula: in, Behavior A and system events for this background pop-up window The associated score of a single pop-up window, is the preset score of the jth system event before the background pop-up behavior, is the weight of the jth system event; the size of the preset score is negatively correlated with the size of j ; The weights satisfy the following formula: Wherein, T is the third time period, and t is the time difference between the system event and the background pop-up behavior; According to the single pop-up associated score of any type of system event in each background pop-up behavior, the pop-up associated score of this type of system event is determined based on the following formula: in, A score is associated with the pop-up window. 3. The method according to claim 1, wherein the preset association score is determined based on the following manner: Obtaining the first normal application sample set; Determining the background pop-up behavior of each normal application in the first normal application sample set and the pop-up correlation score of various predetermined system events, and calculating the quantile of the preset ratio based on the determined pop-up correlation score number, as the preset association score. 4. The method according to claim 1, wherein the pre-order abnormal score is determined based on the following formula: Among them, R1 is the abnormal score of the preorder, is a preset weight coefficient, N is the number of pop-up window behaviors in the background, and n is the number of pop-up window behaviors in the associated event. 5. The method according to claim 1, wherein the step of determining the subsequent abnormal score of the target application according to the abnormal score corresponding to each target feedback event comprises: Summing the product of the number of occurrences of each type of the target feedback event and the corresponding abnormal score to obtain the abnormal score of the feedback event of the target application; The ratio of the abnormal score of the feedback event to the number of pop-up window behaviors in the background is used as the abnormal score of the subsequent sequence. 6. The method according to claim 5, wherein, for any type of the target feedback event, the abnormal score corresponding to the target feedback event is determined in the following manner: Obtaining the second normal application sample set and the first malicious application sample set; Obtaining the first proportion of normal applications in the second normal application sample set that appear the target feedback event after the background pop-up behavior occurs, and the malicious application in the first malicious application sample set that appears the target after the background pop-up behavior occurs The second proportion of feedback events; The ratio of the first ratio to the second ratio is used as the abnormality score corresponding to the target feedback event. 7. The method according to claim 1, wherein the step of judging whether the target application is a malicious application based on the preceding anomaly score and the subsequent anomaly score comprises: Judging whether the pre-sequence abnormality score is greater than the pre-sequence threshold, and whether the subsequent-sequence abnormality score is greater than the post-sequence threshold; If the preceding anomaly score is greater than the preceding threshold, and the subsequent anomaly score is greater than the subsequent threshold, the target application is a high-risk malicious application; If the preceding anomaly score is greater than the preceding threshold, or the subsequent anomaly score is greater than the subsequent threshold, the target application is a medium-risk malicious application; Otherwise, the target application is not a malicious application. 8. The method according to claim 7, wherein the pre-sequence threshold and the post-sequence threshold are determined based on the following manner: Obtaining a second malicious application sample set; determining a pre-sequence anomaly score and a post-sequence anomaly score of each malicious application in the second malicious application sample set; Select the pre-sequence threshold greater than the second threshold from the pre-sequence abnormal scores of the second malicious application sample set, and select the sequence greater than the third threshold from the subsequent anomaly scores of the second malicious application sample set The postorder threshold. 9 . The method according to claim 8 , wherein the background pop-up window behavior data of any malicious application in the second malicious application sample set is smaller than the effective threshold of the model when the background pop-up window behavior data is used for model training. 10. A terminal device, characterized in that the terminal device comprises: The first determining module is used to determine whether there is a pop-up related event in the first period before the background pop-up behavior for each background pop-up behavior of the target application within a preset period of time, and if so, the background pop-up behavior Determined as a related event pop-up behavior; the pop-up related event is a system event with a pop-up related score greater than a preset related score; the pop-up related score represents the degree of association between the system event and the background pop-up behavior; The second determination module is used to determine the pre-sequence abnormal score of the target application according to the proportion of the associated event pop-up behavior in the background pop-up behavior; The third determination module is used to determine whether there is a target feedback event in the second period after the background pop-up behavior for each background pop-up behavior of the target application within the preset time period, and if so, according to each The abnormal score corresponding to the target feedback event determines the subsequent abnormal score of the target application; wherein the target feedback event includes a predetermined user behavior event and/or system state change event; A judging module, configured to judge whether the target application is a malicious application based on the preceding anomaly score and the subsequent anomaly score. 11. A computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute claims 1-9 any one of the methods described.

Images