WO2016180211A1 - 一种伪装应用的处理方法和装置 - Google Patents
一种伪装应用的处理方法和装置 Download PDFInfo
- Publication number
- WO2016180211A1 WO2016180211A1 PCT/CN2016/079927 CN2016079927W WO2016180211A1 WO 2016180211 A1 WO2016180211 A1 WO 2016180211A1 CN 2016079927 W CN2016079927 W CN 2016079927W WO 2016180211 A1 WO2016180211 A1 WO 2016180211A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- feature information
- application
- predetermined
- depth
- matching
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
Definitions
- This document relates to, but is not limited to, mobile communication technology, and more particularly to a processing method and apparatus for a camouflage application.
- smartphones can obtain a large number of third-party applications through various channels, and then the quality of third-party applications themselves is uneven, especially a large number of phishing fake applications disguised as financial, financial, instant messaging.
- Popular applications such as users, the appearance of these applications, text prompts, etc. are very similar to genuine software applications, so that users input information according to genuine software applications lead to the disclosure of personal privacy information, and even cause users to lose financial assets.
- the masquerading of these phishing fake applications is identified by an anti-virus engine, and if such an application is found, the user is prompted to uninstall.
- the embodiment of the invention provides a processing method and device for a camouflage application, which can timely discover a fishing camouflage application and protect user information and property security.
- a method of processing a camouflage application comprising:
- the application is processed according to the matching result of the depth feature information.
- the obtaining the primary feature information of the application installation package includes:
- the method further includes:
- the application is installed.
- the depth feature information of the extracted application installation package includes:
- the data in the application installation package is sampled according to a predetermined algorithm type and related parameter information, and a summary file that represents depth feature information of the application installation package is generated.
- the matching the depth feature information with the feature information in the predetermined second feature library includes:
- the summary file is compared with the summary file in the predetermined second feature library.
- the processing the application according to the matched result includes:
- the risk information is presented.
- the processing the application according to the matched result includes:
- the application is installed.
- the method further includes:
- the depth feature information of the installed application is added to the predetermined second feature library.
- a processing device for a camouflage application comprising:
- the primary feature information matching module is configured to acquire primary feature information of the application installation package, and match the primary feature information with the feature information in the predetermined first feature database, where the primary feature information includes a basic of the application installation package. parameter;
- a screening module configured to filter out a successfully matched application installation package according to the matching result of the primary feature information
- the depth feature information matching module is configured to extract the depth feature information of the filtered application installation package, and match the depth feature information with the feature information in the predetermined second feature database, where the depth feature information includes the application installation Characteristic information in the packet data;
- the processing module is configured to process the application according to the matching result of the depth feature information.
- the obtaining, by the primary feature information matching module, the primary feature information of the application installation package includes:
- the primary feature information matching module acquires basic parameters that one or more of the application installation packages can match, and establishes a primary feature information vector set according to the acquired basic parameters.
- the device further includes:
- the depth feature information matching module extracts the depth feature information of the filtered application installation package, including:
- the depth feature information matching module samples data in the application installation package according to a predetermined algorithm type and related parameter information, and generates a summary file that represents depth feature information of the application installation package.
- the matching, by the depth feature information matching module, the feature information in the predetermined second feature database includes:
- the depth feature information matching module performs a similarity calculation between the summary file and the summary file in the predetermined second feature library.
- processing module processing the application according to the matched result includes:
- the processing module prompts the risk information when the similarity between the digest file of the depth feature information and the digest file in the predetermined second feature library is lower than a predetermined threshold.
- the device further includes: a mounting module
- Processing, by the processing module, the application according to the matched result includes:
- the processing module instructs the installation module to install the application when the similarity between the digest file of the depth feature information and the digest file in the predetermined second feature library is higher than a predetermined threshold or an indication of installation is received .
- the device further includes:
- the adding module is configured to add the depth feature information of the installed application to the predetermined second feature library after the installation module installs the application.
- a computer readable storage medium storing computer executable instructions for performing the above method.
- the embodiment of the invention provides a processing method and device for a camouflage application.
- the device comprises a primary feature information matching module, a screening module, a depth feature information matching module and a processing module, and obtains primary feature information and depth features by detecting an installation package of the camouflage application.
- the information is matched with the feature information in the predetermined feature database, and the masquerading software is processed according to the matched result, so that the maritime camouflage application can be found in time to protect the user's information and property security.
- FIG. 1 is a schematic flowchart of a method for processing a masquerading application according to an embodiment of the present invention
- FIG. 2 is a schematic flowchart of a second processing method of a masquerading application according to an embodiment of the present invention
- FIG. 3 is a schematic structural diagram of a processing device of a masquerading application according to an embodiment of the present disclosure
- FIG. 4 is a schematic structural diagram of a second processing device of a masquerading application according to an embodiment of the present invention.
- the method in the embodiment of the present invention may be applied to a terminal or a platform that may need to install an application, such as a smart phone, a tablet, a handheld, a computer, a server, etc., but is not limited thereto.
- an application such as a smart phone, a tablet, a handheld, a computer, a server, etc., but is not limited thereto.
- the method according to the embodiment of the present invention is to solve the problem that the anti-virus engine kills the phishing camouflage application in the related art or the fish that leaks the net, and the maritime camouflage application cannot be found in time, thereby causing the user information and property security to be formed.
- Hidden problems are to solve the problem that the anti-virus engine kills the phishing camouflage application in the related art or the fish that leaks the net, and the maritime camouflage application cannot be found in time, thereby causing the user information and property security to be formed.
- FIG. 1 is a schematic flowchart of Embodiment 1 of a method for processing a masquerading application according to an embodiment of the present invention.
- the embodiment relates to a process for implementing an identification spoofing application and processing.
- the method includes steps S101 to S104:
- the application needs to be installed first.
- the application installation package runs on the smart terminal platform
- the primary feature information of the application installation package may be obtained, and the primary feature information is used.
- the reference application data package may contain primary feature information of the installation package.
- the screening needs further depth. Identify the installation package for the suspected application to prevent missed detection.
- S103 Extract depth information of the selected application installation package, and match the depth feature information with feature information in a predetermined second feature database, where the depth feature information includes feature information in the application installation package data. .
- the depth feature information is extracted from the filtered application installation package, where the depth feature information includes feature information in the application installation package data, and may be capable of deeply depicting the application installation packages under the premise of calculating complexity operation.
- the detailed feature, the depth feature extraction algorithm can be flexibly selected, and the depth feature information is matched with the feature information in the predetermined second feature library according to actual conditions, and the predetermined second feature library can be preset.
- the data application data packets may contain deep matching feature information that can be deeply matched.
- the primary feature information and the depth feature information it is possible to more accurately match whether the applications are masquerading applications, and if it is a masquerading application, the user may be prompted to process the applications, and if it is not a masquerading application, The app continues to function normally or properly.
- a method for processing a masquerading application is provided by the embodiment of the present invention.
- the method acquires the primary feature information and the depth feature information of the application installation package to match the feature information in the predetermined feature database, and processes the application according to the matched result.
- the package is installed so that the fishing camouflage application can be found in time to protect the user's information and property security.
- Embodiment 2 is a schematic flowchart of Embodiment 2 of a method for processing a masquerading application according to an embodiment of the present invention.
- primary feature information is matched according to the first feature database, if the primary feature information is successfully matched.
- the depth feature information is matched according to the second feature database.
- the risk information is prompted, and if the matching is successful or the user is allowed to install after the risk is prompted, the application is installed; If the primary feature information is not successfully matched, the application is installed; after the application is installed, it is determined whether the feature library is added, if not, the installation is exited, and if added, the depth feature information is added to the second feature database; After the risk information, if the user does not allow installation, exit the installation.
- the acquiring the primary feature information of the application installation package may include:
- the primary feature information of each application installation package includes basic parameters of the application installation package, such as an application name, a file name, a packet name, a type, a version number, a file size, and the like, but is not limited thereto.
- a typical implementation manner is to acquire at least one basic parameter that the application installation package can be matched, and establish a primary feature information vector set according to the obtained basic parameter.
- the primary feature information vector set may be only an application name and a type, and may also be It is the version number and file size, etc., which can be determined according to the actual situation. As long as the matching of these application installation packages can be realized, the initial inspection can be completed quickly, and the subsequent primary feature information matching is facilitated.
- the method further includes:
- the application is installed.
- the feature information vector in the primary feature information vector set and the feature information in the predetermined first feature database are unsuccessful, that is, an application name, a file name, a packet name, a type, a version number, The file size and the like do not match similar or identical content.
- the detection is not continued, and the application is directly installed for user convenience.
- the depth feature information of the extracted application installation package includes:
- the data in the application installation package is sampled according to a predetermined algorithm type and related parameter information, and a summary file that represents depth feature information of the application installation package is generated.
- an exemplary embodiment is to sample the bytecodes of the application installation package files according to a predetermined algorithm to form a summary file that can characterize the depth feature information of the application installation package.
- This summary file can be used for subsequent deep feature matching. For example, based on predetermined parameters, pseudo-random sampling of bytecode files, in a similar random order and Interval traversal of the installation package bytecode file, the extracted bytecode forms a summary file that is much smaller than the application installation file size.
- sampling methods such as uniform sampling and custom sampling functions can also be employed.
- the file header may include the sampling algorithm type and related parameters, and the actually extracted sampling data, thereby improving the matching efficiency.
- the matching the depth feature information with the feature information in the predetermined second feature database includes:
- the summary file is compared with the summary file in the predetermined second feature library.
- a digest file capable of characterizing the depth feature information of the application installation package may be extracted, where the algorithm type and related parameters of the application installation package are extracted to match the depth in the feature library.
- the parameters extracted by the feature information are the same.
- the summary file in the application installation package is correlated with the summary file in the feature library to calculate the similarity. For example, the variance, correlation coefficient, PSNR, quality factor and other parameters between the summary files can be calculated, which can be based on actual conditions. It depends on the situation, but it is not limited to this.
- the foregoing step 104 includes:
- the risk information is presented.
- the similarity is lower than a predetermined threshold (where the predetermined threshold may be determined according to actual conditions) , to determine the matching failure, prompting the user that these applications have installation risks, so that users can decide whether to install according to their own wishes after knowing the risks.
- a predetermined threshold where the predetermined threshold may be determined according to actual conditions
- the foregoing step 104 includes:
- the application is installed if the similarity of the digest file of the depth feature information to the digest file in the predetermined second feature library is higher than a predetermined threshold or an indication of installation is received.
- the application may be directly installed. Or if the similarity is lower than the predetermined threshold, the user still wants to install the application, that is, receiving the user's instruction to install, and then continue to install the application.
- the digest file of the depth feature information is similar to the digest file in the predetermined second feature library When the degree is equal to the predetermined threshold, you can set whether it is a match or a match failure.
- the method further includes:
- the depth feature information of the installed application is added to the predetermined second feature library.
- the related option may be clicked to indicate that the depth feature information of the extracted application installation package is stored in the predetermined second feature library, thereby enriching the second feature library.
- the predetermined first feature database and the second feature library may be the same or different, and may also be updated and improved by means of cloud upgrade by means of massive user interaction data, but is not limited thereto.
- the primary feature information, the depth feature information, and the related data may be globally encrypted and stored, or
- the core parameters and data are locally encrypted, and the parameters are decrypted only at the running stage, so that the feature information extraction and the feature information matching calculation are dynamically performed according to the decrypted parameters.
- the embodiment of the invention provides a hierarchical matching scheme for matching primary feature information matching and depth feature information, and only one of the first-level matching can be used in the implementation to facilitate the process, but this may improve the missed detection rate or the false detection rate, and may also sacrifice certain The efficiency of the calculation.
- FIG. 3 is a schematic structural diagram of Embodiment 1 of a processing apparatus for a masquerading application according to an embodiment of the present invention.
- the apparatus includes: a primary feature information matching module 10, a screening module 20, a depth feature information matching module 30, and processing. Module 40;
- the primary feature information matching module 10 is configured to acquire primary feature information of the application installation package, and match the primary feature information with the feature information in the predetermined first feature database, where the primary feature information includes the The basic parameters of the application installation package;
- the screening module 20 is configured to filter the successfully installed application installation package according to the matching result of the primary feature information
- the depth feature information matching module 30 is configured to extract the depth feature information of the filtered application installation package, and match the depth feature information with the feature information in the predetermined second feature database, where the depth feature information includes Describe the feature information in the application installation package data;
- the processing module 40 is configured to process the response according to the matching result of the depth feature information use.
- a processing device for a camouflage application includes a primary feature information matching module 10, a screening module 20, a depth feature information matching module 30, and a processing module 40, and obtains primary feature information and depth features by detecting an application installation package. The information is matched with the feature information in the predetermined feature database, and the application installation package is processed according to the matching result, so that the fishing camouflage application can be found in time to protect the user information and property security.
- the primary feature information matching module 10 obtains the primary feature information of the application installation package, including:
- the primary feature information matching module 10 acquires at least one basic parameter that the application installation package can perform, and establishes a primary feature information vector set according to the obtained basic parameter.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- FIG. 4 is a schematic structural diagram of a second embodiment of a processing apparatus for a masquerading application according to an embodiment of the present invention.
- the apparatus further includes: a mounting module 50;
- the installation module 50 is configured to, when the primary feature information matching module matches the feature information in the predetermined first feature database, the feature in the primary feature information vector
- the application is installed when the information vector matches the feature information in the predetermined first feature library.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the depth feature information matching module 30 extracts the depth feature information of the filtered application installation package, including:
- the depth feature information matching module 30 samples the data in the application installation package according to a predetermined algorithm type and related parameter information, and generates a summary file that represents depth feature information of the application installation package.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the matching by the depth feature information matching module 30, the matching of the depth feature information and the feature information in the predetermined second feature library, according to the foregoing embodiment, includes:
- the depth feature information matching module 30 performs similarity calculation on the digest file with the digest file in the predetermined second feature library.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the processing module 40 processes the application according to the matched result, including:
- the processing module 40 prompts the risk information when the similarity between the digest file of the depth feature information and the digest file in the predetermined second feature library is lower than a predetermined threshold.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the device further includes a mounting module 50;
- the processing module 40 processes the application according to the matched result, including:
- the processing module 40 instructs the installation module 50 to install the same when the similarity between the digest file of the depth feature information and the digest file in the predetermined second feature library is higher than a predetermined threshold or an indication of installation is received. application.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the apparatus further includes: an adding module 60.
- the adding module 60 is configured to add the depth feature information of the installed application to the predetermined second feature library after the installation module 50 installs the application.
- the device provided by the embodiment of the present invention may perform the foregoing method embodiments, and the implementation principles and technical effects thereof are similar, and details are not described herein again.
- the embodiment of the invention further provides a computer readable storage medium, which is stored in a computer executable An instruction to execute the above method.
- the embodiment of the invention provides a processing method and device for a camouflage application.
- the device comprises a primary feature information matching module, a screening module, a depth feature information matching module and a processing module, and obtains primary feature information and depth features by detecting an installation package of the camouflage application.
- the information is matched with the feature information in the predetermined feature database, and the masquerading software is processed according to the matched result, so that the maritime camouflage application can be found in time to protect the user's information and property security.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
一种伪装应用的处理方法和装置，所述装置包括初级特征信息匹配模块、筛选模块、深度特征信息匹配模块和处理模块，通过检测伪装应用的安装包获取其初级特征信息和深度特征信息与预定的特征库中的特征信息进行匹配，根据匹配的结果处理所述伪装软件。
Description
本文涉及但不限于移动通信技术，尤指一种伪装应用的处理方法和装置。
目前，随着智能手机的普及，智能手机可以通过各种渠道获取海量的第三方应用，然后第三方应用本身的质量参差不齐，尤其有大量的钓鱼类假应用伪装成金融、理财、即时通信等用户常用的热门应用，这些应用软件的外观、文字提示等与正版软件应用非常类似，从而使得用户按照正版软件应用来输入信息导致个人隐私信息泄露，甚至使得用户损失资金财产。
相关技术中，对于这些钓鱼类假应用的伪装都是通过杀毒引擎进行识别的，如果发现有这类应用则提示用户进行卸载。
但是，现在的杀毒引擎查杀钓鱼类伪装应用还是会产生漏网之鱼，而且无法及时的发现钓鱼类伪装应用，从而导致对用户的信息和财产安全构成了隐患。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种伪装应用的处理方法和装置，可以及时地发现钓鱼类伪装应用，保护用户的信息和财产安全。
本发明采用如下技术方案：
一种伪装应用的处理方法，包括：
获取应用安装包的初级特征信息，将所述初级特征信息与预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数；
根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包；
提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息；
根据所述深度特征信息的匹配结果处理所述应用。
可选地，所述获取所述应用安装包的初级特征信息包括：
获取一个或多个所述应用安装包能够进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
可选地，所述将初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后还包括：
若所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功，则安装所述应用。
可选地，所述提取筛选出的应用安装包的深度特征信息包括：
按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
可选地，所述将深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：
将所述摘要文件与预定的第二特征库中的摘要文件进行相似度的计算。
可选地，所述根据匹配的结果处理所述应用包括：
若所述深度特征信息的摘要文件与预定特征库中的摘要文件的相似度低于预定阀值，则提示风险信息。
可选地，所述根据匹配的结果处理所述应用包括：
若所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值或者接收到安装的指示，则安装所述应用。
可选地，在安装所述应用之后，还包括：
将所安装的应用的深度特征信息添加进所述预定的第二特征库。
一种伪装应用的处理装置，包括：
初级特征信息匹配模块，设置成获取应用安装包的初级特征信息，将所述初级特征信息与预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数；
筛选模块，设置成根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包；
深度特征信息匹配模块，设置成提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息；
处理模块，设置成根据所述深度特征信息的匹配结果处理所述应用。
可选地，所述初级特征信息匹配模块获取应用安装包的初级特征信息包括：
所述初级特征信息匹配模块获取一个或多个所述应用安装包能够进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
可选地，所述的装置还包括：
安装模块，设置成在所述初级特征信息匹配模块在将所述初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后，当所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功时，安装所述应用。
可选地，所述深度特征信息匹配模块提取筛选出的应用安装包的深度特征信息包括：
所述深度特征信息匹配模块按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
可选地，所述深度特征信息匹配模块将所述深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：
所述深度特征信息匹配模块将所述摘要文件与所述预定的第二特征库中的摘要文件进行相似度的计算。
可选地，所述处理模块根据匹配的结果处理所述应用包括：
所述处理模块当所述深度特征信息的摘要文件与所述预定的第二特征库中的摘要文件的相似度低于预定阀值时，提示风险信息。
可选地，所述的装置还包括：安装模块；
所述处理模块根据匹配的结果处理所述应用包括：
所述处理模块当所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值时或者接收到安装的指示时，指示所述安装模块安装所述应用。
可选地，所述的装置还包括：
添加模块，设置成在安装模块安装所述应用之后，将所安装应用的深度特征信息添加进预定的第二特征库。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
本发明实施例提供一种伪装应用的处理方法和装置，装置包括初级特征信息匹配模块、筛选模块、深度特征信息匹配模块和处理模块，通过检测伪装应用的安装包获取其初级特征信息和深度特征信息与预定的特征库中的特征信息进行匹配，根据匹配的结果处理所述伪装软件，从而可以及时地发现钓鱼类伪装应用，保护用户的信息和财产安全。在阅读并理解了附图和详细描述后，可以明白其它方面。
附图概述
图1为本发明实施例提供的伪装应用的处理方法之一的流程示意图；
图2为本发明实施例提供的伪装应用的处理方法之二的流程示意图；
图3为本发明实施例提供的伪装应用的处理装置之一的结构示意图；
图4为本发明实施例提供的伪装应用的处理装置之二的结构示意图。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本发明实施例涉及的方法可以应用于可以需要安装应用程序的终端或者平台，例如可以是智能手机、平板电脑、手持机、计算机、服务器等，但并不以此为限。
本发明实施例涉及的方法，旨在解决相关技术中杀毒引擎查杀钓鱼类伪装应用还是会产生漏网之鱼，而且无法及时的发现钓鱼类伪装应用，从而导致对用户的信息和财产安全构成了隐患的问题。
下面以实施例对技术方案进行详细说明。下面这几个实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例不再赘述。
图1为本发明实施例提供的一种伪装应用的处理方法实施例一的流程示意图，本实施例涉及的是实现识别伪装应用以及处理的过程。如图1所示，该方法包括步骤S101～S104：
S101、获取应用安装包的初级特征信息，将所述初级特征信息与预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数。
通常，用户使用智能终端的应用来提供某些服务，会需要先安装这些应用，应用的安装包在智能终端平台上进行运行时，可以获取这些应用安装包的初级特征信息，该初级特征信息用于快速检索、识别安装包，包含这些应用安装包的基本参数，并将该初级特征信息与所述预定的第一特征库中的特征信息进行匹配；该预定的第一特征库中可以预先设定有一个或多个根据相关技术知悉的常用的参考应用数据包，该参考应用数据包可以包含安装包的初级特征信息。
S102、根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包。
可选地，通过将这些应用安装包的初级特征信息与所述预定的第一特征库中的特征信息进行匹配，如果检索到有部分初级特征信息相同的应用安装包，则筛选出需要进一步深度识别的疑似应用的安装包，以防止漏检。
S103、提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息。
可选地，从筛选出的应用安装包中提取深度特征信息，该深度特征信息包括所述应用安装包数据中的特征信息，可以是在计算复杂度运行前提下能深度刻画这些应用安装包的详细特征，深度特征提取算法可灵活选择，根据实际情况而定，将所述深度特征信息与所述预定的第二特征库中的特征信息进行匹配，该预定的第二特征库中可以预先设定有一个或多个根据现有技术知悉的常用的参考应用数据包，该数据应用数据包可以包含有能深度匹配的深度匹配特征信息。
S104、根据所述深度特征信息的匹配结果处理所述应用。
本实施例中，通过初级特征信息和深度特征信息的匹配，能够更加精准的匹配出这些应用是不是伪装应用，如果是伪装应用，可以提示用户对这些应用进行处理，如果不是伪装应用，可以使得该应用继续正常运行或正常安装。
本发明实施例提供的一种伪装应用的处理方法，该方法通过检测应用安装包获取其初级特征信息和深度特征信息与预定的特征库中的特征信息进行匹配，根据匹配的结果处理所述应用安装包，从而可以及时地发现钓鱼类伪装应用，保护用户的信息和财产安全。
图2为本发明实施例提供的一种伪装应用的处理方法实施例二的流程示意图，如图2所示，开始安装后先根据第一特征库进行初级特征信息匹配，如果初级特征信息匹配成功则根据第二特征库进行深度特征信息匹配，如果深度特征信息匹配不成功(比如摘要文件的相似度低于预定阈值)则提示风险信息，如果匹配成功或者提示风险后用户允许安装则安装应用；如果初级特征信息匹配不成功也安装应用；安装应用后判断是否添加进特征库，如果不添加则退出安装，如果添加则将深度特征信息添加到第二特征库；当提示
风险信息后，如果用户不允许安装则退出安装。
在上述实施例的基础上，所述获取所述应用安装包的初级特征信息可以包括：
获取至少一个所述应用安装包可以进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
可选地，每个应用安装包的初级特征信息包括所述应用安装包的基本参数，如应用名称、文件名、数据包名、类型、版本号、文件大小等，但并不限于此，其中，典型实施方式是获取至少一个该应用安装包可以进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集，例如，该初级特征信息向量集可以仅是应用名称和类型，还可以是版本号和文件大小等，可以根据实际情况来定，只要能实现这些应用安装包的匹配即可，从而可以快速完成的初检，便于后续的初级特征信息匹配。
可选地，在上述实施例的基础上，所述将初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后还包括：
若所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功，则安装所述应用。
可选地，若所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功，即应用名称、文件名、数据包名、类型、版本号、文件大小等均没有匹配到相似或者相同的内容，为了提供系统的运行效率，则不再继续检测，直接安装该应用，便于用户使用。
可选地，在上述实施例的基础上，所述提取筛选出的应用安装包的深度特征信息包括：
按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
可选地，对于深度特征信息提取，典型实施方式是对这些应用安装包文件的字节码按照预定的算法进行抽样，形成可以表征所述应用安装包的深度特征信息的摘要文件。这个摘要文件可用于后续的深度特征匹配。例如，基于按照预定的参数，对字节码文件进行伪随机抽样，按照类似随机的顺序和
间隔遍历安装包字节码文件，抽取的字节码形成远小于应用安装文件大小的摘要文件。除了伪随机抽样，也可采用诸如均匀抽样，自定义抽样函数等抽样方法。在最终生成的深度特征信息摘要文件中，文件头可以包括抽样算法类型及相关参数，以及真正提取到的抽样数据，从而可以提高匹配的效率。
可选地，在上述实施例的基础上，所述将深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：
将所述摘要文件与预定的第二特征库中的摘要文件进行相似度的计算。
可选地，在上述实施例的基础上，可以提取到能够表征这些应用安装包的深度特征信息的摘要文件，其中，提取应用安装包的算法类型与相关参数应与特征库中能够匹配的深度特征信息提取的参数相同。然后将应用安装包中的摘要文件与特征库中的摘要文件进行相关计算，进而计算出相似度，例如，可计算摘要文件之间的方差、相关系数、PSNR、品质因数等参数，可以根据实际情况而定，但并不以此为限。
可选地，在上述实施例的基础上，上述步骤104包括：
若所述深度特征信息的摘要文件与预定特征库中的摘要文件的相似度低于预定阀值，提示风险信息。
可选地，计算所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度后，若相似度低于预定阈值(其中，该预定阀值可以根据实际情况而定)，则判断匹配失败，提示用户这些应用有安装风险，让用户知悉风险后可以根据自己的意愿决定是否安装。
可选地，在上述实施例的基础上，上述步骤104包括：
若所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值或者接收到安装的指示，安装所述应用。
可选地，计算所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度后，若相似度高于预定的阈值，即判断匹配成功，可以直接安装所述应用，或者若相似度低于预定的阈值的情况下，用户仍想安装该应用，即接收到用户给出安装的指示，则仍然继续安装该应用。
所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似
度等于预定阀值时，可以自行设置当成匹配成功还是匹配失败。
可选地，在上述实施例的基础上，在安装所述应用之后，还包括：
将所安装应用的深度特征信息添加进预定的第二特征库。
可选地，如果用户认为安装的应用可以信任，可以点击相关的选项，指示将本次提取的应用安装包的深度特征信息存入预定的第二特征库中，从而丰富第二特征库，此外，预定的第一特征库和第二特征库可以是同一个也可以不同，还可以借助海量用户交互的数据，通过云端升级的方式来不段更新和完善，但并不限于此。
此外，在实施过程中，为提高方法的鲁棒性，防止恶意软件应用对本发明实施例的方法解析后进行规避，可以将初级特征信息、深度特征信息以及相关数据进行全局加密存储，或者对部分核心参数和数据进行局部加密，只在运行阶段才将参数解密，从而动态的根据解密出的参数来进行特征信息提取和特征信息匹配计算。
本发明实施例提供了初级特征信息匹配和深度特征信息匹配的分级匹配方案，实施时可只采用其中一级匹配，便于简化流程，但这样可能提高漏检率或错检率，也可能牺牲一定的计算效率。
图3为本发明实施例提供的伪装应用的处理装置实施例一的结构示意图，如图3所示，该装置包括：初级特征信息匹配模块10、筛选模块20、深度特征信息匹配模块30和处理模块40；
所述初级特征信息匹配模块10，设置成获取应用安装包的初级特征信息，将所述初级特征信息与所述预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数；
所述筛选模块20，设置成根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包；
所述深度特征信息匹配模块30，设置成提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息；
所述处理模块40，设置成根据所述深度特征信息的匹配结果处理所述应
用。
本发明实施例提供的一种伪装应用的处理装置，包括初级特征信息匹配模块10、筛选模块20、深度特征信息匹配模块30和处理模块40，通过检测应用安装包获取其初级特征信息和深度特征信息与预定的特征库中的特征信息进行匹配，根据匹配的结果处理所述应用安装包，从而可以及时地发现钓鱼类伪装应用，保护用户的信息和财产安全。
可选地，在上述实施例的基础上，所述初级特征信息匹配模块10获取应用安装包的初级特征信息包括：
所述初级特征信息匹配模块10获取至少一个该应用安装包可以进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，图4为本发明实施例提供的伪装应用的处理装置实施例二的结构示意图，在上述实施例的基础上，如图4所示，所述装置还包括：安装模块50；
所述安装模块50，设置成在所述初级特征信息匹配模块在将所述初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后，当所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功时，安装所述应用。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，在上述实施例的基础上，所述深度特征信息匹配模块30提取筛选出的应用安装包的深度特征信息包括：
所述深度特征信息匹配模块30按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，在上述实施例的基础上，所述深度特征信息匹配模块30将所述深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：
所述深度特征信息匹配模块30将所述摘要文件与预定的第二特征库中的摘要文件进行相似度的计算。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，如图4所示，在上述实施例的基础上，所述处理模块40根据匹配的结果处理所述应用包括：
所述处理模块40当所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度低于预定阀值时，提示风险信息。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，如图4所示，在上述实施例的基础上，所述装置还包括安装模块50；
所述处理模块40根据匹配的结果处理所述应用包括：
所述处理模块40当所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值或者接收到安装的指示时，指示所述安装模块50安装所述应用。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
可选地，在上述实施例的基础上，如图4所示，所述装置还包括：添加模块60。
所述添加模块60，设置成在安装模块50安装所述应用之后，将所安装应用的深度特征信息添加进预定的第二特征库。
本发明实施例提供的装置，可以执行上述方法实施例，其实现原理和技术效果类似，在此不再赘述。
本发明实施例还提供了一种计算机可读存储介质，存储有计算机可执行
指令，所述计算机可执行指令用于执行上述方法。
本发明实施例提供一种伪装应用的处理方法和装置，装置包括初级特征信息匹配模块、筛选模块、深度特征信息匹配模块和处理模块，通过检测伪装应用的安装包获取其初级特征信息和深度特征信息与预定的特征库中的特征信息进行匹配，根据匹配的结果处理所述伪装软件，从而可以及时地发现钓鱼类伪装应用，保护用户的信息和财产安全。
Claims (16)
- 一种伪装应用的处理方法，包括：获取应用安装包的初级特征信息，将所述初级特征信息与预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数；根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包；提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息；根据所述深度特征信息的匹配结果处理所述应用。
- 根据权利要求1所述的方法，其中，所述获取所述应用安装包的初级特征信息包括：获取一个或多个所述应用安装包能够进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
- 根据权利要求2所述的方法，其中，所述将初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后还包括：若所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功，则安装所述应用。
- 根据权利要求1所述的方法，其中，所述提取筛选出的应用安装包的深度特征信息包括：按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
- 根据权利要求4所述的方法，其中，所述将深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：将所述摘要文件与预定的第二特征库中的摘要文件进行相似度的计算。
- 根据权利要求5所述的方法，其中，所述根据匹配的结果处理所述应用包括：若所述深度特征信息的摘要文件与预定特征库中的摘要文件的相似度低于预定阀值，则提示风险信息。
- 根据权利要求5所述的方法，其中，所述根据匹配的结果处理所述应用包括：若所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值或者接收到安装的指示，则安装所述应用。
- 根据权利要求7所述的方法，其中，在安装所述应用之后，还包括：将所安装的应用的深度特征信息添加进所述预定的第二特征库。
- 一种伪装应用的处理装置，包括：初级特征信息匹配模块，设置成获取应用安装包的初级特征信息，将所述初级特征信息与预定的第一特征库中的特征信息进行匹配，所述初级特征信息包括所述应用安装包的基本参数；筛选模块，设置成根据所述初级特征信息的匹配结果筛选出匹配成功的应用安装包；深度特征信息匹配模块，设置成提取筛选出的应用安装包的深度特征信息，将所述深度特征信息与预定的第二特征库中的特征信息进行匹配，所述深度特征信息包括所述应用安装包数据中的特征信息；处理模块，设置成根据所述深度特征信息的匹配结果处理所述应用。
- 根据权利要求9所述的装置，其中，所述初级特征信息匹配模块获取应用安装包的初级特征信息包括：所述初级特征信息匹配模块获取一个或多个所述应用安装包能够进行匹配的基本参数，根据所获取的基本参数建立初级特征信息向量集。
- 根据权利要求10所述的装置，还包括：安装模块，设置成在所述初级特征信息匹配模块在将所述初级特征信息与所述预定的第一特征库中的特征信息进行匹配之后，当所述初级特征信息向量集中的特征信息向量与所述预定的第一特征库中的特征信息均匹配不成功时，安装所述应用。
- 根据权利要求9所述的装置，其中，所述深度特征信息匹配模块提取筛选出的应用安装包的深度特征信息包括：所述深度特征信息匹配模块按照预定的算法类型及相关参数信息对所述应用安装包中的数据进行抽样，生成表征所述应用安装包的深度特征信息的摘要文件。
- 根据权利要求12所述的装置，其中，所述深度特征信息匹配模块将所述深度特征信息与所述预定的第二特征库中的特征信息进行匹配包括：所述深度特征信息匹配模块将所述摘要文件与所述预定的第二特征库中的摘要文件进行相似度的计算。
- 根据权利要求13所述的装置，其中，所述处理模块根据匹配的结果处理所述应用包括：所述处理模块当所述深度特征信息的摘要文件与所述预定的第二特征库中的摘要文件的相似度低于预定阀值时，提示风险信息。
- 根据权利要求13所述的装置，还包括：安装模块；所述处理模块根据匹配的结果处理所述应用包括：所述处理模块当所述深度特征信息的摘要文件与预定的第二特征库中的摘要文件的相似度高于预定阀值时或者接收到安装的指示时，指示所述安装模块安装所述应用。
- 根据权利要求15所述的装置，还包括：添加模块，设置成在安装模块安装所述应用之后，将所安装应用的深度特征信息添加进预定的第二特征库。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510811867.XA CN106778261A (zh) | 2015-11-20 | 2015-11-20 | 伪装应用的处理方法和装置 |
| CN201510811867.X | 2015-11-20 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2016180211A1 true WO2016180211A1 (zh) | 2016-11-17 |
Family
ID=57247750
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2016/079927 WO2016180211A1 (zh) | 2015-11-20 | 2016-04-21 | 一种伪装应用的处理方法和装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN106778261A (zh) |
| WO (1) | WO2016180211A1 (zh) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018196557A1 (en) * | 2017-04-25 | 2018-11-01 | Huawei Technologies Co., Ltd. | Hierarchical pattern matching for deep packet analysis |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110443050B (zh) * | 2019-07-26 | 2021-02-09 | 武汉天喻软件股份有限公司 | 一种文件透明加解密系统中的伪造进程的处理方法和系统 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102222183A (zh) * | 2011-04-28 | 2011-10-19 | 奇智软件（北京）有限公司 | 移动终端软件包安全检测方法及系统 |
| CN102945347A (zh) * | 2012-09-29 | 2013-02-27 | 中兴通讯股份有限公司 | 一种检测Android恶意软件的方法、系统及设备 |
| CN103440455A (zh) * | 2011-04-28 | 2013-12-11 | 北京奇虎科技有限公司 | 一种移动终端软件包安全检测方法及系统 |
| CN104486312A (zh) * | 2014-12-04 | 2015-04-01 | 北京奇虎科技有限公司 | 一种应用程序的识别方法和装置 |
| CN104951675A (zh) * | 2014-03-31 | 2015-09-30 | 北京金山网络科技有限公司 | 一种识别盗版应用的方法及系统 |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103778367A (zh) * | 2013-12-30 | 2014-05-07 | 网秦（北京）科技有限公司 | 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器 |
-
2015
- 2015-11-20 CN CN201510811867.XA patent/CN106778261A/zh not_active Withdrawn
-
2016
- 2016-04-21 WO PCT/CN2016/079927 patent/WO2016180211A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102222183A (zh) * | 2011-04-28 | 2011-10-19 | 奇智软件（北京）有限公司 | 移动终端软件包安全检测方法及系统 |
| CN103440455A (zh) * | 2011-04-28 | 2013-12-11 | 北京奇虎科技有限公司 | 一种移动终端软件包安全检测方法及系统 |
| CN102945347A (zh) * | 2012-09-29 | 2013-02-27 | 中兴通讯股份有限公司 | 一种检测Android恶意软件的方法、系统及设备 |
| CN104951675A (zh) * | 2014-03-31 | 2015-09-30 | 北京金山网络科技有限公司 | 一种识别盗版应用的方法及系统 |
| CN104486312A (zh) * | 2014-12-04 | 2015-04-01 | 北京奇虎科技有限公司 | 一种应用程序的识别方法和装置 |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018196557A1 (en) * | 2017-04-25 | 2018-11-01 | Huawei Technologies Co., Ltd. | Hierarchical pattern matching for deep packet analysis |
| US10397263B2 (en) | 2017-04-25 | 2019-08-27 | Futurewei Technologies, Inc. | Hierarchical pattern matching for deep packet analysis |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106778261A (zh) | 2017-05-31 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10102372B2 (en) | Behavior profiling for malware detection | |
| US10805346B2 (en) | Phishing attack detection | |
| EP3251043B1 (en) | Methods and systems for identifying potential enterprise software threats based on visual and non-visual data | |
| WO2016197710A1 (zh) | 移动终端软件假界面识别方法及装置 | |
| WO2015188788A1 (zh) | 保护移动终端支付安全的方法、装置以及移动终端 | |
| WO2015120752A1 (zh) | 网络威胁处理方法及设备 | |
| US20180253545A1 (en) | File authentication method and apparatus | |
| CN111460445B (zh) | 样本程序恶意程度自动识别方法及装置 | |
| CN106570394B (zh) | 一种检测恶意程序的方法 | |
| US10721248B2 (en) | Methods, systems and apparatus to mitigate steganography-based malware attacks | |
| CN111385270A (zh) | 基于waf的网络攻击检测方法及装置 | |
| EP3905084A1 (en) | Method and device for detecting malware | |
| US20140344931A1 (en) | Systems and methods for extracting cryptographic keys from malware | |
| CN111783092B (zh) | 面向安卓应用程序间通信机制的恶意攻击检测方法及系统 | |
| CN113726818B (zh) | 一种失陷主机检测方法及装置 | |
| US10032022B1 (en) | System and method for self-protecting code | |
| WO2016180211A1 (zh) | 一种伪装应用的处理方法和装置 | |
| CN108234484B (zh) | 用于追溯木马源的计算机可读存储介质和应用该介质的木马源追溯系统 | |
| EP3510557B1 (en) | Image processing system for verification of rendered data | |
| WO2016197827A1 (zh) | 一种恶意捆绑软件的处理方法和装置 | |
| JP6169497B2 (ja) | 接続先情報判定装置、接続先情報判定方法、及びプログラム | |
| CN106919844B (zh) | 一种Android系统应用程序漏洞检测方法 | |
| WO2016095671A1 (zh) | 一种应用程序的消息处理方法和装置 | |
| WO2017028459A1 (zh) | 程序监控方法和装置 | |
| CN106934290B (zh) | 漏洞检测方法及装置 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16792061 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 16792061 Country of ref document: EP Kind code of ref document: A1 |