WO2020048392A1 - 应用程序的病毒检测方法、装置、计算机设备及存储介质 - Google Patents

应用程序的病毒检测方法、装置、计算机设备及存储介质 Download PDF

Info

Publication number
WO2020048392A1
WO2020048392A1 PCT/CN2019/103600 CN2019103600W WO2020048392A1 WO 2020048392 A1 WO2020048392 A1 WO 2020048392A1 CN 2019103600 W CN2019103600 W CN 2019103600W WO 2020048392 A1 WO2020048392 A1 WO 2020048392A1
Authority
WO
WIPO (PCT)
Prior art keywords
function execution
virus
function
target application
image
Prior art date
Application number
PCT/CN2019/103600
Other languages
English (en)
French (fr)
Inventor
雷经纬
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2020048392A1 publication Critical patent/WO2020048392A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/22—Matching criteria, e.g. proximity measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/40—Extraction of image or video features
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • the present application relates to the field of electronic technology, and in particular, to a method, a device, a computer device, and a storage medium for detecting an application program virus.
  • the virus of the application will bring losses and distress to the user. For example, the virus will automatically send text messages in the background to subscribe to the chargeback service, causing economic loss without the user's knowledge. The virus will also maliciously push spam ads. Cause trouble for users.
  • Virus detection is of great significance to the security and convenience of the terminal.
  • the source code of a known virus can be analyzed to determine the signature of the virus, which can be a continuous binary segment in the source code.
  • the source code of the application can be obtained to determine whether the source code of the application contains the signature code of the virus, and if it contains, the application is a virus.
  • the source code of the virus may be modified to obtain a deformed virus. Because the current virus source code has changed and is no longer the same as the original virus source code, the current virus source code may be detected inconsistently with the actual situation, that is, the virus will not be detected, and the hit rate is relatively low. Low, the accuracy of virus detection is poor.
  • the embodiments of the application provide a method, a device, a computer device, and a storage medium for detecting a virus of an application program.
  • An application program virus detection method includes:
  • the target application is marked as a virus.
  • An application program virus detection method includes:
  • the virus detection request carrying the at least one function execution information, the virus detection request being used to instruct the server to detect the target application;
  • a virus alert is performed according to the received virus detection result, and the virus detection result is obtained based on the at least one function execution information.
  • An application program virus detection device includes:
  • An obtaining module configured to obtain at least one function execution information of the target application according to a virus detection instruction on the target application, where the at least one function execution information is used to record the execution of the target application during the running process Features;
  • a generating module configured to determine a target pixel value according to at least one function execution information of the target application program, and generate a function execution image of the target application program according to the target pixel value;
  • An extraction module for extracting image features of the function execution image
  • a determining module configured to mark the target application as a virus when the similarity between the image feature and the virus image feature is greater than a similarity threshold.
  • An application program virus detection device includes:
  • An invoking module for invoking a simulator according to a virus detection instruction for a target application to load the target application into the simulator for operation, wherein the simulator is used to simulate an isolated operating environment;
  • An obtaining module configured to obtain function execution information of the target application during running, and obtain at least one function execution information, where the at least one function execution information is used to record when the target application is running in the simulator; Functions performed;
  • a sending module configured to send a virus detection request to the server, the virus detection request carrying the at least one function execution information, and the virus detection request used to instruct the server to detect the target application program;
  • a prompting module is configured to perform virus prompting according to the received virus detection result, where the virus detection result is obtained based on the at least one function execution information.
  • a computer device includes a memory and a processor.
  • the memory stores computer-readable instructions.
  • the processor causes the processor to execute the virus detection method of the application program. step.
  • One or more non-volatile storage media storing computer-readable instructions that, when executed by one or more processors, cause one or more processors to execute the virus detection method of the above application program step.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of another implementation environment provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of another implementation environment provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of an application program virus detection method according to an embodiment of the present application.
  • FIG. 5A is a schematic diagram of a function execution image provided by an embodiment of the present application.
  • 5B is a schematic diagram of a pixel value matrix according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of determining similarity provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a virus detection system according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a detection process control submodule according to an embodiment of the present application.
  • FIG. 9 is a schematic flow chart of a behavior fingerprint extraction sub-module provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of a method for virus detection of an application program according to an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of a virus database generation submodule process provided by an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of a similarity metric submodule according to an embodiment of the present application.
  • FIG. 13 is a flowchart of an application program virus detection method according to an embodiment of the present application.
  • FIG. 15 is a schematic diagram of an application program virus detection device according to an embodiment of the present application.
  • FIG. 16 is a schematic diagram of an application program virus detection device according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a server according to an embodiment of the present application.
  • FIG. 18 is a structural block diagram of a terminal provided by an embodiment of the present application.
  • the function performed by an application can be used to uniquely represent the function.
  • This application has the same function as the one-to-one correspondence between functions and applications and the one-to-one correspondence between fingerprints and people. Therefore, the application can be applied to the application through the characteristics of the functions performed by the application.
  • Programs are distinguished, that is, the characteristics of the functions performed by the application can function as the fingerprint of the application. For a visual understanding, these characteristics can be referred to as the behavioral fingerprint of the application. For viruses, even if the source code of the virus changes, the functions performed by the virus will generally not change.
  • a charge-reducing virus may still perform the function of automatically sending text messages. Therefore, if the application is a virus, its function execution information matches the function execution characteristics of the corresponding virus type. Based on such thinking, the embodiments of the present application can record the function execution of the application and perform virus detection on the application based on the recorded function execution, thereby improving the accuracy of the virus detection and avoiding viruses. Subtle changes in itself, resulting in missed or incorrect detection.
  • function execution information of an application program is involved.
  • the function execution information of the application program is information that records functions performed by the application program when it is running, and can be used to indicate the function execution status of the application program, for example, , What kind of function an application performed at what time.
  • FIG. 1 is an implementation environment diagram of a virus detection method for an application program provided by an embodiment of the present application.
  • An implementation environment of the virus detection method of the application program may include at least one user equipment 101 and a server 102 for providing services to the at least one user equipment 101.
  • the at least one user equipment 101 is connected to the server 102 through a wireless or wired network, and the at least one user equipment 101 may be a computer device or a smart terminal capable of accessing the server 102.
  • An application client for virus detection may be installed on the user equipment 101, so that the application client can interact with the server 102 to obtain the virus detection service provided by the server 102.
  • the application client may be an application management client, which may not only provide a virus detection service, but also provide at least one of services such as application information, application download, and application update.
  • the server 102 may maintain at least one virus database, and the server 102 may be a background server of the application client.
  • the server 102 may also provide at least one of services such as application information, application download, or application update to the user equipment through an application client.
  • the server 102 may also provide a publishing interface, so that user equipment can publish applications through the publishing interface.
  • the server can provide virus detection services for any user equipment, that is, the user equipment can initiate a virus detection request to the server, and when the server receives the virus detection request sent by the user equipment Can trigger the virus detection process.
  • the virus detection request may carry the identifier of the target application to be detected, so that the server performs virus detection on the target application that is already stored on the server.
  • the virus detection request may also carry the target application, so as to transfer the target application.
  • the server may also periodically perform virus detection on an application program stored on the server, or trigger a virus detection process when a newly released application program is received from any user device.
  • the virus detection process is not limited.
  • the server may obtain function execution information of the target application.
  • an emulator may be installed in the server to simulate the operating environment of the user device.
  • the process of obtaining function execution information by the server includes: the server calls the simulator, loads the target application into the simulator, records the function execution information of the target application during the running process, and obtains the recorded at least one function execution information.
  • the emulator can be an emulator for the Android system, and can run an Android application.
  • the above simulator can also be an IOS simulator or a Windows simulator, and can run corresponding applications, which is not limited here.
  • the function execution information may include a function identifier of the executed function, and may also include a function execution time.
  • the server runs the target application in the simulator, the server can record each time the target application executes a function in the simulator.
  • the function identification and function execution time of the function are stored as a function execution information.
  • the function identifier can be used to indicate the type of function, and the function identifier can adopt a digital identifier to define as much as possible the type of function that a virus may perform.
  • the function IDs corresponding to various functions can be defined in advance, and the range of the function ID can be [0,255]. Based on the value range, the function ID 01 is defined as sending a short message, 02 as a call, and 03 as a voice recorder. , 04 is a pop-up window, 05 is a camera call, etc.
  • the function execution time can be the trigger time of the function.
  • the recorded at least one function execution information can be sorted from morning to night according to the function execution time, so the order of the function execution information can represent the function execution order. For example, when the target application sends a short message, the function ID 01 and function execution time 10:30 of the short message are recorded as function execution information; when the camera is called, the function identifier 05 and function execution time of the camera are recorded 10:33 and other information; when calling the recorder, record the function identifier 03 and function execution time 10:49 of the caller ... After the target application runs for a period of time, you can get the following function execution information:
  • the above content introduces the recording method and content of the function execution information, and the server can have multiple ways to obtain the function execution information, which are described below:
  • the server records function execution information of the target application within a first preset time period.
  • the server can run the target application in the simulator. Whenever the target application executes a function in the simulator, the server can record the function ID and function execution time of the function, and store it as a function execution information. After a preset period of time, the operation is stopped, and at least one recorded function execution information is stored. For example, the server can run the target application for 15 minutes and obtain the function execution information within the 15 minutes. Performing a virus detection based on a function performed by a target application within a preset time period can ensure that the obtained function execution information of the virus can include all the functions of the target application, thereby improving the accuracy of virus detection.
  • the above method provides a recording method in which the running time is the same as the preset time.
  • the running time may be longer than the preset time. That is, the server runs the target application in the simulator. When the target application executes a function in the simulator, the server can record the function ID and function execution time of the function, store it as a function execution information, stop running after a second preset time period, and record at least one function The execution information is stored, and the function execution information within the first preset time period is extracted from the stored function execution information.
  • the starting point of the first preset duration is not limited, and the starting point may be a running starting point or a time point after the running starting point.
  • the starting point can be a point in time at which the initialization of the target application is guaranteed to be completed, and the like.
  • the server can run the target application for 20 minutes.
  • it can obtain the function execution information within 15 minutes, which can be the function execution information for the first 15 minutes or the next 15 minutes, or any intermediate 15 minutes.
  • the function execution information is not limited in the embodiment of the present application.
  • the server obtains the function execution information recorded by the target application during multiple executions of the target application, and the target operation is the operation with the largest number of recorded function execution information.
  • the server can run the target application multiple times and count the number of function execution information in each running process to get the number of function execution information in each running process, so as to determine the target running process, that is, the function execution information The largest number of running processes, and the subsequent virus detection process based on the function execution information recorded during the target running process. In this optional manner, it is possible to ensure that the obtained function execution information of the application program can more accurately reflect the actual function of the application program and improve the accuracy of virus detection.
  • the server can obtain the function execution information recorded in the first preset time period during each operation of the multiple operation processes, and then based on each operation process.
  • the function execution information recorded in the target operation process is used for the subsequent virus detection process.
  • the implementation environment includes: at least one user equipment 201 With server 202.
  • the functions provided by the user equipment 201 are the same as the functions provided by the user equipment 101.
  • the user equipment 201 may further have a function of running a target application program to record function execution information of the target application program.
  • the user equipment 201 may send the function execution information of the target application to the server 202, and the server 202 performs virus detection based on the function execution information of the target application.
  • the virus detection method of the application program may be implemented by a server.
  • the process for the server to obtain the function execution information includes: the server receives at least one function execution information during the operation of the target application on another device.
  • the process specifically includes: the user equipment runs the target application, records at least one function execution information of the target application during the running process, and sends a virus detection request to the server, and the virus detection request carries the virus detection request.
  • the server receives the virus detection request, and extracts at least one function execution information of the target application from the virus detection request.
  • the process of obtaining at least one function execution information of the target application on the user equipment is the same as the process obtained by the server. Further, when the server obtains the virus detection result through detection, the virus detection result may be sent to the user equipment.
  • the user equipment may perform a virus alert based on the virus detection result. For example, when the virus detection result indicates the application When the program is a virus, it prompts that the application is a virus, and when the virus detection result indicates that the application is not a virus, it indicates that the application is not a virus. Of course, when the virus detection result indicates that the application is suspicious, it also You can be alerted that the application is at risk and is not recommended to run.
  • the server is used to implement the virus detection method and the virus detection result is taken as an example for description.
  • the above virus detection method may also be implemented by a virus detection application installed on a user device.
  • the virus The detection application can be configured with a local virus database. With the local virus database, offline virus detection can be performed on the application installed on the user device.
  • the embodiment of the present application further provides an implementation environment. Referring to FIG. 3, FIG. 3 provides an implementation environment of the embodiment of the present application.
  • the implementation environment may include at least one user equipment 301 and a server 302.
  • a virus detection application program may be installed on the user equipment 301, and at least one virus database for virus detection is also stored.
  • the function execution information during the running process can be recorded and stored for subsequent virus detection.
  • the user may not perform the above-mentioned recording and storage at any time, but when the user equipment 301 triggers a virus detection on the target application, the function execution information of the target application during the running process is recorded and recorded. Storage, which can further detect whether the target application is a virus based on the execution information of the function.
  • the user equipment may perform a virus alert based on a virus detection result.
  • the virus prompting method may be the same as the method provided in the foregoing embodiment.
  • the virus detection method of the application program may be implemented by a virus detection application program on a user device.
  • the processing of the virus detection application to obtain the function execution information may be as follows: The virus detection application obtains at least one function execution information of the target application stored locally.
  • FIG. 4 is the virus detection of the application of this application.
  • Method flowchart, the processing flow of the method may include the following steps:
  • the user equipment sends a target application to the server.
  • the server After receiving the target application, the server obtains at least one function execution information of the target application in the running process.
  • step 401 For the step of the server obtaining function execution information in step 401, refer to the obtaining process in the foregoing embodiment.
  • the server is only used to perform virus detection after the user device publishes the target application on the server as an example.
  • the user device may also only send a virus detection request.
  • the virus The detection request carries the target application or the identity of the target application to instruct the server to perform a virus detection.
  • the server may also initiate a virus detection on any application by itself, which is not limited in the embodiment of the present application.
  • the server constructs a function execution sequence based on the function execution time in the at least one function execution information and based on the function identification in the at least one function execution information.
  • the function execution sequence may consist of a function identifier.
  • each function execution information generated during the running process of the target application to be detected obtained by the server in step 401 includes information such as a function identifier and a function execution time.
  • the server may determine the arrangement order of the function identifiers according to the function execution time in the function execution information, and then may form the function execution sequences according to the arrangement order.
  • the server may arrange the function identifiers in order of time.
  • the specific processing of step 402 may be as follows: determine the function execution of the at least one function execution information based on the function execution time in the at least one function execution information. Sequence: Sort the function identifiers in at least one function execution information according to the function execution order to obtain a function execution sequence.
  • the server arranges the function execution information according to the chronological order, the order of the function execution information is the function execution order, and the server can compose the function identification into the corresponding function execution sequence according to the function execution order.
  • the server may compose the function identification into a corresponding function execution sequence according to the function execution order. For example, when the recorded function execution information is (01, 10:30; 05, 10:33; 03, 10:49; ...), the function identifiers are arranged according to the function execution information, and a decimal sequence (1,5 , 3 ...), the decimal sequence may be a corresponding function execution sequence.
  • the server when constructing the function execution sequence, can obtain the function execution time of each two adjacent function execution information, calculate the time interval between each two adjacent function identifiers, and then the server can follow the function execution order.
  • the function identifiers are arranged, and corresponding time interval identifiers can be added between two adjacent function identifiers to obtain the corresponding function execution sequence.
  • the function execution sequence can be (1,0,0,5,0,3, ...), where "0" is the time interval identifier.
  • processing may be performed based on any of the methods of constructing function execution sequences described above.
  • the function execution sequence may be constructed based on at least one of a function execution order, a preset order corresponding to the function identification, or a number of function execution times, based on the function identification in the at least one function execution information.
  • Function execution order can be determined according to function execution time.
  • the preset order corresponding to the function ID is set in advance, and the function execution sequence is formed according to the preset order corresponding to the function ID, which can improve the accuracy of virus detection on the target application program with diversified behavior order. For example, when the manufacturer of a virus program changes the execution order of some functions of the program in order to detect the virus, the virus program can also be detected.
  • the order of the function identifiers corresponding to the phone call can be set to 1
  • the order of the function identifiers corresponding to the text message function can be set to 2
  • the order of the function identifiers corresponding to the popup window can be set to 4.
  • the order of the function identifiers in the function execution sequence may be sorted according to one or more rules in the function execution order, the preset order corresponding to the function identifiers, or the number of function execution times.
  • the function execution order, the preset order corresponding to the function ID, and the priority level of the number of function execution times can be obtained according to the rules Sorted by priority. For example, first sort according to the rule with the highest priority, and when sorting according to the highest priority cannot distinguish between the order of some functional identifiers, then sort the function identifiers that cannot be sorted according to the rule with the second highest priority. .
  • multiple identical function execution identifiers may exist in the function execution sequence, or one of them may be reserved. For example, delete the function IDs in the same function ID after the function execution order.
  • the function execution sequence is (2, 4, 1, 2) or (2, 4, 1).
  • the function execution sequence is (1, 2, 4) or (1, 2, 2, 4).
  • the function execution sequence is (2, 1, 4) or ( 2, 2, 1, 4).
  • the server converts the function identifier in the function execution sequence into pixels, and generates a function execution image of the target application.
  • the correspondence between the function execution information and the pixel value is set in advance, so the target pixel value can be determined based on the function execution information, and a function execution image of the target application can be generated based on the target pixel value.
  • a function identifier may be converted into a target pixel value corresponding to a pixel, and a function execution image of a target application may be generated according to the target pixel value.
  • the server After the server obtains the decimal function execution sequence in step 402, it can convert it into a hexadecimal function execution sequence, that is, (01,05,03 ...) is obtained. Then, the server can convert the value of each function identifier into a pixel value, and each function identifier serves as a pixel to form a function execution image.
  • the range of the pixel value can be [0,255]. For example, the gray value corresponding to the function ID 01 can be set to 01, the gray value corresponding to the function ID 05 can be set to 05, and the gray value corresponding to the function ID 255 can be set to 255. .
  • converting the function identifier into a target pixel value corresponding to the pixel point, and generating the function execution image of the target application program according to the target pixel value corresponding to the pixel point includes: converting the function identifier in the function execution sequence into The target pixel value corresponding to the pixel point is used to generate a function execution image of the target application program according to the target pixel value corresponding to the pixel point.
  • the position of each pixel point is determined according to the order of the corresponding function identifier in the function sequence.
  • each function ID in the hexadecimal function execution sequence can be converted into a pixel value, that is, the function execution sequence is converted into the corresponding function execution image. .
  • the position of each pixel is determined according to the order of the corresponding function identifier in the function sequence.
  • the corresponding pixels can be arranged in order according to the order of the function identifiers in the function sequence.
  • the function execution image may be a 1 * n function execution image.
  • the function execution sequence can also be divided into multiple sequence fragments, and then spliced into a matrix form with multiple rows and columns, and then converted into a function execution image based on the above method, that is, the function execution image includes pixels of multiple rows and columns.
  • each function identifier of a function execution sequence can be correspondingly converted to a gray value within [0,255], so the obtained function execution image can be a gray image, which is shown in FIG. 5A
  • a schematic diagram of a function execution image; or each function identifier of a function execution sequence may also generate pixel values of three channels of RGB through a conversion algorithm. At this time, the function execution image composed of three channels of RGB may be a color image.
  • image size information may be obtained, and the image size information includes the number of pixel rows and the number of pixel columns; according to the image size information, the target pixel values corresponding to the pixels are arranged to generate corresponding pixel values. Matrix to obtain a function execution image of the target application.
  • the function execution image may include pixels in multiple rows and columns, for example, 22 rows * 22 columns.
  • the image size information may be set in advance. When arranging pixel values, you can sort them by rows, for example, starting from the first row and sorting in order of rows. You can also sort in column order, for example, starting from the first column and sorting in order. Therefore, according to the image size information, the target pixel values corresponding to the pixels are arranged, and a pixel value matrix corresponding to the number of rows and columns can be generated, so that the function execution image of the target application can be obtained.
  • a preset value such as 0, may be assigned to the pixels without the corresponding function execution identifier.
  • the function execution sequence corresponds to 12 function identifiers, that is, the target program performs 12 functions, and the corresponding pixel values are 01, 12, 35, 46, 13, 15, 88, 16, 156, 22 , 24, 25.
  • the generated pixel value matrix can be as shown in FIG. 5B, and the last row is supplemented with 0.
  • the pixel value of each pixel of the function execution image generated by the server can be used to indicate the type of function, and the order of the pixels can be the multiple function executions described above.
  • the order of execution of the information function two adjacent pixels can be used to indicate two functions that are executed consecutively.
  • the pixel point of the function execution image can be (01,05,03 ).
  • the pixel value of the function execution image generated by the server can indicate the type of the function, and can also represent a time interval unit.
  • the pixel value 00 in the above form 2 can represent a time interval unit.
  • it can represent the trigger time interval of function 01 and function 05.
  • the time interval between 05 and 03 is 1 time interval unit.
  • the server may generate a function execution image of the target application according to multiple function execution information of the target application, and steps 402-403 may be one possible implementation.
  • the server may also use other methods to generate the function execution image of the target application according to at least one function execution information of the target application.
  • the following describes a method for generating a function execution image.
  • a specific process of constructing a function execution sequence may be as follows: arrange at least one function execution information based on a preset function execution information arrangement rule, and arrange at least one The function identifiers in the function execution information constitute a function execution sequence in the order of the obtained function execution information.
  • the preset function execution information arrangement rule may be in the order of the number of execution times from large to small.
  • the server may count the number of each function identifier in the obtained at least one function execution information, and sort the function identifiers in descending order. The greater the number of function IDs, the more times the target application performs the function. Then, the server can construct the function execution sequence according to the order of the function IDs and the number of the function IDs. For example, if Function 01 is executed 3 times, Function 03 is executed 1 time, Function 05 is executed 2 times, then the function execution sequence is (1,1,1,5,5,3).
  • the function execution information arrangement rule can be set according to actual requirements, which is not limited in the embodiment of the present application.
  • the server extracts image features of the function execution image of the target application.
  • the server may call the image feature extraction model to extract the image features of the function execution image generated in the above process.
  • the image feature extraction model may be an image feature extraction model based on the SIFT (Scale-invariant Feature Transformation) algorithm, or an image feature extraction model based on a machine learning algorithm, which is not limited here.
  • the extracted image features may be feature vectors or feature matrices, and the image features may include at least one feature vector or at least one feature matrix.
  • the image feature extraction model based on SIFT algorithm is taken as an example to introduce the extracted image features:
  • the server invokes the image feature extraction model based on the SIFT algorithm and performs feature extraction on the function execution image to obtain at least one SIFT feature vector.
  • One SIFT feature vector can be composed of 64 floating-point numbers. The dimensions of the SIFT feature vector are not limited here. The number of SIFT feature vectors corresponding to the function execution images of different applications may be different.
  • a set of SIFT feature vectors can be extracted from a function execution image.
  • the set of SIFT feature vectors can include 5 SIFT feature vectors, which are recorded as samples X: [0.1234,0.154...], [0.134,0.5154... ], ..., [0.1254,0.4521 ...].
  • the server After the server obtains the image features corresponding to the target application, it can calculate the similarity between the image features and the virus image features. Prior to this, virus image features need to be extracted, which will be described below:
  • the server may obtain at least one virus sample of a known virus type, run each virus sample in the simulator, execute the processing of steps 201-204, and extract virus image features based on the same method as the target application to be detected.
  • the final server can output and obtain at least one set of SIFT feature vectors corresponding to a virus sample.
  • the server when the server outputs a group of SIFT feature vectors, the corresponding virus type identifier may be added to the group of SIFT feature vectors in the format of "virus type: SIFT feature vector group", for example, a scam class: [0.1234, 0.154 ...], [0.134, 0.5154 ...], ..., [0.1254, 0.4521 ...].
  • the server may store the determined virus image characteristics of the at least one virus type in a virus database.
  • the virus image feature may be determined based on the above method, and the virus database may be updated.
  • the server After obtaining the image features, the server obtains the similarity between the image features and the virus image features of the virus type. For example, step 405 may be entered to traverse the virus image features of multiple virus types. Of course, part of the virus types can also be obtained by filtering according to the target application, and as the candidate virus types, the similarity between the image features and the virus image features of the candidate virus types is calculated. For example, if the target application program has determined that it is not rogue software according to manual troubleshooting or other methods, the similarity calculation may not be performed on the virus image features corresponding to the rogue software.
  • the server traverses the virus image features of multiple virus types, and each time it traverses the virus image features of one virus type to obtain the similarity between the image features and the virus image features of the virus type.
  • the image feature or virus image feature of a virus type in the virus database may include at least one feature vector or feature matrix.
  • the server can traverse all virus types in the virus database to determine the similarity between the virus image features and image features of each virus type. For example, for a case where the image feature is a feature matrix, the rank of the image feature and the rank of the virus image feature may be determined separately. Furthermore, the ratio of the rank of the image feature and the rank of the virus image feature may be determined, and the ratio may be determined as the similarity.
  • step 405 uses feature vectors as an example for description.
  • the specific processing of the above step 405 may be as follows: Determine the vector distance between each target feature vector of the image feature and each feature vector of the virus image feature of the virus type. The number is determined as the similarity between the image features and the virus image features of the virus type.
  • the server can traverse the feature vector of each virus type stored in the virus database and determine the vector distance respectively.
  • the server compares all target feature vectors of the target application with the feature vectors of all virus types stored in the virus database, which can ensure the comprehensiveness of virus detection.
  • the server may calculate the distance between the image feature and the virus image feature based on the distance algorithm.
  • the distance algorithm may be Euclidean distance algorithm or Manhattan distance algorithm.
  • a SIFT feature vector of the image feature be (x 1 , x 2 , ..., x 64 ), and a SIFT feature vector of the virus image feature. Is (y 1 , y 2 , ..., y 64 ), the vector distance d can be calculated based on the following formula (1):
  • the range of the calculated vector distance may be between [0,1], and the distance threshold may be set to 0.2.
  • the vector distance is less than 0.2, the two SIFT feature vectors can be considered similar.
  • the reciprocal of the vector distance can be used as the similarity
  • the reciprocal of the vector threshold can be used as the similarity threshold.
  • the similarity is greater than the similarity threshold.
  • image features can include multiple feature vectors
  • the server may also calculate the similarity between the image features and the virus image features based on the similarity algorithm.
  • the similarity algorithm may be a cosine similarity algorithm or a Jeckard similarity coefficient.
  • the embodiment of the present application does not limit the specific algorithm for determining the similarity.
  • the distance between the image feature and the virus image feature may be calculated in pairs, or when the image feature When the distance between a vector and a vector of image features is less than the distance threshold, the virus image feature vector is no longer calculated from other vectors of image features. For example, suppose there are three vectors corresponding to the target application to be detected: a, b, and c, and three vectors for fraud: d, e, and f. If a and d are found to be similar during the calculation, that is, when the distance is less than the distance threshold, then d will need to be excluded when calculating the vector of b and the virus type. If the similarity vector found for b is f, then d and f need to be excluded when calculating the vector distance between c and the virus type, and the vector distance between c and e is calculated.
  • the server marks the target application as a virus.
  • the server can determine whether the similarity determined in step 405 is greater than the similarity threshold. If any similarity is greater than the similarity threshold, the server can determine that the target application is a virus, and can then mark the target application. If there is no similarity greater than the similarity threshold, the target application cannot be determined as a virus, and the server can temporarily determine that the target application is safe. If the target application that is determined to be safe is indeed a virus, in the subsequent use process, the target application may be detected by other virus detection methods, or the virus image characteristics corresponding to the target application are added to the virus database. , It is detected by the virus detection method provided in the embodiment of the present application during the re-detection.
  • the server may obtain a maximum similarity value and determine whether the maximum similarity value is greater than a similarity threshold. If the maximum similarity is greater than the similarity threshold, it indicates that the target application is a virus; if the maximum similarity is not greater than the similarity threshold, it indicates that the remaining similarity is not greater than the similarity threshold, and the target application can be temporarily determined It is safe, can avoid comparing each similarity with the similarity threshold, and improves the processing efficiency.
  • the virus type of the virus image feature corresponding to the maximum similarity value may also be determined as the target virus type of the target application to improve the accuracy of virus detection in order to take accurate Countermeasures to improve security.
  • the similarity threshold may be set to 3.
  • the server provides a virus detection service for the application market, when determining that the target application is a virus, the target application can be rejected from being delivered to the application market, or the target application can be removed from the application market. If the server provides a virus detection service for other devices, the virus detection results may be sent to the device so that the user can determine whether to continue using the target application or uninstall.
  • the virus detection system may be composed of four sub-modules: a detection process control sub-module, a behavior fingerprint extraction sub-module, a virus database generation sub-module, and a similarity measurement sub-module.
  • the detection process control sub-module can call the remaining three sub-modules, which can be used to implement the entire virus detection process; the behavior fingerprint extraction sub-module can be used to extract image features, and the image features of the function execution image are behavior fingerprints; virus database generation The sub-module can call the behavior fingerprint extraction sub-module, and the generated virus database can store at least one virus type of virus image features; the similarity measurement sub-module can be used to determine the similarity between the image features corresponding to the target application and the virus image features degree.
  • the process flow diagram of the detection process control sub-module is shown in Figure 8.
  • the process flow diagram of the behavior fingerprint extraction sub-module is shown in Figure 9.
  • the method of the application virus detection method is shown in Figure 10.
  • the virus database generation sub-module processing flow is shown in Figure 10.
  • a schematic diagram is shown in FIG. 11, and a processing flow diagram of the similarity measurement sub-module is shown in FIG. 12.
  • the process of the above step 401 may be implemented by calling a behavior fingerprint extraction submodule by the detection process control submodule, the processes of steps 402-404 may be implemented by the behavior fingerprint extraction submodule, and the processing of generating virus image features in the above step 404 may be performed by a virus database.
  • the generation submodule is implemented by calling a behavior fingerprint extraction submodule.
  • the process of step 405 may be implemented by a detection process control submodule calling a similarity measurement submodule, and the process of step 406 may be implemented by a detection process control submodule.
  • the server performs the operation based on the function execution information of the application program.
  • Virus detection can detect the deformed virus, has strong generalization ability.
  • the feature reliability based on image extraction is high.
  • the function execution information of the application is used to generate the function execution image, and the image features corresponding to the application to be detected are compared with the virus image features, which can improve the virus detection. accuracy.
  • the following introduces the virus detection process of an application. As shown in FIG. 13, an example is performed based on the interaction between the server and user equipment in the implementation environment shown in FIG. 2 as an example.
  • Flow chart of a virus detection method for applying for an application. The processing flow of the method may include the following steps:
  • the user equipment acquires at least one function execution information of the target application during the running process according to the virus detection instruction.
  • the user equipment sends a virus detection request to the server, and the virus detection request carries at least one function execution information of the target application in the running process.
  • the server After receiving the virus detection request, the server constructs a function execution sequence based on the function execution time in the at least one function execution information and based on the function identification in the at least one function execution information.
  • the server converts the function identification in the function execution sequence into pixels, and generates a function execution image of the target application.
  • the server extracts image features of the function execution image of the target application.
  • the server traverses the virus image features of multiple virus types, and each time it traverses the virus image features of one virus type to obtain the similarity between the image features and the virus image features of the virus type.
  • the server marks the target application as a virus.
  • the server sends a virus detection result to the user equipment.
  • the user equipment After receiving the virus detection result, the user equipment performs a virus prompt.
  • the server performs Virus detection, can detect the deformed virus, has strong generalization ability.
  • the feature reliability based on image extraction is high.
  • the function execution information of the application is used to generate the function execution image, and the image features corresponding to the application to be detected are compared with the virus image features, which can improve the virus detection. accuracy.
  • the user equipment sends the function execution information obtained during the running process to the server for detection, which can reduce the processing pressure of the server.
  • the following introduces the virus detection process of an application. As shown in FIG. 14, an example is performed based on the interaction between the server and user equipment in the implementation environment shown in FIG. 2 as an example.
  • Flow chart of a virus detection method for applying for an application. The processing flow of the method may include the following steps:
  • the user equipment obtains at least one function execution information of the target application during the running process according to the virus detection instruction.
  • the user equipment constructs a function execution sequence based on the function execution time in the at least one function execution information and based on the function identification in the at least one function execution information.
  • the user equipment converts a function identifier in a function execution sequence into pixels, and generates a function execution image of the target application.
  • the user equipment extracts image features of a function execution image of the target application.
  • the user equipment traverses the virus image features of multiple virus types, and each time it traverses the virus image features of one virus type to obtain the similarity between the image features and the virus image features of the virus type.
  • the user equipment marks the target application as a virus.
  • the user equipment performs a virus prompt according to a virus detection result.
  • the server performs the operation based on the function execution information of the application program.
  • Virus detection can detect the deformed virus, has strong generalization ability.
  • the feature reliability based on image extraction is high.
  • the function execution information of the application is used to generate the function execution image, and the image features corresponding to the application to be detected are compared with the virus image features, which can improve the virus detection. accuracy. Further, the above-mentioned virus detection based on the local virus database by the user equipment can ensure that the virus detection can also be completed in an offline scenario.
  • steps in the embodiments of the present application are not necessarily performed sequentially in the order indicated by the step numbers. Unless explicitly stated in this document, the execution of these steps is not strictly limited, and these steps can be performed in other orders. Moreover, at least a part of the steps in each embodiment may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily performed at the same time, but may be performed at different times. The execution of these sub-steps or stages The sequence is not necessarily performed sequentially, but may be performed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.
  • an embodiment of the present application further provides an application virus detection device, and the device may be the foregoing server.
  • the device includes:
  • An obtaining module 1510 is configured to obtain at least one function execution information of the target application according to a virus detection instruction on the target application, where the at least one function execution information is used to record execution of the target application during execution. Functions.
  • a generating module 1520 is configured to generate a function execution image of the target application according to at least one function execution information of the target application.
  • An extraction module 1530 is configured to extract image features of the function execution image.
  • a determining module 1540 is configured to mark the target application as a virus when the similarity between the image feature and the virus image feature is greater than a similarity threshold.
  • the obtaining module 1510 is configured to:
  • the at least one function execution information includes:
  • At least one function execution information recorded by the target application during the running of the first preset duration At least one function execution information recorded by the target application during the running of the first preset duration; or,
  • At least one function execution information recorded by the target application program during a target operation process of a plurality of operation processes is an operation process with the largest amount of information recorded in the plurality of operation processes.
  • each function execution information includes a function identifier and a function execution time
  • the generating module 1520 is configured to:
  • the function identification in the function execution sequence is converted into pixels to generate a function execution image of the target application.
  • the generating module 1520 is configured to:
  • the generating module 1520 is configured to:
  • the at least one function execution information is arranged, and the function identifiers in the arranged at least one function execution information are arranged in a function execution sequence according to an order of the obtained function execution information.
  • the determining module 1540 is configured to:
  • the target application is marked as a virus.
  • the image features include multiple target feature vectors, and the virus image features include multiple feature vectors;
  • the determining module 1540 is configured to:
  • the determining module 1540 is further configured to:
  • a virus type of a virus image feature corresponding to the maximum similarity value is determined as a target virus type of the target application.
  • the server performs the operation based on the function execution information of the application program.
  • Virus detection can detect the deformed virus, has strong generalization ability.
  • the feature reliability based on image extraction is high.
  • the function execution information of the application is used to generate the function execution image, and the image features corresponding to the application to be detected are compared with the virus image features, which can improve the virus detection. accuracy.
  • the virus detection device of the application program provided in the foregoing embodiment detects a virus
  • only the division of the foregoing functional modules is used as an example.
  • the functions described above may be allocated by different functional modules as required.
  • the internal structure of the server is divided into different functional modules to complete all or part of the functions described above.
  • the application virus detection device provided by the foregoing embodiment belongs to the same concept as the application virus detection method embodiment, and its specific implementation process is described in detail in the method embodiment.
  • an embodiment of the present application further provides a virus detection device for an application, and the device may be the foregoing user equipment.
  • the device includes:
  • a calling module 1610 is configured to call a simulator according to a virus detection instruction of a target application, and load the target application into the simulator for operation, wherein the simulator is used to simulate an isolated operating environment.
  • An obtaining module 1620 is configured to obtain function execution information of the target application during running, and obtain at least one function execution information, where the at least one function execution information is used to record that the target application is run in the simulator. Functions performed at the time.
  • the sending module 1630 is configured to send a virus detection request to the server, where the virus detection request carries the at least one function execution information, and the virus detection request is used to instruct the server to detect the target application.
  • a prompt module 1640 is configured to perform a virus prompt according to the received virus detection result, where the virus detection result is obtained based on the at least one function execution information.
  • the obtaining module 1620 is used for:
  • the virus detection device of the application program provided in the foregoing embodiment detects a virus
  • only the division of the foregoing functional modules is used as an example.
  • the functions described above may be allocated by different functional modules as required.
  • the internal structure of the server is divided into different functional modules to complete all or part of the functions described above.
  • the application virus detection device provided by the foregoing embodiment belongs to the same concept as the application virus detection method embodiment, and its specific implementation process is described in detail in the method embodiment.
  • FIG. 17 is a schematic structural diagram of a server according to an embodiment of the present application.
  • the server 1700 may have a large difference due to different configurations or performance, and may include one or more processors (central processing units) (CPUs) 1701 and one Or more than one memory 1702, where at least one instruction is stored in the memory 1702, and the at least one instruction is loaded and executed by the processor 1701 to implement the virus detection method steps of the above application program, for example, the following steps may be performed :
  • the target application is marked as a virus.
  • the server performs the operation based on the function execution information of the application program.
  • Virus detection can detect the deformed virus, has strong generalization ability.
  • the feature reliability based on image extraction is high.
  • the function execution information of the application is used to generate the function execution image, and the image features corresponding to the application to be detected are compared with the virus image features, which can improve the virus detection. accuracy.
  • FIG. 18 is a structural block diagram of a terminal provided by an embodiment of the present application.
  • the terminal 1800 can be: smartphone, tablet, MP3 player (Moving Picture Experts Group Audio Layer III, moving image expert compression standard audio level 3), MP4 (Moving Picture Expert Experts Group Audio Audio Layer IV, moving image expert compression standard audio Level 4) Player, laptop or desktop computer.
  • the terminal 1800 may also be called other names such as user equipment, portable terminal, laptop terminal, desktop terminal, and the like.
  • the terminal 1800 includes a processor 1801 and a memory 1802.
  • the processor 1801 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like.
  • the processor 1801 may use at least one hardware form among DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array, Field Programmable Gate Array), and PLA (Programmable Logic Array). achieve.
  • the processor 1801 may also include a main processor and a co-processor.
  • the main processor is a processor for processing data in the awake state, also referred to as a CPU (Central Processing Unit).
  • the co-processor is Low-power processor for processing data in standby.
  • the processor 1801 may be integrated with a GPU (Graphics Processing Unit, image processor), and the GPU is responsible for rendering and drawing content required to be displayed on the display screen.
  • the processor 1801 may further include an AI (Artificial Intelligence) processor, and the AI processor is configured to process computing operations related to machine learning.
  • AI Artificial Intelligence
  • the memory 1802 may include one or more computer-readable storage media, which may be non-transitory.
  • the memory 1802 may further include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash storage devices.
  • the non-transitory computer-readable storage medium in the memory 1802 is used to store at least one instruction, and the at least one instruction is executed by the processor 1801 to implement the application program provided by the method embodiment in this application. Virus detection method.
  • the terminal 1800 may further include: a peripheral device interface 1803 and at least one peripheral device.
  • the processor 1801, the memory 1802, and the peripheral device interface 1803 may be connected through a bus or a signal line.
  • Each peripheral device can be connected to the peripheral device interface 1803 through a bus, a signal line, or a circuit board.
  • the peripheral device includes at least one of a radio frequency circuit 1804, a touch display 1805, a camera 1806, an audio circuit 1807, a positioning component 1808, and a power supply 1809.
  • the peripheral device interface 1803 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 1801 and the memory 1802.
  • the processor 1801, the memory 1802, and the peripheral device interface 1803 are integrated on the same chip or circuit board; in some other embodiments, any one of the processor 1801, the memory 1802, and the peripheral device interface 1803 or Two can be implemented on separate chips or circuit boards, which is not limited in this embodiment.
  • the radio frequency circuit 1804 is used to receive and transmit an RF (Radio Frequency) signal, also called an electromagnetic signal.
  • the radio frequency circuit 1804 communicates with a communication network and other communication devices through electromagnetic signals.
  • the radio frequency circuit 1804 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals.
  • the radio frequency circuit 1804 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a subscriber identity module card, and the like.
  • the radio frequency circuit 1804 can communicate with other terminals through at least one wireless communication protocol.
  • the wireless communication protocol includes, but is not limited to: a metropolitan area network, various generations of mobile communication networks (2G, 3G, 4G, and 5G), a wireless local area network, and / or a WiFi (Wireless Fidelity) network.
  • the radio frequency circuit 1804 may further include circuits related to Near Field Communication (NFC), which is not limited in this application.
  • NFC Near Field Communication
  • the display 1805 is used to display a UI (User Interface).
  • the UI can include graphics, text, icons, videos, and any combination thereof.
  • the display screen 1805 is a touch display screen, the display screen 1805 also has the ability to collect touch signals on or above the surface of the display screen 1805.
  • the touch signal can be input to the processor 1801 as a control signal for processing.
  • the display 1805 may also be used to provide a virtual button and / or a virtual keyboard, which is also called a soft button and / or a soft keyboard.
  • one display screen 1805 may be provided, and the front panel of the terminal 1800 is provided. In other embodiments, at least two display screens 1805 may be provided on different surfaces of the terminal 1800 or may be folded.
  • the display screen 1805 may be a flexible display screen disposed on a curved surface or a folded surface of the terminal 1800. Furthermore, the display screen 1805 can also be set as a non-rectangular irregular figure, that is, a special-shaped screen.
  • the display 1805 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).
  • the camera component 1806 is used to capture images or videos.
  • the camera component 1806 includes a front camera and a rear camera.
  • the front camera is disposed on the front panel of the terminal, and the rear camera is disposed on the back of the terminal.
  • the camera assembly 1806 may further include a flash.
  • the flash can be a monochrome temperature flash or a dual color temperature flash.
  • a dual color temperature flash is a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.
  • the audio circuit 1807 may include a microphone and a speaker.
  • the microphone is used to collect sound waves of the user and the environment, and convert the sound waves into electrical signals and input them to the processor 1801 for processing, or input to the radio frequency circuit 1804 to implement voice communication.
  • the microphone can also be an array microphone or an omnidirectional acquisition microphone.
  • the speaker is used to convert electrical signals from the processor 1801 or the radio frequency circuit 1804 into sound waves.
  • the speaker can be a traditional film speaker or a piezoelectric ceramic speaker.
  • the speaker When the speaker is a piezoelectric ceramic speaker, it can not only convert electrical signals into sound waves audible to humans, but also convert electrical signals into sound waves inaudible to humans for ranging purposes.
  • the audio circuit 1807 may further include a headphone jack.
  • the positioning component 1808 is configured to locate the current geographic position of the terminal 1800 to implement navigation or LBS (Location Based Service).
  • the positioning component 1808 may be a positioning component based on a US-based GPS (Global Positioning System), a Beidou system in China, a Granas system in Russia, or a Galileo system in the European Union.
  • the power supply 1809 is used to power various components in the terminal 1800.
  • the power source 1809 may be an alternating current, a direct current, a disposable battery, or a rechargeable battery.
  • the rechargeable battery may support wired charging or wireless charging.
  • the rechargeable battery can also be used to support fast charging technology.
  • the terminal 1800 further includes one or more sensors 1810.
  • the one or more sensors 1810 include, but are not limited to, an acceleration sensor 1811, a gyro sensor 1812, a pressure sensor 1813, a fingerprint sensor 1814, an optical sensor 1815, and a proximity sensor 1816.
  • the acceleration sensor 1811 can detect the magnitude of acceleration on the three coordinate axes of the coordinate system established by the terminal 1800.
  • the acceleration sensor 1811 may be used to detect components of the acceleration of gravity on three coordinate axes.
  • the processor 1801 may control the touch display screen 1805 to display the user interface in a horizontal view or a vertical view according to the gravity acceleration signal collected by the acceleration sensor 1811.
  • the acceleration sensor 1811 may also be used for collecting motion data of a game or a user.
  • the gyro sensor 1812 can detect the body direction and rotation angle of the terminal 1800, and the gyro sensor 1812 can cooperate with the acceleration sensor 1811 to collect a 3D motion of the user on the terminal 1800. Based on the data collected by the gyro sensor 1812, the processor 1801 can implement the following functions: motion sensing (such as changing the UI according to the user's tilt operation), image stabilization during shooting, game control, and inertial navigation.
  • the pressure sensor 1813 may be disposed on a side frame of the terminal 1800 and / or a lower layer of the touch display 1805.
  • a user's grip signal to the terminal 1800 can be detected, and the processor 1801 can perform left-right hand recognition or quick operation according to the grip signal collected by the pressure sensor 1813.
  • the processor 1801 controls the operable controls on the UI interface according to the user's pressure operation on the touch display screen 1805.
  • the operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.
  • the fingerprint sensor 1814 is used to collect a user's fingerprint, and the processor 1801 recognizes the identity of the user based on the fingerprint collected by the fingerprint sensor 1814, or the fingerprint sensor 1814 recognizes the identity of the user based on the collected fingerprint. When the user's identity is identified as trusted, the processor 1801 authorizes the user to perform related sensitive operations, such as unlocking the screen, viewing encrypted information, downloading software, paying, and changing settings.
  • the fingerprint sensor 1814 may be provided on the front, back, or side of the terminal 1800. When a physical button or a manufacturer's logo is set on the terminal 1800, the fingerprint sensor 1814 can be integrated with the physical button or the manufacturer's logo.
  • the optical sensor 1815 is used to collect the ambient light intensity.
  • the processor 1801 may control the display brightness of the touch display 1805 according to the ambient light intensity collected by the optical sensor 1815. Specifically, when the intensity of the ambient light is high, the display brightness of the touch display 1805 is increased; when the intensity of the ambient light is low, the display brightness of the touch display 1805 is decreased.
  • the processor 1801 may also dynamically adjust the shooting parameters of the camera component 1806 according to the ambient light intensity collected by the optical sensor 1815.
  • the proximity sensor 1816 also called a distance sensor, is usually disposed on the front panel of the terminal 1800.
  • the proximity sensor 1816 is used to collect the distance between the user and the front of the terminal 1800.
  • the processor 1801 controls the touch display 1805 to switch from the bright screen state to the closed screen state; when the proximity sensor 1816 detects When the distance between the user and the front side of the terminal 1800 gradually becomes larger, the processor 1801 controls the touch display screen 1805 to switch from the rest screen state to the bright screen state.
  • FIG. 18 does not constitute a limitation on the terminal 1800, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.
  • a computer-readable storage medium such as a memory including instructions, and the instructions may be executed by a processor in a device to complete the virus detection method of the application program.
  • the computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.
  • Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory can include random access memory (RAM) or external cache memory.
  • RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Synchlink DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
  • SRAM static RAM
  • DRAM dynamic RAM
  • SDRAM synchronous DRAM
  • DDRSDRAM dual data rate SDRAM
  • ESDRAM enhanced SDRAM
  • SLDRAM synchronous chain Synchlink DRAM
  • Rambus direct RAM
  • DRAM direct memory bus dynamic RAM
  • RDRAM memory bus dynamic RAM

Abstract

本申请公开了一种应用程序的病毒检测方法、装置、计算机设备及存储介质。所述方法包括：根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；提取所述功能执行图像的图像特征；及，当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。

Description

应用程序的病毒检测方法、装置、计算机设备及存储介质
本申请要求于2018年09月06日提交中国专利局，申请号为201811042877.1，申请名称为“应用程序的病毒检测方法、装置、计算机设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及电子技术领域，特别涉及一种应用程序的病毒检测方法、装置、计算机设备及存储介质。
背景技术
随着终端的广泛应用，终端的安全性也越来越受到关注。应用程序的病毒会给用户带来利益损失和困扰，例如，病毒在后台自动发送短信，来订制扣费服务，在用户不知情的情况下带来经济损失；病毒还会恶意推送垃圾广告，给用户造成困扰。
病毒的检测对终端的安全性和便捷性具有重要意义。首先，可以对已知的病毒的源码进行分析，确定该病毒的特征码，该特征码可以是源码中一个连续的二进制片段。然后，在检测任意应用程序是否为病毒时，可以获取该应用程序的源码，判断该应用程序的源码中是否包含有上述病毒的特征码，如果包含，则该应用程序即为病毒。
但是，为了躲避检测，病毒的源码可能会被修改，得到变形的病毒。由于当前的病毒源码已经改变，与原病毒的源码不再相同，在对当前的病毒源码进行检测时可能会得到跟实际情况不一致的检测结果，也即不会将该病毒检测出来，命中率较低，病毒检测的准确性较差。
发明内容
根据本申请提供的各种实施例，申请实施例提供了一种应用程序的病毒检测方法、装置、计算机设备及存储介质。
一种应用程序的病毒检测方法，包括：
根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行 过程中所执行的功能；
根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；
提取所述功能执行图像的图像特征；及
当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
一种应用程序的病毒检测方法，包括：
根据对目标应用程序的病毒检测指令，调用模拟器，将所述目标应用程序加载至所述模拟器运行，其中，所述模拟器用于模拟一个隔离的运行环境；
获取所述目标应用程序在运行过程中的功能执行信息，得到至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在所述模拟器中运行时所执行的功能；
向服务器发送病毒检测请求，所述病毒检测请求携带所述至少一个功能执行信息，所述病毒检测请求用于指示所述服务器对所述目标应用程序进行检测；及
根据接收到的病毒检测结果，进行病毒提示，所述病毒检测结果基于所述至少一个功能执行信息得到。
一种应用程序的病毒检测装置，包括：
获取模块，用于根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；
生成模块，用于根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；
提取模块，用于提取所述功能执行图像的图像特征；及
确定模块，用于当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
一种应用程序的病毒检测装置，包括：
调用模块，用于根据对目标应用程序的病毒检测指令，调用模拟器，将所述目标应用程序加载至所述模拟器运行，其中，所述模拟器用于模拟一个隔离的运行环境；
获取模块，用于获取所述目标应用程序在运行过程中的功能执行信息，得 到至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在所述模拟器中运行时所执行的功能；
发送模块，用于向服务器发送病毒检测请求，所述病毒检测请求携带所述至少一个功能执行信息，所述病毒检测请求用于指示所述服务器对所述目标应用程序进行检测；及
提示模块，用于根据接收到的病毒检测结果，进行病毒提示，所述病毒检测结果基于所述至少一个功能执行信息得到。
一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行上述应用程序的病毒检测方法的步骤。
一个或多个存储有计算机可读指令的非易失性存储介质，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行上述应用程序的病毒检测方法的步骤。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征、目的和优点将从说明书、附图以及权利要求书变得明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种实施环境示意图；
图2是本申请实施例提供的另一种实施环境示意图；
图3是本申请实施例提供的又一种实施环境示意图；
图4是本申请实施例提供的一种应用程序的病毒检测方法流程图；
图5A是本申请实施例提供的一种功能执行图像示意图；
图5B是本申请实施例提供的一种像素值矩阵的示意图；
图6是本申请实施例提供的一种确定相似度的示意图；
图7是本申请实施例提供的一种病毒检测系统示意图；
图8是本申请实施例提供的一种检测流程控制子模块处理流程示意图；
图9是本申请实施例提供的一种行为指纹提取子模块处理流程示意图；
图10是本申请实施例提供的一种应用程序的病毒检测的方法流程图；
图11是本申请实施例提供的一种病毒库生成子模块处理流程示意图；
图12是本申请实施例提供的一种相似度度量子模块处理流程示意图；
图13是本申请实施例提供的一种应用程序的病毒检测方法流程图；
图14是本申请实施例提供的一种应用程序的病毒检测方法流程图；
图15是本申请实施例提供的一种应用程序的病毒检测装置示意图；
图16是本申请实施例提供的一种应用程序的病毒检测装置示意图；
图17是本申请实施例提供的一种服务器的结构示意图；及
图18是本申请实施例提供的一种终端的结构框图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
在本申请实施例中，应用程序在运行时会执行各种各样的功能，而每个应用程序所执行的功能均具有各自的特点，因此，可以利用一个应用程序所执行的功能来唯一表示该应用程序，由于这种功能与应用程序之间的一一对应关系与指纹与人之间的一一对应关系有异曲同工之妙，因此，可以通过应用程序所执行的功能的特点，来对应用程序进行区分，也即是，应用程序所执行功能的特征可以起到应用程序的指纹的作用，为了形象化的理解，可以将这些特征称为应用程序的行为指纹。对于病毒来说，病毒的源码即使发生改变，病毒执行的功能一般也不会发生改变，例如，扣费类的病毒可能仍然会执行自动发送短信的功能。因此，如果应用程序是病毒，则其功能执行信息会与对应病毒类型的功能执行特征相匹配。基于这样的思考，本申请实施例可以通过对应用程序的功能执行情况进行记录，并基于所记录的功能执行情况，来对应用程序进行病毒检测，从而提高病毒检测的准确性，避免了由于病毒自身的细微变化，而造成漏检或者错检的情况。
在本申请实施例中，涉及了应用程序的功能执行信息，该应用程序的功能执行信息是指记录应用程序在运行时所执行的功能的信息，可以用于表示应用程序的功能执行情况，例如，一个应用程序在何时执行了何种功能。
基于上述原理，在实施本申请实施例时，可以基于多种实施环境进行，例 如，图1是本申请实施例提供的应用程序的病毒检测方法的实施环境图。该应用程序的病毒检测方法的实施环境可以包括至少一个用户设备101以及用于为该至少一个用户设备101提供服务的服务器102。
其中，该至少一个用户设备101通过无线或者有线网络和服务器102连接，该至少一个用户设备101可以为能够访问服务器102的计算机设备或智能终端等。用户设备101上可以安装有用于病毒检测的应用客户端，以便通过该应用客户端，来与服务器102进行交互，从而获取服务器102提供的病毒检测服务。例如，该应用客户端可以为应用管理类客户端，不仅可以提供病毒检测服务，还可以提供应用资讯、应用下载和应用更新等服务中的至少一个。
服务器102中可以维护有至少一种病毒库，该服务器102可以为上述应用客户端的后台服务器。该服务器102还可以通过应用客户端为用户设备提供应用资讯、应用下载或者应用更新等服务中的至少一个。当然，该服务器102还可以提供发布接口，使得用户设备可以通过该发布接口进行应用的发布。
具体的，结合图1所示的实施环境图，服务器可以为任一用户设备提供病毒检测服务，也即是，用户设备可以向服务器发起病毒检测请求，当服务器接收到用户设备发送的病毒检测请求时，可以触发病毒检测流程。其中，该病毒检测请求可以携带待检测的目标应用程序的标识，使得服务器对服务器上已经存储的目标应用程序进行病毒检测，当然，该病毒检测请求还可以携带目标应用程序，以将目标应用程序提供给服务器进行病毒检测。当然，该服务器还可以是周期性对服务器上所存储的应用程序进行病毒检测，或者在接收到任一用户设备新发布的应用程序时，触发病毒检测的流程，本申请实施例对如何触发该病毒检测流程不做限定。
服务器在对目标应用程序进行病毒检测时，可以对目标应用程序的功能执行信息进行获取，在一种可能的实施方式中，服务器中可以安装有模拟器，用于模拟用户设备的运行环境，相应地，服务器获取功能执行信息过程包括：服务器调用模拟器，将目标应用程序加载至模拟器运行，记录目标应用程序在运行过程中的功能执行信息，获取记录的至少一个功能执行信息。基于模拟器运行应用程序时，可以避免病毒对服务器造成危害，提高病毒检测的安全性。
其中，模拟器可以是安卓系统的模拟器，可以运行安卓应用程序。当然，上述模拟器还可以是IOS模拟器或者Windows模拟器等，可以运行相对应的应用程序，此处不作限定。
其中，功能执行信息可以包括所执行功能的功能标识，还可以包括功能执行时间，服务器在模拟器中运行该目标应用程序时，每当目标应用程序在模拟器中执行一个功能，服务器可以记录下该功能的功能标识和功能执行时间，作为一个功能执行信息进行存储。其中，功能标识可以用于表示功能的类型，该功能标识可以采用数字标识，从而尽可能定义病毒可能执行的功能类型。例如，可以预先定义多种功能分别对应的功能标识，功能标识的范围可以为[0，255]，基于该取值范围，功能标识01定义为发送短信，02为拨打电话，03为调用录音笔，04为弹窗，05为调用摄像头等。功能执行时间可以是功能的触发时间。
需要说明的是，所记录的至少一个功能执行信息可以按照功能执行时间由早到晚排序，因此，功能执行信息的顺序即可以表示功能执行顺序。例如，当目标应用程序发送短信时，记录下短信的功能标识01和功能执行时间10:30等信息，作为一条功能执行信息；当调用摄像头时，记录下调用摄像头的功能标识05和功能执行时间10:33等信息；当调用录音笔时，记录下调用录音笔的功能标识03和功能执行时间10:49等信息……目标应用程序运行一段时间后，即可得到如下功能执行信息：
01，10:30；
05，10:33；
03，10:49；
……
上述内容介绍了功能执行信息的记录方式和所记录的内容，而服务器在获取的功能执行信息时可以有多种方式，下面分别进行介绍：
第一种方式，服务器记录目标应用程序在第一预设时长内的功能执行信息。
服务器可以在模拟器中运行目标应用程序，每当目标应用程序在模拟器中执行一个功能时，服务器可以记录下该功能的功能标识和功能执行时间，作为一个功能执行信息进行存储，经过第一预设时长后停止运行，将记录的至少一个功能执行信息进行存储。例如，服务器可以运行目标应用程序15分钟，获取该15分钟内的功能执行信息。基于目标应用程序在预设时长内执行的功能进行病毒检测，能够保证获取到病毒的功能执行信息能够包括该目标应用程序的所有功能，提高病毒检测的准确性。
上述方式提供了一种运行时长与预设时长相同的记录方式，而在一些实施例中，该运行时长还可以大于预设时长，也即是，服务器在模拟器中运行目标 应用程序，每当目标应用程序在模拟器中执行一个功能时，服务器可以记录下该功能的功能标识和功能执行时间，作为一个功能执行信息进行存储，经过第二预设时长后停止运行，将记录的至少一个功能执行信息进行存储，从已存储的功能执行信息中提取第一预设时长内的功能执行信息。在本申请实施例中，对该第一预设时长的起始点不做限定，该起始点可以为运行起始点，也可以为运行起始点以后的某个时间点，该第一预设时长的起始点可以是保证目标应用程序初始化完成的时间点等。例如，服务器可以运行目标应用程序20分钟，在进行病毒检测时，获取其中15分钟内的功能执行信息，可以是前15分钟或后15分钟的功能执行信息，也可以是中间任意15分钟内的功能执行信息，本申请实施例对此不作限定。
第二种方式，服务器获取目标应用程序在多次运行过程中目标运行过程所记录的功能执行信息，该目标运行过程为所记录的功能执行信息数目最多的运行过程。
服务器可以多次运行目标应用程序，并对每个运行过程中的功能执行信息的数目进行统计，得到每个运行过程中的功能执行信息数目，从而确定目标运行过程，也即是，功能执行信息数目最多的运行过程，并基于该目标运行过程中所记录的功能执行信息，进行后续的病毒检测过程。通过这种可选方式，可以尽可能保证获取到应用程序的功能执行信息能够更准确的体现该应用程序的实际功能，提高病毒检测的准确性。
当然，上述两种可选方案可以相结合，也即服务器可以在多次运行过程的每次运行过程中，均获取第一预设时长内所记录的功能执行信息，再基于每次运行过程中目标运行过程所记录的功能执行信息，来进行后续的病毒检测过程。
上述具体获取功能执行信息的过程是基于图1所示的实施环境进行，而在本申请实施例还提供了另一种实施环境，如图2所示，该实施环境包括：至少一个用户设备201与服务器202。该用户设备201所具备的功能与上述用户设备101所具备的功能同理，该用户设备201还可以具备运行目标应用程序，以记录该目标应用程序的功能执行信息的功能，而在用户设备201获取到目标应用程序的功能执行信息后，该用户设备201可以将该目标应用程序的功能执行信息发送至该服务器202，由服务器202基于该目标应用程序的功能执行信息进行病毒检测。在图2所示的实施环境中，应用程序的病毒检测方法可以由服务器实现。服务器获取功能执行信息的过程包括：服务器接收目标应用程序在另一设 备上运行过程中的至少一个功能执行信息。在一种实施方式中，该过程具体包括：用户设备运行该目标应用程序，在运行过程中记录目标应用程序的至少一个功能执行信息，向服务器发送病毒检测请求，该病毒检测请求中携带将该目标应用程序的至少一个功能执行信息，服务器接收该病毒检测请求，从该病毒检测请求中提取目标应用程序的至少一个功能执行信息。需要说明的是，在用户设备上获取目标应用程序的至少一个功能执行信息的过程与服务器获取的过程同理。进一步地，当服务器通过检测得到病毒检测结果时，可以将病毒检测结果发送至用户设备，用户设备在接收到病毒检测结果，可以基于病毒检测结果进行病毒提示，例如，当病毒检测结果指示该应用程序为病毒时，则提示该应用程序为病毒，而当病毒检测结果指示该应用程序不是病毒时，则提示该应用程序为不是病毒，当然，当该病毒检测结果指示该应用程序可疑时，也可以提示该应用程序存在风险，不建议运行等。
上述申请实施例中是以服务器来实现病毒检测方法，并输出病毒检测结果为例进行说明，当然，上述病毒检测方法还可以由安装在用户设备上的病毒检测应用程序实现，相应地，该病毒检测应用程序可以配置有本地病毒数据库，通过本地病毒数据库，则可以对用户设备上已安装的应用程序进行离线的病毒检测。为此，本申请实施例还提供了一种实施环境，参见图3，该图3提供了本申请实施例的一种实施环境。该实施环境可以包括至少一个用户设备301和服务器302。该用户设备301上可以安装有病毒检测应用程序，并且还存储有用于病毒检测的至少一种病毒库。用户设备301在运行任一应用程序时，可以记录运行过程中的功能执行信息并存储，以便后续进行病毒检测。可选地，用户还可以在不随时进行上述的记录和存储，而是当用户设备301上触发对目标应用程序的病毒检测时，则对目标应用程序在运行过程中的功能执行信息进行记录和存储，进而可以基于该功能执行信息检测目标应用程序是否为病毒。用户设备可以基于病毒检测结果进行病毒提示。该病毒提示方法可以与上述实施例中所提供的方法同理。
在图3所示的实施环境中，应用程序的病毒检测方法可以由用户设备上的病毒检测应用程序实现。病毒检测应用程序获取功能执行信息的处理可以如下：病毒检测应用程序获取本地存储的目标应用程序的至少一个功能执行信息。
下面对一个应用程序的病毒检测过程进行介绍，如图4所示，以图1所示的实施环境中的服务器102进行病毒检测为例来进行说明，图4为本申请应用 程序的病毒检测方法流程图，该方法的处理流程可以包括如下的步骤：
400、用户设备向服务器发送目标应用程序。
401、服务器在接收到目标应用程序后，获取目标应用程序在运行过程中的至少一个功能执行信息。
步骤401中服务器获取功能执行信息的步骤可以参见上述实施例中的获取过程。
上述步骤400至步骤401中，仅以用户设备在服务器上发布目标应用程序后，由服务器来进行病毒检测为例进行说明，在一些实施例中，用户设备还可以仅发送病毒检测请求，该病毒检测请求携带目标应用程序或目标应用程序的标识，以指示服务器进行病毒检测。当然，在一些实施例中，服务器还可以自行发起对任一应用程序的病毒检测，本申请实施例对此不做限定。
402、服务器按照至少一个功能执行信息中的功能执行时间，基于至少一个功能执行信息中的功能标识，构造功能执行序列。
功能执行序列可以由功能标识组成。具体地，服务器在上述步骤401中获取的待检测目标应用程序在运行过程中生成的每个功能执行信息包括功能标识以及功能执行时间等信息。服务器可以按照功能执行信息中的功能执行时间，确定功能标识的排列顺序，进而可以将功能标识按照排列顺序构成功能执行序列。
在一种可能的实施方式中，服务器可以按照时间的先后顺序对功能标识进行排列，步骤402的具体处理可以如下：基于至少一个功能执行信息中的功能执行时间确定至少一个功能执行信息的功能执行顺序，按照功能执行顺序对至少一个功能执行信息中的功能标识进行排序，得到功能执行序列。
当服务器按照时间的先后顺序对功能执行信息进行排列时，功能执行信息的排列顺序即为功能执行顺序，服务器可以按照该功能执行顺序，将功能标识组成相应的功能执行序列。
具体地，构造功能执行序列的方法可以有两种，下面分别进行介绍：
第一，在构造功能执行序列时，服务器可以按照功能执行顺序，将功能标识组成相应的功能执行序列。例如，当记录的功能执行信息为(01，10:30；05，10:33；03，10:49；…)时，按照功能执行信息对功能标识进行排列，可以得到十进制序列(1,5,3…)，该十进制序列可以是对应的功能执行序列。
第二，在构造功能执行序列时，服务器可以获取每两个相邻功能执行信息 的功能执行时间，计算每两个相邻的功能标识之间的时间间隔，然后，服务器可以按照功能执行顺序，对功能标识进行排列，并且可以在相邻的两个功能标识之间添加相应的时间间隔标识，得到相应的功能执行序列。例如，功能执行序列可以为(1,0,0,5,0,3,…)，其中“0”为时间间隔标识。
在实施中基于上述任一构造功能执行序列的方法进行处理即可。
在一种可能的实施方式中，可以按照功能执行顺序、功能标识对应的预设顺序或者功能执行次数中的至少一个，基于所述至少一个功能执行信息中的功能标识，构造功能执行序列。
功能执行顺序可以根据功能执行时间确定。功能标识对应的预设排序是预先设定的，根据功能标识对应的预设排序形成功能执行序列，可以提高对行为顺序多样化的目标应用程序进行病毒检测的准确性。例如在病毒程序的制造者，为了通过病毒检测，修改程序部分功能的执行顺序时，也可以检测出该病毒程序。例如可以设定打电话对应的功能标识的排序为1，发短信功能对应的功能标识的排序为2，弹窗对应的功能标识的排序为4。功能执行序列中功能标识的排序可以按照功能执行顺序、功能标识对应的预设顺序或者功能执行次数中的一个或多个规则进行排序。当按照功能执行顺序、功能标识对应的预设顺序或者功能执行次数中的多个规则进行排序时，则可以获取功能执行顺序、功能标识对应的预设顺序以及功能执行次数的优先级别，按照规则的优先级别进行排序。例如，先按照优先级别最高的规则进行排序，当按照优先级别最高的进行排序，不能区分部分功能标识之间的排序时，则根据优先级别为第二的规则对不能区分排序的功能标识进行排序。其中，如果有重复执行的功能，则功能执行序列中可以存在多个相同的功能执行标识，也可以是保留其中的一个。例如，删除相同的功能标识中，功能执行顺序在后的功能标识。
举个实际的例子。假设打电话的功能标识为1，发短信的功能标识为2，弹窗的功能标识为4，执行顺序依次为发短信、弹窗、打电话、发短信。则按照功能执行顺序，功能执行序列为(2，4，1，2)或者(2，4，1)。按照功能标识对应的预设排序，功能执行序列为(1，2，4)或者(1，2，2，4)。按照功能标识对应的执行次数以及功能标识对应的预设排序，且功能标识对应的执行次数的优先级高于功能标识对应的预设排序，则功能执行序列为(2，1，4)或者(2，2，1，4)。
403、服务器将功能执行序列的中的功能标识转换为像素点，生成目标应用 程序的功能执行图像。
预先设置了功能执行信息与像素值的对应关系，因此可以根据功能执行信息，确定目标像素值，根据目标像素值生成目标应用程序的功能执行图像。例如可以将功能标识转换为像素点对应的目标像素值，根据目标像素值生成目标应用程序的功能执行图像。
服务器在步骤402中得到十进制的功能执行序列后，可以将其转换为十六进制的功能执行序列，也即得到(01,05,03…)。然后，服务器可以将每个功能标识的值转换为像素值，每个功能标识作为一个像素点，构成功能执行图像。其中，该像素值的范围可以为[0，255]，例如可以设置功能标识01对应的灰度值为01，功能标识05对应的灰度值为05，功能标识255对应的灰度值为255。
在一种可能的实施方式中，将功能标识转换为像素点对应的目标像素值，根据像素点对应的目标像素值生成目标应用程序的功能执行图像包括：将功能执行序列中的功能标识转换为像素点对应的目标像素值，根据像素点对应的目标像素值生成目标应用程序的功能执行图像，功能执行图像中，各个像素点的位置根据对应的功能标识在功能序列的排序确定。由于功能标识的范围设定在[0，255]之内，十六进制的功能执行序列中的每一个功能标识都可以转换为一个像素值，也即将功能执行序列转换为对应的功能执行图像。各个像素点的位置根据对应的功能标识在功能序列的排序确定。可以按照功能标识在功能序列的排序，依次排列对应的像素点。该功能执行图像可以是1*n的功能执行图像。当然，还可以将功能执行序列切分为多个序列片段，然后拼接成多行多列的矩阵形式，再基于上述方式转换为功能执行图像，即功能执行图像包括多行以及多列的像素点。此处不作限定。例如，功能执行序列的每个功能标识都可以相应的转换为[0，255]之内的灰度值，于是得到的功能执行图像可以是灰度图像，该灰度图像如图5A所示的功能执行图像示意图；或者，功能执行序列的每个功能标识还可以通过转换算法生成RGB三通道的像素值，此时，RGB三通道构成的功能执行图像可以是彩色图像。
在一种可能的实施方式中，可以获取图像尺寸信息，图像尺寸信息包括像素点行数以及像素点列数；根据图像尺寸信息，对像素点对应的目标像素值进行排列，生成对应的像素值矩阵，得到所述目标应用程序的功能执行图像。
功能执行图像可以包括多行以及多列的像素点，例如22行*22列。图像尺寸信息可以是预先设置的。在对像素值进行排列时，可以按照行进行排序，例 如从第一行开始，按照行顺序依次进行排列。也可以按照列顺序进行排序，例如从第一列开始，按照列顺序依次进行排列。因此根据按照图像尺寸信息，对像素点对应的目标像素值进行排列，可以生成相应行数以及列数的像素值矩阵，从而可以得到目标应用程序的功能执行图像。在进行排列时，当程序执行的功能比较少，小于图像对应的像素点数量的情况，则可以对没有对应的功能执行标识的像素点赋予预设的值，例如0。
举个实际的例子，假设功能执行序列对应12个功能标识，即目标程序执行了12个功能，对应的像素值依次为01、12、35、46、13、15、88、16、156、22、24、25。而功能执行图像的行数与列数为4行4列，则生成的像素值矩阵可以如图5B所示，最后一行进行补0。
对于步骤402中的第一种构造功能执行序列的方法，服务器生成的功能执行图像的每个像素点的像素值都可以用于表示功能的类型，像素点的排列顺序可以是上述多个功能执行信息的功能执行顺序，相邻的两个像素点可以用于表示连续执行的两个功能。例如，该功能执行图像的像素点可以为(01,05,03…)。
对于步骤402中的第二种构造功能执行序列的方法，与第一种方法相类似的，服务器生成的功能执行图像的像素值除了可以表示功能的类型，还可以表示时间间隔单位。例如，上述形式二中像素值00可以表示一个时间间隔单位，对于(01,00,00,05,00,03…)，可以表示功能01与功能05的触发时间间隔2个时间间隔单位，功能05与功能03的触发时间间隔1个时间间隔单位等。
服务器可以根据目标应用程序的多个功能执行信息，生成目标应用程序的功能执行图像，步骤402-403可以是一种可能的实施方式。当然，服务器还可以通过其他方法，根据目标应用程序的至少一个功能执行信息，生成目标应用程序的功能执行图像。下面对一种生成功能执行图像的方法进行介绍，该方法中构造功能执行序列具体处理可以如下：基于预设的功能执行信息排列规则对至少一个功能执行信息进行排列，将排列后的至少一个功能执行信息中的功能标识，按照排列后得到的功能执行信息的顺序构成功能执行序列。
预设的功能执行信息排列规则可以是按照执行次数的数目由大到小的顺序。服务器可以在获取到的至少一个功能执行信息中，统计各个功能标识的数目，并按照数目由大到小的顺序对功能标识进行排序。功能标识的数目越多，则表明目标应用程序执行该功能的次数越多。然后，服务器可以按照功能标识的排序以及功能标识的数目，构造功能执行序列。例如，功能01的执行次数为 3次，功能03的执行次数为1次，功能05的执行次数为2次，则可以得到功能执行序列为(1,1,1,5,5,3)。
功能执行信息排列规则可以根据实际需求进行设置，本申请实施例对此不作限定。
404、服务器提取目标应用程序的功能执行图像的图像特征。
服务器中可以调用图像特征提取模型，提取上述过程中生成的功能执行图像的图像特征。例如，图像特征提取模型可以是基于SIFT(Scale-invariant feature transform，尺度不变特征变换)算法的图像特征提取模型，也可以是基于机器学习算法的图像特征提取模型等，此处不作限定。相对应的，提取到的图像特征可以是特征向量，也可以是特征矩阵等，并且，图像特征中可以包括至少一个特征向量或至少一个特征矩阵。
下面以基于SIFT算法的图像特征提取模型为例，对提取的图像特征进行介绍：
服务器调用基于SIFT算法的图像特征提取模型，对功能执行图像进行特征提取，可以得到至少一个SIFT特征向量，一个SIFT特征向量可以由64个浮点数构成，此处对SIFT特征向量的维度不作限定。不同应用程序的功能执行图像对应的SIFT特征向量数目可能不同。一般来说，一张功能执行图像可以提取出一组SIFT特征向量，例如，该组SIFT特征向量可以包括5个SIFT特征向量，记录为样本X：[0.1234,0.154…]，[0.134,0.5154…]，...，[0.1254,0.4521…]。
服务器在获取到目标应用程序对应的图像特征后，可以计算图像特征与病毒图像特征的相似度。在此之前，需要对病毒图像特征进行提取，下面将对此进行介绍：
服务器可以获取至少一个已知病毒类型的病毒样本，在模拟器中运行每个病毒样本，执行步骤201-204的处理，基于与待检测的目标应用程序相同的方法提取病毒图像特征。
以上述基于SIFT算法的图像特征提取模型为例，最终服务器可以输出得到至少一组SIFT特征向量，与病毒样本相对应。可选的，服务器在输出一组SIFT特征向量时，可以为该组SIFT特征向量添加对应的病毒类型的标识，格式可以为“病毒类型：SIFT特征向量组”，例如，诈骗类：[0.1234,0.154…]，[0.134,0.5154…]，...，[0.1254,0.4521…]。
进而，服务器可以将确定的至少一种病毒类型的病毒图像特征存储到病毒 库中。在后续使用中，如果需要添加新的病毒样本的病毒图像特征，则可以基于上述方法确定该病毒图像特征，对病毒库进行更新。
得到图像特征后，服务器获取图像特征与病毒类型的病毒图像特征的相似度。例如，可以进入步骤405，遍历多种病毒类型的病毒图像特征。当然也可以是根据目标应用程序筛选得到部分病毒类型，作为候选病毒类型，再计算图像特征与候选病毒类型的病毒图像特征的相似度。例如，如果目标应用程序根据人工排查或者其他方法排查，已经确定不是流氓类软件，则可以不与流氓类对应的病毒图像特征进行相似度计算。
405、服务器遍历多种病毒类型的病毒图像特征，每遍历一个病毒类型的病毒图像特征，获取图像特征和病毒类型的病毒图像特征的相似度。
图像特征或病毒库中一种病毒类型的病毒图像特征可以包括至少一个特征向量或特征矩阵。
在一种可能的实施方式中，服务器可以遍历病毒库中的所有病毒类型，确定每种病毒类型的病毒图像特征与图像特征的相似度。例如，对于图像特征为特征矩阵的情况，可以分别确定图像特征的秩和病毒图像特征的秩，进而，可以判断图像特征的秩和病毒图像特征的秩的比值，将该比值确定为相似度。
下面以特征向量为例进行介绍，上述步骤405的具体处理可以如下：确定图像特征的每个目标特征向量与病毒类型的病毒图像特征的每个特征向量的向量距离，将小于距离阈值的向量距离的数目，确定为图像特征和病毒类型的病毒图像特征的相似度。
对于目标应用程序的一个目标特征向量，服务器可以遍历病毒库中存储的每种病毒类型的特征向量，分别确定向量距离。服务器将目标应用程序的所有目标特征向量与病毒库中存储的所有病毒类型的特征向量都进行对比，可以保证病毒检测的全面性。
服务器可以基于距离算法计算图像特征和病毒图像特征之间的距离，距离越近，相似度越高，例如，距离算法可以是欧几里得距离算法或者曼哈顿距离算法等。
以欧几里得距离算法为例，对于64维的SIFT特征向量，设图像特征的一个SIFT特征向量为(x 1,x 2,...,x 64)，病毒图像特征的一个SIFT特征向量为(y 1,y 2,...,y 64)，则可以基于下述公式(1)计算向量距离d：
Figure PCTCN2019103600-appb-000001
本申请实施例提供的方法，计算得到的向量距离的范围可以在[0,1]之间，可以将距离阈值设置为0.2。当向量距离小于0.2时，可以认为这两个SIFT特征向量相似。
对于图像特征或一种病毒类型的病毒图像特征中仅包括一个特征向量或一个特征矩阵的情况，可以将向量距离的倒数作为相似度，向量阈值的倒数作为相似度阈值。向量距离小于距离阈值时，相似度即大于相似度阈值。
以特征向量为例，由于图像特征中可以包括多个特征向量，可以利用目标应用程序对应的图像特征中包括的与某病毒类型的病毒图像特征相似的特征向量的数目，来衡量目标应用程序对应的图像特征与该病毒类型的病毒图像特征是否相似。相似的特征向量越多，则表明图像特征越相似。例如，如图6所示的确定相似度的示意图，待检测的目标应用程序与病毒库中病毒类型1的相似特征向量有1个，Sim_1＝1。与病毒类型2的相似特征向量有0个，Sim_2＝0，与病毒类型3的相似特征向量有4个，Sim_3＝4等。
当然，服务器还可以基于相似度算法计算图像特征和病毒图像特征的相似度，例如，相似度算法可以是余弦相似度算法或者求解杰卡德相似系数等。本申请实施例对确定相似度的具体算法不作限定。
在一些实施例中，当图像特征有多个，一个病毒类型对应的病毒图像特征也有多个时，可以是图像特征与病毒图像特征之间两两计算距离，也可以是当病毒图像特征的某一个向量与图像特征的一个向量的距离小于距离阈值时，则该病毒图像特征向量不再与图像特征的其他向量进行距离计算。例如，假设待检测的目标应用程序对应的向量有三个：a、b、c，诈骗类的向量也有三个：d、e、f。在计算过程中如果发现a与d相似，即距离小于距离阈值时，则将在计算b与病毒类型的向量时需要排除d。如果找到了b的相似向量为f，则计算c与病毒类型的向量距离时需要排除d和f，计算c与e的向量距离。
406、当图像特征和病毒图像特征的相似度大于相似度阈值时，服务器将目标应用程序标记为病毒。
服务器可以判断步骤405中确定下的相似度是否大于相似度阈值，如果存在任一相似度大于相似度阈值，则服务器可以确定目标应用程序是病毒，进而可以对该目标应用程序进行标记。如果不存在相似度大于相似度阈值，则不能判断目标应用程序是否为病毒，服务器可以暂时判定该目标应用程序安全。如果该被判定安全的目标应用程序确实为病毒，在后续使用的过程中，该目标应 用程序可能会被其它病毒检测方法检测出来，或者该目标应用程序对应的病毒图像特征被添加到病毒库中，重新检测时被本申请实施例提供的病毒检测方法检测出来。
在一种可能的实施方式中，服务器在步骤405中确定下图像特征与每种病毒类型的相似度后，可以将相似度最大值获取出来，判断该相似度最大值是否大于相似度阈值。如果相似度最大值大于相似度阈值，则表明目标应用程序是病毒；如果相似度最大值不大于相似度阈值，则表明其余的相似度均不大于相似度阈值，即可暂时判定该目标应用程序安全，能够避免将每个相似度与相似度阈值进行对比，提高处理效率。此时，如果相似度最大值大于相似度阈值，则还可以将相似度最大值对应的病毒图像特征的病毒类型，确定为目标应用程序的目标病毒类型，提高病毒检测的准确性，以便采取准确的应对措施，提高安全性。
例如，相似度阈值可以设置为3，在上述步骤405中可以确定下待检测的目标应用程序于各个病毒类型的相似度后，可以将相似度最大值Sim_3＝4获取出来，与相似度阈值3进行比较。容易得到4>3，则可以确定该目标应用程序为病毒。
如果服务器为应用市场提供病毒检测的服务，则在判定目标应用程序是病毒时，可以拒绝目标应用程序投递到应用市场，或是将目标应用程序从应用市场中下架。如果服务器为其它设备提供病毒检测的服务，则可以将病毒检测结果发送给该设备，以便用户判断继续使用该目标应用程序或是卸载。
示例性的，如图7所示的病毒检测系统示意图，病毒检测的系统可以由检测流程控制子模块、行为指纹提取子模块、病毒库生成子模块和相似度度量子模块4个子模块构成。其中，检测流程控制子模块可以调用其余3个子模块，可以用于实现整个病毒检测的流程；行为指纹提取子模块可以用于提取图像特征，功能执行图像的图像特征即是行为指纹；病毒库生成子模块可以调用行为指纹提取子模块，生成的病毒库中可以存储有至少一种病毒类型的病毒图像特征；相似度度量子模块可以用于确定目标应用程序对应的图像特征和病毒图像特征的相似度。检测流程控制子模块处理流程示意图如图8所示，行为指纹提取子模块处理流程示意图如图9所示，应用程序的病毒检测的方法流程图如图10所示，病毒库生成子模块处理流程示意图如图11所示，相似度度量子模块处理流程示意图如图12所示。
上述步骤401的过程可以由检测流程控制子模块调用行为指纹提取子模块实现，上述步骤402-404的过程可以由行为指纹提取子模块实现，上述步骤404中生成病毒图像特征的处理可以由病毒库生成子模块调用行为指纹提取子模块实现，上述步骤405的过程可以由检测流程控制子模块调用相似度度量子模块实现，上述步骤406的过程可以由检测流程控制子模块实现。
本申请实施例中，由于应用程序的病毒具有某些特定的功能执行的行为，即使病毒的源码发生改变，病毒执行的功能一般也不会发生改变，因此，服务器基于应用程序的功能执行信息进行病毒检测，对于变形的病毒也可以检测出来，具有较强的泛化能力。并且，基于图像提取的特征可靠性较高，本申请实施例利用应用程序的功能执行信息生成功能执行图像，将待检测的应用程序对应的图像特征与病毒图像特征进行对比，可以提高病毒检测的准确性。
下面以对一个应用程序的病毒检测过程进行介绍，如图13所示，以基于图2所示的实施环境中的服务器和用户设备的交互，来进行病毒检测为例进行说明，图13为本申请应用程序的病毒检测方法流程图，该方法的处理流程可以包括如下的步骤：
1300、用户设备根据病毒检测指令，获取目标应用程序在运行过程中的至少一个功能执行信息。
1301、用户设备向服务器发送病毒检测请求，该病毒检测请求携带该目标应用程序在运行过程中的至少一个功能执行信息。
1302、服务器接收到该病毒检测请求后，按照至少一个功能执行信息中的功能执行时间，基于至少一个功能执行信息中的功能标识，构造功能执行序列。
1303、服务器将功能执行序列的中的功能标识转换为像素点，生成目标应用程序的功能执行图像。
1304、服务器提取目标应用程序的功能执行图像的图像特征。
1305、服务器遍历多种病毒类型的病毒图像特征，每遍历一个病毒类型的病毒图像特征，获取图像特征和病毒类型的病毒图像特征的相似度。
1306、当图像特征和病毒图像特征的相似度大于相似度阈值时，服务器将目标应用程序标记为病毒。
1307、服务器将病毒检测结果发送至用户设备。
1308、用户设备接收到病毒检测结果后，进行病毒提示。
本申请实施例中，由于应用程序的病毒具有某些特定的功能执行的行为， 即使病毒的源码发生改变，病毒执行的功能一般也不会发生改变，因此，服务器基于应用程序的功能执行信息进行病毒检测，对于变形的病毒也可以检测出来，具有较强的泛化能力。并且，基于图像提取的特征可靠性较高，本申请实施例利用应用程序的功能执行信息生成功能执行图像，将待检测的应用程序对应的图像特征与病毒图像特征进行对比，可以提高病毒检测的准确性。进一步地，通过用户设备将运行过程中所获取的功能执行信息发送给服务器进行检测，可以降低服务器的处理压力。
下面以对一个应用程序的病毒检测过程进行介绍，如图14所示，以基于图2所示的实施环境中的服务器和用户设备的交互，来进行病毒检测为例进行说明，图14为本申请应用程序的病毒检测方法流程图，该方法的处理流程可以包括如下的步骤：
1401、用户设备根据病毒检测指令，获取目标应用程序在运行过程中的至少一个功能执行信息。
1402、用户设备按照至少一个功能执行信息中的功能执行时间，基于至少一个功能执行信息中的功能标识，构造功能执行序列。
1403、用户设备将功能执行序列的中的功能标识转换为像素点，生成目标应用程序的功能执行图像。
1404、用户设备提取目标应用程序的功能执行图像的图像特征。
1405、用户设备遍历多种病毒类型的病毒图像特征，每遍历一个病毒类型的病毒图像特征，获取图像特征和病毒类型的病毒图像特征的相似度。
1406、当图像特征和病毒图像特征的相似度大于相似度阈值时，用户设备将目标应用程序标记为病毒。
1407、用户设备根据病毒检测结果进行病毒提示。
本申请实施例中，由于应用程序的病毒具有某些特定的功能执行的行为，即使病毒的源码发生改变，病毒执行的功能一般也不会发生改变，因此，服务器基于应用程序的功能执行信息进行病毒检测，对于变形的病毒也可以检测出来，具有较强的泛化能力。并且，基于图像提取的特征可靠性较高，本申请实施例利用应用程序的功能执行信息生成功能执行图像，将待检测的应用程序对应的图像特征与病毒图像特征进行对比，可以提高病毒检测的准确性。进一步地，通过用户设备基于本地病毒数据库进行上述病毒检测，可以保证离线场景下也能够完成病毒检测。
应该理解的是，虽然本申请各实施例中的各个步骤并不是必然按照步骤标号指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，各实施例中至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
基于相同的技术构思，本申请实施例还提供了一种应用程序的病毒检测装置，该装置可以是上述服务器。如图15所示，该装置包括：
获取模块1510，用于根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能。
生成模块1520，用于根据所述目标应用程序的至少一个功能执行信息，生成所述目标应用程序的功能执行图像。
提取模块1530，用于提取所述功能执行图像的图像特征。
确定模块1540，用于当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
可选的，所述获取模块1510用于：
调用模拟器，将所述目标应用程序加载至所述模拟器运行，记录所述目标应用程序在运行过程中的功能执行信息，获取记录的至少一个功能执行信息，其中，所述模拟器用于模拟用户设备的运行环境；或
接收所述目标应用程序在另一设备上运行过程中记录的至少一个功能执行信息。
可选的，所述至少一个功能执行信息包括：
所述目标应用程序在第一预设时长的运行过程中所记录的至少一个功能执行信息；或，
所述目标应用程序在多次运行过程的目标运行过程所记录的至少一个功能执行信息，所述目标运行过程为所述多个运行过程中所记录信息数量最多的运行过程。
可选的，每个功能执行信息中包括功能标识和功能执行时间，所述生成模 块1520用于：
按照所述至少一个功能执行信息中的功能执行时间，基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，其中，所述功能执行序列由所述多个功能标识组成；及
将所述功能执行序列中的功能标识的转换为像素点，生成所述目标应用程序的功能执行图像。
可选的，所述生成模块1520用于：
基于所述至少一个功能执行信息中的功能执行时间，确定所述至少一个功能执行信息的功能执行顺序，按照所述功能执行顺序，对所述至少一个功能执行信息中的功能标识进行排序，得到功能执行序列。
可选的，所述生成模块1520用于：
基于预设的功能执行信息排列规则，对所述至少一个功能执行信息进行排列，将排列后的至少一个功能执行信息中的功能标识，按照排列后得到的功能执行信息的顺序构成功能执行序列。
可选的，所述确定模块1540用于：
遍历多种病毒类型的病毒图像特征，每遍历一个病毒类型的病毒图像特征，获取所述图像特征和所述病毒类型的病毒图像特征的相似度；及
当相似度最大值大于相似度阈值时，将所述目标应用程序标记为病毒。
可选的，所述图像特征包括多个目标特征向量，所述病毒图像特征包括多个特征向量；
所述确定模块1540用于：
确定所述图像特征的每个目标特征向量与所述病毒类型的病毒图像特征的每个特征向量的向量距离，将小于距离阈值的向量距离的数目，确定为所述图像特征和所述病毒类型的病毒图像特征的相似度。
可选的，所述确定模块1540还用于：
将所述相似度最大值对应的病毒图像特征的病毒类型，确定为所述目标应用程序的目标病毒类型。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本申请实施例中，由于应用程序的病毒具有某些特定的功能执行的行为，即使病毒的源码发生改变，病毒执行的功能一般也不会发生改变，因此，服务 器基于应用程序的功能执行信息进行病毒检测，对于变形的病毒也可以检测出来，具有较强的泛化能力。并且，基于图像提取的特征可靠性较高，本申请实施例利用应用程序的功能执行信息生成功能执行图像，将待检测的应用程序对应的图像特征与病毒图像特征进行对比，可以提高病毒检测的准确性。
需要说明的是：上述实施例提供的应用程序的病毒检测装置在检测病毒时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将服务器的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的应用程序的病毒检测装置与应用程序的病毒检测方法实施例属于同一构思，其具体实现过程详见方法实施例。
基于相同的技术构思，本申请实施例还提供了一种应用程序的病毒检测装置，该装置可以是上述用户设备。如图16所示，该装置包括：
调用模块1610，用于根据对目标应用程序的病毒检测指令，调用模拟器，将所述目标应用程序加载至所述模拟器运行，其中，所述模拟器用于模拟一个隔离的运行环境。
获取模块1620，用于获取所述目标应用程序在运行过程中的功能执行信息，得到至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在所述模拟器中运行时所执行的功能。
发送模块1630，用于向服务器发送病毒检测请求，所述病毒检测请求携带所述至少一个功能执行信息，所述病毒检测请求用于指示所述服务器对所述目标应用程序进行检测。
提示模块1640，用于根据接收到的病毒检测结果，进行病毒提示，所述病毒检测结果基于所述至少一个功能执行信息得到。
可选的，该获取模块1620用于：
获取所述目标应用程序在第一预设时长的运行过程中的功能执行信息；
或，
获取所述目标应用程序在多次运行过程中的功能执行信息，获取所述多次运行过程中目标运行过程所记录的至少一个功能执行信息，所述目标运行过程为所述多个运行过程中所记录信息数量最多的运行过程。
需要说明的是：上述实施例提供的应用程序的病毒检测装置在检测病毒时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上 述功能分配由不同的功能模块完成，即将服务器的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的应用程序的病毒检测装置与应用程序的病毒检测方法实施例属于同一构思，其具体实现过程详见方法实施例。
图17是本申请实施例提供的一种服务器的结构示意图，该服务器1700可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)1701和一个或一个以上的存储器1702，其中，所述存储器1702中存储有至少一条指令，所述至少一条指令由所述处理器1701加载并执行以实现上述应用程序的病毒检测方法步骤，例如可以执行以下步骤：
根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；
根据所述目标应用程序的至少一个功能执行信息，生成所述目标应用程序的功能执行图像；
提取所述功能执行图像的图像特征；及
当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
本申请实施例中，由于应用程序的病毒具有某些特定的功能执行的行为，即使病毒的源码发生改变，病毒执行的功能一般也不会发生改变，因此，服务器基于应用程序的功能执行信息进行病毒检测，对于变形的病毒也可以检测出来，具有较强的泛化能力。并且，基于图像提取的特征可靠性较高，本申请实施例利用应用程序的功能执行信息生成功能执行图像，将待检测的应用程序对应的图像特征与病毒图像特征进行对比，可以提高病毒检测的准确性。
图18是本申请实施例提供的一种终端的结构框图。该终端1800可以是：智能手机、平板电脑、MP3播放器(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3)、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标准音频层面4)播放器、笔记本电脑或台式电脑。终端1800还可能被称为用户设备、便携式终端、膝上型终端、台式终端等其他名称。
通常，终端1800包括有：处理器1801和存储器1802。
处理器1801可以包括一个或多个处理核心，比如4核心处理器、8核心处理器等。处理器1801可以采用DSP(Digital Signal Processing，数字信号处理)、FPGA(Field－Programmable Gate Array，现场可编程门阵列)、PLA(Programmable Logic Array，可编程逻辑阵列)中的至少一种硬件形式来实现。处理器1801也可以包括主处理器和协处理器，主处理器是用于对在唤醒状态下的数据进行处理的处理器，也称CPU(Central Processing Unit，中央处理器)；协处理器是用于对在待机状态下的数据进行处理的低功耗处理器。在一些实施例中，处理器1801可以在集成有GPU(Graphics Processing Unit，图像处理器)，GPU用于负责显示屏所需要显示的内容的渲染和绘制。一些实施例中，处理器1801还可以包括AI(Artificial Intelligence，人工智能)处理器，该AI处理器用于处理有关机器学习的计算操作。
存储器1802可以包括一个或多个计算机可读存储介质，该计算机可读存储介质可以是非暂态的。存储器1802还可包括高速随机存取存储器，以及非易失性存储器，比如一个或多个磁盘存储设备、闪存存储设备。在一些实施例中，存储器1802中的非暂态的计算机可读存储介质用于存储至少一个指令，该至少一个指令用于被处理器1801所执行以实现本申请中方法实施例提供的应用程序的病毒检测方法。
在一些实施例中，终端1800还可选包括有：外围设备接口1803和至少一个外围设备。处理器1801、存储器1802和外围设备接口1803之间可以通过总线或信号线相连。各个外围设备可以通过总线、信号线或电路板与外围设备接口1803相连。具体地，外围设备包括：射频电路1804、触摸显示屏1805、摄像头1806、音频电路1807、定位组件1808和电源1809中的至少一种。
外围设备接口1803可被用于将I/O(Input/Output，输入/输出)相关的至少一个外围设备连接到处理器1801和存储器1802。在一些实施例中，处理器1801、存储器1802和外围设备接口1803被集成在同一芯片或电路板上；在一些其他实施例中，处理器1801、存储器1802和外围设备接口1803中的任意一个或两个可以在单独的芯片或电路板上实现，本实施例对此不加以限定。
射频电路1804用于接收和发射RF(Radio Frequency，射频)信号，也称电磁信号。射频电路1804通过电磁信号与通信网络以及其他通信设备进行通信。射频电路1804将电信号转换为电磁信号进行发送，或者，将接收到的电磁信号转换为电信号。可选地，射频电路1804包括：天线系统、RF收发器、一个或多 个放大器、调谐器、振荡器、数字信号处理器、编解码芯片组、用户身份模块卡等等。射频电路1804可以通过至少一种无线通信协议来与其它终端进行通信。该无线通信协议包括但不限于：城域网、各代移动通信网络(2G、3G、4G及5G)、无线局域网和/或WiFi(Wireless Fidelity，无线保真)网络。在一些实施例中，射频电路1804还可以包括NFC(Near Field Communication，近距离无线通信)有关的电路，本申请对此不加以限定。
显示屏1805用于显示UI(User Interface，用户界面)。该UI可以包括图形、文本、图标、视频及其它们的任意组合。当显示屏1805是触摸显示屏时，显示屏1805还具有采集在显示屏1805的表面或表面上方的触摸信号的能力。该触摸信号可以作为控制信号输入至处理器1801进行处理。此时，显示屏1805还可以用于提供虚拟按钮和/或虚拟键盘，也称软按钮和/或软键盘。在一些实施例中，显示屏1805可以为一个，设置终端1800的前面板；在另一些实施例中，显示屏1805可以为至少两个，分别设置在终端1800的不同表面或呈折叠设计；在再一些实施例中，显示屏1805可以是柔性显示屏，设置在终端1800的弯曲表面上或折叠面上。甚至，显示屏1805还可以设置成非矩形的不规则图形，也即异形屏。显示屏1805可以采用LCD(Liquid Crystal Display，液晶显示屏)、OLED(Organic Light-Emitting Diode,有机发光二极管)等材质制备。
摄像头组件1806用于采集图像或视频。可选地，摄像头组件1806包括前置摄像头和后置摄像头。通常，前置摄像头设置在终端的前面板，后置摄像头设置在终端的背面。在一些实施例中，后置摄像头为至少两个，分别为主摄像头、景深摄像头、广角摄像头、长焦摄像头中的任意一种，以实现主摄像头和景深摄像头融合实现背景虚化功能、主摄像头和广角摄像头融合实现全景拍摄以及VR(Virtual Reality，虚拟现实)拍摄功能或者其它融合拍摄功能。在一些实施例中，摄像头组件1806还可以包括闪光灯。闪光灯可以是单色温闪光灯，也可以是双色温闪光灯。双色温闪光灯是指暖光闪光灯和冷光闪光灯的组合，可以用于不同色温下的光线补偿。
音频电路1807可以包括麦克风和扬声器。麦克风用于采集用户及环境的声波，并将声波转换为电信号输入至处理器1801进行处理，或者输入至射频电路1804以实现语音通信。出于立体声采集或降噪的目的，麦克风可以为多个，分别设置在终端1800的不同部位。麦克风还可以是阵列麦克风或全向采集型麦克风。扬声器则用于将来自处理器1801或射频电路1804的电信号转换为声波。 扬声器可以是传统的薄膜扬声器，也可以是压电陶瓷扬声器。当扬声器是压电陶瓷扬声器时，不仅可以将电信号转换为人类可听见的声波，也可以将电信号转换为人类听不见的声波以进行测距等用途。在一些实施例中，音频电路1807还可以包括耳机插孔。
定位组件1808用于定位终端1800的当前地理位置，以实现导航或LBS(Location Based Service，基于位置的服务)。定位组件1808可以是基于美国的GPS(Global Positioning System，全球定位系统)、中国的北斗系统、俄罗斯的格雷纳斯系统或欧盟的伽利略系统的定位组件。
电源1809用于为终端1800中的各个组件进行供电。电源1809可以是交流电、直流电、一次性电池或可充电电池。当电源1809包括可充电电池时，该可充电电池可以支持有线充电或无线充电。该可充电电池还可以用于支持快充技术。
在一些实施例中，终端1800还包括有一个或多个传感器1810。该一个或多个传感器1810包括但不限于：加速度传感器1811、陀螺仪传感器1812、压力传感器1813、指纹传感器1814、光学传感器1815以及接近传感器1816。
加速度传感器1811可以检测以终端1800建立的坐标系的三个坐标轴上的加速度大小。比如，加速度传感器1811可以用于检测重力加速度在三个坐标轴上的分量。处理器1801可以根据加速度传感器1811采集的重力加速度信号，控制触摸显示屏1805以横向视图或纵向视图进行用户界面的显示。加速度传感器1811还可以用于游戏或者用户的运动数据的采集。
陀螺仪传感器1812可以检测终端1800的机体方向及转动角度，陀螺仪传感器1812可以与加速度传感器1811协同采集用户对终端1800的3D动作。处理器1801根据陀螺仪传感器1812采集的数据，可以实现如下功能：动作感应(比如根据用户的倾斜操作来改变UI)、拍摄时的图像稳定、游戏控制以及惯性导航。
压力传感器1813可以设置在终端1800的侧边框和/或触摸显示屏1805的下层。当压力传感器1813设置在终端1800的侧边框时，可以检测用户对终端1800的握持信号，由处理器1801根据压力传感器1813采集的握持信号进行左右手识别或快捷操作。当压力传感器1813设置在触摸显示屏1805的下层时，由处理器1801根据用户对触摸显示屏1805的压力操作，实现对UI界面上的可操作性控件进行控制。可操作性控件包括按钮控件、滚动条控件、图标控件、 菜单控件中的至少一种。
指纹传感器1814用于采集用户的指纹，由处理器1801根据指纹传感器1814采集到的指纹识别用户的身份，或者，由指纹传感器1814根据采集到的指纹识别用户的身份。在识别出用户的身份为可信身份时，由处理器1801授权该用户执行相关的敏感操作，该敏感操作包括解锁屏幕、查看加密信息、下载软件、支付及更改设置等。指纹传感器1814可以被设置终端1800的正面、背面或侧面。当终端1800上设置有物理按键或厂商Logo时，指纹传感器1814可以与物理按键或厂商Logo集成在一起。
光学传感器1815用于采集环境光强度。在一个实施例中，处理器1801可以根据光学传感器1815采集的环境光强度，控制触摸显示屏1805的显示亮度。具体地，当环境光强度较高时，调高触摸显示屏1805的显示亮度；当环境光强度较低时，调低触摸显示屏1805的显示亮度。在另一个实施例中，处理器1801还可以根据光学传感器1815采集的环境光强度，动态调整摄像头组件1806的拍摄参数。
接近传感器1816，也称距离传感器，通常设置在终端1800的前面板。接近传感器1816用于采集用户与终端1800的正面之间的距离。在一个实施例中，当接近传感器1816检测到用户与终端1800的正面之间的距离逐渐变小时，由处理器1801控制触摸显示屏1805从亮屏状态切换为息屏状态；当接近传感器1816检测到用户与终端1800的正面之间的距离逐渐变大时，由处理器1801控制触摸显示屏1805从息屏状态切换为亮屏状态。
本领域技术人员可以理解，图18中示出的结构并不构成对终端1800的限定，可以包括比图示更多或更少的组件，或者组合某些组件，或者采用不同的组件布置。
在示例性实施例中，还提供了一种计算机可读存储介质，例如包括指令的存储器，上述指令可由设备中的处理器执行以完成上述应用程序的病毒检测方法。例如，所述计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一非易失性计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据 库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可包括只读存储器(ROM)、可编程ROM(PROM)、电可编程ROM(EPROM)、电可擦除可编程ROM(EEPROM)或闪存。易失性存储器可包括随机存取存储器(RAM)或者外部高速缓冲存储器。作为说明而非局限，RAM以多种形式可得，诸如静态RAM(SRAM)、动态RAM(DRAM)、同步DRAM(SDRAM)、双数据率SDRAM(DDRSDRAM)、增强型SDRAM(ESDRAM)、同步链路(Synchlink)DRAM(SLDRAM)、存储器总线(Rambus)直接RAM(RDRAM)、直接存储器总线动态RAM(DRDRAM)、以及存储器总线动态RAM(RDRAM)等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (22)

  1. 一种应用程序的病毒检测方法，由计算机设备执行，包括：
    根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；
    根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；
    提取所述功能执行图像的图像特征；及
    当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
  2. 根据权利要求1所述的方法，其特征在于，每个功能执行信息中包括功能标识，所述根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像，包括：
    将所述功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像还包括：
    基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，其中，所述功能执行序列由所述功能标识组成；
    所述将所述功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像包括：
    将所述功能执行序列中的功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像，所述功能执行图像中，各个像素点的位置根据对应的功能标识在所述功能序列的排序确定。
  4. 根据权利要求3所述的方法，其特征在于，所述根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像包括：
    获取图像尺寸信息，所述图像尺寸信息包括像素点行数以及像素点列数；及
    根据所述图像尺寸信息，对所述像素点对应的目标像素值进行排列，生成对应的像素值矩阵，得到所述目标应用程序的功能执行图像。
  5. 根据权利要求3所述的方法，其特征在于，所述基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，包括：
    按照功能执行顺序、功能标识对应的预设顺序或者功能执行次数中的至少一个，基于所述至少一个功能执行信息中的功能标识，构造功能执行序列。
  6. 根据权利要求5所述的方法，其特征在于，所述基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，包括：
    基于所述至少一个功能执行信息中的功能执行时间，确定所述至少一个功能执行信息的功能执行顺序；及
    按照所述功能执行顺序，对所述至少一个功能执行信息中的功能标识进行排序，得到功能执行序列。
  7. 根据权利要求1所述的方法，其特征在于，所述当所述图像特征和病毒图像特征的相似度大于相似度阈值时，确定所述目标应用程序为病毒，包括：
    获取所述图像特征和病毒类型的病毒图像特征的相似度；及
    当相似度最大值大于相似度阈值时，将所述目标应用程序标记为病毒。
  8. 根据权利要求7所述的方法，其特征在于，所述图像特征包括多个目标特征向量，所述病毒图像特征包括多个特征向量；
    所述获取所述图像特征和病毒类型的病毒图像特征的相似度，包括：
    确定所述图像特征的每个目标特征向量与所述病毒类型的病毒图像特征的特征向量的向量距离，将小于距离阈值的向量距离的数目，确定为所述图像特征和所述病毒类型的病毒图像特征的相似度。
  9. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    将所述相似度最大值对应的病毒图像特征的病毒类型，确定为所述目标应用程序的目标病毒类型。
  10. 根据权利要求1所述的方法，其特征在于，所述获取目标应用程序的至少一个功能执行信息，包括：
    调用模拟器，将所述目标应用程序加载至所述模拟器运行，记录所述目标应用程序在运行过程中的功能执行信息，获取记录的至少一个功能执行信息，其中，所述模拟器用于模拟用户设备的运行环境；或
    接收所述目标应用程序在另一设备上运行过程中记录的至少一个功能执行 信息。
  11. 一种应用程序的病毒检测装置，包括：
    获取模块，用于根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；
    生成模块，用于根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；
    提取模块，用于提取所述功能执行图像的图像特征；及
    确定模块，用于当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
  12. 一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行如下步骤：
    根据对目标应用程序的病毒检测指令，获取所述目标应用程序的至少一个功能执行信息，所述至少一个功能执行信息用于记录所述目标应用程序在运行过程中所执行的功能；
    根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像；
    提取所述功能执行图像的图像特征；及
    当所述图像特征和病毒图像特征的相似度大于相似度阈值时，将所述目标应用程序标记为病毒。
  13. 根据权利要求12所述的计算机设备，其特征在于，每个功能执行信息中包括功能标识，所述根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像，包括：
    将所述功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像。
  14. 根据权利要求13所述的计算机设备，其特征在于，所述根据所述目标应用程序的至少一个功能执行信息，确定目标像素值，根据所述目标像素值生成所述目标应用程序的功能执行图像还包括：
    基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，其中， 所述功能执行序列由所述功能标识组成；
    所述将所述功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像包括：
    将所述功能执行序列中的功能标识转换为像素点对应的目标像素值，根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像，所述功能执行图像中，各个像素点的位置根据对应的功能标识在所述功能序列的排序确定。
  15. 根据权利要求14所述的计算机设备，其特征在于，所述根据所述像素点对应的目标像素值生成所述目标应用程序的功能执行图像包括：
    获取图像尺寸信息，所述图像尺寸信息包括像素点行数以及像素点列数；及
    根据所述图像尺寸信息，对所述像素点对应的目标像素值进行排列，生成对应的像素值矩阵，得到所述目标应用程序的功能执行图像。
  16. 根据权利要求14所述的计算机设备，其特征在于，所述基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，包括：
    按照功能执行顺序、功能标识对应的预设顺序或者功能执行次数中的至少一个，基于所述至少一个功能执行信息中的功能标识，构造功能执行序列。
  17. 根据权利要求16所述的计算机设备，其特征在于，所述基于所述至少一个功能执行信息中的功能标识，构造功能执行序列，包括：
    基于所述至少一个功能执行信息中的功能执行时间，确定所述至少一个功能执行信息的功能执行顺序；及
    按照所述功能执行顺序，对所述至少一个功能执行信息中的功能标识进行排序，得到功能执行序列。
  18. 根据权利要求12所述的计算机设备，其特征在于，所述当所述图像特征和病毒图像特征的相似度大于相似度阈值时，确定所述目标应用程序为病毒，包括：
    获取所述图像特征和病毒类型的病毒图像特征的相似度；及
    当相似度最大值大于相似度阈值时，将所述目标应用程序标记为病毒。
  19. 根据权利要求18所述的计算机设备，其特征在于，所述图像特征包括多个目标特征向量，所述病毒图像特征包括多个特征向量；
    所述获取所述图像特征和病毒类型的病毒图像特征的相似度，包括：
    确定所述图像特征的每个目标特征向量与所述病毒类型的病毒图像特征的特征向量的向量距离，将小于距离阈值的向量距离的数目，确定为所述图像特征和所述病毒类型的病毒图像特征的相似度。
  20. 根据权利要求18所述的计算机设备，其特征在于，所述方法还包括：
    将所述相似度最大值对应的病毒图像特征的病毒类型，确定为所述目标应用程序的目标病毒类型。
  21. 根据权利要求12所述的计算机设备，其特征在于，所述获取目标应用程序的至少一个功能执行信息，包括：
    调用模拟器，将所述目标应用程序加载至所述模拟器运行，记录所述目标应用程序在运行过程中的功能执行信息，获取记录的至少一个功能执行信息，其中，所述模拟器用于模拟用户设备的运行环境；或
    接收所述目标应用程序在另一设备上运行过程中记录的至少一个功能执行信息。
  22. 一个或多个存储有计算机可读指令的非易失性存储介质，所述计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行如权利要求1至10中任一所述的应用程序的病毒检测方法。
PCT/CN2019/103600 2018-09-06 2019-08-30 应用程序的病毒检测方法、装置、计算机设备及存储介质 WO2020048392A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811042877.1A CN109117635B (zh) 2018-09-06 2018-09-06 应用程序的病毒检测方法、装置、计算机设备及存储介质
CN201811042877.1 2018-09-06

Publications (1)

Publication Number Publication Date
WO2020048392A1 true WO2020048392A1 (zh) 2020-03-12

Family

ID=64858175

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/103600 WO2020048392A1 (zh) 2018-09-06 2019-08-30 应用程序的病毒检测方法、装置、计算机设备及存储介质

Country Status (2)

Country Link
CN (1) CN109117635B (zh)
WO (1) WO2020048392A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115033895A (zh) * 2022-08-12 2022-09-09 中国电子科技集团公司第三十研究所 一种二进制程序供应链安全检测方法及装置
CN116956295A (zh) * 2023-09-19 2023-10-27 杭州海康威视数字技术股份有限公司 基于文件图谱拟合的安全检测方法、装置及设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109117635B (zh) * 2018-09-06 2023-07-04 腾讯科技（深圳）有限公司 应用程序的病毒检测方法、装置、计算机设备及存储介质
CN110502900B (zh) * 2019-08-26 2022-07-05 Oppo广东移动通信有限公司 一种检测方法、终端、服务器及计算机存储介质
CN112487428B (zh) * 2020-11-26 2022-03-11 南方电网数字电网研究院有限公司 一种基于区块链的休眠式组合计算机病毒发现方法
CN112668649B (zh) * 2020-12-29 2022-04-22 中国南方电网有限责任公司 一种基于计算机取证的可靠性验证方法、装置和系统
CN112597499B (zh) * 2020-12-30 2024-02-20 北京启明星辰信息安全技术有限公司 一种视频监控设备无损安全检查方法及系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103699843A (zh) * 2013-12-30 2014-04-02 珠海市君天电子科技有限公司 一种恶意行为检测方法及装置
CN105653956A (zh) * 2016-03-02 2016-06-08 中国科学院信息工程研究所 基于动态行为依赖图的Android恶意软件分类方法
CN106096411A (zh) * 2016-06-08 2016-11-09 浙江工业大学 一种基于字节码图像聚类的Android恶意代码家族分类方法
CN106709350A (zh) * 2016-12-30 2017-05-24 腾讯科技（深圳）有限公司 一种病毒检测方法及装置
US20180046802A1 (en) * 2016-08-11 2018-02-15 The Mitre Corporation System and method for detecting malware in mobile device software applications
WO2018060470A1 (en) * 2016-09-30 2018-04-05 AVAST Software s.r.o. System and method utilizing function length statistics to determine file similarity
CN109117635A (zh) * 2018-09-06 2019-01-01 腾讯科技（深圳）有限公司 应用程序的病毒检测方法、装置、计算机设备及存储介质

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7546471B2 (en) * 2005-01-14 2009-06-09 Microsoft Corporation Method and system for virus detection using pattern matching techniques
JP2010097550A (ja) * 2008-10-20 2010-04-30 Intelligent Software:Kk ウイルス防止プログラム、コンピュータに着脱可能な記憶装置、及びウイルス防止方法
JP4788808B2 (ja) * 2009-08-06 2011-10-05 コニカミノルタビジネステクノロジーズ株式会社 ジョブ処理システム、画像処理装置、ウイルス検出方法およびウイルス検出プログラム
US8806644B1 (en) * 2012-05-25 2014-08-12 Symantec Corporation Using expectation measures to identify relevant application analysis results
JP2015191458A (ja) * 2014-03-28 2015-11-02 エヌ・ティ・ティ・ソフトウェア株式会社 ファイル危険性判定装置、ファイル危険性判定方法、及びプログラム
CN104572821B (zh) * 2014-12-03 2016-12-14 深圳市腾讯计算机系统有限公司 一种文件处理方法及装置
CN106960153B (zh) * 2016-01-12 2021-01-29 阿里巴巴集团控股有限公司 病毒的类型识别方法及装置
CN107657175A (zh) * 2017-09-15 2018-02-02 北京理工大学 一种基于图像特征描述子的恶意样本同源检测方法
CN108268778B (zh) * 2018-02-26 2023-06-23 腾讯科技（深圳）有限公司 数据处理方法、装置及存储介质
CN108334781B (zh) * 2018-03-07 2020-04-14 腾讯科技（深圳）有限公司 病毒检测方法、装置、计算机可读存储介质和计算机设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103699843A (zh) * 2013-12-30 2014-04-02 珠海市君天电子科技有限公司 一种恶意行为检测方法及装置
CN105653956A (zh) * 2016-03-02 2016-06-08 中国科学院信息工程研究所 基于动态行为依赖图的Android恶意软件分类方法
CN106096411A (zh) * 2016-06-08 2016-11-09 浙江工业大学 一种基于字节码图像聚类的Android恶意代码家族分类方法
US20180046802A1 (en) * 2016-08-11 2018-02-15 The Mitre Corporation System and method for detecting malware in mobile device software applications
WO2018060470A1 (en) * 2016-09-30 2018-04-05 AVAST Software s.r.o. System and method utilizing function length statistics to determine file similarity
CN106709350A (zh) * 2016-12-30 2017-05-24 腾讯科技（深圳）有限公司 一种病毒检测方法及装置
CN109117635A (zh) * 2018-09-06 2019-01-01 腾讯科技（深圳）有限公司 应用程序的病毒检测方法、装置、计算机设备及存储介质

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115033895A (zh) * 2022-08-12 2022-09-09 中国电子科技集团公司第三十研究所 一种二进制程序供应链安全检测方法及装置
CN115033895B (zh) * 2022-08-12 2022-12-09 中国电子科技集团公司第三十研究所 一种二进制程序供应链安全检测方法及装置
CN116956295A (zh) * 2023-09-19 2023-10-27 杭州海康威视数字技术股份有限公司 基于文件图谱拟合的安全检测方法、装置及设备
CN116956295B (zh) * 2023-09-19 2024-01-05 杭州海康威视数字技术股份有限公司 基于文件图谱拟合的安全检测方法、装置及设备

Also Published As

Publication number Publication date
CN109117635A (zh) 2019-01-01
CN109117635B (zh) 2023-07-04

Similar Documents

Publication Publication Date Title
WO2020048392A1 (zh) 应用程序的病毒检测方法、装置、计算机设备及存储介质
WO2020019873A1 (zh) 图像处理方法、装置、终端及计算机可读存储介质
CN108924737B (zh) 定位方法、装置、设备及计算机可读存储介质
US10181203B2 (en) Method for processing image data and apparatus for the same
CN108833262B (zh) 会话处理方法、装置、终端及存储介质
CN110059686B (zh) 字符识别方法、装置、设备及可读存储介质
WO2019105237A1 (zh) 图像处理方法、计算机设备和计算机可读存储介质
CN111753784A (zh) 视频的特效处理方法、装置、终端及存储介质
CN111104980B (zh) 确定分类结果的方法、装置、设备及存储介质
US10909420B2 (en) Method and apparatus for continuously displaying images on basis of similarity of images
CN112084811A (zh) 身份信息的确定方法、装置及存储介质
CN111192072A (zh) 用户分群方法及装置、存储介质
EP3511840A1 (en) Data processing method, electronic device, and computer-readable storage medium
US11070736B2 (en) Electronic device and image processing method thereof
CN111563201A (zh) 内容推送方法、装置、服务器及存储介质
CN113987326B (zh) 资源推荐方法、装置、计算机设备及介质
CN107944024B (zh) 一种确定音频文件的方法和装置
CN112560612B (zh) 确定业务算法的系统、方法、计算机设备及存储介质
CN113051485B (zh) 群组搜索方法、装置、终端及存储介质
CN112905328B (zh) 任务处理方法、装置及计算机可读存储介质
CN112001442B (zh) 特征检测方法、装置、计算机设备及存储介质
KR20230000932A (ko) 이미지를 분석하는 방법 및 분석 장치
CN114817709A (zh) 排序方法、装置、设备及计算机可读存储介质
CN107194363B (zh) 图像饱和度处理方法、装置、存储介质及计算机设备
CN112749583A (zh) 人脸图像分组方法、装置、计算机设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19857350

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19857350

Country of ref document: EP

Kind code of ref document: A1