CN119691732B - Method for determining application security, electronic device, and computer-readable storage medium - Google Patents

Abstract

This application discloses a method, electronic device, and computer-readable storage medium for determining application security, belonging to the field of the Internet. The method for determining application security includes: obtaining target information of a target application deployed in a sandbox environment, the target information reflecting the behavioral characteristics of the target application, wherein the target application is an application intended for installation on a cloud phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. This application is used to determine the security of applications.

Description

Methods, electronic devices, and computer-readable storage media for determining application security

Technical Field

This application belongs to the Internet field and specifically relates to a method for determining application security, an electronic device, and a computer-readable storage medium.

Background Technology

A cloud phone is a virtual phone that runs in the cloud. The principle of a cloud phone is to use virtual machines and other technologies on a server to allocate resources such as CPU and memory, install various operating systems of a mobile phone, and virtualize information such as Wi-Fi Media Access Control (MAC) and International Mobile Equipment Identity (IMEI) to create a virtual simulation of a mobile phone.

In related technologies, newly uploaded applications are generally deployed directly to the user's cloud phone. However, if the user-uploaded application is a malicious application with potential risks, directly deploying it on the cloud phone may expose the cloud phone to security vulnerabilities.

Therefore, a method is needed to determine application security and address the security risks associated with applications to be deployed on cloud phones.

Summary of the Invention

This application provides a method, electronic device, and computer-readable storage medium for determining application security, which can solve the problem of security risks in applications to be deployed on cloud phones.

In a first aspect, embodiments of this application provide a method for determining application security, including:

Obtain target information of a target application deployed in a sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

The target information is input into the target machine learning model;

Based on the target machine learning model, the security of the target application is determined.

Secondly, embodiments of this application provide an apparatus for determining application security, comprising:

The acquisition module is used to acquire target information of a target application deployed in a sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

The processing module is used to input the target information into the target machine learning model; and based on the target machine learning model, to determine the security of the target application.

Thirdly, embodiments of this application provide an electronic device including a processor and a memory, wherein the memory stores programs or instructions executable on the processor, and the programs or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

Fourthly, embodiments of this application provide a computer-readable storage medium on which a program or instructions are stored, which, when executed, implement the steps of the method described in the first aspect.

Fifthly, embodiments of this application provide a computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies.

Attached Figure Description

To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

Figure 1 is a flowchart of a method for determining application security provided in an embodiment of this application;

Figure 2 is a flowchart of another method for determining application security provided in an embodiment of this application;

Figure 3 is a flowchart of another method for determining application security provided in an embodiment of this application;

Figure 4 is a flowchart of another method for determining application security provided in an embodiment of this application;

Figure 5 is a structural block diagram of an apparatus for determining application security provided in an embodiment of this application;

Figure 6 is a schematic diagram of an electronic device provided in an embodiment of this application.

Detailed Implementation

The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and/or" indicates at least one of the connected objects, and the character "/" generally indicates that the preceding and following objects are in an "or" relationship.

The method for determining application security provided in this application embodiment is applied to cloud phone services, specifically, it can be used to allocate server nodes for providing cloud phone service functions to target users. Specifically, when a target user uploads a new application to the cloud phone for installation, the application is first deployed and run in a sandbox environment. A security check is performed on the deployed application simultaneously. After security is verified, the application is then migrated to the normal operating environment of the user's cloud phone. This ensures that only secure target applications are deployed on the cloud phone, addressing the security risks associated with applications deployed on cloud phones in related technologies.

The method for determining application security provided in this application embodiment is executed by a target device, which can be a single electronic device or multiple electronic devices. That is, the method for implementing a cloud phone provided in this application embodiment can be executed by a single electronic device, which can be a server, such as a standalone physical server, a server cluster consisting of multiple servers, or a cloud server capable of cloud computing. When the method for determining application security provided in this application embodiment is executed by multiple electronic devices, these multiple electronic devices can form a service cluster, and they cooperate to complete each step.

The method for determining application security provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

Figure 1 is a flowchart of a method for determining application security according to an embodiment of this application. Referring to Figure 1, a method for determining application security according to an embodiment of this application may include:

Step 110: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

In this embodiment of the application, the sandbox environment is an isolated testing environment that allows software, programs, or code to run in a closed setup environment without affecting external systems or environments.

Because sandboxes provide an isolated environment, installing the target application within them primarily isolates it from the normal cloud phone environment. Aside from this, there are no other differences between a sandbox and a normal cloud phone; users can operate the target application within the sandbox. To facilitate observation of the target application's behavior, embodiments of this application can install frequently used applications within the sandbox, simulating user data (such as SMS messages, contacts, call logs, photos, etc.), and temporarily granting permissions to the applications.

The target application in this embodiment is the application to be installed on the cloud phone. Step 110 can be performed before installing the target application on the cloud phone.

Step 120: Input the target information into the target machine learning model;

The target machine learning model in this application embodiment can be a machine learning model obtained through training. In one embodiment, the target machine learning model is a machine learning model that has been trained. The target machine learning model in this application embodiment can be a gradient boosting model, such as the Lightweight Gradient Boosting Model (LightGBM). LightGBM is an efficient and scalable machine learning algorithm based on Gradient Boosted Decision Trees (GBDT), and is a member of the GBDT framework.

The target information in this application embodiment may include multiple target sequences obtained based on multiple unit time periods; wherein, one unit time period corresponds to one target sequence, and the unit time period can be 1 hour or 1 minute, etc. When the target application is a single isolated application (for example, an application compiled/modified by the target user and not used by other users), a self-sliding method can be used to collect multiple target sequences of the target application over multiple unit time periods. For example, on the timeline of monitoring the target application, a one-day period is used as the sliding window, moving in steps of 1 hour (i.e., one unit time period). Each movement yields one target sequence of the target application; after 24 movements, 24 target sequences are obtained.

The target information in this embodiment may also include an average value sequence, which is obtained based on the average of the target values of the multiple applications, and the target values of the multiple applications are obtained based on the same unit of time. When the target application is not an isolated application, the target application can be multiple applications running simultaneously in a sandbox environment, and these multiple applications can be the same application. A sliding method can be used to collect the target values of multiple applications within the same unit of time. For example, if the unit of time is 1 hour, the target values of the multiple applications within that 1 hour can be obtained. If the number of the same application running simultaneously is 5, then 5 target values can be obtained, and the average of these 5 target values can then be calculated to obtain the average value sequence.

The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values reflecting the behavioral characteristics of the target application.

In one specific embodiment, the target sequence includes: a sequence of flags indicating target users logging into the cloud phone within a unit period; a sequence of flags indicating target applications requesting permissions in the cloud phone within a unit period; a sequence of usage frequency of specified permissions in the cloud phone within a unit period; a sequence of usage frequency deviation of specified permissions in the cloud phone within a unit period; an arithmetic sequence of usage of specified permissions in the cloud phone within a unit period; a sequence of arithmetic deviation of usage of specified permissions in the cloud phone within a unit period; a sequence of the number of times other applications in the cloud phone besides the target application are called within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times a website is accessed within a unit period; a sequence of the number of times a website is accessed within a unit period; and a sequence of the amount of data accessed on the website within a unit period.

Step 130: Determine the security of the target application based on the target machine learning model.

The output of the target machine learning model can be a probability value. The security of the target application can be determined based on the probability value output by the target machine learning model. Specifically, the probability value output by the target machine learning model can be compared with a threshold, which can be a threshold set for malicious applications. If the probability value output by the target machine learning model is greater than or equal to the threshold, the target application can be determined to be a malicious application; if the probability value output by the target machine learning model is less than the threshold, the target application can be determined to be a safe application.

In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies.

Figure 2 is a flowchart of a method for determining application security according to an embodiment of this application. Referring to Figure 2, a method for determining application security according to an embodiment of this application may include:

Step 210: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

In this embodiment, before step 210, the target application uploaded by the target user can be received first. If the target application uploaded by the target user meets the target conditions, the target application is then deployed in the sandbox environment. That is, the target application deployed in the sandbox environment is an application that meets the target conditions. The target conditions in this embodiment can be set as needed. In a specific embodiment, it can be determined whether the message digest algorithm of the target application's installation package meets the target conditions. Specifically, it can be determined whether the message digest algorithm (e.g., MD5) of the target application's installation package appears in the unknown list or the malicious list. If the message digest algorithm (e.g., MD5) of the target application's installation package appears in the unknown list or the malicious list, the target application can be deployed in the sandbox environment, thereby obtaining the target information of the target application deployed in the sandbox environment. The unknown list initially consists of the MD5 hashes of the APK packages of risky applications published by some security websites. Subsequently, when an application in the unknown list is proven to be risky, the MD5 hash of the application's APK package is moved to the malicious list. Applications in the malicious list are applications that are prohibited from being installed on cloud phones. Applications in the unknown list are applications that need to be deployed in the sandbox environment for security verification. If the target application is verified as a secure application through the sandbox environment, it can be added to the security list.

Step 220: Input the target information into the target machine learning model;

Step 230: Determine the security of the target application based on the target machine learning model;

Step 240: If the target application is determined to be a secure application, the target application is installed on the cloud phone;

Step 250: If the target application is determined to be a malicious application, prompt the user to remove the target application.

In this embodiment of the application, if the target application is a malicious application, the installation of the target application on the cloud phone is prohibited.

In addition, if a safe application, an unknown application, and a malicious application are maintained, the target application can be moved to the safe application list if it is a safe application, and to the malicious application list if it is a malicious application.

Steps 210-230 can be referred to the previous description.

In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies.

Figure 3 is a flowchart of a method for determining application security provided in an embodiment of this application. Referring to Figure 3, a method for determining application security provided in an embodiment of this application may include:

Step 310: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application. The target information includes multiple target sequences obtained based on multiple unit time periods; wherein, one unit time period corresponds to one target sequence; the target application is an application used to install on a cloud phone.

In this embodiment, the target application can be a single application running in a sandbox environment. Multiple target sequences of the target application can be collected over multiple time units using a self-sliding method. For example, on the timeline of the monitored target application, a one-day period is used as the sliding window, moving in steps of one hour (i.e., one unit of time). Each movement yields one target sequence of the target application; after 24 movements, 24 target sequences are obtained.

The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values reflecting the behavioral characteristics of the target application.

Step 320: Input the multiple target sequences into the target machine learning model;

Step 330: Based on the target machine learning model, determine multiple probability values corresponding to the multiple target sequences;

In this embodiment, the number of target sequences can be the same as the number of probability values obtained based on the target machine learning model. For example, when 24 target sequences are input into the target machine learning model, 24 probability values corresponding to the 24 target sequences can be obtained.

Step 340: Based on the plurality of probability values, determine a first probability range, wherein the first probability range indicates the probability range of the target application's normal operation.

In this embodiment, step 340, determining the first probability range based on the plurality of probability values, may include: determining the average and standard deviation of the plurality of probability values; and determining the first probability range based on the average and standard deviation. The minimum value of the first probability range is the difference between the average and the standard deviation, and the maximum value is the sum of the average and the standard deviation. Thus, the first probability range can be determined using the average and standard deviation, ensuring that the obtained first probability range conforms to mathematical laws and is more accurate.

Step 350: Based on the first probability range, determine a second probability range and a third probability range, wherein the minimum value of the second probability range is greater than or equal to the maximum value of the first probability range, and the maximum value of the third probability range is less than or equal to the minimum value of the first probability range.

In this embodiment of the application, the second probability range can be a range greater than or equal to the maximum value of the first probability range, and the third probability range can be a range less than or equal to the minimum value of the first probability range.

Step 360: Obtain at least one first probability value and at least one second probability value; the at least one first probability value is all probability values among the plurality of probability values that fall within the second probability range, and the at least one second probability value is all probability values among the plurality of probability values that fall within the third probability range;

Step 370: Determine at least one target probability value, wherein the at least one target probability value is the larger of the at least one first probability value and the at least one second probability value;

In this embodiment of the application, if the plurality of probability values are the 24 probability values mentioned above, and among these 24 probability values, 4 probability values fall within the second probability range and 5 probability values fall within the third probability range, then the 5 probability values falling within the third probability range are determined as 5 target probability values.

Step 380: Calculate the average value of the at least one target probability value;

Step 390: Determine the security of the target application based on the average of the at least one target probability value;

In this embodiment, the security of a target application can be determined by comparing the average of the at least one target probability value with a threshold. The threshold can be set as needed, for example, a threshold of 0.5. If the average of the at least one target probability value is greater than or equal to the threshold, the target application is determined to be a malicious application; if the average of the at least one target probability value is less than the threshold, the target application is determined to be a safe application.

In this embodiment of the application, if the target application is determined to be a safe application, the target application can be installed on the cloud phone; if the target application is determined to be a malicious application, a prompt can be made to remove the target application.

In this embodiment, before deploying the target application on a cloud phone, target information of the target application is obtained through a sandbox environment. Based on the target machine learning model and the target information, the security of the target application is determined. This allows for the assessment of the target application's security before deployment on the cloud phone, ensuring that only applications deemed secure are deployed, thus addressing the security risks associated with applications deployed on cloud phones. Furthermore, in determining the security of the target application based on the target machine learning model, considering a second and third probability range—both of which better reflect the malicious nature of the target application—ensures a more accurate assessment of its security. Moreover, for probability values falling within the second and third probability ranges, a voting mechanism and an averaging algorithm are introduced to further ensure the accuracy of the results.

Figure 4 is a flowchart of a method for determining application security provided in an embodiment of this application. Referring to Figure 4, a method for determining application security provided in an embodiment of this application may include:

Step 410: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application. The target application consists of multiple applications running simultaneously in the sandbox environment and is used to install on a cloud phone. The target information includes an average value sequence, which is obtained based on the average of the target sequences of the multiple applications. The target sequences of the multiple applications are obtained based on the same unit of time.

In this embodiment, the target application can be multiple applications running in a sandbox environment. These multiple applications can be the same application. Multiple target sequences of these multiple applications within the same unit of time can be collected using an interleaved sliding method. For example, if the unit of time is 1 hour, the target sequences of these multiple applications within that 1 hour can be obtained. If the number of the same application running simultaneously is 5, then 5 target sequences can be obtained. The average of these 5 target sequences can then be calculated to obtain the average sequence.

The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values reflecting the behavioral characteristics of the target application.

Step 420: Input the average value sequence into the target machine learning model;

Step 430: Based on the target machine learning model, determine the third probability value corresponding to the average value sequence;

Step 440: For each of the plurality of applications, determine the fourth probability value corresponding to the application based on the target machine learning model;

Step 450: Determine the total probability value based on the third probability value and the fourth probability value;

In this embodiment, step 450 can determine the total probability value as follows: determine the product of a third probability value and a first weight as a first result; determine the product of a fourth probability value and a second weight as a second result; and sum the first result and the second result to determine the total probability value; wherein the first weight is less than the second weight. Thus, since the first weight is less than the second weight, the differences between various applications can be reflected, ensuring that the obtained total probability value reflects individual differences.

Step 460: Determine the security of the application based on the total probability value;

In this embodiment, the security of an application can be determined by comparing the total probability value with a preset threshold. In one embodiment, step 460 can determine the security of an application as follows: if the total probability value is greater than or equal to the preset threshold, the application is determined to be a secure application; if the total probability value is less than the preset threshold, the application is determined to be a malicious application. The preset threshold can be set as needed, for example, a preset threshold of 0.5.

Step 470: Determine the security of the target application based on the security of each of the multiple applications;

In this embodiment, step 470, determining the security of the target application based on the security of each of the plurality of applications, may include: determining the target application as a secure application if each of the plurality of applications is a secure application; and determining the target application as a malicious application if at least one malicious application exists among the plurality of applications. This approach can largely eliminate malicious applications and ensure a high degree of reliability in determining the security of the target application.

In this embodiment of the application, if the target application is determined to be a safe application, the target application is installed on the cloud phone; if the target application is determined to be a malicious application, a prompt may be made to remove the target application.

In this embodiment, before deploying the target application on a cloud phone, target information of the target application is obtained through a sandbox environment. Based on the target machine learning model and the target information, the security of the target application is determined. This allows for the assessment of the target application's security before deployment on the cloud phone; only applications deemed secure are deployed, thus addressing the security risks associated with applications deployed on cloud phones. Furthermore, in determining the security of the target application based on the target machine learning model, the third probability value corresponding to the average sequence and the fourth probability value corresponding to each application are comprehensively considered. This approach considers both the overall and individual circumstances, ensuring that the obtained total probability value is more targeted and further guaranteeing the accuracy of the results.

The method for determining application (APP) security provided in this application will be further discussed below with detailed examples. It should be understood that the following discussion is merely illustrative, and the content below can be combined with the various embodiments described in the accompanying drawings without conflict.

In this application embodiment, three lists can be maintained. The first list is a security list, which records the MD5 hash of the APK package of a secure application. The second list is an unknown list, which records the MD5 hash of the APK package of an application for which no risk is clearly defined. The third list is a malicious list, which records the MD5 hash of the APK package of a malicious application.

The first list can initially collect the MD5 hashes of security applications published by major manufacturers or app stores. Considering that some users may try using previous applications, the MD5 hashes of the APK packages of various versions of security applications are recorded in the first list. When an application in the second list is proven to be secure, the MD5 hash of that application's APK package is moved to the first list.

The second list, the Unknown List, initially consists of the MD5 hashes of the APK packages of risky applications published by some security websites. Subsequently, when an application in the second list is proven to be risky, the MD5 hash of that application's APK package is moved to the third list, the Malicious List.

When a target user uploads an application's APK package to a cloud phone, an MD5 hash is generated for the APK package. This MD5 hash is then compared to a first, second, and third list of malicious listings. If the first list is matched, the application is allowed to be installed on the user's cloud phone. If the second list (unknown list) is matched, the application is installed in a sandbox, and its icon is displayed on the user's cloud phone to indicate that it has been installed. If the third list (malicious list) is matched, installation is prohibited. If none of the lists are matched, antivirus software scans the application. If the antivirus software flags a risk, the MD5 hash is added to the second list (unknown list), the application is installed in a sandbox, and its icon is displayed on the user's cloud phone to indicate that it has been installed.

For target applications installed in a sandbox, target information reflecting the behavioral characteristics of the target application can be obtained through observation and detection without parsing the internal code of the malicious target application. Specifically, malicious applications generally exhibit the following autonomous behaviors: first, illegally requesting permissions on the phone to illegally collect user data from the phone; second, illegally calling other applications on the phone to illegally collect user data from those applications; and third, illegally accessing websites and transmitting user data.

Since users may also exhibit the aforementioned behaviors when operating security applications, and there are no obvious differences between the two, relying solely on characteristic values of application-specific behaviors, such as static thresholds, year-on-year thresholds, and predicted values, to set comparison strategies can lead to certain biases in detection.

In view of this, the embodiments of this application treat the detection of secure applications and malicious applications as a binary classification problem, and innovatively design comprehensive features for the behavior of applications. LightGBM (Light Gradient Boosting Machine) is used to detect secure applications and malicious applications, and the results are smoothed. While consuming low resources, it achieves high accuracy and recall.

The process of constructing the target sequence is discussed below. Using a 1-day sampling period, and setting the sampling frequency to 1 minute within that day, the following sequences were collected from the application to reflect the characteristics of its behavior:

1. Sequence A: The sequence of flags indicating when a target user logs into the cloud phone within a unit period.

Sequence A is the flag sequence for user login to the cloud phone. If the user's login time is greater than or equal to 1/2 within 1 minute, it is considered that the user has logged into the cloud phone within 1 minute, and the value of the sampling point is set to 1. If the user's login time is less than 1/2, it is considered that the user has not logged into the cloud phone within 1 minute, and the value of the sampling point is set to 0.

Normal user use of the application will have a certain impact on the application's behavior. Therefore, the time users spend using cloud phones can be considered as a characteristic of application behavior.

2. Sequence B: A sequence of flags indicating permissions requested by the target application in the cloud phone within a unit period.

Sequence B is a sequence of n permissions in the cloud phone. If the application requests a certain permission among the n permissions, the value corresponding to that permission is set to 1; if the application does not request a certain permission, the value corresponding to that permission is set to 0. Here, n is a positive integer.

3. Sequence _C1 ~ _Cn : The frequency sequence of specified permissions used in the cloud phone within a unit period.

Wherein, sequence C _{_i} (i∈n) is the frequency sequence of the i-th permission in the cloud phone. Within 1 minute, the number of times the application uses the i-th permission is counted to form sequence C _{_i} .

4. Sequence _C1 '~ _Cn ': Frequency deviation sequence of specified permissions used in the cloud phone within a unit period.

The sequence C _{_i}' (i∈n) is the frequency deviation sequence of the i-th permission in the cloud phone, which reflects the difference in frequency between the current application's permission and the normal application's permission.

For some typical security applications on the market, especially super apps of different categories, such as well-known apps in the map category and well-known apps in the chat category, these applications have relatively standardized behavior and can be used as a reference. For k well-known apps (where k is an integer greater than 1), we statistically analyze _C1 to _Cn according to point 3, obtaining k groups of _C1 to _Cn . Then, we take the average of these k groups of _C1 to _Cn to obtain _C1avg to _Cnavg . We then subtract the corresponding _C1avg to _Cnavg from _C1 to _Cn and take the absolute value to obtain _C1 ' to _Cn '. Taking _C1 as an example, the average value of C1 is _C1avg . Subtracting _C1avg from _C1 gives a difference. Taking the absolute value of this difference gives _C1 '.

5. Sequences _D1 ~ _Dn : Arithmetic sequences for specifying permissions in the cloud phone within a unit period.

The sequence _Di (i∈n) is the arithmetic sequence of the use of the i-th permission in the cloud phone. Within 1 minute, the number of times the current application uses the i-th permission is counted. If the number is greater than or equal to the threshold r, the sampling point of the 1 minute is set to 1. If the number is less than the threshold r, the sampling point of the 1 minute is set to 0, thus forming the sequence _Di.

6. _D1 '~ _Dn ': The arithmetic deviation sequence of specified permissions in the cloud phone within a unit period.

The sequence D _{_i} ' (i∈n) is the arithmetic deviation sequence of the i-th permission in the cloud phone, which reflects the arithmetic difference between the current application's permission and the normal application's permission.

For some typical security applications on the market, especially super apps of different categories, such as well-known apps in the map category and well-known apps in the chat category, these applications have relatively standardized behavior and can be used as a reference. For k well-known apps (where k is an integer greater than 1), we statistically analyze _D1 to _Dn according to point 5, obtaining k groups of _D1 to _Dn . Then, we take the average of these k groups of _D1 to _Dn to obtain _D1avg to _Dnavg . We then subtract _D1avg to _Dnavg from each of _D1 to _Dn and take the absolute value to obtain _D1 ' to _Dn '. Taking _D1 as an example, the average value corresponding to D1 is _D1avg . Subtracting _D1avg from _D1 gives a difference, and taking the absolute value of this difference gives _D1 '.

7. Sequence E: The sequence of the number of times other applications in the cloud phone besides the target application are called within a unit period.

Sequence E is the sequence of the number of times the current application calls other applications on the cloud phone. Within 1 minute, the number of times the current application calls other applications is counted to form sequence E.

8. Sequence _F1 ~ _Fm : The sequence of the number of times a specified type of application in the cloud phone is invoked within a unit period.

The other applications of the cloud phone are divided into m categories. The sequence _Fj (j∈m) is the sequence of the number of times the application of the j-th category in the cloud phone is called. Within 1 minute, the number of times the application calls the application of the j-th category in the cloud phone is counted to form the sequence F.

9. Sequence _F1 '~ _Fm ': The deviation sequence of the number of times a specified type of application in the cloud phone is called within a unit period.

The sequence _Fj ' (j∈m) is the deviation sequence of the number of times the application of the j-th category in the cloud phone is called, which reflects the difference in the number of times the current application calls other applications and the normal application calls other applications.

For some typical security applications on the market, especially super apps of different categories, such as well-known apps in the map category and well-known apps in the chat category, these applications have relatively standardized behavior and can be used as a reference. For k well-known apps (where k is an integer greater than 1), calculate _F1 ~ _Fm according to point 5, obtaining k groups of _F1 ~ _Fm . Then, average these k groups of _F1 ~ _Fm to obtain _F1avg ~ _Fmavg . Subtract _F1avg ~ _Fmavg from _F1 ~ _Fm and take the absolute value to obtain _F1 ' ~ _Fm '. Taking _F1 as an example, the average value corresponding to F1 is _F1avg . Subtracting _F1avg from _F1 gives a difference. Taking the absolute value of this difference gives _F1 '.

10. Sequence G: The sequence of website visits within a unit period.

Sequence G is a sequence of website accesses. Within one minute, the number of times the current application accesses the website is counted to form sequence G.

11. Sequence G': The sequence of deviations in the number of website visits within a unit period.

Sequence G' is the deviation sequence of the number of times the website is accessed, which reflects the difference in the number of times the current application accesses the website compared to the number of times a normal application accesses the website.

For some typical security applications on the market, especially super apps of different categories, such as well-known apps in the map category and well-known apps in the chat category, the behavior of these apps is relatively standardized and can be used as a reference. For k well-known apps (where k is an integer greater than 1), we calculate G according to point 10, and get k groups of G. Then we take the average of these k groups of G to get _{G_avg} . We subtract _{G_avg} from G and take the absolute value to get G'.

12. Sequence H: The sequence of data accessed to the website within a unit period.

Sequence H is the data volume sequence of the website access. Within 1 minute, the size of the data packets accessed by the current application to the website is counted to form sequence H.

In this embodiment, at least one of the 12 sequences obtained above can be selected as the target sequence. For various applications, at least one of these 12 sequences can be obtained using the above method. For example, these 12 sequences can be collected as samples for security applications and malicious applications respectively, and a model (e.g., LightGBM) can be trained to achieve binary classification.

After training the model, it can be used to determine the application's security. Specifically, when monitoring a target application in a sandbox, behavioral characteristics (at least one of the 12 sequences mentioned above) are collected from the target application according to specifications. These behavioral characteristics are then input into the model, which outputs a probability value indicating whether the target application is malicious. For example, if the probability value is greater than or equal to 0.5, the target application is determined to be malicious. If the probability value is less than 0.5, the target application is determined to be safe.

Although analyzing the behavior of an application from multiple behavioral features can ensure a high level of detection accuracy, the behavior of an application is somewhat random. Judging whether an application is malicious or safe based on a single detection still has a certain false positive rate. Therefore, the embodiments of this application use a sliding method to smooth the results of application detection in order to reduce the false positive rate.

In the embodiments of this application, the sliding method is divided into self-sliding and mutual sliding.

In this embodiment, a self-sliding method can be used to determine the security of the target application. This will be described in detail below.

Self-sliding is used when the application is a unique copy, such as one compiled/modified by the user and not shared with other users. In this case, for a given MD5 hash, the sandbox only runs one application in real time. For example, on the timeline of the monitored application, a one-day period is used as the sliding window, moving in one-hour increments. Each time it moves, a probability value is calculated using the sequence in the window according to the above process. After 24 moves, 24 probability values are obtained.

In some cases, user actions on the application and the application's own actions follow a normal distribution. The mean μ and standard deviation σ are calculated for 24 probability values. The mean μ determines the center of the distribution, and the standard deviation σ determines the height and width of the distribution. In this embodiment, μ±σ can be taken as the filtering range of features (the first probability range). The probability of a probability value falling within μ±σ is 0.6826. Considering that a user's active login to the cloud phone and application actions are short-lived, the probability value within μ±σ is usually calculated from the application's own actions.

In many situations, user actions can activate malicious behavior in applications. For example, intercepting and sending user-entered passwords, or overusing user-authorized permissions. To address this, we filter out probability values above μ±σ, forming the first set (i.e., the second probability range), and filter out probability values below μ±σ, forming the second set (i.e., the third probability range). The first and second sets are primarily probability values calculated based on user actions during application operation. These probability values are more effective in reflecting the malicious nature of applications during security/maliciousness detection.

Considering the randomness of the application's behavior, embodiments of this application can use a voting mechanism to decide whether to use the first set or the second set. Specifically, the number of probability values in the first set (i.e., the number of first probability values) and the number of probability values in the second set (i.e., the number of second probability values) can be counted and compared.

If the number of probability values in the first set is greater than the number of probability values in the second set, then the first set is considered the primary set, and the average of the probability values in the first set is calculated. If the number of probability values in the first set is less than the number of probability values in the second set, then the second set is considered the primary set, and the average of the probability values in the second set is calculated. If the average is greater than or equal to 0.5, the application is determined to be malicious. If the average is less than 0.5, the application is determined to be secure.

In this embodiment, a sliding method can also be used to determine the security of the target application. This will be described in detail below.

Inter-sliding is used when the application is not an isolated copy. This application may be a cracked application, a newly released illegal application, etc. In this case, for a specified MD5, the sandbox runs multiple applications simultaneously.

The average sequence is obtained by averaging the target sequences of multiple applications (i.e., at least one of the 12 sequences above). The average sequence is then input into a model (e.g., LightGBM), which outputs the probability value of maliciousness.

In the embodiments of this application, the total probability value can be calculated according to the following formula:

S = _αS₁ + _βS₂

Where S is the total probability value, _S1 is the probability value calculated by applying its own sequence (i.e., the fourth probability value), _S2 is the probability value calculated by averaging the sequences of multiple applications (i.e., the third probability value), α is the second weight, and β is the first weight.

In this embodiment, if the total probability value is greater than or equal to 0.5, the application is determined to be a malicious application. If the total probability value is less than 0.5, the application is determined to be a safe application. Furthermore, if any application is evaluated as a malicious application, then that application is ultimately determined to be a malicious application. If all applications are evaluated as safe applications, then that application is ultimately determined to be a safe application.

For security applications, officially install them on the user's cloud phone to ensure normal service support and a normal user experience. For malicious applications, prompt the user to remove the application and prohibit its installation on the cloud phone.

As can be seen from the above, the method for determining the security of cloud phones provided in this application embodiment first runs applications with unclear risks in a sandbox environment. Only after confirming the application's security is it transferred to the cloud phone. This ensures a good user experience while also guaranteeing the security of the cloud phone, effectively preventing Trojan programs from directly affecting cloud phone data. Furthermore, this application embodiment can construct feature sequences from multiple dimensions to comprehensively describe the application's behavior. A sliding method is provided to process the detection results, enabling a reliable security strategy to perform security detection on sandboxed applications, ensuring application security and protecting the security of the cloud phone.

Figure 5 is a structural block diagram of an apparatus for determining application security according to an embodiment of this application. Referring to Figure 5, an apparatus 500 for determining application security according to an embodiment of this application may include: an acquisition module 510 and a processing module 520. Wherein:

The acquisition module 510 is used to acquire target information of a target application deployed in a sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone.

The processing module 520 is used to input the target information into the target machine learning model; and to determine the security of the target application based on the target machine learning model.

In the apparatus for determining application security provided in this application embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining the target information of the target application through a sandbox environment before deploying it on the cloud phone, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be determined before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus solving the problem of security risks associated with applications to be deployed on cloud phones in related technologies.

The apparatus for determining application security provided in this application embodiment can implement all the processes implemented in the above method embodiments. The specific implementation details of each module can be found in the preceding method section description; to avoid repetition, they will not be repeated here.

As shown in Figure 6, this application embodiment also provides an electronic device 600. The electronic device 600 includes a processor 610 and a memory 620. The memory 620 stores programs or instructions, which, when executed by the processor 610, implement the steps of any of the methods described above (e.g., the method for determining application security). For example, when the program is executed by the processor 610, it implements the following process: obtaining target information of a target application deployed in a sandbox environment, the target information reflecting the behavioral characteristics of the target application, the target application being an application intended for installation on a cloud phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. Thus, by obtaining the target information of the target application through a sandbox environment before deploying the target application on the cloud phone, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, solving the problem of security risks associated with applications to be deployed on cloud phones in related technologies.

This application also provides a readable storage medium storing a program or instructions that, when executed by a processor, implement the steps of various embodiments of the method for determining application security and achieve the same technical effect. To avoid repetition, these steps will not be repeated here.

The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

This application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above method embodiments and achieve the same technical effects. To avoid repetition, it will not be described again here.

It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims (11)

1. A method of determining application security, comprising:

Acquiring target information of a target application deployed in a sandbox environment, wherein the target information is used for reflecting behavior characteristics of the target application, and the target application is an application for being installed on a cloud mobile phone;

inputting the target information into a target machine learning model;

Determining security of the target application based on the target machine learning model;

The target information comprises a plurality of target sequences obtained based on a plurality of unit time, wherein one unit time corresponds to one target sequence, the target sequence comprises at least one of a sequence associated with a target user logging in a cloud mobile phone, a sequence associated with application authority of the target application, a sequence associated with calling other applications except the target application in the cloud mobile phone and a sequence associated with a visiting website, and the security of the target application is determined based on the target machine learning model, and the method comprises the following steps:

determining a plurality of probability values corresponding to the plurality of target sequences based on the target machine learning model;

Determining a first probability range based on the plurality of probability values, the first probability range indicating a probability range for normal operation of the target application itself;

Determining a second probability range and a third probability range based on the first probability range, wherein the minimum value of the second probability range is larger than or equal to the maximum value of the first probability range, and the maximum value of the third probability range is smaller than or equal to the minimum value of the first probability range;

acquiring at least one first probability value and at least one second probability value, wherein the at least one first probability value is all probability values in the second probability range in the plurality of probability values, and the at least one second probability value is all probability values in the third probability range in the plurality of probability values;

Determining at least one target probability value, the at least one target probability value being the greater of the at least one first probability value and the at least one second probability value;

calculating an average value of the at least one target probability value;

based on an average of the at least one target probability value, security of the target application is determined.

2. The method according to claim 1, wherein the method further comprises:

Under the condition that the target application is determined to be a security application, the target application is installed in the cloud mobile phone;

and prompting to remove the target application under the condition that the target application is determined to be a malicious application.

3. The method of claim 1, wherein prior to obtaining target information for a target application deployed in a sandbox environment, the method further comprises:

Receiving a target application uploaded by a target user;

And deploying the target application into a sandbox environment under the condition that the information abstraction algorithm of the installation package of the target application meets the target condition.

4. The method of claim 1, wherein the determining a first range of probabilities based on the plurality of probability values comprises:

Determining an average value and a standard deviation of the plurality of probability values based on the plurality of probability values;

determining a first probability range based on the mean and the standard deviation;

the minimum value of the first probability range is the difference value between the average value and the standard deviation, and the maximum value of the first probability range is the sum value of the average value and the standard deviation.

5. The method of claim 1, wherein the determining the security of the target application based on the average of the at least one target probability value comprises:

Determining that the target application is a malicious application under the condition that the average value of the at least one target probability value is greater than or equal to a threshold value;

and determining that the target application is a security application in the case that the average value of the at least one target probability value is smaller than the threshold value.

6. The method of claim 1, wherein the target application is a plurality of applications running simultaneously in a sandbox environment, wherein the target information comprises an average sequence, wherein the average sequence is based on an average of the target sequences of the plurality of applications, wherein the target sequences of the plurality of applications are based on the same unit time;

the determining, based on the target machine learning model, security of the target application includes:

determining a third probability value corresponding to the average value sequence based on the target machine learning model;

Determining, for each of the plurality of applications, a fourth probability value corresponding to the application based on the target machine learning model;

Determining a total probability value based on the third probability value and the fourth probability value;

determining security of the application based on the total probability value;

Based on the security of each of the plurality of applications, the security of the target application is determined.

7. The method of claim 6, wherein the determining a total probability value based on the third probability value and the fourth probability value comprises:

Determining a product of the third probability value and the first weight as a first result;

determining a product of the fourth probability value and the second weight as a second result;

determining a sum of the first result and the second result as a total probability value;

wherein the first weight is less than the second weight.

8. The method of claim 6, wherein the determining the security of the target application based on the security of each of the plurality of applications comprises:

Determining that the target application is a secure application if each of the plurality of applications is a secure application;

And determining that the target application is a malicious application under the condition that at least one malicious application exists in the plurality of applications.

9. An electronic device comprising a processor and a memory storing a program or instructions that, when executed by the processor, implement the steps of the method of any of claims 1-8.

10. A computer readable storage medium, characterized in that the medium has stored thereon a program or instructions which, when executed, implement the steps of the method according to any of claims 1-8.

11. A computer program product comprising a computer program which, when executed, implements the method of any of claims 1-8.