CN118277914A - A mobile application classification method based on dynamic and static combined multi-dimensional APK features - Google Patents

Abstract

The invention relates to the technical field of APP classification analysis, and discloses a mobile application classification method based on dynamic and static combination of multidimensional APK features, which comprises the steps of firstly constructing APP features, collecting APP information based on mainstream mobile phone application stores, an Internet small distribution platform and an APP propagation page, specifically identifying the service classification of the APP by the functions provided by the APP or the information content presented by the APP, collecting communication information, and forming an initial test data set; analyzing based on the APP source codes to obtain static source code characteristics, dynamic flow and page characteristic data of the APP, wherein the static source code characteristics, the dynamic flow and the page characteristic data specifically comprise names, flow and content information; and establishing a rule matching model and a matching mechanism, specifically, establishing a timing scanning program, and identifying and judging through each preset classification rule matching model. The method has higher recognition accuracy rate for APP with obvious technical characteristics or content characteristics, and reduces the participation of manual auditing.

Description

A mobile application classification method based on dynamic and static combined multi-dimensional APK features

Technical Field

The present invention relates to the technical field of APP classification analysis, and specifically to a mobile application classification method based on dynamic and static combined multi-dimensional APK features.

Background technique

In recent years, significant progress has been made in the field of APK (Android application package file) classification and analysis technology, including the following aspects:

1. APK classification method based on machine learning and deep learning: (1) Input the App name into the Internet search engine and process the results to obtain the App document; (2) Extract the keyword distribution features based on the vector space model, and use shallow learning technology to train a base classifier on this basis; (3) Train word vectors based on word2vec, and use convolutional neural network to train another base classifier on this basis; (4) Design a collaborative learning framework, use unlabeled samples to collaboratively train the two base classifiers, and fuse the training results to obtain the final App classifier. Only use the App name to achieve personalized classification of Apps; only a small number of labeled samples are needed to establish a classification model with high accuracy; the designed collaborative learning framework takes into account the performance imbalance of different base classifiers and can reduce the impact of noise data in unlabeled samples.

Based on the APP user review classification method: obtain APP user review data and clean and mark it; establish the SVTEO model and the NBTEO model; the SVTEO model includes: extracting the Encoder structure part in the Transformer model to obtain the Trasformer-Encoder-Only layer, connecting the pooling layer after the Trasformer-Encoder-Only layer, and connecting the linear layer and the support vector layer in parallel after the pooling layer to obtain the SVTEO model; the NBTEO model includes: extracting the Encoder structure part in the Transformer model to obtain the Trasformer-Encoder-Only layer, -The Encoder-Only layer is connected to the pooling layer, and the pooling layer is connected to the linear layer and the Naive Bayes layer in parallel to obtain the NBTEO model; the Trasformer-Encoder-Only layer includes: an Embedding layer and a six-layer Encoder layer; according to the label data, the linear layers of the SVTEO model and the NBTEO model are subjected to machine learning, deep learning homogeneity learning, and SVTEO model and NBTEO model heterogeneity and parameter fine-tuning processing, and the processed SVTEO model and NBTEO model are combined into a user comment demand classification model; the APP user comment data to be classified is input into the user comment demand classification model for classification and labeling processing to obtain the classification labels of the APP user comment data.

For example, in the application with application number "CN201810073847.0", the method for automatically dividing APP into categories based on keywords includes the following steps: A. Establishing a classification system and setting a corresponding keyword database, establishing several groups of keyword databases according to the classification categories, and storing the several groups of keyword databases in the storage module; B. APP collects the uploaded information content through the collection module and transmits the information content to the server; C. The server matches the received information content with several groups of keyword databases respectively through the matching and identification module; D. If the information content matches one group of keyword databases or multiple groups of keyword databases successfully, the server will feedback the classification category corresponding to the successfully matched keyword database to the APP, and the APP will classify the information content into the corresponding classification category through the execution module. If the information content fails to match several groups of keyword databases, the server will feedback the unsuccessful matching information to the APP, and the APP will classify the information content separately through the execution module.

Existing APP classification technology uses few dimensions, mainly relying on a few static source code features such as name, LOGO, keywords, etc. for analysis. However, the classification representation ability of such static features is relatively weak, and it is not possible to fully and accurately identify the actual business classification of the APP. In particular, it is difficult to accurately identify APPs that are counterfeit or provide illegal content through limited static source code feature dimensions.

In view of the above problems, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is needed.

Summary of the invention

The purpose of the present invention is to provide a mobile application classification method based on dynamic and static combined multi-dimensional APK features. The present invention extracts APP source code features (including APP name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, static library), traffic (including main service domain name, IP, path, header information, request content), page content (page display content, snapshot) and other dynamic and static multi-dimensional features of APP, extracts common technical features or content feature combinations for APP classification and identification scenarios such as communication, designs APP feature extraction methods combining dynamic and static features, and constructs a two-level specific type APP classification and identification model including rule matching model and scoring and sorting model, thereby realizing effective classification and identification of mobile applications in massive APP data.

The present invention is achieved in that:

The present invention provides a mobile application classification method based on dynamic and static combined multi-dimensional APK features, which is specifically performed in the following steps:

_S1 : Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set;

S ₂ : Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, and request content; the content specifically includes page display content and snapshot information.

The APP source code analysis is specifically to parse the APK package file, build information extraction function according to Android design specifications and output requirements, and obtain the name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

By running analysis and building an automated control program, the app is automatically installed and run in the Android device environment, and the communication traffic and page presentation content information of the app are extracted. When analyzing the characteristics of the communication category, the specific characteristic data in terms of functions, permissions, layout, and content data are included, and the rule matching rule data set and the scoring and sorting rule set are built;

Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption.

_S3 : Establish a rule matching model and matching mechanism. Specifically, by building a timed scanning program, extract the formatted and stored data in the form of objects, and identify and judge through the preset classification rule matching models. If there is any hit, it will be labeled with a classification label and enter the waiting state of the scoring and sorting model; obtain various static source code features, dynamic traffic features and dynamic content features of the APP, and perform data cleaning and data formatting and storage on the full amount of data;

The static source code features include name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshots, and page layout file information.

S ₄ : Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to the rules;

S ₅ : A large number of APPs are matched with APP rules through a rule matching model, and branch screening is performed through a screening mechanism model, and the output results are used to classify the APPs.

Further, in step _S4 , the specific rules are to perform keyword feature matching on the APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and to perform data set feature matching on the LOGO, package name, signature HASH, and signature OWNER, and to calculate a score for each dimension of the APK. The score is calculated based on the matching degree and weight of the features.

Score and dimension: For each APK, two scores A and B are summarized. The score of the APK name and localized configuration content attributes is represented by A, and the score of the package name, signature, LOGO and other dimensions is represented by B. The number of hit dimensions is recorded at the same time. A1 represents the number of hit dimensions in A, and B1 represents the number of hit dimensions in B.

Determine the APK that meets the classification requirements. If B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK;

In step _S5 , if B1 is equal to 1 and A1 is greater than 1, manual review is performed; because the APK name and localization configuration match multiple dimensional rules, further review is required to determine the classification. Feature rule extraction and merging: Extract feature rules from the APKs that are judged as corresponding categories in the previous step, so that they can be used for future rule updates and improvements, and merge the extracted feature rules into the rule set of step _S4 to enrich the feature rules.

Furthermore, the present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, the method described in any one of the above is implemented.

Furthermore, the core principle of the present invention is to build a two-layer classification and recognition model through the basic static source code features, dynamic traffic features, and dynamic content features of the APP to achieve classification and accurate judgment of the APP. The core process includes:

1. Extract features of specific types of apps, including static source code features (including name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, static library), dynamic traffic features (domain name, IP, path, header information, request content), content features (page display content, snapshot) and other 18 types;

2. Build a rule matching model, based on the APP features extracted in the previous step as the identification and matching features of specific categories, and detect and mark business categories in massive APP data;

3. Build a scoring and ranking model to further identify and judge the APPs found in the previous step. According to the multi-dimensional combination rules of static source code features, dynamic traffic features, and dynamic content features, formulate scoring standards, set output thresholds, and output accurate classification data;

4. Optimize and supplement features, manually review the data marked by the system, output the final data, and supplement this part of the feature data to steps S ₃ -S ₄ .

Compared with the prior art, the present invention has the following beneficial effects:

1. In the scenario of massive APP analysis, the present invention can quickly identify APPs of various preset categories.

2. It has a higher recognition accuracy rate for apps with significant technical or content features, reducing the involvement of manual review.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It is understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

FIG1 is a flow chart of the overall method of the present invention;

FIG. 2 is a flowchart of the APP classification execution of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

Please refer to Figure 1-2 for a mobile application classification method based on dynamic and static combined multi-dimensional APK features. The specific steps are as follows:

_S1 : Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set;

S ₂ : Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, and request content; the content specifically includes page display content and snapshot information.

The APP source code analysis is specifically to parse the APK package file, build information extraction function according to Android design specifications and output requirements, and obtain the name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

By running analysis and building an automated control program, the app is automatically installed and run in the Android device environment, and the communication traffic and page presentation content information of the app are extracted. When analyzing the characteristics of the communication category, the specific characteristic data in terms of functions, permissions, layout, and content data are included, and the rule matching rule data set and the scoring and sorting rule set are built;

Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption.

_S3 : Establish a rule matching model and matching mechanism. Specifically, by building a timed scanning program, extract the formatted and stored data in the form of objects, and identify and judge through the preset classification rule matching models. If there is any hit, it will be labeled with a classification label and enter the waiting state of the scoring and sorting model; obtain various static source code features, dynamic traffic features and dynamic content features of the APP, and perform data cleaning and data formatting and storage on the full amount of data;

The static source code features include name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshot, and page layout file information. The feature dimensions are shown in Table 1;

Table 1 Static source code feature dimension table

Dimensions Match Type name Exact matching, fuzzy matching LOGO Exact matching, fuzzy matching Package names Exact matching, fuzzy matching sign Exact Match Permissions Exact Match Service Statement Exact Match SDK Exact Match Static Libraries Exact Match Localization Configuration Exact matching, fuzzy matching Communication traffic domain name Exact matching, fuzzy matching Communication traffic content Exact matching, fuzzy matching

S ₄ : Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to the rules;

S ₅ : A large number of APPs are matched with APP rules through a rule matching model, and branch screening is performed through a screening mechanism model, and the output results are used to classify the APPs.

Further, in step S ₄ , the specific rules are to match the keyword features of APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and match the data set features of LOGO, package name, signature HASH, and signature OWNER, and calculate the score for each dimension of APK. The score is calculated based on the matching degree and weight of the features. The weight design is based on the technical characteristics and content characteristics of APK, where the weight of technical characteristics is higher than that of content characteristics. The weight value of technical characteristics is determined according to the correlation of feature attributes. The weight reference example is shown in Table 2;

Table 2 Weight reference examples

Score and dimension: For each APK, two scores A and B are summarized. The score of the APK name and localized configuration content attributes is represented by A, and the score of the package name, signature, LOGO and other dimensions is represented by B. The number of hit dimensions is recorded at the same time. A1 represents the number of hit dimensions in A, and B1 represents the number of hit dimensions in B.

To determine the APK that meets the classification requirements, if B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK; the criteria for calculating the score are shown in Table 3;

Table 3: Standards for calculating the score

In step _S5 , if B1 is equal to 1 and A1 is greater than 1, manual review is performed; because the APK name and localization configuration match multiple dimensional rules, further review is required to determine the classification. Feature rule extraction and merging: Extract feature rules from the APKs that are judged as corresponding categories in the previous step, so that they can be used for future rule updates and improvements, and merge the extracted feature rules into the rule set of step _S4 to enrich the feature rules.

In this embodiment, the present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, the method described in any one of the above is implemented.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention has various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (9)

1. A mobile application classification method based on dynamic and static combined multi-dimensional APK features, characterized by: specifically performing the following steps: _S1 : Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set; S ₂ : Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; _S3 : Establishing a rule matching model and matching mechanism, specifically by constructing a timed scanning program, extracting the formatted and stored data in the form of objects, and identifying and judging them through the preset classification rule matching models. If there is any hit, a classification label is added and the system enters the waiting state of the scoring and sorting model; S ₄ : Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to the rules; S ₅ : A large number of APPs are matched with APP rules through a rule matching model, and branch screening is performed through a screening mechanism model, and the output results are used to classify the APPs. 2. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that, in step _S2 , the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, and request content; the content specifically includes page display content and snapshot information. 3. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that, in step _S2 , the APP source code analysis is specifically carried out by parsing the APK package file, building an information extraction function according to Android design specifications and output requirements, and obtaining the name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, and static library information; By running analysis and building an automated control program, we can automatically install and run the APP in the Android device environment, and extract the APP's communication traffic and page presentation content information. 4. A mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 1, characterized in that, in step _S2 , when analyzing the characteristics of the communication class, the characteristic data including functions, permissions, layout, and content data are specifically included to construct a rule matching rule data set and a scoring sorting rule set; Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption. 5. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that, in step _S3 , various static source code features, dynamic traffic features and dynamic content features of the APP are obtained, and data cleaning, data formatting and storage are performed on the full amount of data; The static source code features include name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information; Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshots, and page layout file information. 6. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that, in step _S4 , the specific rules are to perform keyword feature matching on APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and to perform data set feature matching on LOGO, package name, signature HASH, and signature OWNER, and calculate a score for each dimension of APK, and the score is calculated based on the matching degree and weight of the features. 7. According to claim 6, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that, for each APK, the scores A and B are summarized, wherein the scores of the APK name and localized configuration content attributes are summarized with A, and the scores of the package name, signature, LOGO and other dimensions are summarized with B, and the number of dimensions hit is recorded at the same time, A1 represents the number of dimensions hit in A, and B1 represents the number of dimensions hit in B; Determine the APK that meets the classification requirements. If B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK; In step _S5 , if B1 is equal to 1 and A1 is greater than 1, manual review processing is performed. 8. According to claim 7, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized by feature rule extraction and merging: feature rule extraction is performed on the APK judged as the corresponding classification in the previous step so that it can be used for future rule updating and improvement, and the extracted feature rules are merged into the rule set of step _S4 . 9. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a main controller, implements the method as claimed in any one of claims 1 to 8.