CN114518996A - Anomaly detection method and system for mobile device, electronic device and storage medium - Google Patents

Abstract

The invention discloses an abnormality detection method and system for mobile equipment, electronic equipment and a storage medium, wherein the abnormality detection method for the mobile equipment comprises the following steps: acquiring a dynamic link library when the mobile equipment requests application, and splitting the dynamic link library to obtain a plurality of plug-in libraries; acquiring first label data and a plurality of feature information of each plug-in library, and inputting the feature information and the first label data into a support vector machine model to obtain a risk score of the plug-in library; obtaining the weight of the plug-in library through Newton's cooling law according to the risk score; weighting according to the weight of the plug-in library and the corresponding risk score to obtain a dynamic link library score; and judging whether the corresponding mobile equipment is abnormal equipment or not according to the dynamic link library score. According to the invention, when the mobile equipment is detected, the blacklist is not required to be relied on, and based on the identification detection of the plug-in library, the coverage rate of abnormal equipment detection can be improved, and the abnormal detection efficiency is improved.

Description

Anomaly detection method, system, electronic device and storage medium of mobile device

technical field

The present invention relates to the technical field of artificial intelligence, and in particular, to an abnormality detection method, system, electronic device and storage medium of a mobile device.

Background technique

Nowadays, abnormal detection on mobile terminals plays an important role in maintaining business security. In related technologies, some risk tags for detecting device abnormality are included in the system during abnormal detection, which can check whether the device is jailbroken and whether the device jailbreak detection is blocked. Risks such as bypassing, whether the device has been tampered with information, etc. However, the use of risk labels is not only limited by the version, and some labels require blacklist maintenance. Therefore, when risk labels identify abnormal risks, it will lead to low efficiency, easy to miss risks, and cannot be effective. Improve the coverage of abnormal device detection.

SUMMARY OF THE INVENTION

The following is an overview of the topics detailed in this article. This summary is not intended to limit the scope of protection of the claims.

The embodiments of the present invention provide an abnormality detection method, system, electronic device and storage medium for a mobile device, which can improve the coverage rate of abnormal device detection and improve the abnormality detection efficiency.

In a first aspect, an embodiment of the present invention provides an abnormality detection method for a mobile device, including: acquiring a dynamic link library when the mobile device requests an application, and splitting the dynamic link library to obtain several plug-in libraries; the first label data and a plurality of feature information of the plug-in library, input the feature information and the first label data into the support vector machine model, and obtain the risk score of the plug-in library; The cooling law obtains the weight of the plug-in library; the dynamic link library score is obtained according to the weight of the plug-in library and the corresponding risk score; and whether the corresponding mobile device is an abnormal device is judged according to the dynamic link library score.

In some embodiments, the feature information includes word scoring features, and the word scoring features are obtained according to the following steps: acquiring the plugin library name of the plugin library, and splitting the plugin library name into several words; selecting For the target words in the words, the homogeneity feature and the difference feature of each target word are obtained by calculation; the word scoring feature corresponding to the plug-in library is obtained according to the homogeneity feature and the difference feature.

In some embodiments, the computing to obtain the homogeneity feature and the difference feature of each of the target words includes: acquiring second tag data, and determining a plurality of plugin libraries according to the second tag data. The abnormal plug-in library and the normal plug-in library; obtain the first request number of the abnormal plug-in library containing the target word, the second request number of all the abnormal plug-in libraries and the normal plug-in library containing the target word. the third number of requests; the homogeneity feature is obtained according to the proportional relationship between the first request number and the second request number; to obtain the differential characteristics.

In some embodiments, the obtaining the word scoring feature corresponding to the plug-in library according to the homogeneity feature and the difference feature, includes: the homogeneity feature of all words in the plug-in library and Among the difference features, the maximum value of the homogeneity feature and the maximum value of the difference feature are selected; the word scoring feature is obtained according to the product of the maximum value of the homogeneity feature and the maximum value of the difference feature.

In some embodiments, the feature information further includes hyphen information in the name of the plug-in library, character information in the name of the plug-in library, and the information of the plug-in library in the dynamic link library including the abnormal plug-in library. At least one of the number of , the number of the plug-in library under the dynamic link library, and the number of the split words.

In some embodiments, the inputting the feature information and the first label data into a support vector machine model to obtain the risk score of the plug-in library includes: calculating a correlation between a plurality of the feature information coefficient; obtain a first preset threshold for feature screening; when the correlation coefficient between the feature information is greater than the first preset threshold, retain at least one of the feature information; the feature to be retained The information and the first label data are input into the support vector machine model to obtain the risk score.

In some embodiments, judging whether the corresponding mobile device is an abnormal device according to the dynamic link library score includes: obtaining a second preset threshold obtained according to an abnormal dynamic link library sample; If the score is greater than the second preset threshold, it is determined that the corresponding mobile device is an abnormal device.

In a second aspect, an embodiment of the present invention also provides an anomaly detection system for a mobile device, including: a data acquisition module for acquiring a dynamic link library when the mobile device requests an application, and splitting the dynamic link library to obtain several a plug-in library; a data processing module for acquiring the first label data and a plurality of feature information of each of the plug-in libraries, and inputting the feature information and the first label data into the support vector machine model to obtain the plug-in The risk score of the library; the abnormal score module is used to obtain the weight of the plug-in library according to the risk score through Newton's law of cooling, and obtain the dynamic link library score according to the weight of the plug-in library and the corresponding risk score weighting; An abnormality detection module, configured to judge whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

In a third aspect, an embodiment of the present invention further provides an electronic device, which is characterized by comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the first aspect when executing the computer program. Anomaly detection method for mobile devices.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, where the storage medium stores a program, and the program is executed by a processor to implement the method for detecting anomaly of a mobile device according to the first aspect.

The embodiments of the present invention at least include the following beneficial effects:

An anomaly detection method, system, electronic device, and storage medium for a mobile device proposed by the disclosed embodiments of the present invention, wherein, when the anomaly detection system for a mobile device executes the anomaly detection method, it first obtains the dynamic link of the mobile device when requesting an application The system obtains the first label data and multiple feature information of the plug-in library, and inputs it into the support vector machine model to obtain the risk score of the plug-in library. Then, the weight of the plug-in library is obtained by calculating, and the weight of the plug-in library and the risk score are weighted to obtain the dynamic link library score. By judging the dynamic link library score, it can be judged whether the mobile device corresponding to the dynamic link library score is an abnormal device. The present invention The embodiment does not need to rely on the blacklist when detecting the mobile device, and based on the identification and detection of the plug-in library, the coverage rate of abnormal device detection can be improved, and the abnormality detection efficiency can be improved.

Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the description, claims and drawings.

Description of drawings

The accompanying drawings are used to provide a further understanding of the technical solutions of the present invention, and constitute a part of the description. They are used to explain the technical solutions of the present invention together with the embodiments of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

1 is a schematic flowchart of an abnormality detection method for a mobile device provided by an embodiment of the present invention;

2 is a schematic flowchart of an abnormality detection method for a mobile device provided by another embodiment of the present invention;

3 is a schematic flowchart of an abnormality detection method for a mobile device provided by another embodiment of the present invention;

4 is a schematic flowchart of an abnormality detection method for a mobile device provided by another embodiment of the present invention;

5 is a schematic flowchart of an abnormality detection method for a mobile device provided by another embodiment of the present invention;

6 is a schematic flowchart of an abnormality detection method for a mobile device provided by another embodiment of the present invention;

7 is a schematic diagram of an abnormality detection system for a mobile device according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of an electronic device according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

It should be understood that, in the description of the embodiments of the present invention, the meaning of several is more than one, the meaning of multiple (or multiple) is more than two, and greater than, less than, exceeding, etc. are understood as not including this number, above, below, Within, etc., are understood to include this number. If there is a description of "first", "second", etc., it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance, or implicitly indicating the number of indicated technical features or implicitly indicating the indicated The sequence of technical characteristics.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The terms used herein are for the purpose of describing the embodiments of the present invention only, and are not intended to limit the present invention.

Embodiments of the present invention provide an abnormality detection method, system, electronic device and storage medium for a mobile device, which can improve the coverage rate of abnormal device detection and improve the abnormality detection efficiency.

The anomaly detection method for a mobile device disclosed in the embodiments of the present invention is specifically described by the following embodiments.

Referring to FIG. 1 , FIG. 1 is an optional flowchart of an abnormality detection method for a mobile device provided by an embodiment of the present disclosure. The method in FIG. 1 may include, but is not limited to, steps S110 , S120 , S130 , Step S140, Step S150 and Step S160.

Step S110: Obtain a dynamic link library when the mobile device requests an application, and split the dynamic link library to obtain several plug-in libraries.

In some embodiments of the present invention, the anomaly detection method of the mobile device is applied in the anomaly detection system of the mobile device, and the anomaly detection system can obtain the dynamic link library (Dynamic-link library, DLL) data when the mobile device requests the application. The collected dynamic link library is organized and stored. The dynamic link library is a module containing functions and data, which can be used by other modules (applications or other DLLs). Since each dynamic link library is composed of several plug-in libraries, so Splitting each dynamic link library into several plug-in libraries means splitting each dynamic link library data into several plug-in library data.

It should be noted that the mobile device in this embodiment of the present invention may be a mobile terminal in any form, for example, the mobile device may be a mobile phone, a tablet computer, or other forms of mobile terminals, which are not specifically limited in this embodiment of the present invention.

Step S120: Obtain the first label data and a plurality of feature information of each plug-in library, input the feature information and the first label data into the support vector machine model, and obtain the risk score of the plug-in library.

In some embodiments of the present invention, after splitting to obtain several plug-in libraries, the anomaly detection system can obtain the first label data of the plug-in library and the feature information corresponding to the multiple plug-in libraries. When the dynamic link library is split into multiple plug-in libraries When the plug-in library is used, the anomaly detection system can obtain the first label data of each plug-in library and multiple feature information of each plug-in library respectively. When the dynamic link library is split into one plug-in library, it can obtain the first label data of the plug-in library. and multiple feature information, in the subsequent embodiments of the present invention, taking splitting to obtain multiple plug-in libraries as an example, the first tag data is the tag data of the plug-in library, and then the anomaly detection system can combine the obtained multiple feature information and the first tag The data is input into the support vector machine (SVM) model, and the risk score corresponding to the plug-in library can be obtained through the processing of the support vector machine model, and the risk score is used to characterize the possibility of abnormality of the plug-in library.

In step S130, the weight of the plug-in library is obtained through Newton's cooling law according to the risk score.

In some embodiments of the present invention, after obtaining the risk score of the plug-in library, the anomaly detection system calculates the weight of each plug-in library through Newton's cooling law. For example, the anomaly detection system sorts the plug-in library from high to low according to the risk score of the plug-in library. , when the weight of the plug-in library ranked e is 1/e of the weight of the first-ranked plug-in library, for example, the weight of the plug-in library ranked 30 is 1/30 of the weight of the first-ranked plug-in library, using Newton's cooling law, The weights of the scores of all the plug-in libraries are obtained by calculation, and on the premise that the requirements of the embodiments of the present invention are met, the anomaly detection system may also calculate the weights of the plug-in libraries in other ways.

In step S140, the dynamic link library score is obtained by weighting according to the weight of the plug-in library and the corresponding risk score.

In some embodiments of the present invention, after obtaining the weight of each plug-in library, the anomaly detection system calculates the risk score obtained in step S120 and the corresponding plug-in library weight to obtain the corresponding dynamic link library score. Each dynamic link library is composed of several plug-in libraries, each plug-in library has a score and a weight, and the weighted summation obtains the score of the dynamic link library to obtain the dynamic link library score.

Step S150: Determine whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

In some embodiments of the present invention, after obtaining the dynamic link library score, the abnormality detection system determines whether the corresponding mobile device is an abnormal device based on the size of the dynamic link library score. Relying on the blacklist, based on the identification and detection of the plug-in library, can improve the coverage of abnormal device detection and improve the efficiency of abnormal detection.

It should be noted that the method for detecting anomalies of mobile devices in the embodiments of the present invention can be applied in the field of artificial intelligence to improve the efficiency of detecting abnormalities of mobile devices by artificial intelligence, and the methods for detecting anomalies in mobile devices in the embodiments of the present invention may also Applied in the business risk decision system (ARES), after executing the abnormality detection method in the embodiment of the present invention, the business risk decision system can identify abnormal mobile devices without relying on the plug-in library blacklist, which can improve the detection efficiency of abnormal devices. Coverage and improve the efficiency of anomaly detection. There are no specific restrictions on its application scenarios here.

In some embodiments of the present invention, multiple feature information of the plug-in library includes word scoring features. Referring to FIG. 2 , the word scoring features in the embodiments of the present invention can be obtained according to the following steps, including but not limited to the following step S210 , step S220 and step S230.

Step S210: Obtain the plug-in library name of the plug-in library, and split the plug-in library name into several words.

Step S220, selecting target words in the words, and calculating the homogeneity feature and difference feature of each target word.

Step S230, obtaining the word scoring feature of the corresponding plug-in library according to the homogeneity feature and the difference feature.

In some embodiments of the present invention, the plug-in library obtains a risk score by inputting multiple pieces of feature information together with the first label data into the support vector machine model, and the multiple pieces of feature information include the word scoring features of the plug-in library. The word scoring feature of the library is obtained according to the name of the plug-in library. The anomaly detection system can obtain the name of the plug-in library of the plug-in library, and split it to obtain several words. When calculating, calculate for each word. When the word is selected as the target word, the word scoring feature is obtained according to the word feature of the word, including the homogeneity feature and the difference feature, so the homogeneity feature and the difference feature of each target word are calculated, so that according to the homogeneity feature The word score feature of the corresponding plug-in library can be obtained from the sexual feature and the difference feature. The word score feature can represent the positive and negative sex of the plug-in library corresponding to the word. Therefore, selecting the word score feature as one of the feature information can improve the obtained risk score. accuracy. It can be understood that, the homogeneity feature and the difference feature in the embodiment of the present invention can be obtained according to the number of requests for words in different types of plug-in libraries.

It should be noted that the anomaly detection system can split the plug-in library name according to a variety of algorithms, and the anomaly detection system in the embodiment of the present invention uses the matching method to split the plug-in library name into words, and each plug-in library name can be Split into several words, and the matching split can be set according to actual needs. In one embodiment, the anomaly detection system is basically in the form of camel case based on the name of the plug-in library. Therefore, when splitting the name of the plug-in library, according to CamelCase rules split the plugin library name to get several words. In another embodiment, the anomaly detection system can also split the plug-in library name according to a Chinese word segmentation algorithm. There are mainly two types of Chinese word segmentation algorithms, namely the forward maximum matching method and the reverse maximum matching method. The anomaly detection system can According to the forward maximum matching method and the reverse maximum matching method, the name of the plug-in library is split to obtain several words.

Referring to FIG. 3 , step S220 of the abnormality detection method in the embodiment of the present invention may further include but not limited to the following steps S310 , S320 and S330 .

Step S310: Acquire second tag data, and determine an abnormal plug-in library and a normal plug-in library in the plurality of plug-in libraries according to the second tag data.

Step S320: Obtain the first request number of abnormal plug-in libraries containing the target word, the second request number of all abnormal plug-in libraries, and the third request number of normal plug-in libraries containing the target word.

Step S330, obtaining the homogeneity feature according to the proportional relationship between the first request number and the second request number, and obtaining the differential feature according to the proportional relationship including the first request number and the third request number.

In some embodiments of the present invention, when splitting the dynamic link library to obtain the plug-in library, the anomaly detection system will aggregate the count of the plug-in library, and calculate the number of requests for each plug-in library, and the word scoring feature of the plug-in library is based on the content of the plug-in library. The homogeneity feature and difference feature of the word are obtained. In the process of calculating the homogeneity feature and difference feature, the anomaly detection system needs to determine the abnormal price difference library and the normal plugin library in the plug-in library. The anomaly detection system first obtains the first Second tag data, and determine abnormal plug-in libraries and normal plug-in libraries in the plurality of plug-in libraries according to the second tag data. The second tag data is the tag data obtained by the abnormality detection system and used to determine whether the plug-in library is abnormal. The label data of the existing abnormal plug-in library and the normal plug-in library are obtained, and compared with the first label data previously stored by the abnormality detection system, it is judged that the stored plug-in library is one of the abnormal plug-in library or the normal plug-in library. , because the number of plug-in libraries is multiple, multiple abnormal plug-in libraries and multiple normal plug-in libraries will be obtained, and then when calculating the homogeneity and difference characteristics of the target word, the abnormal plug-in library containing the target word will be obtained. The first number of requests, the second number of requests for all abnormal plug-in libraries, and the third number of requests for normal plug-in libraries containing the target word, and the homogeneity feature is obtained according to the proportional relationship between the first number of requests and the number of second requests. The proportional relationship between the number of first requests and the number of third requests obtains the distinctive feature.

Specifically, in one embodiment, the anomaly detection system can obtain the homogeneity feature of the target word according to the first number of requests divided by the second number of requests, and can obtain the inclusion target word according to the sum of the first number of requests and the third number of requests The number of requests of all plug-in repositories of the word, and the difference feature can be obtained by dividing the first request number by the number of requests of all plug-in repositories containing the target word.

Referring to FIG. 4 , step S230 of the abnormality detection method in the embodiment of the present invention may further include but not limited to the following steps S410 and S420.

Step S410, from the homogeneity features and difference features of all words in the plug-in library, select the maximum value of the homogeneity feature and the maximum value of the difference feature.

In step S420, the word scoring feature is obtained according to the product of the maximum value of the homogeneity feature and the maximum value of the difference feature.

In some embodiments of the present invention, the word scoring features of the plug-in library are obtained according to the homogeneity characteristics and difference characteristics of words in the plug-in library, and the homogeneity characteristics and difference characteristics of all words in a certain plug-in library by the anomaly detection system Among the features, select the maximum value of the homogeneity feature and the maximum value of the difference feature, and multiply the maximum value of the homogeneity feature and the maximum value of the difference feature to obtain the word scoring feature of the plug-in library. The basis for calculating the maximum value of the sexual feature and the maximum value of the difference feature is that the name of a plug-in library can be divided into multiple words, and each word can calculate the word score feature separately, and then calculate the plug-in library for each word. The maximum value of these scores can be used as the plug-in library word scoring feature. Therefore, in the embodiment of the present invention, the maximum value of the homogeneity feature and the maximum value of the difference feature are directly selected for calculation.

In some embodiments of the present invention, the feature information of the plug-in library further includes hyphen information in the noun of the plug-in library, character information in the noun of the plug-in library, the number of the plug-in library in the dynamic link library including the abnormal plug-in library, the plug-in library At least one of the number under the dynamic link library and the number of split words, the risk score of the plug-in library is calculated through the above-mentioned multiple feature information, which can improve the accuracy of the risk score. Under the premise of requirements, in addition to the word scoring feature, the anomaly detection system can obtain other information of the plug-in library as one of the feature information according to judgment needs, to calculate the risk score of the plug-in library.

It can be understood that the hyphen information in the noun of the plug-in library can include the number of hyphens and numbers in the name of the plug-in library; the character information in the noun of the plug-in library can include the character length of the plug-in library, etc.; When a dynamic link library is used, the aggregate count is calculated by the dynamic link library, the number of requests for each dynamic link library is calculated, and the dynamic link library containing the abnormal plug-in library is marked as abnormal. The number of plug-in libraries in the dynamic link library containing the abnormal plug-in library That is, the number of plug-in libraries that appear in the abnormal dynamic link library; the abnormality detection system can split multiple plug-in libraries according to the dynamic link library. Therefore, the number of plug-in libraries under the dynamic link library is the number of plug-in libraries that appear in all plug-in libraries. quantity.

Referring to FIG. 5 , step S120 of the abnormality detection method in the embodiment of the present invention may further include but not limited to the following steps S510 , S520 , S530 and S540 .

Step S510, calculating a correlation coefficient between multiple pieces of feature information.

Step S520, acquiring a first preset threshold for feature screening.

Step S530, when the correlation coefficient between the feature information is greater than the first preset threshold, at least one of the feature information is retained.

Step S540: Input the reserved feature information and the first label data into the support vector machine model to obtain a risk score.

In some embodiments of the present invention, in the process of calculating the risk score, the anomaly detection system will screen multiple feature information of the plug-in library to reduce the difficulty of calculation and optimize and simplify the calculation. By judging the correlation of feature information, the correlation coefficient between multiple feature information is calculated. The correlation coefficient is a statistical indicator used to reflect the closeness of the correlation between variables. The coefficient of the degree of linear correlation between variables. The correlation coefficient is calculated according to the product difference method. It is based on the deviation of the two variables from their respective averages. The degree of correlation between the two variables is reflected by multiplying the two deviations. The correlation is a description A statistical indicator of the linear relationship between random variables. The larger the absolute value of the correlation coefficient, the stronger the linear relationship between the variables. Then, the abnormality detection system compares the obtained correlation coefficient with the first preset threshold. The threshold is a preset comparison threshold. The first preset threshold is used for feature screening and is a threshold set based on the actual calculated effect. When the correlation coefficient between the feature information is greater than the first preset threshold, at least one of them is reserved. feature information, and input the retained feature information and the first label data into the support vector machine model to obtain a risk score.

It should be noted that, in the embodiment of the present invention, by calculating the correlation coefficient between pairs of feature information, when the correlation coefficient between the feature information is greater than the first preset threshold, one of the feature information is retained. Under the premise required by the embodiment of the present invention, the correlation coefficient can also be obtained for more than two feature information, and several feature information for correlation judgment can also be set, and the specified feature information is used for correlation judgment. There are one or more than two, which are not specifically limited in this embodiment of the present invention, and can be set according to actual application scenarios.

It should be noted that the feature information in this embodiment of the present invention may include word scoring features, hyphen information in the noun of the plug-in library, character information in the noun of the plug-in library, and the number of the plug-in library in the dynamic link library including the abnormal plug-in library. , the number of the plug-in library under the dynamic link library and the number of words obtained by splitting, etc., and judge the correlation between the above feature information, and obtain the correlation coefficient between the two feature information. When the correlation coefficient greater than the first preset threshold, retain one of the feature information, and then input the retained feature information into the support vector machine model to obtain a risk score. In the process of judgment, it will always be retained, and finally one of the final feature information is input into the support vector machine model. This is determined by the calculation principle of the word scoring feature, and there is no strong relationship between the word scoring feature and other feature information. Relevance is therefore always preserved.

Referring to FIG. 6 , step S150 of the abnormality detection method in the embodiment of the present invention may further include but not limited to the following steps S610 and S620.

Step S610, acquiring a second preset threshold value obtained according to the abnormal dynamic link library sample.

Step S610, when the dynamic link library score is greater than the second preset threshold, determine that the corresponding mobile device is an abnormal device.

In some embodiments of the present invention, after obtaining the dynamic link library score, the abnormality detection system determines whether the corresponding mobile device is an abnormal device according to the size of the dynamic link library, and performs dynamic To judge the size of the link library score, the anomaly detection system obtains the second preset threshold value obtained according to the abnormal dynamic link library sample. The abnormal dynamic link library sample is a known data sample, and the threshold value is defined by the known abnormal dynamic link library sample. , obtain a second preset threshold, when the dynamic link library score is greater than the second preset threshold, determine that the corresponding mobile device is an abnormal device, indicating that when the dynamic link library score is greater than the second preset threshold, it is different from the known abnormality The dynamic link library samples are similar and can be attributed to abnormal devices. When the dynamic link library score is less than or equal to the second preset threshold, it is determined that the corresponding mobile device is a normal device, indicating that this time is different from the known abnormal dynamic link library. The samples are not the same, so the devices are normal devices. The embodiments of the present invention do not need to rely on a blacklist when detecting mobile devices. Based on the identification and detection of the plug-in library, the coverage rate of abnormal device detection can be improved, and the abnormal detection efficiency can be improved.

Specifically, in a specific embodiment, the abnormality detection method in the embodiment of the present invention may have the following specific steps:

Step 1): Collect the label data of the abnormal plug-in library and the normal plug-in library, and the data of the device dynamic link library when the user's mobile device requests the application.

Step 2): Arranging the data of the dynamic link library, first, count the number of requests of each dynamic link library according to the aggregate count of the dynamic link library, and secondly, mark the dynamic link library including the abnormal plug-in library as abnormal.

Step 3): Arrange the plug-in library data, each dynamic link library data is composed of several plug-in libraries, split each dynamic link library data into plug-in library data, aggregate and count by the plug-in library, and calculate the request of each plug-in library number.

Step 4): The plug-in library name is divided into words, and the plug-in library name is split into words by matching method, and each plug-in library name can be split into several words.

Step 5): Calculate word features, calculate the homogeneity feature and difference feature of each word, where:

Homogeneity feature = the number of requests for abnormal plug-in libraries containing a certain target word / the number of requests for all abnormal plug-in libraries;

Difference feature = the number of requests for a plug-in library containing a certain target word abnormality/(the number of requests for all plug-in libraries containing a certain target word - the number of requests for a plug-in library containing a certain target word abnormality).

Step 6): Calculate the word scoring feature of the plug-in library. Select the maximum homogeneity feature and the maximum difference feature in the words in the plug-in library, and the calculation formula of the word scoring feature for each plug-in library is as follows:

The word scoring feature of the plug-in library = the maximum value of homogeneity features * the maximum value of different features.

Step 7): Calculate the plug-in library feature information, the plug-in library feature information includes: the number of hyphens in the plug-in library name, the number of numbers, the character length of the plug-in library, the number of the plug-in library in the abnormal dynamic link library, the number of the plug-in library in all The number of occurrences in the plugin library, the number of split words, word scoring features, etc.

Step 8): feature screening of the plug-in library. The correlation of each feature information in step 7) is calculated, and if the correlation coefficient exceeds the feature information of the first preset threshold, one of them can be reserved.

Step 9): Calculate the risk score of the plug-in library, input the feature information retained in step 8) and the label data of the plug-in library into the support vector machine model, and obtain the risk score of the plug-in library.

Step 10): Calculate the weight of the plug-in library, and calculate the weight of each plug-in library through Newton's cooling law according to the risk score.

Step 11): Calculate the dynamic link library score, using the risk score of the plug-in library in step 9) and the weight of the plug-in library in step 10) to calculate the dynamic link library score.

Step 12): marking an abnormal device, when the dynamic link library score is greater than the second preset threshold, marking the mobile device corresponding to the dynamic link library as an abnormal device.

It should be noted that, when the anomaly detection method in the embodiment of the present invention is applied to the business risk decision-making system, the coverage rate of identifying abnormal devices can be improved for the business risk decision-making system. However, abnormal devices can be identified, which improves the efficiency of risk identification and ensures business security.

Referring to FIG. 7 , an embodiment of the present invention further provides an anomaly detection system 100 for a mobile device. The anomaly detection system 100 can execute the anomaly detection method in the foregoing embodiment. The anomaly detection system 100 includes: a data acquisition module 101, a data The processing module 102, the abnormality scoring module 103 and the abnormality detection module 104, the data acquisition module 101 is mainly used to acquire data, including the data of the dynamic link library, etc. The data processing module 102 can process the data from the data acquisition module 101 to obtain Risk score, the abnormal score module 103 is mainly used to obtain the dynamic link library score according to the data from the data processing module 102, and is used to judge the abnormal score, and the abnormality detection module 104 is mainly used to judge the corresponding mobile according to the dynamic link library score. Whether the device is an abnormal device.

Specifically, the data acquisition module 101 is used to acquire the dynamic link library when the mobile device requests the application, and split the dynamic link library to obtain several plug-in libraries; the data processing module 102 is used to acquire the first tag data and multiple plug-in libraries of each plug-in library. The feature information and the first label data are input into the support vector machine model to obtain the risk score of the plug-in library; the abnormality scoring module 103 is used to obtain the weight of the plug-in library according to the risk score through Newton's law of cooling, and according to the risk score of the plug-in library. The weight and the corresponding risk score are weighted to obtain the dynamic link library score; the abnormality detection module 104 is configured to judge whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

The anomaly detection system 100 in this embodiment of the present invention may be a business risk decision-making system. By executing the anomaly detection method in the above embodiment, the anomaly detection system 100 does not need to rely on a blacklist when detecting a mobile device, and is based on the identification of the plug-in library. Detection can improve the coverage of abnormal device detection and improve the efficiency of abnormal detection.

FIG. 8 shows an electronic device 200 provided by an embodiment of the present invention. The electronic device 200 includes: a memory 201, a processor 202, and a computer program stored in the memory 201 and running on the processor 202. When the computer program runs, it is used to execute the above-mentioned abnormality detection method for a mobile device.

The processor 202 and the memory 201 may be connected by a bus or other means.

As a non-transitory computer-readable storage medium, the memory 201 can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the method for detecting anomaly of a mobile device described in the embodiments of the present invention. The processor 202 executes the non-transitory software programs and instructions stored in the memory 201 to implement the above-mentioned abnormality detection method for the mobile device.

The memory 201 may include a storage program area and a storage data area, wherein the storage program area may store an operating system and an application program required by at least one function; the storage data area may store the above-mentioned abnormality detection method for a mobile device. Additionally, memory 201 may include high-speed random access memory 201, and may also include non-transitory memory 201, such as at least one storage device storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 201 may optionally include memory 201 located remotely from the processor 202, and these remote memories 201 may be connected to the electronic device 200 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The non-transitory software programs and instructions required to implement the above-mentioned abnormality detection method for mobile devices are stored in the memory 201, and when executed by one or more processors 202, perform the above-mentioned abnormality detection method for mobile devices, for example, execute Method steps S110 to S150 in FIG. 1 , method steps S210 to S230 in FIG. 2 , method steps S310 to S330 in FIG. 3 , method steps S410 to S420 in FIG. 4 , method steps in FIG. 5 Steps S510 to S540, and steps S610 to S620 of the method in FIG. 6 .

Embodiments of the present invention further provide a computer-readable storage medium storing computer-executable instructions, where the computer-executable instructions are used to execute the above-mentioned abnormality detection method for a mobile device.

In one embodiment, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more control processors, for example, performing steps S110 to S150 of the method in FIG. The method steps S210 to S230 in FIG. 3 , the method steps S310 to S330 in FIG. 3 , the method steps S410 to S420 in FIG. Step S620.

The apparatus embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

Those of ordinary skill in the art can understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, storage device storage or other magnetic storage devices, or Any other medium that can be used to store the desired information and that can be accessed by a computer. In addition, communication media typically include computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

It should also be understood that various implementation manners provided in the embodiments of the present invention may be arbitrarily combined to achieve different technical effects.

Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, functional modules/units in the systems, and devices can be implemented as software, firmware, hardware, and appropriate combinations thereof.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above-mentioned embodiments, and those skilled in the art can also make various equivalent deformations or replacements under the shared conditions that do not violate the spirit of the present invention, These equivalent modifications or substitutions are all included within the scope defined by the claims of the present invention.

Claims (10)

1. An anomaly detection method for a mobile device, comprising:

acquiring a dynamic link library when a mobile device requests application, and splitting the dynamic link library to obtain a plurality of plug-in libraries;

acquiring first label data and a plurality of feature information of each plug-in library, and inputting the feature information and the first label data into a support vector machine model to obtain a risk score of the plug-in library;

obtaining the weight of the plug-in library through Newton's cooling law according to the risk score;

weighting according to the weight of the plug-in library and the corresponding risk score to obtain a dynamic link library score;

and judging whether the corresponding mobile equipment is abnormal equipment or not according to the dynamic link library score.

2. The abnormality detection method according to claim 1, characterized in that the feature information includes a word score feature obtained according to the steps of:

Acquiring the name of the plug-in library, and splitting the name of the plug-in library into a plurality of words;

selecting target words in the words, and calculating to obtain the homogeneity characteristic and the difference characteristic of each target word;

and obtaining word scoring characteristics corresponding to the plug-in library according to the homogeneity characteristics and the difference characteristics.

3. The method of claim 2, wherein the computing a homogeneity feature and a variability feature of each of the target words comprises:

acquiring second label data, and determining an abnormal plug-in library and a normal plug-in library in the plurality of plug-in libraries according to the second label data;

acquiring a first request number of the abnormal plug-in library containing the target word, a second request number of all the abnormal plug-in libraries and a third request number of the normal plug-in library containing the target word;

and obtaining the homogeneity characteristic according to the proportional relation between the first request number and the second request number, and obtaining the difference characteristic according to the proportional relation between the first request number and the third request number.

4. The anomaly detection method of the mobile device according to claim 2, wherein the deriving a word score feature corresponding to the plug-in library according to the homogeneity feature and the variability feature comprises:

Selecting a homogeneity characteristic maximum value and a difference characteristic maximum value from the homogeneity characteristic and the difference characteristic of all words in the plug-in library;

and obtaining the word scoring characteristics according to the product of the homogeneity characteristic maximum value and the difference characteristic maximum value.

5. The abnormality detection method according to claim 2, characterized in that said feature information further includes at least one of hyphenation information in said plug-in library name, character information in said plug-in library name, number of said plug-in libraries in said dynamic link library containing said abnormal plug-in library, number of said plug-in libraries under said dynamic link library, and number of said words obtained by splitting.

6. The anomaly detection method of the mobile device according to claim 1, wherein the inputting the feature information and the first tag data into a support vector machine model to obtain a risk score of the plug-in library comprises:

calculating a correlation coefficient between a plurality of the characteristic information;

acquiring a first preset threshold value for feature screening;

when the correlation coefficient between the characteristic information is larger than the first preset threshold value, retaining at least one of the characteristic information;

Inputting the retained feature information and the first tag data into the support vector machine model to obtain the risk score.

7. The method according to claim 1, wherein the determining whether the corresponding mobile device is an abnormal device according to the score of the dynamic link library comprises:

acquiring a second preset threshold value obtained according to the abnormal dynamic link library sample;

and when the dynamic link library score is larger than the second preset threshold value, determining that the corresponding mobile equipment is abnormal equipment.

8. An anomaly detection system for a mobile device, comprising:

the data acquisition module is used for acquiring a dynamic link library when the mobile equipment requests application and splitting the dynamic link library to obtain a plurality of plug-in libraries;

the data processing module is used for acquiring first label data and a plurality of feature information of each plug-in library, and inputting the feature information and the first label data into a support vector machine model to obtain a risk score of the plug-in library;

the abnormal scoring module is used for obtaining the weight of the plug-in library through a Newton cooling law according to the risk score and obtaining a dynamic link library score according to the weight of the plug-in library and the corresponding risk score weighting;

And the abnormity detection module is used for judging whether the corresponding mobile equipment is abnormal equipment or not according to the dynamic link library score.

9. An electronic device, comprising a memory storing a computer program, and a processor implementing the abnormality detection method for a mobile device according to any one of claims 1 to 7 when the processor executes the computer program.

10. A computer-readable storage medium characterized in that the storage medium stores a program executed by a processor to implement the abnormality detection method of a mobile device according to any one of claims 1 to 7.

Images