Risk application detection method and device and server

Abstract

The invention provides a risk application detection method and device and a server. Based on the method, before specific implementation, a positive sample path set and a negative sample path set can be used for training a corresponding preset first path processing model, a preset second path processing model and a preset classification model; during specific implementation, a target application can be subjected to preset static analysis firstly, and a key API based on the target application and a plurality of API calling paths related to the key API are determined; then, the preset first path processing model and the preset second path processing model are called for processing the API calling paths to obtain and utilize suspicious degree parameters of the API calling paths and construct a suspicious degree feature vector about the target application; and a preset classification model is called to process the suspicious degree feature vector, and determine whether the target application is a risk application. Therefore, the risk application injected with a small number of malicious codes can be accurately and efficiently detected and identified.

Description

technical field [0001] This specification belongs to the field of artificial intelligence technology, and in particular relates to detection methods, devices and servers for risky applications. Background technique [0002] When detecting risky applications (for example, malicious Android software, etc.), most of the existing methods start from the perspective of the application as a whole and perform feature extraction on the overall code of the application to determine whether the application is a risky application. [0003] However, in order to avoid being detected and identified, some risky applications will inject a small amount of malicious code into the application code, and use the overall characteristics of most of the normal code in the application to hide the partial characteristics of a small part of the malicious code. As a result, the above risk applications cannot be accurately detected and identified based on existing methods, and missed detection occurs. ...

AI Technical Summary

Problems solved by technology

As a result, the above-mentioned risky applications cannot be accurately detected and identified based on existing methods, resulting in missed detection

[0004] For the above problems, no effective solution has been proposed

Images