CN107220527A

CN107220527A - One kind application discriminating method and application management equipment

Info

Publication number: CN107220527A
Application number: CN201710254173.XA
Authority: CN
Inventors: 邱孝童
Original assignee: Nubia Technology Co Ltd
Current assignee: Nubia Technology Co Ltd
Priority date: 2017-04-18
Filing date: 2017-04-18
Publication date: 2017-09-29

Abstract

The invention discloses one kind application discriminating method and application management equipment, model is screened to set up to apply by the modelling application feature that various kinds this application is obtained in being applied from sample (modelling application feature applies the difference characteristic being had differences with mountain vallage application including legal), it is that can obtain the type examination value of the application to be identified to screen model by the modelling application feature and application of application to be identified again, and type examination value and mountain vallage application discriminator are compared and can determine that whether it is mountain vallage application.So, the difference characteristic being had differences by using legal application with mountain vallage application, allow the application set up to screen model and screen out legal application and mountain vallage application well, realize the high-efficient automatic examination to application, considerably reduce by manually screening the cost that mountain vallage is applied, Detection accuracy is improved, terminal security and privacy of user safety has been ensured.

Description

One kind application discriminating method and application management equipment

Technical field

The present invention relates to areas of information technology, more specifically to one kind application discriminating method and application management equipment.

Background technology

With reaching its maturity for intelligent terminal technology, the function of terminal is also stronger and stronger, and the innovation applied in terminal Make rapid progress.However, in current end-use market, the application for being available for user to download is often very different, mountain vallage application Even more it is flooded with application market.And mountain vallage application is often difficult to the actual demand for meeting user, it is also possible to carry virus on the contrary, very To leakage subscriber data, great potential safety hazard is brought to user.

In fact, along with the continuous expansion of terminal user colony, the quantity of mountain vallage application is also constantly increasing, and mountain vallage Using with higher fascination, make us hard to guard against, or even the mountain vallage application having and the icon of legal application, word are all almost It is the same.At present, mountain vallage application has become the significant threat of terminal security and privacy of user.In this case, Find a kind of method that can screen mountain vallage application exactly and just seem very necessary.

The content of the invention

The technical problem to be solved in the present invention is：A large amount of mountain vallage applications are flooded with current application market to be difficult to differentiate, So as to seriously threaten terminal security and privacy of user safety.For the technical problem, screened the invention provides one kind application Method and application management equipment.

In order to solve the above technical problems, the present invention provides a kind of application management equipment, the application management equipment includes：

Feature acquisition module, the modelling application feature for obtaining the application of current sample, the current sample apply including At least two applications in known legal application and mountain vallage application, the modelling application feature includes legal application and mountain vallage application The difference characteristic having differences；And for obtaining the modelling application feature of current application to be identified；

Model building module, is applied examination model for the modelling application feature based on each sample application, and Obtain mountain vallage application discriminator corresponding with application examination model；

Using module is screened, screen model for the modelling application feature according to the application to be identified and the application and obtain To the type examination value of the application to be identified, and the type examination value is compared with the mountain vallage application discriminator sentenced Determine whether it is mountain vallage application.

Further, the model building module includes：

Feature calculation unit, based on the modelling application feature progress feature with application to be identified is applied to each sample Calculate；

Normalized unit, each sample for being obtained to calculating is applied and the same modeling of application to be identified should It is normalized with the characteristic value of feature；

Model sets up unit, for regarding the characteristic value of each sample application after the normalized as training Collection, sets up application by machine learning algorithm and screens model.

Further, the application screens module and is used to make the characteristic value after the normalized of the application to be identified The application is inputted for test set and screens model, obtains the type examination value of the application to be identified.

Further, the model building module includes：

Sample application updating block, should for each legal application and/or mountain vallage application after examination to be added into the sample In；

Model modification unit, for when model modification condition is triggered, the modelling application feature applied based on current sample Set up new application examination model to be updated to screen model to the application, and obtain and the application examination after the renewal The corresponding mountain vallage application discriminator of model.

Further, the difference characteristic includes：Apply Names similarity, Apply Names include spcial character situation, answered Official's mark situation, application data bag are included with developer's situation, using accumulative version number, using inclusion size, application data Scored containing case of advertisements, using download, using report amount, using user, using dangerous authority quantity mesh, using in source At least two.

Further, the invention provides one kind application discriminating method, methods described includes：

The modelling application feature of current sample application is obtained, the current sample, which is applied, includes at least one known legal copy Using with least one mountain vallage application, the difference that the modelling application feature includes legal application with mountain vallage application has differences is special Levy；

Modelling application feature based on each sample application is applied examination model, and obtains and screened with the application The corresponding mountain vallage application discriminator of model；

The modelling application feature of current application to be identified is obtained, according to the modelling application feature of acquisition and the application Screen the type examination value that model obtains the application to be identified；

Whether the type examination value and the mountain vallage application discriminator are compared judges it as mountain vallage application.

Further, the modelling application feature based on various kinds this application be applied examination model include：

Each sample is applied and the modelling application feature of application to be identified carries out feature calculation；

The characteristic value with the same modelling application feature of application to be identified is applied to carry out in each sample that calculating is obtained Normalized；

Using the characteristic value of each sample application after the normalized as training set, pass through machine learning algorithm Set up application and screen model.

Further, the modelling application feature for obtaining application to be identified, according to the modelling application feature of acquisition The type examination value for obtaining the application to be identified with application examination model includes：

Characteristic value after the normalized of the application to be identified is inputted into the application as test set and screens model, Obtain the type examination value of the application to be identified.

Further, the modelling application feature based on each sample application examination model that is applied also includes：

Each legal application and/or mountain vallage application after examination is added in the sample application；

When model modification condition is triggered, new application is set up based on the modelling application feature that current sample is applied and screens mould Type is updated with screening model to the application, and obtains mountain vallage application corresponding with the application examination model after the renewal Discriminator.

Further, it is special according to the modelling application of acquisition in the modelling application feature for obtaining application to be identified The application examination model of seeking peace is obtained before the type examination value of the application to be identified, in addition to：

When screening trigger condition triggering, the unknown application of the classification that there is currently is obtained, and the classification is unknown Using being used as application to be identified.

Beneficial effect

A kind of application discriminating method and application management equipment that the present invention is provided, by from including it is known at least one just Modelling application feature (the modelling application feature of various kinds this application is obtained in the sample application that version application and at least one mountain vallage are applied The difference characteristic being had differences including legal application with mountain vallage application), then the modelling application feature based on various kinds this application obtains Using examination model, and obtain mountain vallage application discriminator corresponding with application examination model.Application to be identified is obtained afterwards Its modelling application feature, it is that the type that can obtain the application to be identified is screened to screen model by the modelling application feature and application Value, and type examination value and mountain vallage application discriminator are compared and can determine that whether it is mountain vallage application.So, pass through The difference characteristic being had differences using legal application with mountain vallage application so that the application of foundation screens model and can be very good reflection The difference gone out between legal application and mountain vallage application, screens model by application and unknown applications is detected, realize correspondence High-efficient automatic is screened, it is ensured that the security for the application that supply user downloads, and then has ensured terminal security and user Personal secrets, while being screened automatically by model, considerably reduce by manually screening the cost that mountain vallage is applied, also carry High Detection accuracy.

Brief description of the drawings

Below in conjunction with drawings and Examples, the invention will be further described, in accompanying drawing：

Fig. 1 is the hardware architecture diagram for realizing the optional mobile terminal of each embodiment one of the invention；

Fig. 2 is the structural representation for realizing the optional server of each embodiment one of the invention；

A kind of schematic flow sheet for application discriminating method that Fig. 3 provides for first embodiment of the invention；

Fig. 4 is applied examination mould for the modelling application feature based on various kinds this application that first embodiment of the invention is provided A kind of idiographic flow schematic diagram of type；

Fig. 5 screens the method flow schematic diagram of model for a kind of dynamic adjustment application that first embodiment of the invention is provided；

A kind of basic framework figure for application discriminating method implementation process that Fig. 6 provides for second embodiment of the invention；

A kind of idiographic flow schematic diagram for application discriminating method implementation process that Fig. 7 provides for second embodiment of the invention；

A kind of application management device structure schematic diagram that Fig. 8 provides for third embodiment of the invention；

A kind of concrete structure schematic diagram for model building module that Fig. 9 provides for third embodiment of the invention；

A kind of concrete structure schematic diagram for model building module that Figure 10 provides for fourth embodiment of the invention.

Embodiment

It should be appreciated that specific embodiment described herein is not intended to limit the present invention only to explain the present invention.

Describe to realize the terminal of each embodiment of the invention referring now to accompanying drawing.In follow-up description, using for The suffix of such as " module ", " part " or " unit " of element is represented only for being conducive to the explanation of the present invention, itself is not There is specific meaning.Therefore, " module " can be used mixedly with " part ".

Mobile terminal can be implemented in a variety of manners.For example, the terminal described in the present invention can include such as moving Phone, smart phone, notebook computer, digit broadcasting receiver, PDA (personal digital assistant), PAD (tablet personal computer), PMP The mobile terminal of (portable media player), guider etc. and such as numeral TV, desktop computer etc. are consolidated Determine terminal.Hereinafter it is assumed that terminal is mobile terminal, however, it will be understood by those skilled in the art that, except being used in particular for movement Outside the element of purpose, construction according to the embodiment of the present invention can also apply to the terminal of fixed type.

Fig. 1 is the hardware architecture diagram for realizing the optional mobile terminal of each embodiment one of the invention.

Mobile terminal 1 00 can include wireless communication unit 110, A/V (audio/video) input block 120, user's input Unit 130, sensing unit 140, output unit 150, memory 160, interface unit 170, controller 180 and power subsystem 190 Etc..Fig. 1 shows the mobile terminal with various assemblies, it should be understood that being not required for implementing all groups shown Part, can alternatively implement more or less components, the element of mobile terminal will be discussed in more detail below.

Wireless communication unit 110 generally includes one or more assemblies, and it allows mobile terminal 1 00 and wireless communication system Or the radio communication between network.

A/V input blocks 120 are used to receive audio or video signal.A/V input blocks 120 can include camera and Mike Wind.

The order that user input unit 130 can be inputted according to user generates key input data to control each of mobile terminal Plant operation.User input unit 130 allows user to input various types of information, and can include keyboard, metal dome, touch Plate (for example, detection due to being touched caused by resistance, pressure, electric capacity etc. change sensitive component), roller, rocking bar etc. Deng.

Sensing unit 140 detects the current state of mobile terminal 1 00, (for example, mobile terminal 1 00 opens or closes shape State), the position of mobile terminal 1 00, user is for the presence or absence of contact (that is, touch input) of mobile terminal 1 00, mobile terminal The acceleration or deceleration movement of 100 orientation, mobile terminal 1 00 and direction etc., and generate for controlling mobile terminal 1 00 The order of operation or signal.For example, when mobile terminal 1 00 is embodied as sliding-type mobile phone, sensing unit 140 can be sensed The sliding-type phone is opening or closing.In addition, sensing unit 140 can detect power subsystem 190 whether provide electric power or Whether person's interface unit 170 couples with external device (ED).

Interface unit 170 is connected the interface that can pass through as at least one external device (ED) with mobile terminal 1 00.For example, External device (ED) can include wired or wireless head-band earphone port, external power source (or battery charger) port, wired or nothing Line FPDP, memory card port, the port for connecting the device with identification module, audio input/output (I/O) end Mouth, video i/o port, ear port etc..Identification module can be that storage is used to verify that user uses each of mobile terminal 1 00 Plant information and subscriber identification module (UIM), client identification module (SIM), Universal Subscriber identification module (USIM) can be included Etc..In addition, the device (hereinafter referred to as " identifying device ") with identification module can take the form of smart card, therefore, know Other device can be connected via port or other attachment means with mobile terminal 1 00.Interface unit 170 can be used for reception and come from The input (for example, data message, electric power etc.) of external device (ED) and the input received is transferred in mobile terminal 1 00 One or more elements can be used for transmitting data between mobile terminal and external device (ED).

In addition, when mobile terminal 1 00 is connected with external base, interface unit 170 may be used as allowing by it by electricity Power provides to the path of mobile terminal 1 00 from base or may be used as allowing passing through it from the various command signals that base is inputted It is transferred to the path of mobile terminal.The various command signals or electric power inputted from base may be used as being used to recognize that mobile terminal is The no signal being accurately fitted within base.Output unit 150 is configured to provide defeated with vision, audio and/or tactile manner Go out signal (for example, audio signal, vision signal, alarm signal, vibration signal etc.).

Memory 160 can store software program of the processing performed by controller 180 and control operation etc., Huo Zheke Temporarily to store oneself data (for example, telephone directory, message, still image, video etc.) through exporting or will export.And And, memory 160 can store the vibration of various modes on being exported when touching and being applied to touch-screen and audio signal Data.

Memory 160 can include the storage medium of at least one type, and the storage medium includes flash memory, hard disk, many Media card, card-type memory (for example, SD or DX memories etc.), random access storage device (RAM), static random-access storage Device (SRAM), read-only storage (ROM), Electrically Erasable Read Only Memory (EEPROM), programmable read only memory (PROM), magnetic storage, disk, CD etc..Moreover, mobile terminal 1 00 can be with performing memory by network connection The network storage device cooperation of 160 store function.

The overall operation of the generally control mobile terminal of controller 180.For example, controller 180 is performed and voice call, data Communication, video calling etc. related control and processing.Controller 180 can be with execution pattern identifying processing, will be in touch-screen The handwriting input of upper execution or picture draw input and are identified as character or image.

Power subsystem 190 receives external power or internal power under the control of controller 180 and provides operation each member Appropriate electric power needed for part and component.

Various embodiments described herein can be with use such as computer software, hardware or its any combination of calculating Machine computer-readable recording medium is implemented.Implement for hardware, embodiment described herein can be by using application-specific IC (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), scene can Programming gate array (FPGA), processor, controller, microcontroller, microprocessor, it is designed to perform function described herein At least one of electronic unit is implemented, and in some cases, such embodiment can be implemented in controller 180. For software implementation, the embodiment of such as process or function can be with allowing to perform the single of at least one function or operation Software module is implemented.Software code can by the software application (or program) write with any appropriate programming language Lai Implement, software code can be stored in memory 160 and be performed by controller 180.

So far, oneself according to its function through describing mobile terminal.Below, for the sake of brevity, will description such as folded form, Slide type mobile terminal in various types of mobile terminals of board-type, oscillating-type, slide type mobile terminal etc. is as showing Example.Therefore, the present invention can be applied to any kind of mobile terminal, and be not limited to slide type mobile terminal.

Referring also to shown in Fig. 2, Fig. 2 is the structural representation for realizing the optional server of each embodiment one of the invention Figure, the server at least includes：Input and output (IO) bus 21, processor 22, memory 23, internal memory 24 and communicator 25. Wherein,

Input and output (IO) bus 21 respectively with other parts of the server belonging to itself (processor 22, memory 23, Internal memory 24 and communicator 25) connection, and provide transmission lines for other parts.

Processor 22 generally controls the overall operation of the server belonging to itself.Calculated and true for example, processor 22 is performed The operation such as recognize.Wherein, processor 22 can be central processing unit (CPU).

The storage processor of memory 23 is readable, the software code that processor is executable, and it, which is included, is used for control processor 22 Perform the instruction (i.e. software perform function) of functions described herein.

Wherein, in the application management equipment that the present invention is provided, realize that feature acquisition module, model building module and application are discriminated The software code of the function of other module is storable in memory 23, and by processor 22 perform or compile after perform.

Internal memory 24, typically using semiconductor memory cell, including random access memory (RAM), read-only storage (ROM), with And cache (CACHE), RAM is most important of which memory.Internal memory 24 is one of important part in computer, and it is The operation of all programs is all carried out in internal memory in the bridge linked up with CPU22, computer, and it is to be used for temporarily that it, which is acted on, Operational data in Shi Cunfang CPU22, and the data exchanged with the external memory storage such as hard disk, as long as computer is in operation, CPU22 will carry out computing needing the data of computing to be transferred in internal memory, and CPU22 again sends out result after the completion of computing Come.

Communicator 25, generally includes one or more assemblies, and it allows the server and radio communication system belonging to itself Radio communication between system or network.

It is described in detail below by way of specific embodiment.

First embodiment

Accurately and efficiently screened out to realize using whether being mountain vallage application, examination side is applied the invention provides one kind Method.Reference picture 3, the application discriminating method schematic flow sheet that Fig. 3 provides for first embodiment of the invention, including：

S301:Obtain the modelling application feature of current sample application；

It is worth noting that, current sample application in the present embodiment should include at least one known legal copy application and At least one mountain vallage application.It is further noted that being used for the modelling application that each current sample is applied modeled in the present embodiment Feature should include the difference characteristic that legal application has differences with mountain vallage application.

In the present embodiment, difference characteristic can be determined by feature mining engineering, for example, can be related by application The engineer in field to carry out aspect ratio pair to related application, determines that mountain vallage applies some that there is discrimination with legal application Feature, these features are difference characteristic.Typically, engineer can first determine that mountain vallage is applied compared with legal copy application, tool Standby the characteristics of, such as imitate popular application title, Logo (it is to imitate popular application " Taobao " for example " to wash in a pan treasured nets ")；Illegally Chinesizing (Chinese, content is English)；Function is single (the only simple page)；Title it is strange (for example " angry cuts bird, Crack version ")；Authority is excessive, and is related to safety, privacy authority more；Inclusion is smaller, mostly 1-2M and following；Version is single, when long Between not more redaction；Include erotica, sensitive information；Download is low, scoring is low；Etc.；And according to these features, you can correspondence is true Make mountain vallage and apply the feature larger with the indexing of legal application area, for example Apply Names similarity (to be legal answer by such as a application With then it will not be too high with the Apply Names similarity of another money legal copy application, and mountain vallage application then most probably can be a with certain The Apply Names similarity of legal copy application is very high, such as " washes in a pan treasured nets " and " Taobao ").

In the present embodiment, difference characteristic can also be determined by way of machine and engineer's linkage.For example, allowing work Cheng Shi can determine that mountain vallage applies some features that there is discrimination with legal application comprehensively as far as possible, recycle machine algorithm, Such as similarity algorithm determines some more obvious features of differentiation, and difference characteristic is used as using these features.

S302:Modelling application feature based on each current sample application is applied examination model；

In the present embodiment, during each current sample application can be each legal application and blacklist in application market white list Each mountain vallage application or consistent legal application and/or mountain vallage application not in white list or blacklist.Using application , can be by the institute in white list when each legal copy in the white list of market is applied with each mountain vallage in blacklist using being applied as sample There are all mountain vallages applications in legal copy application and blacklist as sample application, only can also answer the part legal copy in white list Sample application is used as with being applied with part mountain vallage in blacklist.

In the present embodiment, using the modelling application feature of each current sample application as training set, pass through machine learning algorithm Set up model.It should be appreciated that can be instructed in the present embodiment using supervised learning class machine learning algorithm to training set Practice study, so as to set up model.

Applied for example, setting current sample as 100, wherein legal application 50, mountain vallage applies 50；If x, y, z are every Individual sample applies the modelling application feature for three classes having, x1-x50, y1-y50, z1-z50, respectively 50 legal applications pair The modelling application feature for three classes answered, x51-x100, y51-y100, z51-z100, respectively 50 mountain vallages apply corresponding three The modelling application feature of class；If legal copy application is characterized with 0, mountain vallage is applied to be characterized with 1；Then by training set (x1, y1, z1,0), (x2, y2, z2,0) ..., (x50, y50, z50,0), (x51, y51, z51,1), (x52, y52, z52,1) ..., (x100, Y100, z100,1) input equipment is learnt, trained, namely annunciator input x1, y1, and during z1,0 is output as, x2 is inputted, When y2, z2,0 is output as ..., inputs x50, y50, during z50, be output as 0, input x51, y51, during z51, be output as 1, input When x52, y52, z52,1 is output as ..., input x100, y100, during z100, be output as 1；Hereafter equipment is obtained according to set algorithm To the model for meeting above-mentioned training set input and output.As long as hereafter should to the corresponding modeling of the corresponding application to be identified of the mode input With feature, model is that exportable its is the probability of mountain vallage application, and carries out judgement classification according to the threshold value of setting.It should be understood that It is that the characterization value that legal copy application and mountain vallage are applied can be the different numerical value of any two, for example, can also uses 1 by legal Characterize, mountain vallage is applied to be characterized with 0；Or characterize legal copy application with 0.1, mountain vallage is applied with 0.9 sign etc..When legal copy uses 0 Characterize, when mountain vallage is applied with 1 sign, actual model output valve is that corresponding application to be identified is the probability that mountain vallage is applied；When just Version application is characterized with 1, when mountain vallage is applied with 0 sign, and actual model output valve is that corresponding application to be identified is applied to be legal Probability.

S303:Obtain mountain vallage application discriminator corresponding with application examination model；

In the present embodiment, because the difference of modeling algorithm can cause obtained application examination model also different, and apply and discriminate The difference of other model can cause its corresponding mountain vallage application discriminator different.

It should be appreciated that the engineer that mountain vallage application discriminator can be association area is set according to practical experience Fixed；Or by carrying out a large amount of testability examinations to model, the type examination value exported further according to model and corresponding test The analogy of application carries out counting what is obtained.

S304:Obtain the modelling application feature of current application to be identified；

It is worth noting that, what the modelling application feature of the current application to be identified obtained should be applied with the sample of acquisition Modelling application feature is corresponding.The modelling application of the sample application of such as acquisition is characterized as title similarity, using accumulative version Inclusion size is counted and applies, then the modelling application feature of the current application to be identified obtained should also be as title similarity, application Add up version number and apply inclusion size.

S305:The type examination that model obtains the application to be identified is screened according to the modelling application feature of acquisition and application Value；

After the modelling application feature of current application to be identified is got, the modelling application feature of application to be identified is structure The test set of model is screened into application, after these modelling application features are inputted, can correspondingly be calculated using model is screened Export corresponding type examination value.It should be appreciated that due to the difference of modeling algorithm, discriminating using the type for screening model output It is that the setting value that legal application or mountain vallage are applied is different that value may not set sign from training set.

S306:Obtained type examination value and mountain vallage application discriminator are compared and judge whether it should as mountain vallage With.

In the present embodiment, it can screen model output type by mountain vallage application discriminator write device in application and discriminate Not Zhi after, contrasted automatically, result of determination exported.It should be appreciated that the present embodiment can also be in type examination value After output, it is compared by manual examination and verification mode, judges the type of application to be identified.

It should be appreciated that it can also be multiple that the current application to be identified in the present embodiment, which can be one, you can with Realize and the batch of application to be identified is screened.

It should be appreciated that sample applies more (i.e. training set capacity is bigger), obtained model is for application to be identified The accuracy rate that type is screened is can be higher, but its modeling time can also increase therewith, can also increase for consumed resource, because This, can be determined according to the actual requirements for the quantity that sample is applied.

It is to be further understood that the step of each in the present embodiment can automatically be carried out by equipment, you can with previous step After the completion of rapid, the operation of next step can be carried out automatically by being not required to user's intervention.

In the present embodiment, difference characteristic can include Apply Names similarity, Apply Names and include spcial character situation, answer Official's mark situation, application data bag are included with developer's situation, using accumulative version number, using inclusion size, application data Scored containing case of advertisements, using download, using report amount, using user, using dangerous authority quantity mesh, using in source At least two.

In the present embodiment, the modelling application feature based on various kinds this application, which is applied, screens a kind of idiographic flow of model Fig. 4 is may refer to, including：

S401：Feature calculation is carried out to various kinds this application and the modelling application feature of application to be identified；

In the present embodiment, it can be calculated for Apply Names similarity using SimHash scheduling algorithms, obtain corresponding phase Like degree calculated value；It can be judged for Apply Names comprising spcial character situation by the testing result to application, For example：It is then 0 comprising spcial character, is then 0 not comprising then as 1, or comprising 3 and above spcial character, includes 1-2 Individual spcial character is then 0.5, not comprising then as 1 etc..For application developer situation, using accumulative version number, using bag Body size, application data comprising official mark situation, application data comprising case of advertisements, using download, using report amount, should Scored, using dangerous authority quantity mesh, using the feature calculation in source etc., can be used with calculating feature " application name with user Claiming to include spcial character situation " identical mode carries out；Accordingly, foregoing side can also be used for Apply Names similarity Formula, such as SimHash algorithms, which are calculated, to be obtained being less than 0.8 like degree calculated value, then is designated as 1, is otherwise designated as 0.

S402：The various kinds this application and the characteristic value of the same modelling application feature of application to be identified obtained to calculating is entered Row normalized；

In the present embodiment, the characteristic value of various kinds this application and each same modelling application feature of application to be identified can be carried out Normalized, such as some this application and application to be identified, there is the class modelling application feature of A, B, C tri-, if sample should With there is 100, the corresponding characteristic value of the class modelling application feature of A, B, C tri- respectively is A1-A100, B1-B100, C1-C100； Application to be identified has 10, and the corresponding characteristic value of the class modelling application feature of A, B, C tri- respectively is A101-A110, B101- B110, C101-C110；Then A1-A110 is normalized respectively, B1-B110 is normalized, C1-C110 enters Row normalized, obtains A ' 1-A ' 110, B ' 1-B ' 110, C ' 1-C ' 110 of the numerical value between 0-1.

S403：Using the characteristic value of the various kinds this application after normalized as training set, built by machine learning algorithm Model is screened in vertical application.

It is worth noting that, not including the normalization characteristic value of application to be identified in the present embodiment in training set.More than still Exemplified by example, the 100-C ' 110 of 110, B ' 100-B ' of A ' 100-A ' 110, C ' are not included in training set now.

In the present embodiment, it can be included using the machine learning algorithm being modeled：Logistic regression algorithm, decision Tree algorithms, The machine learning algorithms such as random forests algorithm.

In the present embodiment, established according to Fig. 4 method using after screening model, then by returning application to be identified The characteristic value of modelling application feature after one change processing is screened in model as test set input application, you can obtain this to be identified The type examination value of application.

It should be appreciated that the application in the present embodiment screen model the step of as described in Figure 4 in it has been established that i.e. phase When in having determined that a function of many variables, now by by the modelling application feature of the application to be identified after normalized it Characteristic value input application is screened in model, that is, informing function variable value, is thus calculated i.e. using examination model An available value, the value is the type examination value of corresponding application to be identified.

In the present embodiment, according to the type examination value of obtained a certain application and the mountain vallage application discriminator of acquisition Whether the type for obtaining the application is mountain vallage application.The type examination value of such as a certain application is 0.3, and mountain vallage application discriminating threshold It is worth for 0.5, then judges the application as mountain vallage application.It should be appreciated that the mountain vallage application set in training set is characterized Value, then the application screened more is probably mountain vallage application.The mountain vallage application characterization value for example in training set set is legal as 0 Using for 1, then type examination value, closer to 0 application, is more probably mountain vallage application, and the application closer to 1 is more probably legal Using.

In the present embodiment, after the type that determined each application to be identified, the mountain vallage screened out can be applied and pass through people Work is operated or equipment the mode such as is automatically brought into operation and carries out off-frame treatment.So, user is available for user to download when entering application market Application be legal application after screening.

In the present embodiment, the mountain vallage application for off-frame treatment can be added in the blacklist of application market, to avoid Same money is screened again using needs later.Likewise, being applied for the legal copy screened out, application can be added it to In the white list in market.

Because the size of sample size can influence model to screen the degree of accuracy, typically, the quantity of sample application is more, builds It is more accurate that vertical application examination model will be screened, and to improve constantly the examination precision of model, the present embodiment additionally provides one The method that model is screened in dynamic adjustment application is planted, referring to Fig. 5, including：

S501:Each legal application and/or mountain vallage application after examination is added in sample application；

In the present embodiment, if comprising the application in application market blacklist or white list in sample application, after screening Each legal application be added in the white list of application market, each mountain vallage application after examination is added to the black name of application market Dan Zhong.

S502:When model modification condition is triggered, the modelling application feature applied based on current sample sets up new application Model is screened to be updated to screen model to original application；

It is worth noting that, the current sample application that model is screened for updating application refers to that adding the last time has screened Each legal application gone out and/or the set of applications of mountain vallage application.

In the present embodiment, model modification condition can be cycle time, namely equipment automatic root when reaching in each cycle Training set data is reacquired according to various kinds this application, the training set data further according to reacquisition retrieves an application examination Model.In the present embodiment, model modification condition can also be some moment of setting；It can also be the increase number of sample application Deng.It should be appreciated that foregoing three kinds of model modification conditions are only three kinds of conditions of the present embodiment example, representative model does not update Condition only can be foregoing three kinds.

S503:Obtain mountain vallage application discriminator corresponding with the application examination model after renewal.

In the present embodiment, necessarily change because the application examination model after renewal may have compared with model is screened in original application Become, therefore the application after renewal screens the corresponding mountain vallage application discriminator of model namely needs to redefine.

It should be appreciated that as the continuous renewal of model is screened in application, it screens accuracy rate meeting more and more higher, therewith more Application after new is screened the mountain vallage application corresponding with upper one application examination model of the corresponding mountain vallage application discriminator of model and screened Threshold value difference can be less and less, or even equivalent.

It should be appreciated that after certain degree is reached in sample size, making for the raising that model screens the degree of accuracy With just unobvious, on the contrary because sample size is excessive, the consumption to resource is very high, loses more than gain, therefore, is applied in sample Quantity is reached after certain degree, you can the quantity applied with no longer enlarged sample.

In the present embodiment, because the application for adding application market is a lot, after once screening, many applications is had again and are entered Enter into application market, and many mountain vallage applications have been likely to contain in the application of these new entrance, it is therefore desirable to for a long time to entering The application for entering application market is screened.

In this regard, a kind of feasible scheme is：Set and screen trigger condition, when screening trigger condition triggering, to the last time The application entered after examination in application market is screened, namely can obtain the application market when screening trigger condition triggering Present in the unknown application of classification, and the unknown application of these classifications is screened as application to be identified.Here screen Trigger condition can be cycle time, and such as cycle is one week, so can all call weekly and once be discriminated using examination model Not；It can also be the setting moment to screen trigger condition, for example, set on April 31st, 2017 and on May 3rd, 2017, then equipment exists Part can also be that setting moment, such as setting on April 31st, 2017 and on May 3rd, 2017, this can be called using examination mould for two days Type is screened；Screen trigger condition and can also be the new application number entered in application market, for example, set and newly enter application Number threshold value is 100, then the application entered after once being screened on detecting in application market is more than or equal to 100 When, then call and screened using examination model.

It should be appreciated that above-mentioned three kinds are screened three kinds of conditions that trigger condition is only the present embodiment example, Zhen is not represented Other trigger condition only can be above-mentioned three kinds.

It should be appreciated that during above-mentioned examination trigger condition triggering, obtaining the application market when screening trigger condition triggering Present in the operation of the unknown application of classification " the modelling application feature of application to be identified should obtained, according to the modeling of acquisition The type examination value that model obtains the application to be identified is screened using feature and the application " carry out before.

It should be appreciated that to prevent user after upper once examination, this examination not yet started under this period Be downloaded to mountain vallage application, the application of these new entrance application markets can be done wouldn't restocking processing, after examination, then will screen The legal application gone out carries out restocking.

And another feasible scheme is：When each application enters application market, that is, call and enter using examination model Row is screened.

It is worth noting that, each step in the present embodiment can be completed by server as shown in Figure 2, specifically , server as shown in Figure 2, engineer can set which of each application to be characterized as modeling by input/output bus 21 Using feature；Processor 22 obtains from memory 23 sample and applied and application to be identified, and obtains various kinds this application and treat The modelling application feature of identification application carries out the operation such as feature calculation, normalized, and then model is screened in foundation application；Together When, processor 22 can also be screened model using the application set up and obtain the corresponding type examination value of each application to be identified, so as to sentence Whether fixed each application to be identified is mountain vallage application, and carries out off-frame treatment to the mountain vallage application screened out；Then, communicator 25 The legal application for being available for user to download can be sent on user terminal when user enters application market.

It should be appreciated that each step in the present embodiment can also independently be realized by terminal as shown in Figure 1, tool Body, engineer can set which of each application to be characterized as modeling by user input unit 130 or interface unit 170 Using feature；Controller 180 obtains sample from memory 160 and applied and application to be identified, and obtains various kinds this application and treat The modelling application feature of identification application carries out the operation such as feature calculation, normalized, and then model is screened in foundation application；Together When, controller 180 can also be screened model using the application set up and obtain the corresponding type examination value of each application to be identified, so as to sentence Whether fixed each application to be identified is mountain vallage application, and carries out off-frame treatment to the mountain vallage application screened out.

The application discriminating method that the present embodiment is provided, by from including at least one known legal copy application and at least one (modelling application feature includes legal application and mountain to the modelling application feature of acquisition various kinds this application in the sample application of mountain vallage application The difference characteristic that has differences of stockaded village's application), then the modelling application feature based on various kinds this application is applied examination model, and obtain Take mountain vallage application discriminator corresponding with using model is screened.Its modelling application feature is obtained to application to be identified afterwards, is led to Cross the modelling application feature and application screens model and can obtain the type examination value of the application to be identified, and type examination is worth It is compared with mountain vallage application discriminator and can determine that whether it is mountain vallage application.So, by using legal copy application and mountain The difference characteristic that stockaded village's application has differences so that the application of foundation screens model and can be very good to reflect legal application and mountain vallage Difference between, screens model by application and unknown applications is detected, realizes the high-efficient automatic Zhen to application Not, it is ensured that supply user download application security, and then ensured terminal security and privacy of user safety, pass through simultaneously Model is screened automatically, is considerably reduced by manually screening the cost that mountain vallage is applied, is also improved Detection accuracy.The Two embodiments

The present embodiment on the basis of first embodiment, applied with sample be legal application in application market white list and Mountain vallage application in blacklist, and model modification condition with screen trigger condition for the setting moment (be set with two it is different Timed task) in case of, present invention work is further illustrated.

Referring to Fig. 6, a kind of basic framework for application discriminating method implementation process that Fig. 6 provides for second embodiment of the invention Figure, it is seen then that mainly include using discriminating method implementation process in the present embodiment：Equipment is first according in white and black list Model, the now as sample application of the application in white and black list are screened in application build application；Again by application to be identified The application built is inputted to screen in model (it should be appreciated that what is inputted is the application to be identified after normalized herein Modelling application feature characteristic value), using screening the type examination value that model is the application to be identified of output correspondence, thereafter through The method such as judgement compares type examination value and mountain vallage application discriminator automatically for artificial judgement or machine, obtains application to be identified Type.Its idiographic flow may refer to Fig. 7, including：

S701：Load timed task 1；

Presetting the step of being automatically performed following S702-S704 constantly, such as it is then automatic week about to carry out The step of S702-S704, that is, re-establish using examination model.

S702：Obtain white and black list in application, and each application to be identified modelling application feature and carry out Feature calculation and normalized；

It should be appreciated that when loading timed task 1 every time, because step S710 have updated white and black list, therefore Application in the white and black list obtained every time during loading timed task 1 is differed.

It should be appreciated that when loading timed task 1 every time, application to be identified can be reacquired, these applications to be identified The applicating category do not screened when the application and/or last time examination that are as newly added after last time examination is unknown (i.e. unclear to be Still be legal application for mountain vallage application) application.

It is to be further understood that in the present embodiment can be used for carry out feature calculation method include SimHash algorithms, Scikit-Learn etc..

S703：Application is set up by machine learning algorithm and screens model；

It is worth noting that, when setting up application examination model by machine learning algorithm, being included in the data used There is the corresponding normalization characteristic value of the application in white and black list, but be free of the corresponding normalization characteristic of each application to be identified Value.

S704：Preserve application and screen model.

S705：Load timed task 2；

Presetting the step of being automatically performed following S706-S710 constantly, such as it is complete whenever detecting step S704 After, then the step of automatic progress S706-S710, i.e., screen model by the application re-established and carry out application Zhen to be identified Not.

S706：Model is screened in loading application；

S707：Application to be identified input application is screened in model；

The essence of input is the characteristic value of the modelling application feature of the application to be identified after being normalized.

S708：Output type examination value；

S709：Application type to be identified is judged according to type examination value and mountain vallage application discriminator；

In the present embodiment, under the judgement of application type to be identified can be manually carried out by operation and mountain vallage application is carried out Frame, automation can also be carried out by machine and judges and mountain vallage application is carried out into undercarriage automatically.

S710：Update white and black list.

The application discriminating method that the present embodiment is provided, by regarding the application in existing white and black list as sample Using be modeled using feature extraction and set up using screen model, by by the modelling application feature of application to be identified it Characteristic value input application is screened in model, obtains the type examination value of the application to be identified, and then judge that the application to be identified is No is mountain vallage application, and the application after identification is added in blacklist or white list, realize the expansion applied to sample and Renewal to model.So, due to including the difference spy that legal application and mountain vallage application have differences in modelling application feature Levy so that the application of foundation screens model and can be very good to screen out legal application and mountain vallage application, realizes the height to application Effect automation is screened, and is considerably reduced by manually screening the cost that mountain vallage is applied, is improved Detection accuracy, it is ensured that supplies The security for the application downloaded to user.

3rd embodiment

Accurately and efficiently screen out using whether being mountain vallage application, set the invention provides a kind of application management in order to realize It is standby.Referring to Fig. 8, a kind of application management device structure schematic diagram that Fig. 8 provides for third embodiment of the invention, including：

Feature acquisition module 81, for obtaining current sample using the modelling application feature with current application to be identified.

It should be noted that current sample application in the present embodiment should include at least one known legal copy application and At least one mountain vallage application.It is further noted that being used for the modelling application that each current sample is applied modeled in the present embodiment Feature should include the difference characteristic that legal application has differences with mountain vallage application.

Model building module 82, the modelling application of each current sample application obtained for feature based acquisition module 81 is special The examination model that is applied is levied, and obtains mountain vallage application discriminator corresponding with application examination model.

Using module 83 is screened, the modelling application of the current application to be identified for being obtained according to feature acquisition module 81 is special The application that model building module 82 of seeking peace is set up screens model and obtains the type examination value of the application to be identified, and the type is discriminated Whether value is not compared with mountain vallage application discriminator, so as to judge the corresponding application to be identified of the type examination value as mountain vallage Using.

In the present embodiment, difference characteristic can be determined by feature mining engineering, for example, can be related by application The engineer in field to carry out aspect ratio pair to related application, determines that mountain vallage applies some that there is discrimination with legal application Feature, these features are difference characteristic.

In the present embodiment, various kinds this application can be each in each legal application and blacklist in application market white list Mountain vallage is applied or consistent legal application and/or mountain vallage application not in white list or blacklist.City is applied using Each mountain vallage is as sample using when applying in each legal application and blacklist in white list, can will be in white list it is all All mountain vallage applications only can also apply the part legal copy in white list as sample application in legal copy application and blacklist Applied with part mountain vallage in blacklist and be used as sample application.

In the present embodiment, model building module 82 understands the modelling application feature using each current sample application as training set, Model is set up by machine learning algorithm.It should be appreciated that in the present embodiment, model building module 82 can be learned using supervision Practise class machine learning algorithm and study is trained to training set, so as to set up using examination model.

In the present embodiment, because model is screened in the application that the difference of modeling algorithm can cause model building module 82 to obtain Difference, and apply the difference for screening model that its corresponding mountain vallage application discriminator can be caused different.

It is worth noting that, the modelling application feature for the current application to be identified that feature acquisition module 81 is obtained should be with obtaining The modelling application feature of the sample application taken is corresponding.The modelling application for the sample application that for example feature acquisition module 81 is obtained is special Levy for title similarity, using accumulative version number and apply inclusion size, then the modelling application feature of the application to be identified obtained It should also be as title similarity, using accumulative version number and apply inclusion size.

After the modelling application feature that feature acquisition module 81 gets current application to be identified, current application to be identified Modelling application feature be constitute using screen model test set, using screen module 83 these modelling application features are defeated Enter to application after screening in model, correspondingly calculating corresponding type examination value can be exported using model is screened.It should be understood that It is, may be with instruction using the type examination value for screening model output because the modeling algorithm that model building module 82 is used is different Practice collection and set the setting value difference that sign is legal application or mountain vallage application.

In the present embodiment, engineer can also exist in mountain vallage application discriminator write device using module 83 is screened After examination model output type examination value, contrasted automatically, result of determination is exported.It should be appreciated that this reality Apply example can also type examination value output after, by manual examination and verification mode will using screen model output type examination value with It is compared using the corresponding mountain vallage application discriminator of model is screened, judges the type of application to be identified.

It should be appreciated that it can also be multiple that the application to be identified in the present embodiment, which can be one, you can to realize The batch of application to be identified is screened.

In the present embodiment, using screening after module 83 determined the type of each application to be identified, application management equipment can To be applied to the mountain vallage screened out by manually operating or equipment is automatically brought into operation etc. that mode carries out off-frame treatment.So, Yong Hu During into application market, it is seen that the application as application management equipment for being available for user to download screen after legal application.

It should be appreciated that modules are after a upper module completes corresponding function in the present embodiment, you can automatically begin to Itself function is completed, such as after model building module 82 completes itself function, can be automatically begun to using module 83 is screened Work, is not required to manpower intervention.It should be appreciated that after modules complete itself function, can also be selected by user Mode starts the work of next module.

It should be appreciated that sample applies more (i.e. training set capacity is bigger), the model that model building module 82 is obtained Being for the accuracy rate that application type to be identified is screened can be higher, but its modeling time can also increase therewith, for resource consumption Amount can also increase, therefore, can be determined according to the actual requirements for the quantity that sample is applied.

In the present embodiment, a kind of concrete structure of model building module 82 may refer to Fig. 9, including：

Feature calculation unit 821, based on the modelling application feature progress feature to various kinds this application and application to be identified Calculate.

Normalized unit 822, should for the various kinds this application obtained to calculating and the same modeling of application to be identified It is normalized with the characteristic value of feature.

Model sets up unit 823, for using the characteristic value of each sample application after normalized as training set, Application is set up by machine learning algorithm and screens model.

In the present embodiment, feature calculation unit 821 can be carried out for Apply Names similarity using SimHash scheduling algorithms Calculate, obtain corresponding similarity value calculation；It can pass through the detection knot to application comprising spcial character situation for Apply Names Really judged, for example：It is then 1 comprising spcial character, not comprising then as 0, or include 3 and above spcial character It is then 1, is then 0.5 comprising 1-2 spcial character, not comprising then as 0 etc..For application developer situation, using tired Count version number, official's mark situation, application data are included using inclusion size, application data comprising case of advertisements, using download Amount, score using report amount, using user, using dangerous authority quantity mesh, using the feature calculation in source etc., can use with Feature " Apply Names includes spcial character situation " identical mode is calculated to carry out；Accordingly, for Apply Names similarity Aforementioned manner can be used, such as SimHash algorithms, which are calculated, to be obtained being less than 0.9 like degree calculated value, then is designated as 0, is otherwise designated as 1.

It is worth noting that, in the present embodiment, model set up unit 823 be used for set up application examination model training set in Normalization characteristic value not comprising application to be identified.

In the present embodiment, model, which sets up unit 823, to be included using the machine learning algorithm being modeled：Logistic regression is calculated The machine learning algorithms such as method, decision Tree algorithms, random forests algorithm.

In the present embodiment, set up unit 823 in model and establish using after screening model, can be with using module 83 is screened It will be answered by the characteristic value of the application to be identified after the normalized of normalized unit 822 as test set input is described With model is screened, the type examination value of the application to be identified is obtained.

It should be appreciated that the foundation application examination model in the present embodiment can be polynary equivalent to what one had determined Function, now by the way that the characteristic value input application of the modelling application feature of the application to be identified after normalized is screened into model In, that is, inform function variable value, an i.e. available value thus is calculated using screening model, and the value is pair The type examination value for the application to be identified answered.

, should according to the type examination value of obtained a certain application and the mountain vallage of acquisition using module 83 is screened in the present embodiment It is whether can obtain the type of the application be mountain vallage application with discriminator.

It should be appreciated that the mountain vallage application characterization value set in training set, then the application screened is got over can It can be mountain vallage application.The mountain vallage application characterization value for example in training set set is 1, and legal copy application is 0, then type examination value more connects Nearly 1 application, is more probably mountain vallage application, and the application closer to 0 is more probably legal application.

It is worth noting that, in the present embodiment, the function of application management equipment can be by server as shown in Figure 2 be Lai complete Into specifically, the software code for the function that module 83 is screened in feature acquisition module 81, model building module 82 and application can be stored In the memory 23 of server as shown in Figure 2, and by processor 22 perform or compile after perform；Feature acquisition module 81, Model building module 82 and application are screened module 83 and can be arranged within processor 22.It should be appreciated that processor 22 is also The operation that undercarriage is carried out to the mountain vallage application after examination can be realized, hereafter communicator 25 can enter application market in user When, the legal application for being available for user to download is sent on user terminal.

It should be appreciated that the function of application management equipment can also be by terminal as shown in Figure 1 be Lai solely in the present embodiment Vertical to realize, the function that module 83 is screened in now feature acquisition module 81, model building module 82 and application can be by terminal control Device 180 realizes that module 83 is screened in feature acquisition module 81, model building module 82 and application can be arranged at terminal control unit In 180.

The application management device that the present embodiment is provided, is obtained by feature acquisition module from including the application of known sample (difference that modelling application feature includes legal application with mountain vallage application has differences is special for the modelling application feature of various kinds this application Levy), application is set up by model building module and screens model, the type for obtaining application to be identified by application examination module is screened Value, and type examination value is compared with mountain vallage application discriminator, so as to judge application to be identified whether as mountain vallage application. So, the difference characteristic being had differences using legal application with mountain vallage application so that model is screened in the application of foundation can be fine Reflect legal application and mountain vallage apply between difference, then model is screened by application unknown applications is detected, in fact Show the high-efficient automatic examination to application, it is ensured that the security for the application that supply user downloads, and then ensure terminal peace Complete and privacy of user safety, while being screened automatically by model, considerably reduces what is applied by manually screening mountain vallage Cost, also improves Detection accuracy.

Fourth embodiment

The present embodiment is on the basis of 3rd embodiment, the further example of progress to be done to technical scheme and is said It is bright.

It should be appreciated that the size of sample size can influence model to screen the degree of accuracy, typically, sample size is bigger, mould It is higher that type screens the degree of accuracy.Namely sample application quantity it is more, foundation application screen model will screen it is more accurate. To improve constantly the examination precision of model, referring to Figure 10, another model building module 82 that Figure 10 provides for the present embodiment Structural representation, including：

Sample application updating block 824, for application to be screened, each legal copy after module 83 is screened is applied and/or mountain vallage should With in addition sample application.

Model modification unit 825, for when model modification condition is triggered, the modelling application feature based on various kinds this application Update using examination model, and obtain mountain vallage application discriminator corresponding with the application examination model after renewal.

It should be appreciated that sample application updating block 824 and model modification unit 825 can with 3rd embodiment Feature calculation unit 821, normalized unit 822 and model are set up unit 823 and coexisted.

In the present embodiment, if including the application in application market blacklist or white list, sample application in sample application Each legal application after examination can be added in the white list of application market by updating block 824, by each mountain vallage after examination Using being added in the blacklist of application market.

It is worth noting that, in the present embodiment, the various kinds that model modification unit 825 is used to update application examination model should With the set of applications for referring to add the last each legal application screened out and/or mountain vallage application.

In the present embodiment, the application after being updated due to model modification unit 825 is screened model and screens model phase with original application Necessarily change than that may have, therefore the application after renewal screens the corresponding mountain vallage application discriminator of model namely needs again It is determined that.

It should be appreciated that as the continuous renewal of model is screened in application, can be got over using the examination accuracy rate for screening model Come higher, it is corresponding with upper one application examination model that the corresponding mountain vallage application discriminator of model is screened in the application after updating therewith Mountain vallage application discriminator difference can be less and less, or even equivalent.

It should be appreciated that after certain degree is reached in sample size, making for the raising that model screens the degree of accuracy With just unobvious, on the contrary because sample size is excessive, the consumption to resource is very high, loses more than gain, therefore, is applied in sample Quantity reached after certain degree, sample application updating block 824 be can no longer enlarged sample application quantity.

In the present embodiment, because the application for adding application market is a lot, after once screening, many applications is had again and are entered Enter into application market, and many mountain vallage applications have been likely to contain in the application of these new entrance, therefore application management equipment Need for a long time to screen the application for entering application market.

In this regard, a kind of feasible scheme is：Application management equipment, which is set, screens trigger condition, is screening trigger condition triggering When, screened using the application in application market is entered after the 83 pairs of last examinations of examination module.Here triggering is screened Condition can be cycle time or setting moment, can also be new application number entered in application market etc..

It should be appreciated that to prevent user after upper once examination, this examination not yet started under this period Be downloaded to mountain vallage application, application management equipment the application of these new entrance application markets can be done wouldn't restocking processing, screening Afterwards, then by the legal application screened out restocking is carried out.

Another feasible scheme is：Application management equipment is when each application enters application market, using examination mould Block 83 is called to be screened using examination model.

It is worth noting that, the function of application management equipment still can be by server as shown in Figure 2 in the present embodiment To complete, specifically, the software code of the function of sample application updating block 824 and model modification unit 825 be storable in as In the memory 23 of server shown in Fig. 2, and by processor 22 perform or compile after perform；Sample application updating block 824 It can be arranged within processor 22 with model modification unit 825.

It should be appreciated that the function of application management equipment equally can also be by terminal as shown in Figure 1 in the present embodiment Independently to realize, the function of now sample application updating block 824 and model modification unit 825 can be by terminal control unit 180 Realize, sample application updating block 824 and model modification unit 825 can be arranged in terminal control unit 180.

The application management equipment that the present embodiment is provided, by the way that the application after identification is added in sample application, then passes through The mode of model modification trigger condition is set to realize the renewal for screening model to original application so that realizing high-efficient automatic While examination mountain vallage is applied, also the constantly automatic examination degree of accuracy for improving application examination model, the same of cost is screened reducing When, further increase Detection accuracy, it is ensured that the security for the application that supply user downloads.

It should be noted that herein, term " comprising ", "comprising" or its any other variant are intended to non-row His property is included, so that process, method, article or device including a series of key elements not only include those key elements, and And also including other key elements being not expressly set out, or also include for this process, method, article or device institute inherently Key element.In the absence of more restrictions, the key element limited by sentence "including a ...", it is not excluded that including this Also there is other identical element in process, method, article or the device of key element.

The embodiments of the present invention are for illustration only, and the quality of embodiment is not represented.

Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side Method can add the mode of required general hardware platform to realize by software, naturally it is also possible to by hardware, but in many cases The former is more preferably embodiment.Understood based on such, technical scheme is substantially done to prior art in other words Going out the part of contribution can be embodied in the form of software product, and the computer software product is stored in a storage medium In (such as ROM/RAM, magnetic disc, CD), including some instructions are to cause a station terminal equipment (can be mobile phone, computer, clothes It is engaged in device, air conditioner, or network equipment etc.) perform method described in each embodiment of the invention.

Embodiments of the invention are described above in conjunction with accompanying drawing, but the invention is not limited in above-mentioned specific Embodiment, above-mentioned embodiment is only schematical, rather than restricted, one of ordinary skill in the art Under the enlightenment of the present invention, in the case of present inventive concept and scope of the claimed protection is not departed from, it can also make a lot Form, these are belonged within the protection of the present invention.

Claims

1. a kind of application management equipment, it is characterised in that including：

Feature acquisition module, the modelling application feature for obtaining current sample application, the current sample is applied including known At least two applications in legal copy application and mountain vallage application, the modelling application feature includes legal application with mountain vallage using presence The difference characteristic of difference；And for obtaining the modelling application feature of current application to be identified；

Model building module, is applied examination model, and obtain for the modelling application feature based on each sample application Mountain vallage application discriminator corresponding with application examination model；

Using module is screened, screen model for the modelling application feature according to the application to be identified and the application and be somebody's turn to do The type examination value of application to be identified, and the type examination value and mountain vallage application the discriminator are compared judge it Whether it is mountain vallage application.

2. application management equipment as claimed in claim 1, it is characterised in that the model building module includes：

Feature calculation unit, for applying the modelling application feature with application to be identified to carry out feature calculation to each sample；

Normalized unit, each sample for being obtained to calculating is applied and the same modelling application of application to be identified is special The characteristic value levied is normalized；

Model sets up unit, for the characteristic value of each sample application after the normalized, as training set, to be led to Cross machine learning algorithm and set up application examination model.

3. application management equipment as claimed in claim 2, it is characterised in that module is screened in the application to be used to wait to know by described Not Ying Yong normalized after characteristic value input the application as test set and screen model, obtain the application to be identified Type examination value.

4. the application management equipment as described in claim any one of 1-3, it is characterised in that the model building module includes：

Sample application updating block, for each legal application and/or mountain vallage application after examination to be added in the sample application；

Model modification unit, for when model modification condition is triggered, being set up based on the modelling application feature that current sample is applied New application is screened model and is updated with screening model to the application, and acquisition screens model with the application after the renewal Corresponding mountain vallage application discriminator.

5. the application management equipment as described in claim any one of 1-3, it is characterised in that the difference characteristic includes：Using Title similarity, Apply Names are comprising spcial character situation, application developer situation, using accumulative version number, big using inclusion Small, application data is comprising official's mark situation, application data comprising case of advertisements, using download, using report amount, using use Score, using dangerous authority quantity mesh, using at least two in source at family.

6. one kind application discriminating method, it is characterised in that including：

The modelling application feature of current sample application is obtained, the current sample, which is applied, includes at least one known legal copy application With at least one mountain vallage application, the modelling application feature includes the difference characteristic that legal application has differences with mountain vallage application；

Modelling application feature based on each sample application is applied examination model, and obtains and screen model with the application Corresponding mountain vallage application discriminator；

The modelling application feature of current application to be identified is obtained, is screened according to the modelling application feature of acquisition and the application Model obtains the type examination value of the application to be identified；

7. apply discriminating method as claimed in claim 6, it is characterised in that the modelling application based on various kinds this application is special Levying the examination model that is applied includes：

The characteristic value with the same modelling application feature of application to be identified is applied to carry out normalizing in each sample that calculating is obtained Change is handled；

Using the characteristic value of each sample application after the normalized as training set, set up by machine learning algorithm Using examination model.

8. apply discriminating method as claimed in claim 7, it is characterised in that the modelling application of the acquisition application to be identified is special Levy, the type examination value bag that model obtains the application to be identified is screened according to the modelling application feature of acquisition and the application Include：

Characteristic value after the normalized of the application to be identified is inputted into the application as test set and screens model, is obtained The type examination value of the application to be identified.

9. the application discriminating method as described in claim any one of 6-8, it is characterised in that described to be based on each sample application Modelling application feature be applied examination model include：

When model modification condition is triggered, based on the modelling application feature that current sample is applied set up new application screen model with Model, which is screened, to the application to be updated, and obtains mountain vallage application corresponding with the application examination model after the renewal screens Threshold value.

10. the application discriminating method as described in claim any one of 6-8, it is characterised in that obtain application to be identified described Modelling application feature, model is screened according to the modelling application feature of acquisition and the application and obtains the application to be identified Before type examination value, in addition to：

When screening trigger condition triggering, the unknown application of the classification that there is currently is obtained, and by the unknown application of the classification It is used as application to be identified.