A kind of method that the X of monitoring planted agent wiretapping type software calling record is uploadedTechnical field
The present invention relates to mobile phone and prevent Eavesdropping field, relate in particular to a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.
Background technology
Along with increasing substantially of smart mobile phone popularity rate, smart mobile phone is when bringing convenience to us, and its safe and secret problem also highlights day by day, if smart mobile phone is mounted eavesdropping software, can carry out ambience listening to monitored mobile phone.The wiretapping type software relatively spreading unchecked is at present as " X planted agent " software, once implanted user mobile phone,
During user's communication, dialog context can be recorded, after end of conversation, calling record file goes be uploaded in the appointment mailbox that monitoring side arranges in advance.Can realize the whole process of this subscriber phone information is monitored.
Calling record for above-mentioned X planted agent wiretapping type software is uploaded behavior, is necessary to study a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.
Summary of the invention
Calling record for above-mentioned X planted agent wiretapping type software is uploaded behavior, the invention discloses a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.Be used on smart mobile phone, can effectively prevent that similar calling record from uploading.Adopt receiving system telephone-broadcast mode, detect call on-hook message, detect after on-hook flow in certain hour simultaneously and upload process list, and differentiate whether there is backstage recording behavior etc. in conjunction with authority, differentiate and whether exist backstage grouping to send calling record behavior, prompt alarm after finding.
Object of the present invention realizes by following technical proposals:
A kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded, it specifically comprises following steps: register static radio receiver, be used for receiving end of conversation on-hook message, after end of conversation on-hook, start the data traffic that Service monitored and distinguished records application program, according to the data traffic of application program, after end of conversation on-hook, whether increase to judge whether to exist the application program that calling record is uploaded carrying out, according to this application program of carrying out, whether there is user to hand over interface, family to determine whether pure background program simultaneously, if this program be pure background program and after end of conversation on-hook the data traffic of this application program increase, judge that this program starts warning interface as dangerous program.
Preferably, the application program that described startup Service monitors and records is respectively the application program that has access to netwoks and recording privilege feature.
Preferably, described startup Service monitoring and respectively the data traffic of records application program be the application program data traffic of this day.
Preferably, describedly judge that this program starts warning interface as dangerous program and specifically comprises: after encapsulating this danger program related information, start warning interface, and transmit packaging information to this interface of reporting to the police.
Preferably, described method adds mode of vibration by jingle bell immediately and reports to the police, and the program packaging information passing over is shown by list after also comprising that warning interface starts, and for user, checks.
Preferably, described after end of conversation on-hook, start Service monitoring and respectively the data traffic of records application program in 3 seconds after call words finish on-hook, start the data traffic that Service monitored and distinguished records application program.
Preferably, describedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of the monitoring in time application program after the data traffic of records application program in 50 seconds, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Preferably, describedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of monitoring and measuring application program after the data traffic of records application program and within the interval time of this call and call next time, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Beneficial effect of the present invention: be that carry out on pure backstage according to whether there is application program after end of conversation, and whether the data traffic of this backstage working procedure increases directly judges whether to exist X planted agent wiretapping type software calling record to upload, because if upload calling record, data traffic is inevitable obviously increases, by above-mentioned method, just can directly judge whether to exist this application program this application program of quick lock in, according to application program, whether exist user to hand over interface, family to determine whether pure background program again simultaneously, if application program exists user to hand over interface, family, it is not pure background program, otherwise be pure background program, the application program of non-pure background program is excluded, do not affect the normal application program of using of user.
Accompanying drawing explanation
The method flow diagram that accompanying drawing 1 is uploaded for monitoring X planted agent wiretapping type software calling record of the present invention.
Embodiment
The method flow diagram that monitoring X planted agent wiretapping type software calling record of the present invention is uploaded as shown in Figure 1.The invention discloses a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded, it specifically comprises following steps: register static radio receiver, be used for receiving end of conversation on-hook message, after end of conversation on-hook, start the data traffic that Service monitored and distinguished records application program, according to the data traffic of application program, after end of conversation on-hook, whether increase to judge whether to exist the application program that calling record is uploaded carrying out, according to this application program of carrying out, whether there is user to hand over interface, family to determine whether pure background program simultaneously, if this program be pure background program and after end of conversation on-hook the data traffic of this application program increase, judge that this program starts warning interface as dangerous program.The method that above-mentioned monitoring calling record is uploaded is mainly receiving system telephone-broadcast mode, on-hook message detection, flow and uploads process judgement, the judgement of process authority, get all flows of this time period the process list of uploading and the size of uploading flow, and produced in the process that flow uploads and realized permission match at these, searching possesses the process of eavesdropping software authority feature, once find to report to the police immediately.According to whether there is application program after end of conversation, be that carry out on pure backstage, and whether the data traffic of this backstage working procedure increases directly judges whether to exist X planted agent wiretapping type software calling record to upload, because if upload calling record, data traffic is inevitable obviously increases, by above-mentioned method, just can directly judge whether to exist this application program this application program of quick lock in, according to application program, whether exist user to hand over interface, family to determine whether pure background program again simultaneously, if application program exists user to hand over interface, family, it is not pure background program, otherwise be pure background program, the application program of non-pure background program is excluded, do not affect the normal application program of using of user.
Preferably, the application program that above-mentioned startup Service monitors and records is respectively the application program that has access to netwoks and recording privilege feature.Because only possess the application program of above-mentioned access to netwoks and recording privilege feature, just may realize the calling record intercepting is uploaded, the range of applications of monitoring and record is dwindled, improve the efficiency of this method.
Preferably, above-mentioned startup Service monitoring and respectively the data traffic of records application program be the application program data traffic of this day.The data traffic numeral of minute book day is relatively little, is convenient to record and compares.
Preferably, above-mentionedly judge that this program starts warning interface as dangerous program and specifically comprises: after encapsulating this danger program related information, start warning interface, and transmit packaging information to this interface of reporting to the police.Quick lock in application program is also presented on warning interface, is convenient to user and processes in time this danger program.
Preferably, said method adds mode of vibration by jingle bell immediately and reports to the police, and the program packaging information passing over is shown by list after also comprising that warning interface starts, and for user, checks.The very first time notifies user to process this dangerous program, guarantees user's information security.
Preferably, above-mentioned after end of conversation on-hook, start Service monitoring and respectively the data traffic of records application program in 3 seconds after call words finish on-hook, start the data traffic that Service monitored and distinguished records application program.The upload file of X planted agent wiretapping type software calling record, because file content is larger, is difficult for preserving mobile phone is local, so generally after user's on-hook, spread out of on immediately.In 3 seconds, start Service monitoring and respectively the data traffic of records application program and the data traffic in follow-up time section comparing, judge whether data traffic increases.
Preferably, above-mentionedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of the monitoring in time application program after the data traffic of records application program in 50 seconds, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Preferably, above-mentionedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of monitoring and measuring application program after the data traffic of records application program and within the interval time of this call and call next time, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Given coefficient and parameter in the above embodiments; be to provide to those skilled in the art and realize or use of the present invention; the present invention does not limit and only gets aforementioned disclosed numerical value; without departing from the present invention in the case of the inventive idea; those skilled in the art can make various modifications or adjustment to above-described embodiment; thereby protection scope of the present invention do not limit by above-described embodiment, and it should be the maximum magnitude that meets the inventive features that claims mention.