Movatterモバイル変換


[0]ホーム

URL:


CN114036520B - Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product - Google Patents

Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product
Download PDF

Info

Publication number
CN114036520B
CN114036520BCN202111419783.3ACN202111419783ACN114036520BCN 114036520 BCN114036520 BCN 114036520BCN 202111419783 ACN202111419783 ACN 202111419783ACN 114036520 BCN114036520 BCN 114036520B
Authority
CN
China
Prior art keywords
target application
application
information
authority
terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202111419783.3A
Other languages
Chinese (zh)
Other versions
CN114036520A (en
Inventor
巫鑫
王盈
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Antiy Technology Group Co Ltd
Original Assignee
Antiy Technology Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Antiy Technology Group Co LtdfiledCriticalAntiy Technology Group Co Ltd
Priority to CN202111419783.3ApriorityCriticalpatent/CN114036520B/en
Publication of CN114036520ApublicationCriticalpatent/CN114036520A/en
Application grantedgrantedCritical
Publication of CN114036520BpublicationCriticalpatent/CN114036520B/en
Activelegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Classifications

Landscapes

Abstract

The invention provides an application information evidence obtaining method and device, electronic equipment, a computer readable storage medium and a program product, wherein the method comprises the following steps: acquiring information evidence obtaining operation aiming at target application in a terminal; responding to the information evidence obtaining operation, and determining the authority setting state of the target application in the terminal; determining whether the target application is abnormal according to the authority setting state of the target application, wherein when the authority setting state of the target application is a first authority state, determining whether the target application is abnormal based on the running information of the target application and an application abnormality identification model; and when the permission setting state of the target application is the second permission state, carrying out security performance detection on the target application based on a target detection mode so as to determine whether the target application is abnormal. The technical scheme of the invention is that the application with different rights is suitable for the evidence obtaining mode conforming to the actual situation, and the terminal safety is effectively protected.

Description

Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product
[ Field of technology ]
The present invention relates to the field of terminal technologies, and in particular, to an application information evidence obtaining method and apparatus, an electronic device, a computer readable storage medium, and a program product.
[ Background Art ]
At present, mobile terminals are frequently used by people, the related privacy data volume is huge, but the mobile terminals are easy to leak information by applications installed by the mobile terminals due to insufficient safety protection capability, and users often generate information safety loss under the condition of unknowing.
In order to solve the problem, antivirus software, application monitoring software and the like can be arranged in the mobile terminal to detect and process the application working beyond the authority limit, but in order to increase the use convenience in the actual use process of a user, multiple authorities are required to be set for the application, and severe behaviors such as inputting, uploading and the like of private data of the user are required to be carried out in the authority limit of the application.
Therefore, how to detect and evidence the application according to the existing authority of the application becomes a technical problem to be solved urgently.
[ Invention ]
The embodiment of the invention provides an application information evidence obtaining method and device, electronic equipment, a computer readable storage medium and a program product, and aims to solve the technical problem that the prior authority application is difficult to effectively detect and identify to reveal user privacy data in the related technology.
In a first aspect, an embodiment of the present invention provides an application information evidence obtaining method, including: acquiring information evidence obtaining operation aiming at target application in a terminal; responding to the information evidence obtaining operation, and determining the authority setting state of the target application in the terminal; determining whether the target application is abnormal according to the authority setting state of the target application, wherein when the authority setting state of the target application is a first authority state, determining whether the target application is abnormal based on the running information of the target application and an application abnormality identification model; and when the permission setting state of the target application is the second permission state, carrying out security performance detection on the target application based on a target detection mode so as to determine whether the target application is abnormal.
In the above embodiment of the present invention, optionally, in the first permission state, the current permission of the target application includes a specified permission, and in the second permission state, the current permission of the target application does not include the specified permission; or in the first authority state, the number of the current authorities of the target application is larger than or equal to the appointed number, and in the second authority state, the number of the current authorities of the target application is smaller than the appointed number.
In the foregoing embodiment of the present invention, optionally, the step of obtaining an information forensics operation for a target application in a terminal includes: responding to the physical connection between the external storage device and the terminal, and displaying evidence obtaining function information of the external storage device on the terminal, wherein the evidence obtaining function information comprises an application type, an application name and an application authority type; acquiring user selection operation aiming at the evidence obtaining function information; and generating the information evidence obtaining operation aiming at the target application in the terminal based on the user selection operation.
In the foregoing embodiment of the present invention, optionally, the running information of the target application includes: the application type, the current authority, the use times and/or the use frequency of the current authority, the call times and/or the call frequency of calling a third party application or a third party page, the access times and/or the access frequency of accessing a database, the user operation type, the user operation times and the user operation time period which occur in the target application.
In the above embodiment of the present invention, optionally, the step of training the applied anomaly identification model includes: acquiring sample operation information of a sample application; for each sample operation information applied by the sample, converting the sample operation information into a characteristic value according to a conversion rule corresponding to the sample operation information; the application anomaly recognition model is trained based on the feature values of all the sample operation information of the sample application and the actual state of the sample application under the sample operation information.
In the foregoing embodiment of the present invention, optionally, the step of performing security performance detection on the target application based on the target detection mode includes: detecting whether the target application acquires a uniform resource identifier related to a designated application and/or a designated storage position of the terminal; and determining that the target application is abnormal under the condition that the target application is detected to acquire the uniform resource identifier.
In the above embodiment of the present invention, optionally, the method further includes: inserting verification data in a specified table of a database of the terminal in response to a physical connection of the external storage device with the terminal; the step of performing security performance detection on the target application based on the target detection mode further includes: intercepting protocol information sent by the target application, and detecting whether the analysis result of the protocol information has the check data or not; and determining that the target application is abnormal under the condition that the analysis result is detected to have the check data.
In the above embodiment of the present invention, optionally, the method further includes: under the condition that the target application is determined to be abnormal, aiming at the target application in the first authority state, first safety control function information is displayed on the terminal; and aiming at the target application in the second authority state, displaying second safety control function information on the terminal, wherein the first safety control function information and the second safety control function information are used for responding to a user safety control selection operation to carry out safety control on the target application.
In a second aspect, an embodiment of the present invention provides an application information evidence obtaining apparatus, including: the information evidence obtaining operation obtaining unit is used for obtaining information evidence obtaining operation aiming at target application in the terminal; a right setting state determining unit configured to determine a right setting state of the target application in the terminal in response to the information evidence obtaining operation; the application information evidence obtaining unit is used for determining whether the target application is abnormal according to the authority setting state of the target application, wherein when the authority setting state of the target application is a first authority state, whether the target application is abnormal is determined based on the running information of the target application and an application abnormality identification model, and when the authority setting state of the target application is a second authority state, security performance detection is performed on the target application based on a target detection mode so as to determine whether the target application is abnormal.
In the above embodiment of the present invention, optionally, in the first permission state, the current permission of the target application includes a specified permission, and in the second permission state, the current permission of the target application does not include the specified permission; or in the first authority state, the number of the current authorities of the target application is larger than or equal to the appointed number, and in the second authority state, the number of the current authorities of the target application is smaller than the appointed number.
In the above embodiment of the present invention, optionally, the information forensic operation obtaining unit is configured to: responding to the physical connection between the external storage device and the terminal, and displaying evidence obtaining function information of the external storage device on the terminal, wherein the evidence obtaining function information comprises an application type, an application name and an application authority type; acquiring user selection operation aiming at the evidence obtaining function information; and generating the information evidence obtaining operation aiming at the target application in the terminal based on the user selection operation.
In the foregoing embodiment of the present invention, optionally, the running information of the target application includes: the application type, the current authority, the use times and/or the use frequency of the current authority, the call times and/or the call frequency of calling a third party application or a third party page, the access times and/or the access frequency of accessing a database, the user operation type, the user operation times and the user operation time period which occur in the target application.
In the above embodiment of the present invention, optionally, the method further includes: an applied anomaly recognition model training unit for: acquiring sample operation information of a sample application; for each sample operation information applied by the sample, converting the sample operation information into a characteristic value according to a conversion rule corresponding to the sample operation information; the application anomaly recognition model is trained based on the feature values of all the sample operation information of the sample application and the actual state of the sample application under the sample operation information.
In the above embodiment of the present invention, optionally, the application information evidence obtaining unit is configured to: detecting whether the target application acquires a uniform resource identifier related to a designated application and/or a designated storage position of the terminal; and determining that the target application is abnormal under the condition that the target application is detected to acquire the uniform resource identifier.
In the above embodiment of the present invention, optionally, the application information evidence obtaining unit is further configured to: inserting verification data in a specified table of a database of the terminal in response to a physical connection of the external storage device with the terminal; intercepting protocol information sent by the target application, and detecting whether the analysis result of the protocol information has the check data or not; and determining that the target application is abnormal under the condition that the analysis result is detected to have the check data.
In the above embodiment of the present invention, optionally, the method further includes: the first management and control unit is used for displaying first safety management and control function information on the terminal aiming at the target application in the first authority state under the condition that the target application is determined to be abnormal; the second management and control unit is used for displaying second safety management and control function information on the terminal aiming at the target application in the second authority state, wherein the first safety management and control function information and the second safety management and control function information are used for responding to a user safety management and control selection operation to carry out safety management and control on the target application.
In a third aspect, an embodiment of the present invention provides an electronic device, including: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being arranged to perform the method of any of the first aspects above.
In a fourth aspect, embodiments of the present invention provide a computer-readable storage medium storing computer-executable instructions for performing the method flow of any one of the first aspects above.
In a fifth aspect, embodiments of the present invention provide a computer program product for, when run on an electronic device, causing the electronic device to perform the method flow of any one of the first aspects above.
According to the technical scheme, aiming at the technical problem that the existing authority application is difficult to effectively detect and identify the leakage of the user privacy data in the related technology, proper evidence obtaining modes which are suitable for the actual demands of the application can be adopted for the application with different authorities, namely the evidence obtaining modes which are suitable for the application with different authorities and accord with the actual conditions of the application are adopted, so that the efficiency and the effectiveness of the application anomaly detection are improved on the basis of saving system resources, and the user privacy information safety in the terminal is effectively protected.
[ Description of the drawings ]
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 illustrates a flow chart of a method of application information forensics according to one embodiment of the present invention;
FIG. 2 illustrates a block diagram of an application information forensics device according to one embodiment of the present invention;
Fig. 3 shows a block diagram of an electronic device according to an embodiment of the invention.
[ Detailed description ] of the invention
For a better understanding of the technical solution of the present invention, the following detailed description of the embodiments of the present invention refers to the accompanying drawings.
It should be understood that the described embodiments are merely some, but not all, embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The terminology used in the embodiments of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
Fig. 1 shows a flowchart of an application information forensics method according to one embodiment of the present invention.
As shown in fig. 1, the flow of the application information evidence obtaining method according to one embodiment of the present invention includes:
Step 102, obtaining information evidence obtaining operation aiming at target application in the terminal.
Various applications are installed in the terminal, and information evidence obtaining operation can be performed on target applications in the terminal under the aim of detecting whether the applications leak private information of a terminal user. The target application can be one or more designated applications, or one or more designated applications, and the type and the number of the target applications are determined by actual information evidence obtaining requirements.
Specifically, the step of acquiring information evidence obtaining operation for a target application in a terminal includes: responding to the physical connection between the external storage device and the terminal, and displaying evidence obtaining function information of the external storage device on the terminal, wherein the evidence obtaining function information comprises an application type, an application name and an application authority type; acquiring user selection operation aiming at the evidence obtaining function information; and generating the information evidence obtaining operation aiming at the target application in the terminal based on the user selection operation.
The external storage device includes, but is not limited to, a usb disk, a mobile hard disk, a memory card, and other independent storage devices, and may be physically connected to the terminal through a type-c interface, a lighting interface, and other manners. The external storage device is internally provided with a evidence obtaining function, and when the external storage device is accessed to the terminal, evidence obtaining function information provided by the external storage device can be popped up in a popup mode, but is not limited to the popup mode.
The evidence obtaining function information refers to the content of evidence obtaining required by the target application, including but not limited to the application type, the application name and the application authority type of the target application, and of course, more evidence obtaining functions can be set in the external storage device according to the actual terminal security detection requirement.
And step 104, responding to the information evidence obtaining operation, and determining the authority setting state of the target application in the terminal.
In one possible design, in the first permission state, the current permission of the target application includes a designated permission, and in the second permission state, the current permission of the target application does not include the designated permission.
At this time, the permission setting state of the target application in the terminal refers to what types of permissions the target application currently has, where multiple specified permission types related to terminal security, user privacy information and the like, for example, position acquisition permission, recording permission, input text viewing permission and the like, may be set, and if the permission type of the target application currently has includes several types of the specified permission types, the target application is set to belong to the first permission state, that is, the target application is deemed to be an application having specified permissions related to terminal security, user privacy information and the like. Therefore, whether the application utilizes the existing authority to make abnormal actions which endanger the safety of the terminal and the privacy of the user or not is detected in the subsequent steps more comprehensively and effectively.
Otherwise, if the current authority class of the target application does not include a plurality of specified authority types, setting that the target application belongs to the second authority state, namely, determining that the target application is an application which does not relate to specified authorities related to terminal security, user privacy information and the like. Thus, since the application does not relate to the specified rights related to the terminal security, the user privacy information, and the like, it is not necessary to detect the application with respect to the specified rights, but only necessary detection of the application is necessary for this part.
In another possible design, in the first permission state, the number of current permissions of the target application is greater than or equal to a specified number, and in the second permission state, the number of current permissions of the target application is less than the specified number.
At this time, the authority setting state of the target application in the terminal refers to the level of the number of authorities that the target application currently has, and the greater the number of authorities that the target application has, the greater the influence on the terminal security, user privacy information, and the like. In this regard, a specified number may be set, which represents a maximum value of the number of application rights in the case where the influence is within a controllable range if the application has an influence on contents such as terminal security, user privacy information, and the like due to the existing rights.
If the number of the current rights of the target application is greater than or equal to the specified number, it is indicated that the target application may have a greater risk of disclosure of the privacy information due to the existing large number of rights, and the influence on the security of the terminal, the privacy information of the user, and the like is great, and at this time, the target application may be set to belong to the first rights state. Otherwise, if the number of the current rights of the target application is smaller than the specified number, it is indicated that the target application may be in a controllable range due to the risk of disclosure of the privacy information by the existing rights, and the influence on the security of the terminal, the privacy information of the user, and the like is limited, and at this time, the target application may be set to belong to the second rights state.
Therefore, proper evidence obtaining modes adapting to the actual demands of the two different applications can be adopted respectively, so that evidence obtaining modes conforming to the actual conditions can be applied to the applications with different authorities, the efficiency and the effectiveness of application anomaly detection are improved on the basis of saving system resources, and the user privacy information safety in the terminal is effectively protected.
And step 106, determining whether the target application is abnormal or not according to the authority setting state of the target application.
When the authority setting state of the target application is a first authority state, determining whether the target application is abnormal or not based on the running information of the target application and an application abnormality recognition model; and when the permission setting state of the target application is the second permission state, carrying out security performance detection on the target application based on a target detection mode so as to determine whether the target application is abnormal.
That is, different evidence-taking approaches are employed for the target application for different rights states.
When the permission setting state of the target application is the first permission state, at this time, the target application has specified permissions related to terminal security, user privacy information and the like, or the number of current permissions of the target application is greater than or equal to the specified number, which makes the target application face a larger risk of revealing the privacy information, and has a great influence on terminal security, user privacy information and the like, so that a big data operation mode can be adopted, and multiple running information and application abnormality recognition models of the target application are combined to comprehensively judge whether the target application is abnormal from multiple dimensions.
Wherein, the operation information of the target application includes, but is not limited to: the application type, the current authority, the use times and/or the use frequency of the current authority, the call times and/or the call frequency of calling a third party application or a third party page, the access times and/or the access frequency of accessing a database, the user operation type, the user operation times and the user operation time period which occur in the target application.
In the process of training the application anomaly identification model, firstly, sample operation information of a sample application needs to be acquired; then, for each sample operation information of the sample application, the sample operation information is converted into a characteristic value according to a conversion rule corresponding to the sample operation information.
The various running information can represent the actual running condition of the application to different degrees, and the actual running condition of the application can reflect whether the application possibly generates abnormal behaviors which damage the terminal safety and reveal the user privacy information. In this regard, the conversion rules corresponding to different operation information can be set to convert the operation information into characteristic values, and the characteristic values are used as input data required for training and applying the abnormal recognition model, so that the operation is convenient. In different conversion rules, the size of the conversion coefficient is positively correlated with the degree of the actual running condition of the application which can be reflected by the running information, or the size of the conversion coefficient is positively correlated with the size of the influence of the running corresponding to the running information.
Then, the application anomaly recognition model is trained based on the feature values of all the sample operation information of the sample application and the actual state of the sample application under the sample operation information. At this time, the feature values of all the sample operation information of the sample application are taken as input information, the initial model is trained to obtain a sample state of the sample application under the sample operation information, and model parameters of the initial model are adjusted based on comparison of the sample state and the actual state of the sample application, and the training process is repeated continuously, so that the final application anomaly identification model can be obtained. Then, only the running information of the target application is input into the final application abnormality recognition model, and an effective result of whether the target application is abnormal or not can be obtained.
When the permission setting state of the target application is the second permission state, at this time, the target application step has the appointed permission related to terminal security, user privacy information and the like, or the number of the current permissions of the target application is smaller than the appointed number, which makes the risk of disclosure of the privacy information faced by the target application limited, and the risk of disclosure of the privacy information is insufficient to have great influence on terminal security, user privacy information and the like, or the influence generated by the risk of disclosure of the privacy information is still in a controllable range. At this time, security performance detection may be performed on the target application based on a target detection manner to determine whether the target application is abnormal.
It is known that the target detection mode is faster and simpler than the big data operation mode, so that when the application with less influence on terminal safety and user privacy information is subjected to evidence collection, operation resources can be saved as much as possible, and evidence collection efficiency is improved.
In one possible design, the target detection means includes: detecting whether the target application acquires a uniform resource identifier related to a designated application and/or a designated storage position of the terminal; and determining that the target application is abnormal under the condition that the target application is detected to acquire the uniform resource identifier.
At this point, the external storage device may be considered as a proxy for the terminal, and all in-pair requests generated by the terminal are verified by the external storage device. The designated application refers to an important application related to terminal security, user privacy information and the like, and can store a unique uniform resource identifier thereof to a designated storage location. Then, the target application needs to use a special uniform resource identifier to perform the interactive operation when calling the data in the terminal, for example, when accessing the address book or album. Thus, upon detecting that the target application obtains the uniform resource identifier(s) associated with the specified application and/or the specified storage location, it is indicated that the target application is obtaining or has obtained the user privacy data in the specified application and/or the specified storage location associated with the uniform resource identifier(s). Thus, the target application can be judged to be abnormal and in an unsafe state so as to be further subjected to safety control.
In another possible design, the target detection means includes: inserting verification data in a specified table of a database of the terminal in response to a physical connection of the external storage device with the terminal; the step of performing security performance detection on the target application based on the target detection mode further includes: intercepting protocol information sent by the target application, and detecting whether the analysis result of the protocol information has the check data or not; and determining that the target application is abnormal under the condition that the analysis result is detected to have the check data.
At this time, the external storage device may be regarded as a proxy of the terminal, and all external requests generated by the terminal are checked by the external storage device. Because the external interface paths of all applications are various, the monitoring difficulty is great, so that the test data can be inserted in the appointed table of the database of the terminal in advance, when the target application sends out the protocol information, the target application is indicated to interact with the external data, at the moment, whether the test data is contained in the analysis result of the protocol information or not can be monitored, and if the test data is contained, the target application is indicated to transmit the data content of the database of the terminal to the external through the protocol information. Wherein the protocol information may comprise http/https requests. Therefore, the target application abnormality can be judged to be in an unsafe state so as to further carry out safety control on the target application abnormality.
It should be added that, in the case of determining that the target application is abnormal, the method further includes: displaying first security management and control function information on the terminal aiming at the target application in the first authority state; and aiming at the target application in the second authority state, displaying second safety control function information on the terminal, wherein the first safety control function information and the second safety control function information are used for responding to a user safety control selection operation to carry out safety control on the target application.
After the target application is determined to be abnormal, because the rights of the target application are different in the first right state and the second right state, the possible harm influence on the terminal safety and the user privacy information is different, and therefore, the safety management and control measures for the user in the different right states can be set individually.
When the target application is judged to be abnormal and in an unsafe state, the external storage device can actively provide safety control function information for the target application in a mode of displaying a popup window and the like at the terminal, and a user can select the required safety control function information to carry out safety control on the target application.
In one possible design, the first security management function information includes intercepting a designated behavior of the target application, encrypting user privacy data related to the target application, and saving all information related to the target application in a non-secure state to the external storage device, and the second security management function information includes encrypting user privacy data related to the target application and saving the encrypted information to the external storage device. Of course, the setting of the first security management and control function information and the second security management and control function information includes, but is not limited to, one manner given above, and any management and control content required for actual protection of the terminal security and user privacy information may also be met.
In sum, the application with different rights can respectively adopt a proper evidence obtaining mode which is suitable for the actual demands of the application, namely, the evidence obtaining mode which is suitable for the application with different rights and accords with the actual conditions of the application is adopted, so that the efficiency and the effectiveness of application anomaly detection are improved on the basis of saving system resources, and the user privacy information safety in the terminal is effectively protected.
Fig. 2 shows a block diagram of an application information forensics device according to one embodiment of the present invention.
As shown in fig. 2, the application information evidence obtaining apparatus 200 according to one embodiment of the present invention includes: an information evidence obtaining operation obtaining unit 202, configured to obtain an information evidence obtaining operation for a target application in the terminal; a rights setting state determining unit 204 for determining a rights setting state of the target application in the terminal in response to the information evidence obtaining operation; an application information evidence obtaining unit 206, configured to determine whether the target application is abnormal according to the permission setting state of the target application, where when the permission setting state of the target application is a first permission state, determine whether the target application is abnormal based on the running information of the target application and an application abnormality identification model, and when the permission setting state of the target application is a second permission state, perform security performance detection on the target application based on a target detection mode, so as to determine whether the target application is abnormal.
In the above embodiment of the present invention, optionally, in the first permission state, the current permission of the target application includes a specified permission, and in the second permission state, the current permission of the target application does not include the specified permission; or in the first authority state, the number of the current authorities of the target application is larger than or equal to the appointed number, and in the second authority state, the number of the current authorities of the target application is smaller than the appointed number.
In the above embodiment of the present invention, optionally, the information forensic operation obtaining unit 202 is configured to: responding to the physical connection between the external storage device and the terminal, and displaying evidence obtaining function information of the external storage device on the terminal, wherein the evidence obtaining function information comprises an application type, an application name and an application authority type; acquiring user selection operation aiming at the evidence obtaining function information; and generating the information evidence obtaining operation aiming at the target application in the terminal based on the user selection operation.
In the foregoing embodiment of the present invention, optionally, the running information of the target application includes: the application type, the current authority, the use times and/or the use frequency of the current authority, the call times and/or the call frequency of calling a third party application or a third party page, the access times and/or the access frequency of accessing a database, the user operation type, the user operation times and the user operation time period which occur in the target application.
In the above embodiment of the present invention, optionally, the method further includes: an applied anomaly recognition model training unit for: acquiring sample operation information of a sample application; for each sample operation information applied by the sample, converting the sample operation information into a characteristic value according to a conversion rule corresponding to the sample operation information; the application anomaly recognition model is trained based on the feature values of all the sample operation information of the sample application and the actual state of the sample application under the sample operation information.
In the above embodiment of the present invention, optionally, the application information evidence obtaining unit 206 is configured to: detecting whether the target application acquires a uniform resource identifier related to a designated application and/or a designated storage position of the terminal; and determining that the target application is abnormal under the condition that the target application is detected to acquire the uniform resource identifier.
In the above embodiment of the present invention, optionally, the application information evidence obtaining unit 206 is further configured to: inserting verification data in a specified table of a database of the terminal in response to a physical connection of the external storage device with the terminal; intercepting protocol information sent by the target application, and detecting whether the analysis result of the protocol information has the check data or not; and determining that the target application is abnormal under the condition that the analysis result is detected to have the check data.
In the above embodiment of the present invention, optionally, the method further includes: the first management and control unit is used for displaying first safety management and control function information on the terminal aiming at the target application in the first authority state under the condition that the target application is determined to be abnormal; the second management and control unit is used for displaying second safety management and control function information on the terminal aiming at the target application in the second authority state, wherein the first safety management and control function information and the second safety management and control function information are used for responding to a user safety management and control selection operation to carry out safety management and control on the target application.
The application information evidence obtaining device 200 uses the scheme described in any one of the embodiments of fig. 1, so that all the above technical effects are achieved, and will not be described herein.
Fig. 3 shows a block diagram of an electronic device of an embodiment of the invention.
As shown in fig. 3, an electronic device 300 of one embodiment of the invention includes at least one memory 302; and a processor 304 communicatively coupled to the at least one memory 302; wherein the memory stores instructions executable by the at least one processor 304, the instructions being configured to perform the arrangements described in any of the embodiments above. Therefore, the electronic device 300 has the same technical effects as those of any of the above embodiments, and will not be described herein.
The electronic device of the embodiments of the present invention exists in a variety of forms including, but not limited to:
(1) Mobile communication devices, which are characterized by mobile communication functionality and are aimed at providing voice, data communication. Such terminals include smart phones (e.g., iPhone), multimedia phones, functional phones, and low-end phones, among others.
(2) Ultra mobile personal computer equipment, which belongs to the category of personal computers, has the functions of calculation and processing and generally has the characteristic of mobile internet surfing. Such terminals include PDA, MID and UMPC devices, etc., such as iPad.
(3) Portable entertainment devices such devices can display and play multimedia content. Such devices include audio, video players (e.g., iPod), palm game consoles, electronic books, and smart toys and portable car navigation devices.
(4) The server is similar to a general computer architecture in that the server is provided with high-reliability services, and therefore, the server has high requirements on processing capacity, stability, reliability, safety, expandability, manageability and the like.
(5) Other electronic devices with data interaction function.
In addition, an embodiment of the present invention provides a computer readable storage medium storing computer executable instructions for performing the method flow described in any one of the above embodiments.
The technical scheme of the invention is explained in detail by combining the drawings, through the technical scheme of the invention, proper evidence obtaining modes which are suitable for the actual demands of the applications with different authorities can be adopted respectively, namely, the evidence obtaining modes which are suitable for the applications with different authorities and meet the actual conditions of the applications are adopted, so that the efficiency and the effectiveness of application anomaly detection are improved on the basis of saving system resources, and the privacy information safety of users in the terminal is effectively protected.
It should be understood that although the terms first, second, etc. may be used in embodiments of the present invention to describe the state of rights, these states of rights should not be limited to these terms. These terms are only used to distinguish one state of authority from another. For example, a first state of authority may also be referred to as a second state of authority, and similarly, a second state of authority may also be referred to as a first state of authority, without departing from the scope of embodiments of the present invention.
Depending on the context, the word "if" as used herein may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to a detection". Similarly, the phrase "if determined" or "if detected (stated condition or event)" may be interpreted as "when determined" or "in response to determination" or "when detected (stated condition or event)" or "in response to detection (stated condition or event), depending on the context.
In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the elements is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple elements or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in hardware plus software functional units.
The integrated units implemented in the form of software functional units described above may be stored in a computer readable storage medium. The software functional unit is stored in a storage medium, and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a Processor (Processor) to perform part of the steps of the methods according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
The foregoing description of the preferred embodiments of the invention is not intended to be limiting, but rather to enable any modification, equivalent replacement, improvement or the like to be made within the spirit and principles of the invention.

Claims (9)

An application information evidence obtaining unit, configured to determine whether the target application is abnormal according to a permission setting state of the target application, where when the permission setting state of the target application is a first permission state, determine whether the target application is abnormal based on running information of the target application and an application abnormality identification model, and when the permission setting state of the target application is a second permission state, perform security performance detection on the target application based on a target detection mode, so as to determine whether the target application is abnormal; the method comprises the steps that in the first authority state, the current authority of the target application comprises a designated authority, and in the second authority state, the current authority of the target application does not comprise the designated authority; or in the first authority state, the number of the current authorities of the target application is larger than or equal to the appointed number, and in the second authority state, the number of the current authorities of the target application is smaller than the appointed number;
CN202111419783.3A2021-11-262021-11-26Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program productActiveCN114036520B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN202111419783.3ACN114036520B (en)2021-11-262021-11-26Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN202111419783.3ACN114036520B (en)2021-11-262021-11-26Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product

Publications (2)

Publication NumberPublication Date
CN114036520A CN114036520A (en)2022-02-11
CN114036520Btrue CN114036520B (en)2024-09-24

Family

ID=80138835

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN202111419783.3AActiveCN114036520B (en)2021-11-262021-11-26Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product

Country Status (1)

CountryLink
CN (1)CN114036520B (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN104462970A (en)*2014-12-172015-03-25中国科学院软件研究所Android application program permission abuse detecting method based on process communication

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN1333552C (en)*2005-03-232007-08-22北京首信科技有限公司Detecting system and method for user behaviour abnormal based on machine study
CN103761472B (en)*2014-02-212017-05-24北京奇虎科技有限公司Application program accessing method and device based on intelligent terminal
CN105528295B (en)*2016-01-042018-12-14北京航空航天大学Mobile applications anomaly detection method and device
US20170329966A1 (en)*2016-05-132017-11-16Qualcomm IncorporatedElectronic device based security management
CN107506646B (en)*2017-09-282021-08-10努比亚技术有限公司Malicious application detection method and device and computer readable storage medium
CN108932435A (en)*2018-07-052018-12-04宇龙计算机通信科技(深圳)有限公司A kind of information security management method, terminal device and computer readable storage medium
CN110858247A (en)*2018-08-232020-03-03北京京东尚科信息技术有限公司 Android malicious application detection method, system, device and storage medium
CN110826006B (en)*2019-11-222021-03-19支付宝(杭州)信息技术有限公司Abnormal collection behavior identification method and device based on privacy data protection
CN111325451B (en)*2020-02-022020-11-13贾海芳 Intelligent building multi-level scheduling method, intelligent building scheduling center and system
CN112685737A (en)*2020-12-242021-04-20恒安嘉新(北京)科技股份公司APP detection method, device, equipment and storage medium

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN104462970A (en)*2014-12-172015-03-25中国科学院软件研究所Android application program permission abuse detecting method based on process communication

Also Published As

Publication numberPublication date
CN114036520A (en)2022-02-11

Similar Documents

PublicationPublication DateTitle
CN109743315B (en) Behavior recognition method, device, device and readable storage medium for website
US20130111586A1 (en)Computing security mechanism
US20160057157A1 (en)Verification method, apparatus, server and system
CN109120645A (en)A kind of file uploading method, device, electronic equipment and medium
US11770385B2 (en)Systems and methods for malicious client detection through property analysis
CN104866770B (en)Sensitive data scanning method and system
US20160072792A1 (en)Verification method, apparatus, server and system
CN111274046A (en)Service call validity detection method and device, computer equipment and computer storage medium
CN111881460B (en)Vulnerability exploitation detection method, system, equipment and computer storage medium
CN110932960A (en)Social software-based fraud prevention method, server and system
CN110706143A (en)Identity authentication method and device based on government affair service
CN113761515A (en)Cloud desktop security detection method and system, computing device and storage medium
CN105337739B (en)Safe login method, device, server and terminal
CN115242608B (en)Alarm information generation method, device, equipment and storage medium
CN113497807A (en)Method and device for detecting user login risk and computer readable storage medium
CN114036520B (en)Application information evidence obtaining method and device, electronic equipment, computer readable storage medium and program product
CN107124330B (en)Data downloading control method and system
CN108092795A (en)A kind of reminding method, terminal device and computer-readable medium
CN114389858B (en)Flow processing method and device, electronic equipment and computer readable storage medium
CN113596600B (en)Security management method, device, equipment and storage medium for live broadcast embedded program
CN110875919B (en)Network threat detection method and device, electronic equipment and storage medium
CN111030982B (en)Strong management and control method, system and storage medium for confidential files
CN114266042B (en) Information detection method and device, electronic device and computer-readable storage medium
CN107465744B (en)Data downloading control method and system
CN106127051A (en)Method and device for preventing mouse from being maliciously captured and electronic equipment

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
GR01Patent grant
GR01Patent grant

[8]ページ先頭

©2009-2025 Movatter.jp