CN116361121A

CN116361121A - Abnormal interface alarm method, device, electronic equipment and computer readable medium

Info

Publication number: CN116361121A
Application number: CN202310162596.4A
Authority: CN
Inventors: 邓晓灵; 陈雨瞻; 伍彦铭; 沈亮; 李盛开
Original assignee: Multipoint Shenzhen Digital Technology Co ltd
Current assignee: Multipoint Shenzhen Digital Technology Co ltd
Priority date: 2023-02-17
Filing date: 2023-02-17
Publication date: 2023-06-30

Abstract

The embodiment of the disclosure discloses an abnormal interface alarming method, an abnormal interface alarming device, electronic equipment and a computer readable medium. One embodiment of the method comprises the following steps: acquiring interface privacy information and interface access relation information of each interface in a target application; updating a common interface database, a privacy interface database and an unknown interface database; determining privacy interface data in a privacy interface database as privacy interface information to obtain a privacy interface information set; carrying out identification processing on a preset privacy template to generate an information processing list; grouping the privacy interface information sets to generate application privacy interface information sets; for each of the set of application privacy interface information sets, controlling the associated alert device to perform a first alert process in response to determining that the set of application privacy interface information meets a preset privacy alert condition. This embodiment may alert a portion of the abnormal interface.

Description

Abnormal interface alarm method, device, electronic equipment and computer readable medium

Technical Field

Embodiments of the present disclosure relate to the field of computer technology, and in particular, to an abnormal interface alarm method, an abnormal interface alarm device, an electronic device, and a computer readable medium.

Background

The application includes an interface that can acquire the private information of the user, but the abnormal interface can randomly acquire the private information of the user, and can randomly transmit the private information of the user after the private information of the user is acquired, so that the private information of the user is revealed. At present, the abnormal interface is identified by adopting the following general methods: the interface privacy information is acquired in a dynamic sandbox analysis mode, and whether the interface is abnormal or not is identified according to the related privacy policy.

However, the following technical problems generally exist in the above manner:

firstly, whether the interfaces are abnormal is only identified according to the privacy information of the interfaces, and the access relation among the interfaces is not considered, so that part of abnormal interfaces are not identified, and the alarm can not be given to part of abnormal interfaces;

secondly, the interface privacy information is acquired by using a dynamic sandbox analysis mode, the Application limit is higher, only the interface privacy information of each interface included in the APP (Application) can be identified, but the interface privacy information of each interface included in the website cannot be identified, so that the interface privacy information of part of interfaces cannot be acquired;

thirdly, by means of the privacy policy interface identification mode, whether the interface is abnormal or not can be identified, the abnormal interface can be alarmed, and specific abnormal information of the abnormal interface cannot be alarmed.

The above information disclosed in this background section is only for enhancement of understanding of the background of the inventive concept and, therefore, may contain information that does not form the prior art that is already known to those of ordinary skill in the art in this country.

Disclosure of Invention

The disclosure is in part intended to introduce concepts in a simplified form that are further described below in the detailed description. The disclosure is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Some embodiments of the present disclosure propose abnormal interface alerting methods, apparatuses, electronic devices, and computer readable media to solve one or more of the technical problems mentioned in the background section above.

In a first aspect, some embodiments of the present disclosure provide an abnormal interface alerting method, the method comprising: acquiring interface privacy information and interface access relation information of each interface in a target application, and acquiring an interface privacy information set and an interface access relation information set; updating a common interface database, a privacy interface database and an unknown interface database based on the interface privacy information set and the interface access relation information set; determining the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set; carrying out identification processing on a preset privacy template to generate an information processing list; grouping the privacy interface information sets to generate application privacy interface information sets; for each application privacy interface information group in the application privacy interface information group, controlling the associated alarm device to perform first alarm processing in response to determining that the application privacy interface information group meets a preset privacy alarm condition, wherein the preset privacy alarm condition is constructed by the information processing list and the application privacy interface information group; and for each piece of privacy interface information in the privacy interface information set, controlling the alarm device to perform second alarm processing in response to determining that the privacy interface information meets a preset access alarm condition.

In a second aspect, some embodiments of the present disclosure provide an abnormal interface warning apparatus, the apparatus including: the acquisition unit is configured to acquire interface privacy information and interface access relation information of each interface in the target application, and acquire an interface privacy information set and an interface access relation information set; an updating unit configured to update a common interface database, a privacy interface database, and an unknown interface database based on the above-described interface privacy information set and the above-described interface access relationship information set; the determining unit is configured to determine the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set; the identification unit is configured to carry out identification processing on a preset privacy template so as to generate an information processing list; a grouping unit configured to perform grouping processing on the privacy interface information set to generate an application privacy interface information set; a first alarm unit configured to control an associated alarm device to perform a first alarm process in response to determining that the application privacy interface information group satisfies a preset privacy alarm condition for each of the application privacy interface information groups, wherein the preset privacy alarm condition is constructed from the information processing list and the application privacy interface information group; and a second alarm unit configured to control the alarm device to perform a second alarm process in response to determining that the privacy interface information satisfies a preset access alarm condition for each of the privacy interface information in the privacy interface information set.

In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, which when executed by one or more processors causes the one or more processors to implement the method described in any of the implementations of the first aspect above.

In a fourth aspect, some embodiments of the present disclosure provide a computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

The above embodiments of the present disclosure have the following advantageous effects: by the abnormal interface alarming method of some embodiments of the present disclosure, part of abnormal interfaces may be alarmed. Specifically, the reason why the alarm cannot be given to a part of the abnormal interfaces is that: whether the interfaces are abnormal is only identified according to the privacy information of the interfaces, and the access relation among the interfaces is not considered, so that part of abnormal interfaces are not identified. Based on this, in the abnormal interface alarm method of some embodiments of the present disclosure, first, interface privacy information and interface access relation information of each interface in a target application are obtained, and an interface privacy information set and an interface access relation information set are obtained. Therefore, the interface privacy information and the interface access relation information of each interface can be obtained, the interface access relation information is considered, and the abnormal interfaces can be conveniently identified later. And updating a common interface database, a privacy interface database and an unknown interface database based on the interface privacy information set and the interface access relation information set. Thus, each interface can be classified, so that the data of the interface related to the user privacy information is selected and stored in the privacy interface database. And then, determining the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set. Thus, a privacy interface information set corresponding to each interface related to the user privacy information can be obtained. And then, carrying out identification processing on the preset privacy template to generate an information processing list. Therefore, the preset privacy template can be subjected to identification processing, so that the generated information processing list can be compared with privacy data included in the privacy interface information, and the abnormal interface can be identified. And then, carrying out grouping processing on the privacy interface information set to generate an application privacy interface information set. Thus, processing can be performed separately for each application. And then, for each application privacy interface information group in the application privacy interface information group, controlling the associated alarm equipment to perform first alarm processing in response to determining that the application privacy interface information group meets the preset privacy alarm condition. Thus, an application that does not conform to the privacy template can be alert processed. And finally, for each piece of privacy interface information in the privacy interface information set, controlling the alarm device to perform second alarm processing in response to determining that the privacy interface information meets a preset access alarm condition. Thus, the access relation among the interfaces is also considered, and whether the interfaces are abnormal or not can be identified according to the access relation. Thus, an interface that is cross-border and does not use a cross-border encryption algorithm can be alert-processed. Thus, a part of abnormal interfaces can be identified in consideration of the access relationship between the interfaces. Furthermore, an alarm can be given to a part of abnormal interfaces.

Drawings

The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.

FIG. 1 is a flow chart of some embodiments of an abnormal interface alerting method according to the present disclosure;

FIG. 2 is a schematic structural diagram of some embodiments of an abnormal interface alerting device according to the present disclosure;

fig. 3 is a schematic structural diagram of an electronic device suitable for use in implementing some embodiments of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings. Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

Referring to FIG. 1, a flow 100 of some embodiments of an abnormal interface alerting method according to the present disclosure is shown. The abnormal interface alarming method comprises the following steps:

Step 101, obtaining interface privacy information and interface access relation information of each interface in the target application, and obtaining an interface privacy information set and an interface access relation information set.

In some embodiments, an executing body (for example, a computing device) of the abnormal interface alarm method may acquire interface privacy information and interface access relation information of each interface in the target application from the terminal device in a wired connection or wireless connection manner, so as to obtain an interface privacy information set and an interface access relation information set. The target application may be an application for acquiring user privacy information. Here, the user privacy information may include, but is not limited to, at least one of: name, phone number, identification number, date of birth, address. One target application may include at least one interface. For example, the target application may be, but is not limited to: social APP (Application), news APP, shopping website, etc.

In practice, the executing body may acquire the interface privacy information and the interface access relationship information of each interface in the target application through the following steps to obtain an interface privacy information set and an interface access relationship information set:

The first step, the interface address information of each interface is obtained, and an interface address information set is obtained. The interface address information in the interface address information set may include an interface address and an application identifier. The interface address may uniquely identify an interface. The application identification may uniquely identify an application. One application may include at least one interface. In practice, first, the execution subject may add a preset dependent code to the code of the target application. Then, the execution body may obtain the interface address information of each interface from the code of the target application through a preset dependent code, to obtain an interface address information set. For example, the preset dependency code may be Swagger (interface document auto-generation) dependency.

And a second step of acquiring interface privacy information of each interface in the interface address information set in response to determining that the interface corresponding to the interface address information meets a preset acquisition condition. The preset obtaining condition may be that the interface corresponding to the interface address information obtains the user privacy information. The interface privacy information may include, but is not limited to, at least one of: interface address, application identification, private data. The privacy data may be data of user privacy information acquired by the interface. In practice, the execution body may acquire the interface privacy information of the interface from the code of the target application through the preset dependent code.

And thirdly, determining the acquired interface privacy information as an interface privacy information set.

Fourth, a first privacy interface information set is obtained. In practice, first, the execution subject may import the target application into a sandbox. Then, the execution subject may replace the source program of the target application with a preset replacement program. Finally, the executing body may obtain the first privacy interface information set by calling a preset replacement program. Wherein, the first privacy interface information in the first privacy interface information set may include, but is not limited to, at least one of the following: interface address, application identification, private data. For example, the preset replacement program may be a hook program.

Fifth, for each of the first privacy interface information sets, adding the first privacy interface information to an interface privacy information set in response to determining that the first privacy interface information is not in the interface privacy information set.

Sixth, for each of the interface address information sets, adding the interface address information to the interface privacy information set in response to determining that the interface address information is not in the interface privacy information set.

And seventhly, carrying out flow statistics processing on each interface to generate interface access relation information, and obtaining an interface access relation information set. Wherein, the interface access relation information in the interface access relation information set may include, but is not limited to, at least one of the following: interface address, access information group, region identification. The access information in the access information group may include an access address, the number of accesses. The region identifier may be a first region identifier. The region identifier may also be a second region identifier. The first region identifier may characterize that an interface corresponding to the interface access relationship has access to cross-border access. The second region identifier may characterize that the interface corresponding to the interface access relationship does not have cross-border access. The access address may be an address of an interface accessed by an interface corresponding to the interface access relationship information. The number of accesses may be the number of times the interface corresponding to the interface access relationship information is accessed in the interface within the preset period of time. For example, the preset time period may be 2023, 2, 1, and 2023, 2, and 2. The preset time period may also be 2023, 1/2023, 2/1. For example, the traffic statistics process may be, but is not limited to: hundred degree statistics, dimension statistics, quantum constant channel statistics, and the like.

The technical content in step 101 is taken as an invention point of the embodiment of the disclosure, which solves the second technical problem that the alarm cannot be given to a part of abnormal interfaces in the prior art. The factors that cause the failure to alert a part of the abnormal interfaces are often as follows: the interface privacy information is acquired by using a dynamic sandbox analysis mode, the Application limit is higher, only the interface privacy information of each interface included in the APP (Application) can be identified, but the interface privacy information of each interface included in the website cannot be identified, so that the interface privacy information of part of interfaces cannot be acquired, and part of abnormal interfaces cannot be identified. If the above factors are solved, the effect of warning partial abnormal interfaces can be achieved. To achieve this, first, interface address information of each interface is acquired, resulting in an interface address information set. Therefore, the interface address information of each interface included in the APP or the website can be acquired in a code scanning mode. And secondly, for each interface address information in the interface address information set, acquiring the interface privacy information of the interface in response to determining that the interface corresponding to the interface address information meets a preset acquisition condition. Thus, the interface privacy information of each interface related to the user privacy information can be acquired by means of code scanning. Next, the acquired individual interface privacy information is determined as an interface privacy information set. Then, a first set of privacy interface information is obtained. Thus, a first set of privacy interface information for each interface related to user privacy information may be obtained by means of dynamic sandboxed analysis. Then, for each of the first privacy interface information sets, the first privacy interface information is added to the interface privacy information set in response to determining that the first privacy interface information is not in the interface privacy information set. Therefore, the first privacy interface information set obtained through dynamic sandbox analysis can be updated in a complementary mode to the interface privacy information set, and part of interface privacy information is prevented from being missed. And then, for each interface address information in the interface address information set, adding the interface address information to the interface privacy information set in response to determining that the interface address information is not in the interface privacy information set. Therefore, the interface address information which does not relate to the privacy information of the user can be added to the privacy interface information set, so that the common interface database can be updated conveniently. And finally, carrying out flow statistics processing on each interface to generate interface access relation information, and obtaining an interface access relation information set. Thus, the interface access relation information set can be obtained through the flow analysis technology. Thus, the interface privacy information of each interface included in the APP and the website can be obtained through code scanning and dynamic sandboxed analysis, and the interface access relation information set of each interface is obtained through the flow analysis technology so as to supplement the interface privacy information. Furthermore, the privacy interface information of part of the interfaces and the interface access relation information of each interface can be obtained. Therefore, part of the abnormal interfaces can be identified, and the alarm can be given to the part of the abnormal interfaces.

And 102, updating a common interface database, a privacy interface database and an unknown interface database based on the interface privacy information set and the interface access relation information set.

In some embodiments, the executing entity may update the generic interface database, the private interface database, and the unknown interface database based on the set of interface privacy information and the set of interface access relationship information. The general interface database may be used to store general interface data. The normal interface data may be data of an interface that does not acquire the privacy data. The above-described privacy interface database may be used to store privacy interface data. The privacy interface data may be data of an interface that acquired the privacy data. The unknown interface database may be used to store unknown interface data. The unknown interface data may be data of interfaces other than the above-described normal interface and the above-described privacy interface. The generic interface data may include, but is not limited to, at least one of: interface address, access information group, region identification. The privacy interface data may include, but is not limited to, at least one of: interface address, application identification, privacy data, access information group, region identification. The unknown interface data may include, but is not limited to, at least one of: interface address, access information group, region identification.

In practice, based on the above-mentioned interface privacy information set and the above-mentioned interface access relation information set, the above-mentioned execution subject may update the ordinary interface database, the privacy interface database, and the unknown interface database by:

first, for each piece of interface privacy information in the interface privacy information set, the interface privacy information is added to a common interface database in response to determining that the interface privacy information satisfies a preset privacy condition. The preset privacy condition may be that the privacy data included in the interface privacy information is null.

And a second step of updating the normal interface database in response to determining that the interface address included in the interface access relationship information is in the normal interface database for each interface access relationship information in the interface access relationship information set. In practice, for each interface access relation information in the interface access relation information set, in response to determining that an interface address included in the interface access relation information is in the common interface database, the execution subject may add the interface access information to common interface data corresponding to the interface access information in the common interface database.

Optionally, the method further comprises:

first, for each interface privacy information in the interface privacy information set, the following updating steps are executed:

and a first updating step of determining whether the interface privacy information is in a privacy interface database or not in response to determining that the interface privacy information does not meet the preset privacy condition.

In some embodiments, in response to determining that the interface privacy information does not satisfy the preset privacy condition, the execution subject may determine whether the interface privacy information is in a privacy interface database.

And a second updating step of updating the privacy interface database in response to determining that the interface privacy information is in the privacy interface database.

In some embodiments, the execution entity may update the privacy interface database in response to determining that the interface privacy information is in the privacy interface database. In practice, in response to determining that the interface privacy information is in the privacy interface database, the execution subject may perform fusion processing on the privacy interface data corresponding to the interface privacy information in the privacy interface database and the interface privacy information to update the privacy interface data in the privacy interface database.

And a third updating step of adding the interface privacy information to the privacy interface database in response to determining that the interface privacy information is not in the privacy interface database.

In some embodiments, in response to determining that the interface privacy information is not in the privacy interface database, the executing entity may add the interface privacy information to the privacy interface database.

And a second step of updating the privacy interface database in response to determining, for each of the interface access relationship information in the set of interface access relationship information, an interface address included in the interface access relationship information in the privacy interface database.

In some embodiments, for each of the set of interface access relationship information, the executing entity may update the privacy interface database in response to determining that the interface address included in the interface access relationship information is in the privacy interface database. In practice, for each piece of interface access relation information in the set of interface access relation information, in response to determining that an interface address included in the piece of interface access relation information is in the privacy interface database, the execution subject may add the piece of interface access information to privacy interface data corresponding to the piece of interface access information in the privacy interface database.

Optionally, for each interface access relation information in the interface access relation information set, in response to determining that an interface address included in the interface access relation information is not in the common interface database and is not in the privacy interface database, the interface access relation information is added to an unknown interface database.

In some embodiments, for each of the set of interface access relationship information, the executing entity may add the interface access relationship information to an unknown interface database in response to determining that the interface address included in the interface access relationship information is not in the generic interface database and is not in the privacy interface database.

And step 103, determining the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set.

In some embodiments, the executing entity may determine the privacy interface data in the privacy interface database as privacy interface information, to obtain a privacy interface information set. Wherein, the privacy interface information in the privacy interface information set may include, but is not limited to, at least one of the following: interface address, application identification, privacy data, access information group, region identification. The access information in the set of access information may include, but is not limited to, at least one of: access address, number of accesses.

And 104, carrying out identification processing on the preset privacy template to generate an information processing list.

In some embodiments, the executing body may perform an identification process on a preset privacy template to generate an information processing list. For example, the identification process may be, but is not limited to: OCR (optical character recognition ) character recognition, picture recognition, and the like. The preset privacy template may characterize a preset privacy policy or privacy protocol for collecting user privacy information. For example, the preset privacy template may include, but is not limited to, at least one of: name, phone number, identification card number, address. The operations of collecting, storing, using and the like of the user privacy information (such as name, mobile phone number, identity card number and address) related in the preset privacy template are carried out, and before the corresponding operations are executed, related organizations or individuals take the obligations including carrying out privacy information security influence evaluation, informing the privacy information main body of obligations, obtaining the authorization consent of the privacy information main body in advance and the like.

Step 105, grouping the privacy interface information sets to generate application privacy interface information set.

In some embodiments, the execution body may perform packet processing on the privacy interface information set to generate an application privacy interface information set. In practice, first, the execution subject may determine, as the privacy interface information group, each privacy interface information having the same application identifier as the privacy interface information included in the privacy interface information set. The execution subject may then determine each of the determined privacy interface information groups as a privacy interface information group set.

And step 106, for each application privacy interface information group in the application privacy interface information group, controlling the associated alarm equipment to perform first alarm processing in response to determining that the application privacy interface information group meets the preset privacy alarm condition.

In some embodiments, for each of the set of application privacy interface information sets, the execution body may control the associated alert device to perform the first alert process in response to determining that the set of application privacy interface information satisfies a preset privacy alert condition. The preset privacy warning condition is constructed by the information processing list and the application privacy interface information group. The preset privacy warning condition may be that privacy data included in the application privacy interface information existing in the application privacy interface information group is not equal to the information processing list. The associated alarm device may be a device that alarms an application corresponding to the application privacy interface information group. The first alarm processing may be to display warning text or control a speaker to emit a warning sound.

Step 107, for each piece of privacy interface information in the privacy interface information set, controlling the alarm device to perform a second alarm processing in response to determining that the privacy interface information meets the preset access alarm condition.

In some embodiments, for each piece of privacy interface information in the privacy interface information set, the execution body may control the alert device to perform the second alert process in response to determining that the piece of privacy interface information satisfies a preset access alert condition. The preset access alarm condition may be that the region identifier included in the privacy interface information is a first region identifier, and encryption transmission is not used. The encrypted transmission may be SSL (Secure Socket Layer, secure sockets layer) transmission, TLS (Transport Layer Security, secure transport layer protocol) transmission, HTTPS (Hypertext Transfer Protocol Secure, hypertext transfer security protocol) transmission. The second alarm processing may be a text for displaying warning or a control speaker for emitting a prompt tone.

Optionally, the method further comprises:

first, a privacy data set is generated based on the privacy interface information set.

In some embodiments, the executing entity may generate the privacy data set based on the privacy interface information set. In practice, the execution body may compare each piece of privacy interface information in the privacy interface information set with a preset template to generate privacy data, so as to obtain a privacy data set. The privacy data may include the same data as the privacy interface information and the preset template. The preset template may be a preset template for evaluating whether the information acquired by the interface is compliant. For example, the preset template may be "information security technology personal information security impact assessment guidelines". The preset templates may also include, but are not limited to, at least one of: whether user privacy information is obtained, whether SSL, TLS encryption is used, whether sharing to a third party is not allowed by the user, and transfer of user privacy information. The operations of collecting, storing, using and the like of the user privacy information (such as name, mobile phone number, identity card number and address) related in the preset template are carried out, and before the corresponding operations are executed, related organizations or individuals can take the obligations including carrying out the evaluation of the security influence of the privacy information, informing the privacy information main body of obligations, obtaining the authorized consent of the privacy information main body in advance and the like.

And a second step of generating an information data flow graph based on the privacy interface information set.

In some embodiments, the executing entity may generate the information dataflow graph based on the privacy interface information set. Wherein, the access information included in the privacy interface information set further includes: an application identification is accessed. The access application identifier may be an application identifier of an interface accessed by an interface corresponding to the privacy interface information. The preset access condition may be that the number of accesses reaches a preset value. For example, the preset value may be 20. The preset value may also be 50.

In practice, based on the privacy interface information set, the execution subject may generate an information dataflow graph through the following sub-steps:

a first sub-step of, for each piece of access information included in the privacy interface information set, performing, in response to determining that the number of accesses included in the access information satisfies a preset access condition, the following generation step:

a first generation step of determining, in response to determining that the access address included in the access information is in the privacy interface database, an application identifier corresponding to the access address included in the access information as an access application identifier included in the access information.

And a second generation step of updating the access information in response to determining that the access address included in the access information is not in the privacy interface database. In practice, first, in response to determining that the access address included in the access information is not in the privacy interface database, the executing entity may send update reminder information to an operator. Then, in response to the operator updating the access information, the execution subject may use the updated access information as the access information. The update reminding information may be an access application identifier included in the update access information.

And a third generation step of generating an information subgraph based on the access information. The node in the information subgraph may be an interface corresponding to the access information and an interface corresponding to an access address included in the access information. The connection between the nodes in the information subgraph can represent the access relationship between the two interfaces.

And a second sub-step, merging the generated information subgraphs to generate an information data flow graph. In practice, the execution body may use the same node in each information sub-graph as a common node to perform merging processing on each information sub-graph to generate an information data flow graph.

And thirdly, carrying out fusion processing on the privacy data set and the information data flow graph to generate the privacy data flow graph.

In some embodiments, the execution body may perform fusion processing on the privacy dataset and the information dataflow graph to generate a privacy dataflow graph. In practice, first, the execution subject may send the generated alert information to the operator. Then, in response to receiving the anomaly information set sent by the operator, the executing body may add the anomaly information set to the information data flow graph to generate a privacy data flow graph. The generating of the reminding information may be selecting abnormal information from the privacy data set. Here, the anomaly information may characterize information of anomalies in the privacy dataset. For example, the anomaly information may be: the plaintext transmits the user privacy information. The anomaly information may also be: the use of cookies (data stored on the user's local terminal) is not agreed upon.

And fourthly, controlling the alarm equipment to perform third alarm processing based on the privacy data flow diagram.

In some embodiments, the executing entity may control the alarm device to perform a third alarm process based on the privacy data flow graph. The third alarm processing may be to display warning text or control the speaker to emit a prompt tone. In practice, the execution body may control the alarm device to perform a third alarm processing on the abnormal information included in the privacy data flow graph. For example, the third alarm processing may be displaying exception information included in the privacy data flow graph.

The optional technical content in step 107 is taken as an invention point of the embodiment of the present disclosure, which solves the third technical problem mentioned in the background art that the specific abnormal information of the abnormal interface cannot be alarmed. The following factors are often used to alarm specific abnormal information of an abnormal interface: by means of the privacy policy identifying interface, whether the interface is abnormal or not can be identified, and the abnormal interface can be alarmed only. If the above factors are solved, the effect of warning specific abnormal information of the abnormal interface can be achieved. To achieve this, first, a privacy data set is generated based on the above privacy interface information set. Thus, the privacy data can be generated by comparing the preset template with the privacy interface information so as to select the abnormal information later. And secondly, generating an information data flow diagram based on the privacy interface information set. Thus, an information data flow graph including access relationships between interfaces can be generated from access information included in the privacy interface information. And then, carrying out fusion processing on the privacy data set and the information data flow graph to generate the privacy data flow graph. Therefore, the abnormal information and the information data flow graph in the privacy data set can be artificially selected for fusion processing, so that the privacy data flow graph comprising the access relation among the interfaces and the abnormal information of the interfaces is generated. Thus, specific abnormality information for each interface can be obtained. And finally, controlling the alarm equipment to perform third alarm processing based on the privacy data flow diagram. Thus, specific abnormal information of the abnormal interface can be alarmed.

With further reference to FIG. 2, as an implementation of the method illustrated in the above figures, the present disclosure provides some embodiments of an abnormal interface alarm apparatus, corresponding to those illustrated in FIG. 1, which may find particular application in a variety of electronic devices.

As shown in fig. 2, the abnormal interface warning apparatus 200 of some embodiments includes: an acquisition unit 201, an update unit 202, a determination unit 203, an identification unit 204, a grouping unit 205, a first alarm unit 206, and a second alarm unit 207. The acquiring unit 201 is configured to acquire interface privacy information and interface access relation information of each interface in the target application, and obtain an interface privacy information set and an interface access relation information set; an updating unit 202 configured to update a common interface database, a privacy interface database, and an unknown interface database based on the above-described interface privacy information set and the above-described interface access relationship information set; a determining unit 203 configured to determine the privacy interface data in the privacy interface database as privacy interface information, to obtain a privacy interface information set; an identification unit 204 configured to perform identification processing on a preset privacy template to generate an information processing list; a grouping unit 205 configured to perform grouping processing on the privacy interface information set to generate an application privacy interface information group set; a first alarm unit 206 configured to control, for each of the application privacy interface information groups in the application privacy interface information group, the associated alarm device to perform a first alarm process in response to determining that the application privacy interface information group satisfies a preset privacy alarm condition, wherein the preset privacy alarm condition is constructed by the information processing manifest and the application privacy interface information group; and a second alarm unit 207 configured to control the alarm device to perform a second alarm process in response to determining that the privacy interface information satisfies a preset access alarm condition for each of the privacy interface information sets.

It will be appreciated that the elements described in the abnormal interface alarm apparatus 200 correspond to the various steps in the method described with reference to fig. 1. Thus, the operations, features and beneficial effects described above with respect to the method are equally applicable to the abnormal interface alarm apparatus 200 and the units contained therein, and are not described herein.

Referring now to FIG. 3, a schematic diagram of an electronic device (e.g., computing device) 300 suitable for use in implementing some embodiments of the present disclosure is shown. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), car terminals (e.g., car navigation terminals), and the like, as well as stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 3 is merely an example and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

As shown in fig. 3, the electronic device 300 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 301 that may perform various suitable actions and processes in accordance with a program stored in a Read Only Memory (ROM) 302 or a program loaded from a storage means 308 into a Random Access Memory (RAM) 303. In the RAM303, various programs and data required for the operation of the electronic apparatus 300 are also stored. The processing device 301, the ROM302, and the RAM303 are connected to each other via a bus 304. An input/output (I/O) interface 305 is also connected to bus 304.

In general, the following devices may be connected to the I/O interface 305: input devices 306 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 307 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 308 including, for example, magnetic tape, hard disk, etc.; and communication means 309. The communication means 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. While fig. 3 shows an electronic device 300 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead. Each block shown in fig. 3 may represent one device or a plurality of devices as needed.

In particular, according to some embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network via communications device 309, or from storage device 308, or from ROM 302. The above-described functions defined in the methods of some embodiments of the present disclosure are performed when the computer program is executed by the processing means 301.

It should be noted that, the computer readable medium described in some embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In some embodiments of the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, however, the computer-readable signal medium may comprise a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring interface privacy information and interface access relation information of each interface in a target application, and acquiring an interface privacy information set and an interface access relation information set; updating a common interface database, a privacy interface database and an unknown interface database based on the interface privacy information set and the interface access relation information set; determining the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set; carrying out identification processing on a preset privacy template to generate an information processing list; grouping the privacy interface information sets to generate application privacy interface information sets; for each application privacy interface information group in the application privacy interface information group, controlling the associated alarm device to perform first alarm processing in response to determining that the application privacy interface information group meets a preset privacy alarm condition, wherein the preset privacy alarm condition is constructed by the information processing list and the application privacy interface information group; and for each piece of privacy interface information in the privacy interface information set, controlling the alarm device to perform second alarm processing in response to determining that the privacy interface information meets a preset access alarm condition.

Computer program code for carrying out operations for some embodiments of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in some embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. The described units may also be provided in a processor, for example, described as: a processor includes an acquisition unit, an update unit, a determination unit, an identification unit, a grouping unit, a first alert unit, and a second alert unit. The names of these units do not limit the unit itself in some cases, for example, the obtaining unit may also be described as "obtaining the interface privacy information and the interface access relationship information of each interface in the target application, and obtaining the interface privacy information set and the interface access relationship information set".

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above technical features, but encompasses other technical features formed by any combination of the above technical features or their equivalents without departing from the spirit of the invention. Such as the above-described features, are mutually substituted with (but not limited to) the features having similar functions disclosed in the embodiments of the present disclosure.

Claims

1. An abnormal interface warning method, comprising:

acquiring interface privacy information and interface access relation information of each interface in a target application, and acquiring an interface privacy information set and an interface access relation information set;

updating a common interface database, a privacy interface database and an unknown interface database based on the interface privacy information set and the interface access relation information set;

determining privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set;

carrying out identification processing on a preset privacy template to generate an information processing list;

grouping the privacy interface information sets to generate application privacy interface information sets;

for each application privacy interface information group in the application privacy interface information group, controlling the associated alarm device to perform first alarm processing in response to determining that the application privacy interface information group meets a preset privacy alarm condition, wherein the preset privacy alarm condition is constructed by the information processing list and the application privacy interface information group;

and for each piece of privacy interface information in the privacy interface information set, controlling the alarm equipment to perform second alarm processing in response to determining that the privacy interface information meets a preset access alarm condition.

2. The method of claim 1, wherein the interface access relationship information in the set of interface access relationship information comprises: an interface address; and

the updating of the common interface database, the privacy interface database and the unknown interface database based on the interface privacy information set and the interface access relation information set comprises the following steps:

for each piece of interface privacy information in the interface privacy information set, responding to the fact that the interface privacy information meets a preset privacy condition, and adding the interface privacy information into a common interface database;

for each interface access relationship information in the set of interface access relationship information, updating the common interface database in response to determining that an interface address included in the interface access relationship information is in the common interface database.

3. The method of claim 2, wherein the method further comprises:

for each interface privacy information in the interface privacy information set, performing the following updating steps:

determining whether the interface privacy information is in a privacy interface database in response to determining that the interface privacy information does not meet the preset privacy condition;

Updating the privacy interface database in response to determining that the interface privacy information is in the privacy interface database;

responsive to determining that the interface privacy information is not in the privacy interface database, adding the interface privacy information to the privacy interface database;

for each interface access relationship information in the set of interface access relationship information, updating the privacy interface database in response to determining that an interface address included in the interface access relationship information is in the privacy interface database.

4. A method according to claim 3, wherein the method further comprises:

for each interface access relationship information in the set of interface access relationship information, in response to determining that an interface address included in the interface access relationship information is not in the common interface database and is not in the privacy interface database, adding the interface access relationship information to an unknown interface database.

5. An abnormal interface warning device, comprising:

the acquisition unit is configured to acquire interface privacy information and interface access relation information of each interface in the target application, and acquire an interface privacy information set and an interface access relation information set;

An updating unit configured to update a common interface database, a privacy interface database, and an unknown interface database based on the interface privacy information set and the interface access relation information set;

the determining unit is configured to determine the privacy interface data in the privacy interface database as privacy interface information to obtain a privacy interface information set;

the identification unit is configured to carry out identification processing on a preset privacy template so as to generate an information processing list;

a grouping unit configured to perform grouping processing on the privacy interface information set to generate an application privacy interface information set;

a first alert unit configured to control an associated alert device to perform a first alert process in response to determining that the application privacy interface information set satisfies a preset privacy alert condition for each of the application privacy interface information sets, wherein the preset privacy alert condition is constructed from the information processing manifest and the application privacy interface information set;

and the second alarm unit is configured to control the alarm device to perform second alarm processing in response to determining that the privacy interface information meets a preset access alarm condition for each piece of privacy interface information in the privacy interface information set.

6. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon;

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-4.

7. A computer readable medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the method of any of claims 1-4.