WO2019037521A1

WO2019037521A1 - Security detection method, device, system, and server

Info

Publication number: WO2019037521A1
Application number: PCT/CN2018/090863
Authority: WO
Inventors: 庄乾六; 张建新
Original assignee: 北京奇虎科技有限公司
Priority date: 2017-08-23
Filing date: 2018-06-12
Publication date: 2019-02-28
Also published as: CN107480530A

Abstract

The present invention provides a security detection method, device, system, and server. The method comprises: upon detection of a security detection request, configuring a security detection environment on the basis of the security detection request; in the security detection environment, determining, by running a preset application program in the security detection request corresponding to a function on which security detection is to be performed, whether the function on which security detection is to be performed is secure; and sending the determination result to a security detection client, to inform a user of the security detection result concerning the function. The present technical solution effectively detects whether an application program or an application function under different application scenarios will cause a malicious behavior to a user or has insecure factors, to prevent the application program or the application function from stealing or leaking property data and privacy data of the user, resulting in user privacy insecurity and property damage.

Description

Method, device, system and server for security detection

Technical field

The present invention relates to the field of computers, and in particular, to a method for security detection, a device for security detection, a system for security detection, and a server for security detection.

Background technique

With the development of information technology, traditional digital mobile terminals are gradually replaced by intelligent mobile terminals. Since the smart mobile terminal not only realizes all the functions of the traditional digital mobile terminal, but also can install various applications to meet various needs of the user, such as office requirements, social needs, online video viewing requirements, and the like.

Due to the open intelligent mobile operating system of the smart mobile terminal, such as the Android mobile operating system, many applications can be allowed to be installed in the open intelligent operating system; because the open intelligent operating system is more inclusive to the application Strong, once the user's important information is obtained by the malicious application, not only will the user's private information be leaked, but even the user's property will be lost. Or even if a malicious application is not installed on the smart mobile operating system of the user's current smart mobile terminal, the malicious application installed on the smart mobile operating system of the smart mobile terminal of another user cannot be prevented from stealing and leaking the private information of the user. And the theft of the property of the user; for example, other users steal the wireless network information of the nearby user and the connection password of the wireless network information through a malicious application installed on the smart mobile operating system of the smart mobile terminal.

In the prior art, due to the limitation of the authority of the intelligent mobile operating system, there is currently no particularly effective method for performing security detection on a malicious application of the smart mobile terminal of the user or other users that causes loss to the user; How to perform security detection on the malicious application of the smart mobile terminal of the user or other users is the key to solving the above problem.

Summary of the invention

In order to overcome the above technical problems or at least partially solve the above technical problems, the following technical solutions are proposed:

In a first aspect, an embodiment of the present invention provides a method for security detection, comprising: setting a security detection environment based on a security detection request when a security detection request is detected; and performing a security detection request in a security detection environment The preset application corresponding to the security detection function determines whether the security detection function is safe; sends the determination result to the security detection client to inform the user of the security detection result of the security detection function.

In a second aspect, an embodiment of the present invention provides an apparatus for security detection, comprising: at least one processor; and at least one memory communicatively coupled to the at least one processor; the at least one memory Included by the processor executable instructions, when executed by the at least one processor, causing the apparatus to perform at least the following: upon detecting a security detection request, setting based on the security detection request a security detection environment; in the security detection environment, determining whether the security detection function is safe by running a preset application corresponding to the security detection function in the security detection request; sending the determination result to the security detection The client informs the user of the security detection result of the security detection function to be described.

In a third aspect, an embodiment of the present invention provides a security detection system, including a security detection platform and a security detection client. The security detection platform is configured to set a security detection environment based on the security detection request when a security detection request is detected. In the security detection environment, it is determined whether the security detection application is safe by running a preset application corresponding to the security detection function in the security detection request; the judgment result is sent to the security detection client; the security detection client, It is used to receive the judgment result sent by the security detection platform, and inform the user of the security detection result of the security detection function.

In a fourth aspect, an embodiment of the present invention provides a server for security detection, including a memory, a processor, and a computer program stored on the processor and running on the processor; the processor performs the above security detection when executing the computer program. method.

In a fifth aspect, the invention provides a computer program comprising computer readable code, which when executed by a server causes the method of the first aspect to be performed.

In a sixth aspect, the invention provides a computer readable medium storing a computer program as described in the fifth aspect.

In the technical solution of the present invention, when the security detection request is detected, the security detection environment is set based on the security detection request; in the security detection environment, the preset application corresponding to the security detection function in the security detection request is determined to be determined. Whether the security detection function is secure; the judgment result is sent to the security detection client to inform the user of the security detection result of the security detection function, thereby effectively detecting whether the application or application function in different application scenarios is malicious to the user. Behavior or insecurities to prevent applications or application functions from stealing and revealing user property data and private data, thereby bringing privacy insecurity and property damage to users; and because users are aware of the existence of applications or application functions in a timely manner Malicious behavior or insecure factors, so as to remove malicious applications or exclude insecure application functions as early as possible, thus ensuring users have a secure application environment and application functions.

The additional aspects and advantages of the invention will be set forth in part in the description which follows.

DRAWINGS

The above and/or additional aspects and advantages of the present invention will become apparent and readily understood from

1 is a schematic flow chart of a method for security detection according to an embodiment of the present invention;

2 is a schematic flowchart of determining whether a security detection function is to be safe according to a preferred embodiment of the present invention;

3 is a schematic structural view of a device for safety detection according to another embodiment of the present invention;

4 is a schematic structural diagram of a judgment module of a preferred embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a system for security detection according to still another embodiment of the present invention; FIG.

Figure 6 shows a block diagram of a server for performing the method according to the invention;

Figure 7 shows a schematic diagram of a memory unit for holding or carrying program code implementing a method in accordance with the present invention.

Detailed ways

The embodiments of the present invention are described in detail below, and the examples of the embodiments are illustrated in the drawings, wherein the same or similar reference numerals are used to refer to the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the drawings are intended to be illustrative of the invention and are not to be construed as limiting.

The singular forms "a", "an", "the" It is to be understood that the phrase "comprise" or "an" Integers, steps, operations, components, components, and/or groups thereof. It will be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element. Further, "connected" or "coupled" as used herein may include either a wireless connection or a wireless coupling. The phrase "and/or" used herein includes all or any one and all combinations of one or more of the associated listed.

Those skilled in the art will appreciate that all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention belongs, unless otherwise defined. It should also be understood that terms such as those defined in a general dictionary should be understood to have meaning consistent with the meaning in the context of the prior art, and will not be idealized or excessive unless specifically defined as here. The formal meaning is explained.

FIG. 1 is a schematic flow chart of a method for security detection according to an embodiment of the present invention.

It should be noted that the execution subject of this embodiment is a server.

Step S101: When the security detection request is detected, the security detection environment is set based on the security detection request. Step S102: In the security detection environment, determine the security to be determined by running a preset application corresponding to the security detection function in the security detection request. Whether the detection function is safe; Step S103: Send the determination result to the security detection client to inform the user of the security detection result of the security detection function.

The following is a further description of the specific implementation of each step:

Step S101: When the security detection request is detected, the security detection environment is set based on the security detection request.

Specifically, setting the security detection environment based on the security detection request includes: determining the security detection environment configuration data based on the operation condition of the security detection function in the security detection request; and setting the security detection environment according to the security detection configuration data.

For example, when the security detection server receives the security detection request sent by the user, by parsing the security detection request and obtaining the content of the request in the security detection request and the operating condition of the security detection function, such as requesting content: detecting the current user The security function of the wifi signal of the intelligent mobile terminal, the operating condition of the security detection function: wifi environment, such as the wifi name "XXX", IP address, etc.; based on the operating conditions of the security detection function in the security detection request, determine The server security detects the environment configuration data, such as the wifi environment configuration data, and sets a security detection environment based on the configuration data, for example, setting the simulated mobile terminal operating environment to the wifi environment based on the wifi environment configuration data.

It should be noted that, in this embodiment, the operating environment of the mobile terminal is simulated by the sandbox; in this embodiment, the wifi configuration data can also be directly set to the operating environment in the preset real machine.

Step S102: In the security detection environment, determine whether the security detection function is safe by running a preset application corresponding to the security detection function in the security detection request.

Specifically, in the security detection environment, it is determined whether the security detection function is safe by running a preset application corresponding to the security detection function in the security detection request, as shown in FIG. 2, including: Step S201: In security detection In the environment, running a preset application corresponding to the security detection function, and performing a simulation operation on the preset application; step S202: when the preset application sends data generated by any simulation operation to its corresponding target server At the request, intercepting and acquiring the data request; step S203: forwarding the data request to the security detection client, so that the security detection client sends the data request to the target server; step S204: receiving the target server response returned by the security detection client The feedback data information of the data request; step S205: determining whether the security detection function is to be safe based on the returned feedback data information.

The step of intercepting and obtaining the data request includes: intercepting, by the hook function, a data request sent by the preset application to its corresponding target server, and acquiring the data request.

The step of determining whether the security detection function is safe based on the returned feedback data information includes: determining whether the feedback data information is malicious data.

For example, in the security detection environment that is set up, run the corresponding preset application installed in the security detection environment: wifi sharing application to detect whether the wifi network "XXX" application function is safe; run wifi sharing through simulated click operation The application, and automatically searches the wifi network "XXX" through the wifi sharing application, when the wifi sharing application connects to the wifi network, that is, the wifi sharing application sends a connection request to the server corresponding to the wifi sharing application The security detection server is based on the interception layer set in the application programming interface, intercepts and acquires the connection request through the hook function, and the security detection server forwards the connection request to the security detection client of the user, so that the security is passed through the user. Detecting that the client sends the connection request to the server of the wifi sharing application; when the server of the wifi sharing application receives the connection request, if the wifi network "XXX" has been shared by other users, the wifi sharing The wifi is stored in the application's server The connection password of "XXX", the server of the wifi sharing application returns the connection password to the security detection client, and then returns to the security detection server through the security detection client; when the security detection server obtains the connection password, Returning the connection password to the wifi sharing application. When the security detection server detects that the wifi sharing application can connect to the wifi network “XXX” through the connection password, the security detection server determines that the connection password is malicious data, that is, The wifi "XXX" has been shared, that is, the wifi application function has an insecure problem.

It should be noted that, in this embodiment, because the security detection environment is a simulated mobile terminal operating environment or a real mobile terminal operating environment, the preset application program can determine that the current operating environment is a real mobile terminal operation. The environment is thus able to run the preset application.

Specifically, in the security detection environment, the step of determining whether the security detection function is to be safe is performed by running a preset application corresponding to the security detection function in the security detection request, and further comprising: presetting the preset application access. The application programming interface intercepts and acquires interception data information; determines whether the intercepted data information is malicious data.

For example, when the security detection server simulates clicking on the preset application so that the preset application starts running, by setting the interception layer in the preset application programming interface API, when the preset application programming interface is called for the preset application, The obtained application data is intercepted and acquired; the security detection server analyzes the intercepted application data to determine whether the application data is malicious data, and when the application data is determined to be malicious data, the security detection client notifies the user to be detected. There are insecure issues with the application features.

It should be noted that the preset application programming interface is an application programming interface that is called when the preset application may cause a loss to the user, such as an application programming interface that is called when acquiring user privacy data or user property data.

Step S103: Send the determination result to the security detection client to inform the user of the security detection result of the security detection function.

Specifically, the security detection server sends a judgment result, such as the wifi network "XXX", to the security detection client of the user, to inform the user that the wifi network of the mobile terminal is insecure, and prompts to change the password in time.

It should be noted that, in the embodiment, if the result of the determination is that the security detection function does not have a security problem, the determination result may be sent to the security detection client of the user.

3 is a schematic structural view of a device for safety detection according to another embodiment of the present invention.

The setting module 301, when detecting the security detection request, sets a security detection environment based on the security detection request; the determining module 302 determines, in the security detection environment, by running a preset application corresponding to the security detection function in the security detection request. Whether the security detection function is safe or not; the sending module 303 sends the determination result to the security detection client to inform the user of the security detection result of the security detection function.

The following is a further description of the specific implementation of each module:

The setting module 301 sets a security detection environment based on the security detection request when the security detection request is detected.

Specifically, the setting module 301 includes: a determining unit that determines security detection environment configuration data based on an operating condition of the security detection function in the security detection request; and a setting unit that sets the security detection environment according to the security detection configuration data.

For example, when the security detection server receives the security detection request sent by the user, by parsing the security detection request and obtaining the content of the request in the security detection request and the operating condition of the security detection function, such as requesting content: detecting the current user The security function of the wifi signal of the intelligent mobile terminal, the operating condition of the security detection function: wifi environment, such as wifi name "XXX", IP address, etc.; the determining unit is based on the operating condition of the security detection function in the security detection request The server security detection environment configuration data, such as the wifi environment configuration data, is set, and the setting unit sets the security detection environment based on the configuration data, for example, setting the simulated mobile terminal operating environment to the wifi environment based on the wifi environment configuration data.

The determining module 302 determines whether the security detecting function is safe by running a preset application corresponding to the security detecting function in the security detecting request in the security detecting environment.

Specifically, the determining module 302, as shown in FIG. 4, includes: an operating unit 401, in the security detecting environment, running a preset application corresponding to the security detecting function, and performing an analog operation on the preset application; The intercepting unit 402 intercepts and acquires the data request when the preset application sends a data request generated by any of the simulation operations to its corresponding target service; the forwarding unit 403 forwards the data request to the security detection client to enable the security detection. The client sends the data request to the target server; the receiving unit 404 receives the feedback data information of the target server returned by the security detection client in response to the data request; the first determining unit 405 determines the to-be-safe detection based on the returned feedback data information. Whether the function is safe.

The intercepting unit intercepts the data request sent by the preset application to its corresponding target service through the hook function, and acquires the data request.

The first determining unit determines whether the feedback data information is malicious data.

For example, the running unit 401 detects whether the wifi network "XXX" application function is safe by running a corresponding preset application installed in the security detection environment: the wifi sharing application in the set security detection environment; Running the wifi sharing application, and automatically searching for the wifi network "XXX" through the wifi sharing application, when the wifi sharing application connects to the wifi network, that is, the wifi sharing application sends the server corresponding to the wifi sharing application When the connection request is made, the first intercepting unit 402 intercepts and acquires the connection request by the intercepting unit hook function based on the intercepting layer set in the application programming interface, and forwards the connection request to the user's security detecting client by the forwarding unit 403. Ending, so that the connection request is sent to the server of the wifi sharing application by the user's security detection client; when the server of the wifi sharing application receives the connection request, if the wifi network "XXX" has been used by other users Shared, then the server of the wifi sharing application The connection password of the wifi network "XXX" is stored, and the server of the wifi sharing application returns the connection password to the security detection client, and then returns to the security detection server via the security detection client; when the receiving unit 404 receives After the password is connected, the connection password is returned to the wifi sharing application. When the security detecting server detects that the wifi sharing application can connect to the wifi network "XXX" through the connection password, the first determining unit 405 determines the password. The connection password is malicious data, that is, the wifi "XXX" has been shared, that is, the wifi application function has an insecure problem.

Specifically, the determining module further includes: a second intercepting unit that intercepts the preset application programming interface accessed by the preset application and acquires the intercepted data information; and the second determining unit determines whether the intercepted data information is malicious data.

For example, when the security detection server simulates clicking on the preset application so that the preset application starts running, the second intercepting unit calls the preset application by setting the interception layer in the preset application programming interface API. The application data acquired during the programming interface is intercepted and acquired; the security detection server analyzes the intercepted application data, and the second determining unit determines whether the application data is malicious data, and when determining that the application data is malicious data, The detection client informs the user that there is an insecure problem with the application function to be detected.

The sending module 303 sends the determination result to the security detection client to inform the user of the security detection result of the security detection function.

Specifically, the sending module 303 sends the determination result, such as the wifi network "XXX", to the security detection client of the user, to inform the user that the wifi network of the mobile terminal is insecure, and prompts to replace the password in time.

FIG. 5 is a schematic structural diagram of a system for security detection according to still another embodiment of the present invention.

The security detection system includes a security detection platform 501 and a security detection client 502. The security detection platform 501 sets a security detection environment based on the security detection request when detecting the security detection request, and passes the operation and security detection request in the security detection environment. The preset application corresponding to the security detection function determines whether the security detection application is safe; sends the determination result to the security detection client 502; the security detection client 502 receives the judgment result sent by the security detection platform, and informs The security test result of the user's security detection function.

The following is a further description of the specific implementation of each system component:

The security detection platform 501, when detecting the security detection request, sets a security detection environment based on the security detection request; in the security detection environment, determining the to-be-safe detection by running a preset application corresponding to the security detection function in the security detection request Whether the application is secure; the judgment result is sent to the security detection client 502.

Specifically, the system for security detection further includes an auxiliary platform; the auxiliary platform determines the security detection environment configuration data based on the operating conditions of the security detection function in the security detection request; and sets the security detection environment according to the security detection configuration data.

For example, when the security detection server receives the security detection request sent by the user, by parsing the security detection request and obtaining the content of the request in the security detection request and the operating condition of the security detection function, such as requesting content: detecting the current user The security function of the wifi signal of the intelligent mobile terminal, the operating condition of the security detection function: wifi environment, such as wifi name "XXX", IP address, etc.; the auxiliary platform is based on the operating condition of the security detection function in the security detection request The server security detection environment configuration data, such as the wifi environment configuration data, is set, and the security detection environment is set based on the configuration data, for example, the simulated mobile terminal operating environment is set to the wifi environment based on the wifi environment configuration data.

Specifically, the security detection platform 501 includes an operating system platform and a forwarding platform; the operating system platform runs a preset application corresponding to the security detection function in the security detection environment, and performs an analog operation on the preset application; When the preset application sends a data request generated by any simulation operation to its corresponding target service, intercepts and acquires the data request; and sends the data request to the forwarding platform; and determines the security detection function based on the feedback data information returned by the forwarding platform. Whether it is secure; the forwarding platform receives the data request sent by the operating system platform; and forwards the data request to the security detection client 502, so that the security detection client 502 sends the data request to the target server; the receiving is returned by the security detection client 502. The target server responds to the data request feedback data information; and sends the feedback data information to the operating system platform.

The forwarding platform includes a VPN client and a VPN server; the VPN client receives the data request sent by the operating system platform; and sends the data request to the VPN server; and receives the feedback data information of the target server returned by the VPN server in response to the data request. And sending the feedback data information to the operating system platform; the VPN server receives the data request sent by the VPN client, and sends the data request to the security detection client 502; and receives the target server returned by the security detection client 502 to respond to the data. The requested feedback data information; and the feedback data information is sent to the VPN client.

For example, the operating system platform detects whether the wifi network "XXX" application function is safe by running a corresponding preset application installed in the security detection environment: the wifi sharing application in the set security detection environment; Running the wifi sharing application, and automatically searching for the wifi network "XXX" through the wifi sharing application, when the wifi sharing application connects to the wifi network, that is, the wifi sharing application sends the server corresponding to the wifi sharing application When the connection request is made, the security detection server intercepts and acquires the connection request through the hook function based on the interception layer set in the application programming interface, and the connection request is forwarded to the VPN client by the security detection server; the VPN client receives a connection request sent by the operating system platform; and the connection request is sent to the VPN server; the VPN server forwards the connection request to the security detection client 502 of the user, so that the connection request is sent to the wifi sharing by the security detection client 502 of the user Application server; when When the server of the wifi sharing application receives the connection request, if the wifi network "XXX" has been shared by other users, the server of the wifi sharing application stores the connection password of the wifi network "XXX", the wifi The server sharing the application will return the connection password to the security detection client 502, and then return to the VPN server via the security detection client 502; the VPN server returns the connection password to the VPN client; the VPN client returns the connection password. To the operating system platform; when the operating system platform obtains the connection password, the connection password is returned to the wifi sharing application, and when the operating system platform detects that the wifi sharing application can connect to the wifi network through the connection password " XXX", the operating system platform determines that the connection password is malicious data, that is, the wifi "XXX" has been shared, that is, the wifi application function has an insecure problem.

Specifically, the security detection platform 501 intercepts the preset application programming interface accessed by the preset application and acquires the interception data information; and determines whether the intercepted data information is malicious data.

For example, when the security detection platform 501 simulates clicking on the preset application so that the preset application starts running, the preset application programming interface is called for the preset application by setting the interception layer in the preset application programming interface API. The application data obtained at the time is intercepted and acquired; the security detection platform 501 analyzes the intercepted application data to determine whether the application data is malicious data, and when the application data is determined to be malicious data, the user is notified by the security detection client 502. There is an insecure problem with the application function to be detected.

The security detection client 502 receives the judgment result sent by the security detection platform, and informs the user of the security detection result of the security detection function.

Specifically, the security detection platform 501 sends the determination result, such as the wifi network "XXX", to the security detection client 502 of the user, and the security detection client 502 informs the user that the wifi network of the mobile terminal is insecure. And prompt to change the password in time.

It should be noted that, in the embodiment, if the result of the determination is that the security detection function does not have a security problem, the determination result may be sent to the security detection client 502 of the user.

Still another embodiment of the present invention provides a server for security detection, comprising a memory, a processor, and a computer program stored on the processor and running on the processor; and the method for implementing the security detection when the processor executes the computer program. Since these technical solutions have been clearly explained in the above embodiments, they will not be described again here.

Fig. 6 shows a server (hereinafter collectively referred to as a server) that can implement security detection according to the present invention. The server conventionally includes a processor 610 and a computer program product or computer readable medium in the form of a memory 620. The memory 620 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 620 has a memory space 630 for program code 631 for performing any of the method steps described above. For example, storage space 630 for program code may include various program code 631 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG. The storage unit may have a storage section or a storage space or the like arranged similarly to the memory 620 in FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit comprises program code 631' for performing the steps of the method according to the invention, ie code that can be read by a processor, such as 610, which, when run by the server, causes the server to execute the above Each step in the described method.

Those skilled in the art will appreciate that the present invention includes apparatus related to performing one or more of the operations described herein. These devices may be specially designed and manufactured for the required purposes, or may also include known devices in a general purpose computer. These devices have computer programs stored therein that are selectively activated or reconfigured. Such computer programs may be stored in a device (eg, computer) readable medium or in any type of medium suitable for storing electronic instructions and coupled to a bus, respectively, including but not limited to any Types of disks (including floppy disks, hard disks, optical disks, CD-ROMs, and magneto-optical disks), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory) , EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or light card. That is, a readable medium includes any medium that is stored or transmitted by a device (eg, a computer) in a readable form.

Those skilled in the art will appreciate that each block of the block diagrams and/or block diagrams and/or flow diagrams and combinations of blocks in the block diagrams and/or block diagrams and/or flow diagrams can be implemented by computer program instructions. . Those skilled in the art will appreciate that these computer program instructions can be implemented by a general purpose computer, a professional computer, or a processor of other programmable data processing methods, such that the processor is executed by a computer or other programmable data processing method. The blocks of the disclosed structure and/or block diagrams and/or flow diagrams or blocks specified in the various blocks.

Those skilled in the art can understand that the steps, measures, and solutions in the various operations, methods, and processes that have been discussed in the present invention may be alternated, changed, combined, or deleted. Further, other steps, measures, and schemes of the various operations, methods, and processes that have been discussed in the present invention may be alternated, modified, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and solutions in the various operations, methods, and processes disclosed in the present invention may be alternated, modified, rearranged, decomposed, combined, or deleted.

The above is only a part of the embodiments of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Claims

A method of security detection, including:

When a security detection request is detected, setting a security detection environment based on the security detection request;

In the security detection environment, determining whether the to-be-safe detection function is safe by running a preset application corresponding to the to-be-safe detection function in the security detection request;

Sending the judgment result to the security detection client to inform the user of the security detection result of the security detection function to be performed.
The method of claim 1, wherein setting the security detection environment based on the security detection request comprises:

Determining security detection environment configuration data based on an operating condition of the security detection function in the security detection request;

A security detection environment is set according to the security detection configuration data.
The method according to claim 1 or 2, wherein in the security detection environment, whether the to-be-safe detection function is determined by running a preset application corresponding to the security detection function in the security detection request Security, including:

In the security detection environment, running the preset application corresponding to the to-be-detected function, and performing an analog operation on the preset application;

Intercepting and acquiring the data request when the preset application sends a data request generated by any of the simulation operations to its corresponding target server;

Forwarding the data request to the security detection client, such that the security detection client sends the data request to the target server;

Receiving feedback data information of the target server returned by the security detection client in response to the data request;

Based on the returned feedback data information, it is determined whether the to-be-safe detection function is secure.
The method of claim 3 wherein the step of intercepting and obtaining the data request comprises:

The data request sent by the preset application to its corresponding target server is intercepted by a hook function, and the data request is obtained.
The method according to claim 3, wherein the step of determining whether the to-be-safety detection function is safe based on the returned feedback data information comprises:

Determining whether the feedback data information is malicious data.
The method according to claim 3, wherein in the security detection environment, whether the to-be-safe detection function is safe is determined by running a preset application corresponding to the security detection function in the security detection request. The steps also include:

Intercepting a preset application programming interface accessed by the preset application and acquiring interception data information;

Determining whether the intercepted data information is malicious data.
A device for safety detection, comprising:

At least one processor;

And at least one memory communicatively coupled to the at least one processor; the at least one memory comprising processor-executable instructions when the processor-executable instructions are executed by the at least one processor Causing the device to perform at least the following operations:

When a security detection request is detected, setting a security detection environment based on the security detection request;

In the security detection environment, determining whether the to-be-safe detection function is safe by running a preset application corresponding to the to-be-safe detection function in the security detection request;

Sending the judgment result to the security detection client to inform the user of the security detection result of the security detection function to be performed.
The apparatus according to claim 7, wherein the setting of the security detection environment based on the security detection request comprises:

Determining security detection environment configuration data based on an operating condition of the security detection function in the security detection request;

A security detection environment is set according to the security detection configuration data.
The apparatus according to claim 7 or 8, wherein said said security detection environment determines said to be safely detected by running a preset application corresponding to said security detection function in said security detection request Whether the function is safe, including:

In the security detection environment, running the preset application corresponding to the to-be-detected function, and performing an analog operation on the preset application;

Intercepting and acquiring the data request when the preset application sends a data request generated by any of the simulation operations to its corresponding target server;

Forwarding the data request to the security detection client, such that the security detection client sends the data request to the target server;

Receiving feedback data information of the target server returned by the security detection client in response to the data request;

Based on the returned feedback data information, it is determined whether the to-be-safe detection function is secure.
The apparatus of claim 9, wherein the intercepting and acquiring the data request operation comprises:

The data request sent by the preset application to its corresponding target server is intercepted by a hook function, and the data request is obtained.
The device according to claim 9, wherein the determining, based on the returned feedback data information, whether the security detection function is safe, comprises:

Determining whether the feedback data information is malicious data.
The device according to claim 9, wherein in the security detection environment, whether the to-be-safe detection function is determined by running a preset application corresponding to the security detection function in the security detection request Safe operation also includes:

Intercepting a preset application programming interface accessed by the preset application and acquiring interception data information;

Determining whether the intercepted data information is malicious data.
A system for security detection, including a security detection platform and a security detection client;

The security detection platform is configured to set a security detection environment based on the security detection request when a security detection request is detected;

In the security detection environment, determining whether the to-be-checked application is safe by running a preset application corresponding to the to-be-detected function in the security detection request;

Send the judgment result to the security detection client;

The security detection client is configured to receive the determination result sent by the security detection platform, and notify the user of the security detection result of the security detection function.
The system of claim 13 wherein said security detection platform comprises an operating system platform and a forwarding platform;

The operating system platform is configured to run, in the security detection environment, the preset application corresponding to the to-be-detected function, and perform an analog operation on the preset application;

And when the preset application sends a data request generated by any simulation operation to its corresponding target server, intercepting and acquiring the data request; and sending the data request to the forwarding platform;

Determining whether the to-be-safety detection function is safe based on the feedback data information returned by the forwarding platform;

The forwarding platform is configured to receive the data request sent by the operating system platform, and forward the data request to the security detection client, so that the security detection client sends the data request to The target server;

Receiving feedback data information of the target server returned by the security detection client in response to the data request; and transmitting the feedback data information to the operating system platform.
The system of claim 14 wherein said forwarding platform comprises a VPN client and a VPN server;

The VPN client is configured to receive the data request sent by the operating system platform; and send the data request to the VPN server; and receive feedback of a target server returned by the VPN server in response to a data request Data information; and transmitting feedback data information to the operating system platform;

The VPN server is configured to receive the data request sent by the VPN client, and send the data request to the security detection client; and receive, by the security detection client, a target server that responds to the data The requested feedback data information; and the feedback data information is sent to the VPN client.
The system of claim 13 wherein said system further comprises an auxiliary platform;

The auxiliary platform is configured to determine security detection environment configuration data based on an operating condition of the security detection function in the security detection request, and set a security detection environment according to the security detection configuration data.
A server for security detection, comprising a memory, a processor, and a computer program stored on the processor and running on the processor; wherein the processor implements the computer program when implementing the claim 1 The method of security detection according to any of the preceding claims.
A computer program comprising computer readable code, when the server runs the computer readable code, causing the method of any of claims 1-6 to be performed.
A computer readable medium storing the computer program of claim 18.