WO2022247226A1

WO2022247226A1 - Applet monitoring method and device

Info

Publication number: WO2022247226A1
Application number: PCT/CN2021/137053
Authority: WO
Inventors: 徐浩冬
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2021-05-28
Filing date: 2021-12-10
Publication date: 2022-12-01
Also published as: CN113326506A

Abstract

The present invention relates to the technical field of data processing in financial technology (Fintech), and in particular to an applet monitoring method and device, for use in improving data security monitoring efficiency and ensuring data security. The method in embodiments of the present invention comprises: in response to a monitoring operation for primarily selected applets, obtaining application identifiers of N primarily selected applets, wherein N is a positive integer; according to the application identifiers, querying change records of the N primarily selected applets; on the basis of the change records, determining from the N primarily selected applets a target applet whose information has changed; obtaining a source code of the target applet, and performing a security scan on the target applet on the basis of the source code; and determining a security level of the target applet according to the result of the security scan.

Description

A small program monitoring method and device

Cross References to Related Applications

This application claims the priority of the Chinese patent application with the application number 202110589518.3 and the application name "A Small Program Monitoring Method and Device" submitted to the China Patent Office on May 28, 2021, the entire contents of which are incorporated in this application by reference middle.

technical field

The invention relates to the technical field of data processing in financial technology (Fintech), in particular to a small program monitoring method and device.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology (Finteh). However, due to the security and real-time requirements of the financial industry, higher requirements are placed on technology requirements.

A small program is an application that can be used without downloading and installing. Users can scan or search to open the application without worrying about whether to install too many applications. For developers, the development threshold of small programs is relatively low, and the difficulty is lower than that of APP (Application, Application). For users, it can save time cost and mobile phone memory space; for developers, it can also save development and promotion costs.

When conducting security risk assessment and testing for small programs, the existing technical solutions mainly use the R&D process control and internal asset management system to interface with the receiving set, while security testing requires manual intervention for testing. The entire solution involves multiple related systems and requires a large number of Manual intervention, poor timeliness, unable to discover small program security risks in real time, and cannot meet existing security needs.

Contents of the invention

The present application provides a small program monitoring method and device to improve the efficiency of data security monitoring and ensure data security.

A small program monitoring method provided by an embodiment of the present invention, the method includes:

Responding to the monitoring operation for the primary selection applet, obtain the application identifiers of the N primary selection applets, where N is a positive integer;

According to the application identification, query the change records of the N primary selection applets;

Based on the change record, determine a target applet with information changes from the N primary selection applets;

Acquire the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.

In an optional embodiment, after acquiring the application identifiers of the N primary-selected applets, before querying the change records of the N primary-selected applets according to the application identifiers, the method further includes:

For any primary selection applet, judge whether the primary selection applet is in the whitelist according to the application identifier of the primary selection applet;

If so, execute the step of querying the change record of the primary selection applet according to the application identifier;

If not, end the data monitoring of the primary selection applet.

In an optional embodiment, the querying the change records of the N primary applets according to the application identification includes:

For any primary selection applet, according to the application identifier of the primary selection applet, send a record acquisition request to the server of the primary selection applet;

A record acquisition response fed back by the server is received, and the record acquisition response includes the change record of the primary selected applet.

In an optional embodiment, the sending a record acquisition request to the server of the primary selection applet according to the application identifier of the primary selection applet includes:

A simulator is used to establish a session with the server of the primary selection applet according to the application identifier of the primary selection applet, and the simulator is used to send data packets to the server of the primary selection applet according to a set frequency to maintain said session;

Based on the session, a record acquisition request is sent to the server of the primary selection applet.

In an optional embodiment, the acquiring the source code of the target applet includes:

sending an access request to the server of the target applet by using a simulator;

receiving an access response fed back by the server of the target applet, where the access response includes the source code of the target applet;

The source code of the target applet is saved.

In an optional embodiment, the performing a security scan on the target applet based on the source code to generate a security scan result includes:

Decompiling the source code of the target applet;

Perform a security scan on the decompiled source code and generate a security scan result.

In an optional embodiment, performing a security scan on the decompiled source code to generate a security scan result includes:

Get the security scan script;

Using the security scanning script to scan the decompiled source code to determine whether there is sensitive information matching preset rules in the decompiled source code;

If there is sensitive information matching preset rules in the decompiled source code, it is determined that the security scan result indicates that there is a security hole in the source code.

In an optional embodiment, after determining the target applet with information change from the N primary applets based on the change record, the method further includes:

A change alarm is issued for the target applet;

The results of the generated security scan include:

If the result of the security scan is that there is a security hole in the source code, then determine that the target applet has a low security level;

According to the low security level of the target applet, a security alarm is issued.

An embodiment of the present invention also provides a small program monitoring device, including:

A response unit, configured to respond to the monitoring operation for the primary selection applet, and obtain the application identifiers of the N primary selection applets, where N is a positive integer;

A query unit, configured to query the change records of the N primary-selected applets according to the application identifier;

A change unit, configured to determine, from the N primary selected applets, a target applet with information change based on the change record;

The scanning unit is configured to obtain the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.

In an optional embodiment, a primary selection unit is also included for:

If not, end the data monitoring of the primary selection applet.

In an optional embodiment, the query unit is specifically used for:

In an optional embodiment, the scanning unit is specifically used for:

Receive the access response fed back by the server of the target applet, where the access response includes the source code of the target applet;

The source code of the target applet is saved.

In an optional embodiment, the scanning unit is specifically used for:

Decompiling the source code of the target applet;

In an optional embodiment, the scanning unit is specifically used for:

Get the security scan script;

In an optional embodiment, an alarm unit is also included for:

A change alarm is issued for the target applet;

The embodiment of the present invention also provides an electronic device, including:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions are executed by the at least one processor to enable the at least one processor to perform the method as described above.

An embodiment of the present invention also provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the method as described above.

An embodiment of the present invention provides a small program monitoring method, which is applied to a terminal device. The user inputs a monitoring operation on the display interface of the terminal, and the terminal acquires the application identifiers of the N primary-selected applets in response to the monitoring operation on the primary-selected applets. According to the application identification, the terminal queries the change records of the N primary applets, and based on the change records, determines the primary applet with information change from the N primary applets as the target applet. The terminal obtains the source code of the target applet, and performs a security scan on the target applet based on the source code, and generates a security scanning result, thereby realizing security monitoring of the target applet. The embodiment of the present invention only needs the user to input the monitoring operation to realize real-time monitoring of the change record of the primary selection applet and perform security scanning, so that security problems can be effectively found in real time and security alarms can be issued in time, thereby improving the efficiency of data security risk monitoring Efficiency and effective protection of data security.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic structural diagram of a possible system architecture provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of a small program monitoring method provided by an embodiment of the present invention;

Fig. 3 is a schematic flow chart of the preliminary screening of small programs provided by the embodiment of the present invention;

Fig. 4 is a schematic diagram of the process of mini program change monitoring provided by the embodiment of the present invention;

Fig. 5 is a schematic diagram of the interface of the applet change alarm provided by the embodiment of the present invention;

Fig. 6 is a schematic structural diagram of a small program monitoring device provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments . Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Referring to FIG. 1 , it is a schematic diagram of an application architecture of a method for processing operation rights in an embodiment of the present invention. The system architecture includes a terminal device 100 and a server 200 .

The terminal device 100 may be a mobile device or a fixed electronic device. For example, mobile phones, tablet computers, notebook computers, desktop computers, various wearable devices, smart TVs, vehicle-mounted devices, or other electronic devices that can achieve the above functions. Various software and applets can be installed in the terminal device 100, which can receive and process user monitoring operations, and perform security monitoring on the applets based on the monitoring operations.

The terminal device 100 and the server 200 may be connected through the Internet to realize mutual communication. Optionally, the aforementioned Internet uses standard communication technologies and/or protocols. The Internet is usually the Internet, but can be any network, including but not limited to Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired or wireless Any combination of network, private network, or virtual private network. In some embodiments, data exchanged over a network is represented using technologies and/or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), and the like. In addition, you can also use methods such as Secure Socket Layer (Secure Socket Layer, SSL), Transport Layer Security (Transport Layer Security, TLS), Virtual Private Network (Virtual Private Network, VPN), Internet Protocol Security (Internet Protocol Security, IPsec) and other conventional encryption techniques to encrypt all or some links. In some other embodiments, customized and/or dedicated data communication technologies may also be used to replace or supplement the above data communication technologies.

The server 200 can provide various network services for the terminal device 100, and the server 200 can use cloud computing technology to process information. Wherein, the server 200 can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal and the server may be connected directly or indirectly through wired or wireless communication, which is not limited in this application.

Specifically, the terminal device 100 may include a processor (Center Processing Unit, CPU) 110, a memory 120, an input device 130, an output device 140, etc., the input device 130 may include a keyboard, a mouse, a touch screen, etc., and the output device 140 may include a display device , such as liquid crystal display (Liquid Crystal Display, LCD), cathode ray tube (Cathode Ray Tube, CRT) and so on.

The memory 120 may include Read Only Memory (ROM) and Random Access Memory (RAM), and provides program instructions and data stored in the memory 120 to the processor 110 . In the embodiment of the present invention, the memory 120 may be used to store the program of the applet monitoring method in the embodiment of the present invention.

The processor 110 invokes the program instructions stored in the memory 120, and the processor 110 is configured to execute the steps of any applet monitoring method in the embodiments of the present invention according to the obtained program instructions.

Based on the above architecture, embodiments of the present invention provide a method for monitoring applets, which can be used to monitor applets in a terminal device. The following content is described by taking applets as objects of monitoring as an example. As shown in Figure 2, when the applet monitoring method provided by the embodiment of the present invention is applied to a terminal device, the method includes the following steps:

Step 201 , the terminal acquires the application identifiers of N primary selected applets in response to the monitoring operation on the primary selected applets, where N is a positive integer.

During the specific implementation process, the user performs a monitoring operation on the interface displayed on the terminal. The monitoring operation may be clicking, for example, clicking on the icon of the applet to be monitored; it may also be that the user enters the name of the applet in the input box to search. Here, the number of applets corresponding to the monitoring operation is not limited, and may be one or multiple. For example, if you input "security monitoring" to search, the terminal determines the applets whose names contain "security monitoring", including: security monitoring applet A, security monitoring applet B, security monitoring applet C, and so on.

Step 202: Query the change records of the N primary-selected applets according to the application identification.

During the specific implementation process, when the information of the applet is changed, the changed information will be recorded. The change of the applet here includes version change, name change, etc. In addition to recording the changed information, the change record can also record the time of change and the name of the changed applet.

The application identifier in the embodiment of the present invention may be unique, that is, any two different applets have different application identifiers, for example, the APPID of the applet is used as the application identifier.

The application identification can also be non-unique, that is, different applets have the same application identification, for example, "security monitoring" is used as the application identification above, and part of the information in the name of the applet is used as the application identification. In this case, when querying the change record of the applet, it is also necessary to extract the unique identifier of the applet based on the application identifier, such as APPID, URL (Uniform Resource Locator, Uniform Resource Locator), etc., so as to distinguish different Small program for easy follow-up monitoring. After that, based on the unique identifier of the applet, the change records of N applets can be queried respectively.

Step 203 , based on the change record, determine a target applet with information change from the N preliminary selected applets.

During the specific implementation process, the information of the applet may be recorded in the database. Compare the queried change record with the applet information recorded in the database. If the two are inconsistent, it indicates that the information of the applet has changed. Set the applet as the target applet, and update the applet information in the database according to the change information. information.

Step 204: Obtain the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.

An embodiment of the present invention provides a small program monitoring method, which is applied to a terminal device. The user inputs a monitoring operation on the display interface of the terminal, and the terminal acquires the application identifiers of the N primary-selected applets in response to the monitoring operation on the primary-selected applets. According to the application identification, the terminal queries the change records of the N primary applets, and based on the change records, determines the primary applet with information change from the N primary applets as the target applet. The terminal obtains the source code of the target applet, and performs a security scan on the target applet based on the source code. According to the security scanning result, the terminal determines the security level of the target applet, so as to realize the security monitoring of the target applet. The embodiment of the present invention only needs the user to input the monitoring operation to realize real-time monitoring of the change record of the primary selection applet and perform security scanning, so that security problems can be effectively found in real time and security alarms can be issued in time, thereby improving the efficiency of data security risk monitoring Efficiency and effective protection of data security.

Further, after acquiring the application identifiers of the N primary-selected applets, before querying the change records of the N primary-selected applets according to the application identifiers, the method further includes:

If not, end the data monitoring of the primary selection applet.

In the specific implementation process, in order to select the applets that can be monitored, the white list is used to screen the primary applets. The whitelist here can be saved in the terminal, and when a preliminary screening is required, the whitelist can be obtained directly from the terminal for comparison. The white list can also be saved in the server, and when a preliminary screening is required, the terminal obtains the white list from the server.

The specific criteria for the primary screening are not limited. In the embodiment of the present invention, developers are used to screen the applets. Fig. 3 shows a schematic flow chart of preliminary screening of applets. As shown in Figure 3, obtain the developer name of the applet and compare it with the developer name in the white list. If it is determined that the developer name of the applet is in the white list, then perform subsequent monitoring steps, including obtaining the applet Fields such as APPID, name, and URL are stored in the database mysql to facilitate subsequent change monitoring of the applet.

If the developer of the applet is not in the white list, the monitoring of the applet will be ended directly.

Since the number of primary selection applets is not limited in the embodiment of the present invention, it is necessary to perform a whitelist comparison for each primary selection applet to determine subsequent operations for the primary selection applet.

Further, the querying the change records of the N primary selected applets according to the application identification includes:

During the specific implementation process, for the above-mentioned applets that have been determined to be in the white list, they are monitored for changes. The change record needs to be obtained from the server corresponding to the applet. Specifically, based on the APPID of the applet, the official interface of the applet can be invoked, and a record acquisition request can be sent to the server of the applet to query the relevant information of the applet.

Further, the sending a record acquisition request to the server of the primary selection applet according to the application identifier of the primary selection applet includes:

A simulator is used to establish a session with the server of the primary selection applet according to the application identifier of the primary selection applet, and the simulator is used to send data packets to the server of the primary selection applet according to a set frequency to keep the session;

Specifically, the session identifier X-WECHAT-KEY and user identifier X-WECHAT-UIN are used in the query of the applet change record. The session between the terminal and the server of the applet is established based on X-WECHAT-UIN, that is, the user needs to log in to establish a session. A session corresponds to a unique X-WECHAT-KEY. Since X-WECHAT-KEY is the session KEY when querying the applet, it has a valid period of 2 hours. In order to ensure that the session can remain valid for a long time, the simulator is used on the terminal to simulate clicking on the applet, that is, clicking on the applet at regular intervals. Send a data packet to the server corresponding to the applet to trigger the generation of a new X-WECHAT-KEY to keep the session alive.

Fig. 4 shows a schematic diagram of the process of performing change monitoring on applets. As shown in Figure 4, through the session, compare the queried records such as the change time of the applet and the name of the applet with the information in the database mysql. If the newly queried record is inconsistent with the information in the database, the new query The received records are updated to the information corresponding to the database applet and recorded in the change table.

Further, after performing change query on all the primary-selected applets, a change alarm can be issued to the changed applet, that is, based on the change record, it is determined from the N primary-selected applets that there is an information change target After the applet, it also includes:

A change alarm is issued for the target applet.

For example, the Mini Program whose information has been changed and the relevant information about the Mini Program change are displayed to the user through the interface or email. Fig. 5 shows a schematic diagram of the interface of the applet change alarm. As shown in FIG. 5 , the change information of one applet whose information has been changed may be displayed to the user, or the change information of multiple applets whose information has been changed within a period of time may be displayed.

Further, the acquiring the source code of the target applet includes:

The source code of the target applet is saved.

In the specific implementation process, the source code search of the target applet is carried out in the simulator. Specifically, the simulator accesses the corresponding applet according to the name of the applet. After accessing the applet for the first time, the compressed source code package of the applet will be downloaded and stored in the local directory of the emulator. After the information of the subsequent applet changes, its source code will also change, so access the server of the applet through the simulator again, obtain the updated source code of the applet and save it.

Further, the performing a security scan on the target applet based on the source code to generate a security scan result includes:

Decompiling the source code of the target applet;

Specifically, after obtaining the source code of the applet from the simulator, the source code is decompiled, thereby turning the source code into an intuitive and readable code. Then perform a security scan on the decompiled source code. Since there may be sensitive information in the source code, including key AppSecret, account password, URL, and personal information, based on the scanning of sensitive information, the obtained URL can be scanned for security vulnerabilities such as unauthorized access.

Further, performing security scanning on the decompiled source code to generate security scanning results, including:

Get the security scan script;

During the specific implementation process, the security scanning script can be a developed open source tool, or a self-written scanning script. For example, you can call the bulk-extractor open source tool to scan whether the source code includes information such as email addresses, credit card numbers, and URLs. Since the decompiled source code exists in a certain directory, you can use the bulk-extractor open source tool to scan regularly by "executing bulk_extractor-R filedir-traversing files in the directory-o outdir-specifying the output directory" by text matching Determine whether there are sensitive information such as email addresses, credit card numbers, and URLs in the source code.

On the other hand, for sensitive information such as key AppSecret and mobile phone number that cannot be covered by bulk-extractor, scan scripts are written to scan, and identify whether there is sensitive information in the source code that matches the preset rules through regular matching. For example, the preset rules for mobile phone numbers can be set as follows: iphones=

re.findall(r'[%"\'<](?:13[012]\d{8}[%"\'<]|15[56]\d{8}[%"\'<]| 18[56]\d{8}[%"\'<]|176\d{8}[%"\'<]|145\d{8}[%"\'<]|13[456789]\ d{8}[%"\'<]|147\d{8}[%"\'<]|178\d{8}[%"\'<]|15[012789]\d{8}[ %"\'<]|18[23478]\d{8}[%"\'<]|133\d{8}[%"\'<]|153\d{8}[%"\'< ]|189\d{8}[%"\'<])',string).

That is, if the source code matches the above preset rules, it is considered that there is sensitive information of the mobile phone number in the source code.

Further, the result of generating the security scan includes:

During the specific implementation process, if a security loophole is found in the source code, it is determined that the corresponding applet has a low security level, and a security warning needs to be issued. The warning methods include email, text message, interface display, etc. If there are no security vulnerabilities in the source code, then confirm that the corresponding applet has a high security level and continue with data monitoring.

The embodiment of the present invention also provides a small program monitoring device, as shown in Figure 6, including:

The response unit 601 is configured to respond to the monitoring operation on the primary selection applet, and obtain the application identifiers of the N primary selection applets, where N is a positive integer;

A query unit 602, configured to query the change records of the N primary selected applets according to the application identifier;

A change unit 603, configured to determine, from the N primary selected applets, a target applet with information change based on the change record;

The scanning unit 604 is configured to obtain the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.

In an optional embodiment, a primary selection unit 605 is also included, configured to:

If not, end the data monitoring of the primary selection applet.

In an optional embodiment, the query unit 602 is specifically used for:

In an optional embodiment, the query unit 602 is specifically configured to:

In an optional embodiment, the scanning unit 604 is specifically configured to:

The source code of the target applet is saved.

In an optional embodiment, the scanning unit 604 is specifically configured to:

Decompiling the source code of the target applet;

In an optional embodiment, the scanning unit is specifically used for:

Get the security scan script;

In an optional embodiment, an alarm unit 606 is also included, configured to:

A change alarm is issued for the target applet;

Based on the same principle, the present invention also provides an electronic device, as shown in Figure 7, comprising:

Including a processor 701, a memory 702, a transceiver 703, and a bus interface 704, wherein the processor 701, the memory 702, and the transceiver 703 are connected through the bus interface 704;

The processor 701 is configured to read the program in the memory 702, and execute the following method:

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable applet monitoring device to produce a machine such that instructions executed by the processor of the computer or other programmable applet monitoring device Produce means for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable applet monitoring device to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the The instruction means implements the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable applet monitoring device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process for execution on the computer or other programmable device The instructions provide steps for implementing the functions specified in the procedure or procedures of the flowchart and/or the block or blocks of the block diagram.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims

A small program monitoring method, characterized in that the method comprises:

Responding to the monitoring operation for the primary selection applet, obtain the application identifiers of the N primary selection applets, where N is a positive integer;

According to the application identification, query the change records of the N primary selection applets;

Based on the change record, determine a target applet with information changes from the N primary selection applets;

Acquire the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.
The method according to claim 1, characterized in that, after acquiring the application identifiers of the N primary-selected applets, before querying the change records of the N primary-selected applets according to the application identifiers, further include:

For any primary selection applet, judge whether the primary selection applet is in the whitelist according to the application identifier of the primary selection applet;

If so, execute the step of querying the change record of the primary selection applet according to the application identifier;

If not, end the data monitoring of the primary selection applet.
The method according to claim 1, wherein the querying the change records of the N primary applets according to the application identification includes:

For any primary selection applet, according to the application identifier of the primary selection applet, send a record acquisition request to the server of the primary selection applet;

A record acquisition response fed back by the server is received, and the record acquisition response includes the change record of the primary selected applet.
The method according to claim 3, wherein the sending a record acquisition request to the server of the primary selection applet according to the application identifier of the primary selection applet includes:

A simulator is used to establish a session with the server of the primary selection applet according to the application identifier of the primary selection applet, and the simulator is used to send data packets to the server of the primary selection applet according to a set frequency to maintain said session;

Based on the session, a record acquisition request is sent to the server of the primary selection applet.
The method according to claim 1, wherein said acquiring the source code of said target applet comprises:

sending an access request to the server of the target applet by using a simulator;

receiving an access response fed back by the server of the target applet, where the access response includes the source code of the target applet;

The source code of the target applet is saved.
The method according to claim 5, wherein the performing a security scan on the target applet based on the source code to generate a security scan result comprises:

Decompiling the source code of the target applet;

Perform a security scan on the decompiled source code and generate a security scan result.
The method according to claim 6, wherein said performing a security scan on the decompiled source code to generate a security scan result comprises:

Get the security scan script;

Using the security scanning script to scan the decompiled source code to determine whether there is sensitive information matching preset rules in the decompiled source code;

If there is sensitive information matching preset rules in the decompiled source code, it is determined that the security scan result indicates that there is a security hole in the source code.
The method according to any one of claims 1 to 7, characterized in that, after determining the target applet with information change from the N primary applets based on the change record, further comprising:

A change alarm is issued for the target applet;

The results of the generated security scan include:

If the result of the security scan is that there is a security hole in the source code, then determine that the target applet has a low security level;

According to the low security level of the target applet, a security alarm is issued.
A small program monitoring device, characterized in that the device includes:

A response unit, configured to respond to the monitoring operation for the primary selection applet, and obtain the application identifiers of the N primary selection applets, where N is a positive integer;

A query unit, configured to query the change records of the N primary-selected applets according to the application identifier;

A change unit, configured to determine, from the N primary selected applets, a target applet with information change based on the change record;

The scanning unit is configured to obtain the source code of the target applet, and perform a security scan on the target applet based on the source code to generate a security scan result.
A non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to make the computer perform the method described in any one of claims 1-8 .