CN102572123B - Method for monitoring call record uploading of eavesdropping software X undercover - Google Patents

Method for monitoring call record uploading of eavesdropping software X undercover Download PDF

Info

Publication number
CN102572123B
CN102572123B CN201110431256.4A CN201110431256A CN102572123B CN 102572123 B CN102572123 B CN 102572123B CN 201110431256 A CN201110431256 A CN 201110431256A CN 102572123 B CN102572123 B CN 102572123B
Authority
CN
China
Prior art keywords
application program
data traffic
program
monitoring
hook
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201110431256.4A
Other languages
Chinese (zh)
Other versions
CN102572123A (en
Inventor
虞忠辉
董琳
包亮
闵波
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
CHENGDU 30RUITONG MOBILE COMMUNICATION Co Ltd
Original Assignee
CHENGDU 30RUITONG MOBILE COMMUNICATION Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by CHENGDU 30RUITONG MOBILE COMMUNICATION Co Ltd filed Critical CHENGDU 30RUITONG MOBILE COMMUNICATION Co Ltd
Priority to CN201110431256.4A priority Critical patent/CN102572123B/en
Publication of CN102572123A publication Critical patent/CN102572123A/en
Application granted granted Critical
Publication of CN102572123B publication Critical patent/CN102572123B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

The invention belongs to the field of mobile phone security, and discloses a method for monitoring the call record uploading of eavesdropping software X undercover. The method specifically comprises the following steps of: registering a static broadcast receiver for receiving a call end on-hook message, starting Service monitoring and recording the data traffic of each application program after call end on-hook, judging whether the data traffic of each application program is increased after the call end on-hook or not to further judge whether any application program uploading call records is executed or not, judging whether the executed application program has a user interaction interface or not to further judge whether the executed application program is a pure background program, and if the program is the pure background program and the data traffic of the application program is increased after the call end on-hook, determining that the program is a malicious program, and starting an alarming interface. By the method, whether the application program exists or not can be directly judged, and the application program can be quickly locked.

Description

A kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded
Technical field
The present invention relates to mobile phone and prevent Eavesdropping field, relate in particular to a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.
Background technology
Along with increasing substantially of smart mobile phone popularity rate, smart mobile phone is when bringing convenience to us, and its safe and secret problem also highlights day by day, if smart mobile phone is mounted eavesdropping software, can carry out ambience listening to monitored mobile phone.The wiretapping type software relatively spreading unchecked is at present as " X planted agent " software, once implanted user mobile phone,
During user's communication, dialog context can be recorded, after end of conversation, calling record file goes be uploaded in the appointment mailbox that monitoring side arranges in advance.Can realize the whole process of this subscriber phone information is monitored.
Calling record for above-mentioned X planted agent wiretapping type software is uploaded behavior, is necessary to study a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.
Summary of the invention
Calling record for above-mentioned X planted agent wiretapping type software is uploaded behavior, the invention discloses a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded.Be used on smart mobile phone, can effectively prevent that similar calling record from uploading.Adopt receiving system telephone-broadcast mode, detect call on-hook message, detect after on-hook flow in certain hour simultaneously and upload process list, and differentiate whether there is backstage recording behavior etc. in conjunction with authority, differentiate and whether exist backstage grouping to send calling record behavior, prompt alarm after finding.
Object of the present invention realizes by following technical proposals:
A kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded, it specifically comprises following steps: register static radio receiver, be used for receiving end of conversation on-hook message, after end of conversation on-hook, start the data traffic that Service monitored and distinguished records application program, according to the data traffic of application program, after end of conversation on-hook, whether increase to judge whether to exist the application program that calling record is uploaded carrying out, according to this application program of carrying out, whether there is user to hand over interface, family to determine whether pure background program simultaneously, if this program be pure background program and after end of conversation on-hook the data traffic of this application program increase, judge that this program starts warning interface as dangerous program.
Preferably, the application program that described startup Service monitors and records is respectively the application program that has access to netwoks and recording privilege feature.
Preferably, described startup Service monitoring and respectively the data traffic of records application program be the application program data traffic of this day.
Preferably, describedly judge that this program starts warning interface as dangerous program and specifically comprises: after encapsulating this danger program related information, start warning interface, and transmit packaging information to this interface of reporting to the police.
Preferably, described method adds mode of vibration by jingle bell immediately and reports to the police, and the program packaging information passing over is shown by list after also comprising that warning interface starts, and for user, checks.
Preferably, described after end of conversation on-hook, start Service monitoring and respectively the data traffic of records application program in 3 seconds after call words finish on-hook, start the data traffic that Service monitored and distinguished records application program.
Preferably, describedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of the monitoring in time application program after the data traffic of records application program in 50 seconds, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Preferably, describedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of monitoring and measuring application program after the data traffic of records application program and within the interval time of this call and call next time, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Beneficial effect of the present invention: be that carry out on pure backstage according to whether there is application program after end of conversation, and whether the data traffic of this backstage working procedure increases directly judges whether to exist X planted agent wiretapping type software calling record to upload, because if upload calling record, data traffic is inevitable obviously increases, by above-mentioned method, just can directly judge whether to exist this application program this application program of quick lock in, according to application program, whether exist user to hand over interface, family to determine whether pure background program again simultaneously, if application program exists user to hand over interface, family, it is not pure background program, otherwise be pure background program, the application program of non-pure background program is excluded, do not affect the normal application program of using of user.
Accompanying drawing explanation
The method flow diagram that accompanying drawing 1 is uploaded for monitoring X planted agent wiretapping type software calling record of the present invention.
Embodiment
The method flow diagram that monitoring X planted agent wiretapping type software calling record of the present invention is uploaded as shown in Figure 1.The invention discloses a kind of method that the X of monitoring planted agent wiretapping type software calling record is uploaded, it specifically comprises following steps: register static radio receiver, be used for receiving end of conversation on-hook message, after end of conversation on-hook, start the data traffic that Service monitored and distinguished records application program, according to the data traffic of application program, after end of conversation on-hook, whether increase to judge whether to exist the application program that calling record is uploaded carrying out, according to this application program of carrying out, whether there is user to hand over interface, family to determine whether pure background program simultaneously, if this program be pure background program and after end of conversation on-hook the data traffic of this application program increase, judge that this program starts warning interface as dangerous program.The method that above-mentioned monitoring calling record is uploaded is mainly receiving system telephone-broadcast mode, on-hook message detection, flow and uploads process judgement, the judgement of process authority, get all flows of this time period the process list of uploading and the size of uploading flow, and produced in the process that flow uploads and realized permission match at these, searching possesses the process of eavesdropping software authority feature, once find to report to the police immediately.According to whether there is application program after end of conversation, be that carry out on pure backstage, and whether the data traffic of this backstage working procedure increases directly judges whether to exist X planted agent wiretapping type software calling record to upload, because if upload calling record, data traffic is inevitable obviously increases, by above-mentioned method, just can directly judge whether to exist this application program this application program of quick lock in, according to application program, whether exist user to hand over interface, family to determine whether pure background program again simultaneously, if application program exists user to hand over interface, family, it is not pure background program, otherwise be pure background program, the application program of non-pure background program is excluded, do not affect the normal application program of using of user.
Preferably, the application program that above-mentioned startup Service monitors and records is respectively the application program that has access to netwoks and recording privilege feature.Because only possess the application program of above-mentioned access to netwoks and recording privilege feature, just may realize the calling record intercepting is uploaded, the range of applications of monitoring and record is dwindled, improve the efficiency of this method.
Preferably, above-mentioned startup Service monitoring and respectively the data traffic of records application program be the application program data traffic of this day.The data traffic numeral of minute book day is relatively little, is convenient to record and compares.
Preferably, above-mentionedly judge that this program starts warning interface as dangerous program and specifically comprises: after encapsulating this danger program related information, start warning interface, and transmit packaging information to this interface of reporting to the police.Quick lock in application program is also presented on warning interface, is convenient to user and processes in time this danger program.
Preferably, said method adds mode of vibration by jingle bell immediately and reports to the police, and the program packaging information passing over is shown by list after also comprising that warning interface starts, and for user, checks.The very first time notifies user to process this dangerous program, guarantees user's information security.
Preferably, above-mentioned after end of conversation on-hook, start Service monitoring and respectively the data traffic of records application program in 3 seconds after call words finish on-hook, start the data traffic that Service monitored and distinguished records application program.The upload file of X planted agent wiretapping type software calling record, because file content is larger, is difficult for preserving mobile phone is local, so generally after user's on-hook, spread out of on immediately.In 3 seconds, start Service monitoring and respectively the data traffic of records application program and the data traffic in follow-up time section comparing, judge whether data traffic increases.
Preferably, above-mentionedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of the monitoring in time application program after the data traffic of records application program in 50 seconds, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Preferably, above-mentionedly judge whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of monitoring and measuring application program after the data traffic of records application program and within the interval time of this call and call next time, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
Given coefficient and parameter in the above embodiments; be to provide to those skilled in the art and realize or use of the present invention; the present invention does not limit and only gets aforementioned disclosed numerical value; without departing from the present invention in the case of the inventive idea; those skilled in the art can make various modifications or adjustment to above-described embodiment; thereby protection scope of the present invention do not limit by above-described embodiment, and it should be the maximum magnitude that meets the inventive features that claims mention.

Claims (8)

1. monitor the method that X planted agent wiretapping type software calling record is uploaded for one kind, it specifically comprises following steps: register static radio receiver, be used for receiving end of conversation on-hook message, after end of conversation on-hook, start the data traffic that Service monitored and distinguished records application program, according to the data traffic of application program, after end of conversation on-hook, whether increase to judge whether to exist the application program that calling record is uploaded carrying out, according to this application program of carrying out, whether there is user to hand over interface, family to determine whether pure background program simultaneously, if this program be pure background program and after end of conversation on-hook the data traffic of this application program increase, judge that this program starts warning interface as dangerous program, the method that above-mentioned monitoring calling record is uploaded is mainly receiving system telephone-broadcast mode, on-hook message detection, flow and uploads process judgement, the judgement of process authority, get all flows of this time period the process list of uploading and the size of uploading flow, and produced in the process that flow uploads and realized permission match at these, searching possesses the process of eavesdropping software authority feature, once find to report to the police immediately.
2. the method that monitoring X planted agent wiretapping type software calling record as claimed in claim 1 is uploaded, is characterized in that described startup Service monitoring the application program recording are respectively the application program that has access to netwoks and recording privilege feature.
3. the method that monitoring as claimed in claim 1 X planted agent wiretapping type software calling record is uploaded, it is characterized in that described startups Service monitors and respectively the data traffic of records application program be the application program data traffic of this day.
4. the method that monitoring X planted agent wiretapping type software calling record as claimed in claim 1 is uploaded, it is characterized in that describedly judging that this program starts warning interface as dangerous program and specifically comprises: after encapsulating this danger program related information, start warning interface, and transmit packaging information to this interface of reporting to the police.
5. the method that monitoring X planted agent wiretapping type software calling record as claimed in claim 4 is uploaded, after it is characterized in that described method also comprises that warning interface starts, by jingle bell, add mode of vibration immediately and report to the police, and the program packaging information passing over is shown by list, for user, check.
6. the method that the monitoring X as described in any one claim of claim 1-5 planted agent wiretapping type software calling record is uploaded, it is characterized in that described after end of conversation on-hook, start Service monitoring and respectively the data traffic of records application program in 3 seconds after call words finish on-hook, start the data traffic that Service monitored and distinguished records application program.
7. the method that the planted agent of the monitoring X as described in any one claim of claim 1-5 wiretapping type software calling record is uploaded, it is characterized in that describedly judging whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of the monitoring in time application program after the data traffic of records application program in 50 seconds, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
8. the method that the planted agent of the monitoring X as described in any one claim of claim 1-5 wiretapping type software calling record is uploaded, it is characterized in that describedly judging whether the data traffic of application program increases and be specially after end of conversation on-hook: the data traffic of monitoring and measuring application program after the data traffic of records application program and within the interval time of this call and call next time, and compare by the data traffic of the data traffic monitoring and record, whether its data traffic increases to judge whether the data traffic of application program increases.
CN201110431256.4A 2011-12-21 2011-12-21 Method for monitoring call record uploading of eavesdropping software X undercover Expired - Fee Related CN102572123B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201110431256.4A CN102572123B (en) 2011-12-21 2011-12-21 Method for monitoring call record uploading of eavesdropping software X undercover

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201110431256.4A CN102572123B (en) 2011-12-21 2011-12-21 Method for monitoring call record uploading of eavesdropping software X undercover

Publications (2)

Publication Number Publication Date
CN102572123A CN102572123A (en) 2012-07-11
CN102572123B true CN102572123B (en) 2014-10-22

Family

ID=46416562

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201110431256.4A Expired - Fee Related CN102572123B (en) 2011-12-21 2011-12-21 Method for monitoring call record uploading of eavesdropping software X undercover

Country Status (1)

Country Link
CN (1) CN102572123B (en)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101584166A (en) 2006-11-02 2009-11-18 迪吉福尼卡(国际)有限公司 Producing routing messages for voice over IP communications
MX2009005751A (en) 2006-11-29 2009-08-26 Digifonica Int Ltd Intercepting voice over ip communications and other data communications.
WO2008116296A1 (en) 2007-03-26 2008-10-02 Digifonica (International) Limited Emergency assistance calling for voice over ip communications systems
US8630234B2 (en) 2008-07-28 2014-01-14 Digifonica (International) Limited Mobile gateway
US8675566B2 (en) 2009-09-17 2014-03-18 Digifonica (International) Limited Uninterrupted transmission of internet protocol transmissions during endpoint changes
CN103416045A (en) 2012-09-20 2013-11-27 华为终端有限公司 Eavesdropping detection method and terminal apparatus
CN103118184B (en) * 2013-01-18 2015-01-14 浙江长天信息技术有限公司 Environment recording alarm method
CN105721492B (en) * 2016-03-25 2019-10-11 宇龙计算机通信科技(深圳)有限公司 A kind of method, apparatus and terminal of speech processes
CN106203098A (en) * 2016-07-14 2016-12-07 中国科学院信息工程研究所 Application layer eavesdropping means of defence and device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1414190A1 (en) * 2002-10-22 2004-04-28 Alcatel Method and system for informing a user about a WLAN accessibility
CN101584150A (en) * 2006-11-29 2009-11-18 迪吉福尼卡(国际)有限公司 Intercepting voice over IP communications and other data communications
CN102110220A (en) * 2011-02-14 2011-06-29 宇龙计算机通信科技(深圳)有限公司 Application program monitoring method and device

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1414190A1 (en) * 2002-10-22 2004-04-28 Alcatel Method and system for informing a user about a WLAN accessibility
CN101584150A (en) * 2006-11-29 2009-11-18 迪吉福尼卡(国际)有限公司 Intercepting voice over IP communications and other data communications
CN102110220A (en) * 2011-02-14 2011-06-29 宇龙计算机通信科技(深圳)有限公司 Application program monitoring method and device

Also Published As

Publication number Publication date
CN102572123A (en) 2012-07-11

Similar Documents

Publication Publication Date Title
CN102572123B (en) Method for monitoring call record uploading of eavesdropping software X undercover
JP5001380B2 (en) Apparatus and method for locating, tracking and / or recovering wireless communication devices
CN104135717B (en) A kind of calling for help and emergency method based on mobile phone
EP2728918B1 (en) Method for detecting interception behaviour and terminal device
US9544773B2 (en) System and method for enforcing communication policies
US20150213708A1 (en) Apparatus and methods for tracking in wireless communication systems in response to an activation event
US20090251318A1 (en) Anti-theft system of mobile device
CN101179802A (en) Communication equipment, network appliance and alarm method
WO2005065168A3 (en) Method for reporting personal status of a mobile communication device user and method therefor
CN101212747A (en) Method and device for implementing automatic alarm from mobile terminal
CA2526755A1 (en) Ip phone intruder security monitoring system
WO2011160328A1 (en) Method and device for monitoring communications
CN102546897B (en) Method for preventing X undercover interception software from environment monitoring
US20170324854A1 (en) A method for operating a communication system, and communication system
CN103680089B (en) Video monitoring police service linkage system
CN102186166A (en) Method for preventing environmental monitoring and environmental sound-recording based on Bluetooth technology
US20090111439A1 (en) System and method for monitoring a monitored mobile phone
CN102438263A (en) Wireless router with voice alarming function
CN101232677A (en) Method and apparatus for start-up logging of mobile terminal
CN103118184B (en) Environment recording alarm method
CN101332804B (en) Vehicle alarm system and method and system combination-controlled by Internet
CN103037337A (en) Method intercepting sent short message and device thereof
CN103260174B (en) Mobile terminal data flow method for real-time monitoring and system
CN101795326A (en) Cellphone anti-theft device and anti-theft method
CN104519491A (en) Alarm method and alarm device for mobile terminals

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20141022

Termination date: 20211221