CN109120482A

CN109120482A - Monitor the method and device that application program uses flow

Info

Publication number: CN109120482A
Application number: CN201811143339.1A
Authority: CN
Inventors: 王宝林
Original assignee: Beijing Xiaomi Mobile Software Co Ltd
Current assignee: Beijing Xiaomi Mobile Software Co Ltd
Priority date: 2018-09-28
Filing date: 2018-09-28
Publication date: 2019-01-01

Abstract

The disclosure provides a kind of method and device for monitoring application program and using flow, wherein, the described method includes: obtaining the network request of Microsoft Loopback Adapter forwarding, the network request is to be initiated by application program using shared user identifier ShareUserId mechanism, and the network request is sent to the Microsoft Loopback Adapter through physical network card by the application program；Target information is obtained according to the network request, the target information is used to indicate the application program and uses flow；Store the target information, since target information has the function of indicating that application program uses flow, therefore the flow service condition of application program and application program can be determined according to target information, realize the monitoring for using application program flow, which has many advantages, such as simple, easy.

Description

Monitor the method and device that application program uses flow

Technical field

This disclosure relates to computer communication technology field more particularly to it is a kind of monitoring application program using flow method and Device.

Background technique

In use, certain applications program understands exception request network to terminal after switching to running background from foreground, If uploaded or downloading the data needed for nonusable routine operates normally, flow is caused to escape, increases the usage amount of flow and make Use expense.

In the related technology, in android terminal each application program configure a UID (Unique Identifica tion, Unique identifier), developer can check the transmission of operating system nucleus storage after the operating system permission for obtaining terminal The UID of the application program of network request can count the flow use information of a corresponding application program according to a UID, And judge whether the application program escapes flow according to flow use information.Developer can be in discovery application program escaption stream When amount, modify to application program, the flow so that modified application program is no longer escaped.

However, multiple applications when Android system is using shared user identifier ShareUserId mechanism, in android terminal The same UID of program sharing causes developer that can not determine the flow service condition of each application program according to a UID, And then which application program escaption flow can not be determined.

Summary of the invention

In view of this, the disclosure provides a kind of method and device for monitoring application program and using flow, it can be in Android system When system is using shared user identifier ShareUserId mechanism, application program is determined by the target information of storage and using journey The flow service condition of sequence.

According to the first aspect of the embodiments of the present disclosure, a kind of method that monitoring application program uses flow is provided, it is described Method includes:

The network request of Microsoft Loopback Adapter forwarding is obtained, the network request is by application program using shared user identifier What ShareUserId mechanism was initiated, and the network request is sent to the virtual net through physical network card by the application program Card；

Target information is obtained according to the network request, the target information is used to indicate the application program and uses stream Amount；

Store the target information.

Optionally, the method also includes:

The network request is sent to the physical network card, so that the network request is sent to by the physical network card Transmission medium outside the terminal.

Optionally, the target information includes: the identity instruction information of the application program, described to be asked according to the network It includes any one of following for asking and obtaining the identity instruction information:

The interconnection of the corresponding server of the application program is extracted from the uniform resource position mark URL of the network request FidonetFido address/IP address；

Domain-name information is extracted from the URL of the network request.

Optionally, the target information includes: the identity instruction information and flow use information of the application program, in institute It states after obtaining target information according to the network request, the method also includes:

Indicate that information determines the identity of the application program according to the identity；

According to the flow use information, judge to have the application program of the identity whether to escape flow；

The flow if application program is escaped exports the alarm of the application program escaption flow.

Optionally, described to indicate that information determines that the identity of the application program includes: according to the identity

It indicates that information inquires default application information list according to the identity, obtains corresponding with identity instruction information Identity, the default application information list include: the corresponding relationship of default identity instruction information and default identity.

Optionally, described according to the flow use information, judge that the application program with the identity is No escaption flow includes at least one of the following:

Judge that the application program sends in preset duration in running background including the network request Whether the request number of times of network request is greater than preset times threshold value at least once, and the request number of times of the multiple network request is greater than When the preset times threshold value, the application program is judged as escaption flow；

Judge the application program sent in running background the occupied duration of the network request whether be greater than it is default Duration threshold value, when the occupied duration of network request is greater than the preset duration threshold value, the application program is judged as Escaption flow；

Judge the application program sent in running background the occupied flow value of the network request whether be greater than it is pre- If flow threshold, when the occupied flow value of network request is greater than the preset flow threshold value, the application program is judged to Surely it escapes flow.

According to the second aspect of an embodiment of the present disclosure, a kind of device for monitoring application program and using flow is provided, it is described Device includes:

First obtains module, is configured as obtaining the network request of Microsoft Loopback Adapter forwarding, the network request is by applying Program is initiated using shared user identifier ShareUserId mechanism, and the network request by the application program through physics Network interface card is sent to the Microsoft Loopback Adapter；

Second obtains module, is configured as obtaining target information according to the network request, the target information is for referring to Show that the application program uses flow；

Memory module is configured as storing the target information.

Optionally, described device further include:

Sending module is configured as the network request being sent to the physical network card so that the network request by The physical network card is sent to the transmission medium outside the terminal.

Optionally, the second acquisition module includes any one of following:

First extracting sub-module is configured as answering described in extraction from the uniform resource position mark URL of the network request With the Internet protocol address IP address of the corresponding server of program, the target information includes: the identity of the application program Indicate information；

Second extracting sub-module is configured as extracting domain-name information from the URL of the network request, the target information It include: the identity instruction information of the application program.

Optionally, described device further include:

Determining module is configured as after the acquisition target information according to the network request, according to the identity Indicate that information determines the identity of the application program, the target information includes: the identity instruction letter of the application program Breath and flow use information；

Judgment module is configured as judging the application with the identity according to the flow use information Whether program escapes flow；

Output module exports the application program escaption if being configured as the application program escaption flow

The alarm of flow.

Optionally, the determining module is configured as indicating that information inquires default application information list according to the identity, Identity corresponding with identity instruction information is obtained, the default application information list includes: default identity instruction letter The corresponding relationship of breath and default identity.

Optionally, the judgment module includes at least one of the following:

First judging submodule is configured as judging what the application program was sent in preset duration in running background Whether the request number of times of the network request at least once including the network request is greater than preset times threshold value, the multiple When the request number of times of network request is greater than the preset times threshold value, the application program is judged as escaption flow；

Second judgment submodule is configured as judging that the application program sends the network request institute in running background Whether the duration of occupancy is greater than preset duration threshold value, and the occupied duration of network request is greater than the preset duration threshold value When, the application program is judged as escaption flow；

Third judging submodule is configured as judging that the application program sends the network request institute in running background Whether the flow value of occupancy is greater than preset flow threshold value, and the occupied flow value of network request is greater than the preset flow threshold When value, the application program is determined escaption flow.

According to the third aspect of an embodiment of the present disclosure, a kind of non-transitorycomputer readable storage medium is provided, thereon It is stored with computer program, which realizes any one of above-mentioned first aspect the method when being executed by processor the step of.

According to a fourth aspect of embodiments of the present disclosure, a kind of device for monitoring application program and using flow is provided, comprising:

Processor；

Memory for storage processor executable instruction；

Wherein, the processor is configured to:

Store the target information.

The technical solution that the embodiment of the present disclosure provides can include the following benefits:

In the disclosure, application program initiates network request using ShareUserId mechanism, and network request is passed through by application program Physical network card is sent to Microsoft Loopback Adapter and is forwarded by Microsoft Loopback Adapter, and the disclosure obtains the network request of Microsoft Loopback Adapter forwarding, according to Network request obtains target information and stores target information, the work that due to target information there is instruction application program to use flow With, therefore the flow service condition of application program and application program can be determined according to target information, it realizes to application program Using the monitoring of flow, which has many advantages, such as simple, easy.

In the disclosure, information, body are indicated according to the identity that the target information that network request obtains may include application program Part instruction information can be the IP address or domain-name information of the corresponding server of application program in the URL of network request, Ke Yigen According to the IP address or domain-name information in URL, determine that the application program and the application program using flow, are realized to use Each application program that ShareUserId mechanism initiates network request uses the monitoring of flow.

It may include the identity instruction information and stream of application program according to the target information that network request obtains in the disclosure Use information is measured, indicates that information determines application program according to identity, whether the application program is judged according to flow use information Escaption flow realizes the judgement to application program escaption flow.Further, police is exported after determining application program escaption flow Report is conducive to the timely discovery and solution of application program escaption problems of liquid flow.

In the disclosure, after the network request for obtaining Microsoft Loopback Adapter forwarding, network request is sent to physical network card, so that Network request is sent to the transmission medium outside terminal by physical network card, realizes that application program is sent out network request.

It should be understood that above general description and following detailed description be only it is exemplary and explanatory, not The disclosure can be limited.

Detailed description of the invention

Fig. 1 is the method flow diagram that a kind of monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 2 is that a kind of monitoring application program shown according to an exemplary embodiment is illustrated using the application scenarios of flow Figure；

Fig. 3 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 4 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 5 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 6 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 7 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 8 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Fig. 9 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 10 is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 11 is the device block diagram that a kind of monitoring application program shown according to an exemplary embodiment uses flow；

Figure 12 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 13 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 14 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 15 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 16 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 17 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 18 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 19 is the device block diagram that another monitoring application program shown according to an exemplary embodiment uses flow；

Figure 20 is a kind of use the device of flow for monitoring application program one shown according to an exemplary embodiment Structural schematic diagram；

Figure 21 is another device that flow is used for monitoring application program shown according to an exemplary embodiment One structural schematic diagram.

Specific embodiment

Example embodiments are described in detail here, and the example is illustrated in the accompanying drawings.Following description is related to When attached drawing, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements.Following exemplary embodiment Described in embodiment do not represent all implementations consistent with this disclosure.On the contrary, they be only with it is such as appended The example of the consistent device and method of some aspects be described in detail in claims, the disclosure.

It is only to be not intended to be limiting the disclosure merely for for the purpose of describing particular embodiments in the term that the disclosure uses. The "an" of the singular used in disclosure and the accompanying claims book, " described " and "the" are also intended to including majority Form, unless the context clearly indicates other meaning.It is also understood that term "and/or" used herein refers to and wraps It may be combined containing one or more associated any or all of project listed.

It will be appreciated that though various information, but this may be described using term first, second, third, etc. in the disclosure A little information should not necessarily be limited by these terms.These terms are only used to for same type of information being distinguished from each other out.For example, not departing from In the case where disclosure range, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as One information.Depending on context, word as used in this " if " can be construed to " ... when " or " when ... When " or " in response to determination ".

As shown in Figure 1, Fig. 1 is that a kind of disclosure monitoring application program shown according to an exemplary embodiment uses flow Method flow diagram, can be applied in terminal, terminal can be smart phone, tablet computer, notebook, personal digital assistant, Wearable device etc., the described method comprises the following steps:

In a step 101, the network request of Microsoft Loopback Adapter forwarding is obtained, above-mentioned network request is by application program using altogether The initiation of user identifier ShareUserId mechanism is enjoyed, and above-mentioned network request is sent to virtually by application program through physical network card Network interface card.

Physical network card (also known as network adapter), installation are the interfaces for connecting terminal and transmission medium at the terminal.It is related In technology, the network request that application program is sent is sent to physical network card, and the biography of exterior of terminal is sent directly to by physical network card Defeated medium.

Microsoft Loopback Adapter (also known as Objunctive network adaptor) uses software analog network environment, analog network adapter.Virtually Network interface card is established using VPN (Virtual Private Network, Virtual Private Network) technology.The operating system of terminal can Carry this software.

The disclosure provides a kind of functional application, and the monitoring application program for executing disclosure offer uses flow Method.Functional application can be vpn application, and vpn application is carried out data transmission by VPN standard interface, function Can application program can also be the other applications carried out data transmission by other interfaces, the disclosure is herein with no restrictions.

Below by taking vpn application as an example, the monitoring application program that the disclosure provides is carried out in detail using the method for flow It is thin to introduce.It is emphasized that the application program referred in being described below is to initiate the program of network request, it is not this public affairs The functional application of offer is provided.

Fig. 2 is that a kind of monitoring application program shown according to an exemplary embodiment is illustrated using the application scenarios of flow Figure.Referring to Fig. 2, scene shown in Fig. 2 includes that application program, physical network card, Microsoft Loopback Adapter and the VPN of initiation network request are answered With program, the arrow direction in Fig. 2 is the direction of transfer for the network request that application program is initiated.

In the disclosure, operating system is built-in with Microsoft Loopback Adapter, after Microsoft Loopback Adapter is opened, under the control of an operating system in object Data transfer path is established between reason network interface card and Microsoft Loopback Adapter.After application program initiates network request, the transmission of network request Journey is as follows: network request is sent to physical network card by S1, application program；S2, physical network card are based on internal mechanism setting and are receiving The network request is not sent to directly the transmission medium of exterior of terminal after to network request, but the network request is sent to Microsoft Loopback Adapter；S3, Microsoft Loopback Adapter are used for transfer network request, and Microsoft Loopback Adapter is in the network request for receiving physical network card transmission Afterwards, received network request is transmitted to by vpn application by specified interface；S4, vpn application are asked receiving network Data processing is carried out after asking, application program is monitored using flow, and network request can be sent to physics by vpn application Network interface card, the transmission medium being sent to network request by physical network card outside terminal.

It in an alternative embodiment, is another monitoring application shown according to an exemplary embodiment referring to Fig. 3 Program uses the method flow diagram of flow, and the case where unlatching for Microsoft Loopback Adapter, vpn application is executing above-mentioned steps Before 101, step 104 can be executed: opening Microsoft Loopback Adapter, so that operating system, which detects, establishes Physical Network after Microsoft Loopback Adapter is opened Data transfer path between card and Microsoft Loopback Adapter, so that the network request that application program is sent is transmitted to virtually by physical network card Network request is transmitted to vpn application by network interface card, Microsoft Loopback Adapter.

There are many implementations for opening Microsoft Loopback Adapter, is shown according to an exemplary embodiment another for example, referring to Fig. 4 It is a kind of monitoring application program use flow method flow diagram, above-mentioned steps 104 may include: step 1041, receive user it is defeated The instruction of the unlatching Microsoft Loopback Adapter entered；Step 1042 opens Microsoft Loopback Adapter according to the instruction.

For above-mentioned steps 1041, the instruction for opening Microsoft Loopback Adapter can be what user was actively entered as needed, such as User triggers Microsoft Loopback Adapter by predetermined registration operation and is turned on, and predetermined registration operation can be clicks designated button, defeated in target interface Enter phonetic order etc.；The instruction for opening Microsoft Loopback Adapter is also possible to vpn application and is based on preset Microsoft Loopback Adapter trigger mechanism After whether output opens the inquiry message of Microsoft Loopback Adapter, user inputs according to inquiry message.

In the disclosure, above-mentioned Microsoft Loopback Adapter trigger mechanism can there are many, for example, Microsoft Loopback Adapter trigger mechanism can be Time mechanism exports inquiry message if the time locating for terminal meets the time conditions limited in time mechanism, after terminal booting Export inquiry message, predetermined time output inquiry message etc. of the terminal in certain day；Microsoft Loopback Adapter trigger mechanism is also possible to flow Employment mechanism is measured, if the flow value that terminal uses in preset duration is greater than or equal to the default stream limited in flow employment mechanism Threshold value is measured, shows that terminal, using more flow, exports inquiry message within the period immediately.

For above-mentioned steps 1042, vpn application is opened after receiving the instruction of unlatching Microsoft Loopback Adapter of user's input Open Microsoft Loopback Adapter, operating system monitors after Microsoft Loopback Adapter is turned on, and the data established between physical network card and Microsoft Loopback Adapter pass Defeated path.Vpn application opens the instruction of Microsoft Loopback Adapter in the negative for receiving user's input, is not turned on Microsoft Loopback Adapter.

It in an alternative embodiment, is another monitoring application shown according to an exemplary embodiment referring to Fig. 5 Program uses the method flow diagram of flow, and to prevent Microsoft Loopback Adapter to be turned on when user accidentally touches, above-mentioned steps 1041 can lead to It crosses following manner realization: step 1041-1, receiving the trigger action that user executes at the terminal；If step 1041-2, passing through behaviour Make to identify and determines that the trigger action for opening Microsoft Loopback Adapter, exports inquiry message, inquiry message is for asking the user whether out Open Microsoft Loopback Adapter, wherein inquiry message can be shown on the display screen of terminal in the form of picture and text, can be passed through with audio form Audio output device output etc.；Step 1041-3, the finger that user opens Microsoft Loopback Adapter according to the confirmation that inquiry message triggers is received It enables.

By the above method, after vpn application receives the trigger action that user executes at the terminal, to trigger action Operation identification is carried out, when trigger action is for exporting inquiry message, to consult whether user opens virtually when opening Microsoft Loopback Adapter Network interface card only just opens Microsoft Loopback Adapter after user confirms and opens Microsoft Loopback Adapter, so that Microsoft Loopback Adapter be effectively prevent to miss in user It is turned on when touching.

In a step 102, target information is obtained according to network request, target information is used to indicate application program and uses stream Amount.

In the embodiment of the present disclosure, after the network request for obtaining Microsoft Loopback Adapter forwarding, target letter is obtained according to network request Breath, target information have the function of indicating that application program using flow, can determine according to target information and send network request Application program and the application program have used flow.

In an alternative embodiment, target information may include: the identity instruction information of application program, identity instruction Information has the function of indicating that application program using flow, specifically indicates that the initiator of the network request is to share the same UID Multiple application programs in which application program, and indicate that the application program has used flow.Application program and apply journey There are one-to-one relationships between the identity instruction information of sequence, can determine that unique one is answered according to an identity instruction information Use program.

It can be to given server such as the system application installed before mobile phone factory for certain application programs of terminal Network request is sent, without sending network request to public server, is existed between application program and the given server of request One-to-one relationship.Since given server is the equipment in network, the IP address (Internet of given server Protocol Address, Internet protocol address) and domain-name information be used equally for mark given server, therefore application program With the IP address of given server there are one-to-one relationship, there are an a pair for the domain-name information of application program and given server It should be related to.Therefore, can by the IP address of given server, and/or, domain-name information as application program identity indicate letter Breath.

URL (Uniform Resource Locator, the unified resource for the network request that application program is initiated in the disclosure Finger URL) in include the corresponding server of application program IP address or domain-name information.When target information includes application program Identity indicate information, and in URL include server IP address when, referring to Fig. 6 be it is shown according to an exemplary embodiment separately A kind of monitoring application program uses the method flow diagram of flow, and above-mentioned steps 102 can be realized by following steps: step 1021, the IP address of the corresponding server of application program, the IP address conduct of the server are extracted from the URL of network request The identity of application program indicates information；When target information include application program identity indicate information, and in URL include server Domain-name information when, be the side that another monitoring application program shown according to an exemplary embodiment uses flow referring to Fig. 7 Method flow chart, above-mentioned steps 102 can be realized by following steps: step 1022 is extracted from the URL of network request and applies journey The domain-name information of the corresponding server of sequence, domain name information indicate information as the identity of application program.

In addition to the IP address of the corresponding server of application program and domain-name information, the identity instruction information of application program may be used also The other information of application identity can be indicated to be, such as default identification field in URL etc..

In an alternative embodiment, target information can also wrap in addition to the identity instruction information for including application program Include the flow use information of application program；The flow use information is used to indicate the flow service condition of application program.At this moment join It is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow, above-mentioned step according to Fig. 8 Rapid 102 can be realized by following step 1023: obtaining the identity instruction information of application program and flow according to network request makes Use information.The flow use information may include at least one of following: the application program transmission network request occupied time, Send the occupied flow value of network request, request number of times of transmission network request etc. in preset period of time.

Vpn application can be built-in with counter, and counter has number accumulating function, can send out each application program The request number of times of network request rising, forwarding through physical network card and Microsoft Loopback Adapter is added up, and each application program hair is counted The request number of times of the network request risen.Vpn application can obtain each application program in a period of time from counter and initiate Network request request number of times.

In an alternative embodiment, vpn application obtains identity instruction information and flow including application program After the target information of use information, the target information can be exported, indicates that information determines according to identity for developer and applies journey Sequence determines the flow service condition of application program according to flow use information, realizes the monitoring for using application program flow.It opens Hair personnel can determine that the application program for sending the network request has used stream by the target information obtained according to network request Amount realizes the monitoring for using the application program flow, can be realized by above-mentioned monitor mode to ShareUserId mechanism In share the monitoring that each application program in multiple application programs of same UID uses flow.

In an alternative embodiment, certain applications program terminal starting after automatically in running background when or from After front stage operation switches to running background, meeting abnormal access network, causes to be disappeared compared with various flow in the unwitting situation of user Consumption, causes flow to escape.For example, application program will not upload or download mass data when backstage operates normally, if using journey Sequence uploads in running background or downloads mass data, shows application program escaption flow；If application program is in running background The frequency abnormality for sending network request is more, shows application program escaption flow etc..

To realize voluntarily judge whether application program escapes flow, referring to Fig. 8, the disclosure is answered being obtained according to network request It, i.e., can be according to the body of application program after completing step 1023 after indicating information and flow use information with the identity of program Part instruction information and flow use information judge whether application program escapes flow, and specific deterministic process may include following step Rapid: step 105 indicates that information determines the identity of application program according to identity, and the identity of application program, which can be, answers With the title of program, preset number etc., application program can be determined according to the identity of application program；Step 106, according to stream Use information is measured, judges whether the application program with the identity escapes flow.After step 106 executes, VPN is answered Step 107 can also be performed with program: the flow if application program is escaped, the alarm of output application program escaption flow, to answer It is found and is handled in time with program escaption problems of liquid flow.

After step 106 executes, vpn application can also store application program escaption in addition to exporting alarm The judgement of flow is as a result, checking and using for subsequent；Alternatively, the problem of escaption flow to application program regular according to default processing It is handled, such as closes the application program of escaption flow, interrupts the currently transmitted network request of the application program of escaption flow, resistance Only the application program of escaption flow sends network request etc. in preset duration, realizes that vpn application is settled a dispute by the parties concerned themselves using journey The problem of sequence escaption flow, improves the intelligence of terminal so that terminal has the function of application program escaption flow of settling a dispute by the parties concerned themselves Degree.

The present embodiment includes: that the identity instruction information of application program and flow make according to the target information that network request obtains With information, it can indicate that information determines application program according to identity, judge whether application program escapes according to flow use information Flow realizes whether escape the judgement of flow to application program.The method of the present embodiment can be used in multiple application programs Each application program whether escape flow carry out effective monitoring, allow terminal check out more quickly escaption flow application Program.

In an alternative embodiment, for above-mentioned steps 105, indicate that information determines the body of application program according to identity There are many implementations of part mark, for example, terminal preset has default application information list, default application information list includes: The corresponding relationship of the identity of default identity instruction information and application program, step 105 can be accomplished by the following way: root Default application information list is inquired according to identity instruction information, obtains the identity of destination application corresponding with identity instruction information Mark.

Illustratively, above-mentioned application information list is as shown in Table 1 below,

Table 1

Default identity indicates information	APP ID
		The IP address of server 1	The title of application program 1
The IP address of server 2	The title of application program 2

When the identity instruction information obtained according to network request is the IP address of server 1, according to the IP of server 1 Above-mentioned table one is inquired in location, obtains the title of application program 1 corresponding with the IP address of server 1.Further according to the stream of acquisition Use information is measured, judges whether application program 1 escapes flow.

In an alternative embodiment, for above-mentioned steps 106, vpn application is according to flow use information, judgement Application program with identity whether escape flow implementation there are many, for example, step 106 can be by with lower section Formula is realized:

First way judges the network request at least once that application program is initiated in preset duration in running background Request number of times whether be greater than preset times threshold value, the network request at least once includes currently received network request, when When the request number of times of network request is greater than preset times threshold value at least once, which is judged as escaption flow；Wherein, Vpn application can be built-in with counter, use the request number of times for the network request that counter initiates each application program It is counted；Preset times threshold value can be configured according to prior information, and prior information can be developer according to work Empirically determined information can be the information that machine learns historical data.

The second way judges that application program sends whether the occupied duration of the network request is greater than in running background Preset duration threshold value, when the occupied duration of the network request is greater than preset duration threshold value, which is judged as stealing Run flow, wherein preset time threshold can be configured according to prior information.

The third mode judges whether application program sends the occupied flow value of the network request in running background big In preset flow threshold value, when the occupied flow value of the network request is greater than preset flow threshold value, which is determined Escaption flow, wherein preset flow threshold value can be configured according to prior information, can also be other applicable realization sides Formula.

In practice, a kind of mode can be used and judge whether application program escapes flow, can also simultaneously using two kinds or Two or more modes judge whether application program escapes flow.For example, vpn application is used according to the flow in target information Information determines that application program sends the occupied duration of the network request in running background greater than preset duration threshold value, and It determines that application program sends the occupied flow value of the network request in running background greater than after preset flow threshold value, determines to answer With program escaption flow.

In step 103, target information is stored.

Vpn application stores the target information after obtaining target information.When target information is to obtain in step 1021 The corresponding server of application program IP address when, referring to Fig. 6, step 103 can be realized by following steps: step 1031, the IP address of the corresponding server of storage application program；When target information is the application program pair obtained in step 1022 When the domain-name information for the server answered, referring to Fig. 7, step 103 can be realized by following steps: step 1032, storage application The domain-name information of the corresponding server of program.Developer can grasp application program initiation by checking the target information of storage It network request and has used flow, has realized that developer uses application program the monitoring of flow.

When target information includes the identity instruction information and flow use information of application program, developer can basis Identity instruction information determines application program, and the flow service condition of application program is determined according to flow use information, is answered in judgement When with program escaption flow, if application program is the independently developed application program of developer, application program can be modified, The flow so that modified application program is no longer escaped；If the application program is the third party application of purchase, develop The problem of application program escaption flow, can be reported to developer by personnel, so that developer improves application program in time, or Developer application program can be escaped flow judging result as basis for claims, lodge claims requirement to developer.

It in an alternative embodiment, can be according to the storage location of actual setting target information, for example, storage target Information can check target information by journal file into journal file.Store realization of the target information into journal file There are many modes, for example, journal file is used to store target information, when storing excess target information in journal file, log File occupied space is larger, causes terminal memory usage larger, and terminal operating is slower, to solve the above problems, storage target The operation of information to journal file can be realized by following steps: using in the target information replacement journal file currently obtained The history target information of storage prevents journal file occupied space by deleting the history target information stored in journal file It is excessive.

There are many implementations that the history target information stored in journal file is replaced using target information, for example, ginseng It is the method flow diagram that another monitoring application program shown according to an exemplary embodiment uses flow according to Fig. 9, uses mesh The operation of the history target information stored in mark information replacement journal file may include: step 1033, judge that journal file is worked as Whether the size of preceding occupied space is greater than or equal to preset value；If the size of the current occupied space of step 1034, journal file is big In or equal to preset value, the history target information of N before the sequence of storage duration in journal file is replaced using target information, wherein N For positive integer.It can be according to the size of actual setting preset value and the size of N, for example, preset value can be 80M, 100M etc.；N It can be 1,2,3,4,5 etc..The above method is realized deletes the longer history target information of storage time in journal file at first, and The higher history target information of the shorter use relevance of storage time is not deleted, ensure that the history stored in journal file The use of target information.

For another example, it can also be accomplished by the following way: can be to the number of the history target information stored in journal file It is counted, if the number of the history target information stored in journal file reaches preset value, deletes going through in journal file History target information specifically can delete the history target information for storing that M is a before duration sorts in journal file, wherein M is positive Integer, such as 1,2,3,4,5.Can be according to the storage mode of actual setting target information, the present embodiment is herein with no restrictions.

It in an alternative embodiment, 0 is referring to Fig.1 another monitoring application shown according to an exemplary embodiment Program uses the method flow diagram of flow, and vpn application also executes following after the network request for obtaining Microsoft Loopback Adapter forwarding Operation: network request is sent to physical network card by step 108, the transmission being sent to network request by physical network card outside terminal On medium, realize that application program is sent out network request.

Vpn application is after obtaining network request, and there are many modes that network request is sent to physical network card, example Such as, the first: vpn application obtain Microsoft Loopback Adapter forwarding network request after, duplicate network request URL, replicated Network request is sent to physical network card after, target information is obtained by the URL of duplication, stores the target information of acquisition, it should Method has many advantages, such as that network request forwarding speed is fast, delay is short, and duplication can be deleted after the completion of target information stores URL, to reduce space hold；Second: after the network request for obtaining Microsoft Loopback Adapter forwarding, target being obtained according to network request Network request is sent to physical network card, this method has operation letter without replicating URL after getting target information by information The advantages that single.

For the various method embodiments described above, for simple description, therefore, it is stated as a series of action combinations, but Be those skilled in the art should understand that, the disclosure is not limited by the described action sequence because according to the disclosure, certain A little steps can be performed in other orders or simultaneously.

Secondly, those skilled in the art should also know that, embodiment described in this description belongs to alternative embodiment, Necessary to the related actions and modules not necessarily disclosure.

Corresponding with aforementioned applications function realizing method embodiment, the disclosure additionally provides application function realization device and phase The embodiment for the terminal answered.

1 is a kind of device block diagram of the monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1, The apparatus may include:

First obtains module 21, is configured as obtaining the network request of Microsoft Loopback Adapter forwarding, the network request is by answering Initiated with program using shared user identifier ShareUserId mechanism, and the network request by the application program through object Reason network interface card is sent to the Microsoft Loopback Adapter；

Second obtains module 22, is configured as obtaining target information according to the network request, the target information is used for Indicate that the application program uses flow；

Memory module 23 is configured as storing the target information.

2 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, described device can also include:

Opening module 24 is configured as before the network request for obtaining Microsoft Loopback Adapter forwarding, opens Microsoft Loopback Adapter.

3 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 12 shown device embodiment, the opening module 24 may include:

First receiving submodule 241 is configured as receiving the instruction of the unlatching Microsoft Loopback Adapter of user's input；

Submodule 242 is opened, is configured as opening Microsoft Loopback Adapter according to described instruction.

4 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 12 shown device embodiment, first receiving submodule 241 may include:

First receiving unit 241-1 is configured as receiving the trigger action that user executes at the terminal；

Output unit 241-2 determines that the trigger action is used to open Microsoft Loopback Adapter if being configured as identifying by operation, defeated Inquiry message out；

Second receiving unit 241-3 is configured as receiving the confirmation unlatching Microsoft Loopback Adapter that user triggers according to inquiry message Instruction.

5 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, the second acquisition module 22 may include:

First extracting sub-module 221 is configured as extracting the application program from the URL of the network request corresponding The IP address of server, the target information include: the identity instruction information of the application program；

Memory module 23 may include:

First sub-module stored 231 is configured as the IP address of the corresponding server of storage application program.

6 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, the second acquisition module 22 may include:

Second extracting sub-module 222 is configured as extracting domain-name information from the URL of the network request, the target Information includes: the identity instruction information of the application program；

Memory module 23 may include:

Second sub-module stored 232 is configured as the domain-name information of the corresponding server of storage application program.

7 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, the second acquisition module 22 may include

Third extracting sub-module 223 is configured as obtaining the identity instruction information and stream of application program according to network request It measures and is applicable in information, the target information includes: the identity instruction information and flow use information of the application program；

Described device can also include:

Determining module 25 is configured as indicating that information determines the identity of application program according to identity；

Judgment module 26 is configured as being applicable in information according to flow, whether judges the application program with the identity Escaption flow；

Output module 27, if being configured as application program escaption flow, the alarm of output application program escaption flow.

The determining module 25 can be configured as and indicate that information inquires default application information list according to the identity, Identity corresponding with identity instruction information is obtained, the default application information list includes: default identity instruction letter The corresponding relationship of breath and default identity.

The judgment module 26 may include at least one of following:

8 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, the memory module 23 may include:

Judging submodule 233 is configured as judging whether the size of the current occupied space of journal file is greater than or equal to pre- If value；

Submodule 234 is replaced, if the size for being configured as the current occupied space of journal file is greater than or equal to preset value, is fitted The history target information of N before being sorted with storage duration in target information replacement journal file, wherein N is positive integer.

9 be device frame of another monitoring application program shown according to an exemplary embodiment using flow referring to Fig.1 Figure, on the basis of Figure 11 shown device embodiment, described device further include:

Sending module 28 is configured as the network request being sent to the physical network card, so that the network request Transmission medium outside the terminal is sent to by the physical network card.

For device embodiment, since it corresponds essentially to embodiment of the method, so related place is referring to method reality Apply the part explanation of example.The apparatus embodiments described above are merely exemplary, wherein above-mentioned be used as separation unit The unit of explanation may or may not be physically separated, and component shown as a unit can be or can also be with It is not physical unit, it can it is in one place, or may be distributed over multiple network units.It can be according to actual The purpose for needing to select some or all of the modules therein to realize disclosure scheme.Those of ordinary skill in the art are not paying Out in the case where creative work, it can understand and implement.

Accordingly, on the one hand, the embodiment of the present disclosure provides a kind of device for monitoring application program and using flow, comprising: Processor；Memory for storage processor executable instruction；Wherein, above-mentioned processor is configured as:

Store the target information.

Figure 20 is the one of the device 2000 that a kind of monitoring application program shown according to an exemplary embodiment uses flow Structural schematic diagram.For example, device 2000 can be user equipment, it can be specially mobile phone, computer, digital broadcasting end End, messaging devices, game console, tablet device, Medical Devices, body-building equipment, personal digital assistant, wearable device Such as smartwatch, intelligent glasses, Intelligent bracelet, intelligent running shoes.

Referring to Figure 20, device 2000 may include following one or more components: processing component 2002, memory 2004, Power supply module 2006, multimedia component 2008, audio component 2010, the interface 2012 of input/output (I/O), sensor module 2014 and communication component 2016.

The integrated operation of the usual control device 2000 of processing component 2002, such as with display, telephone call, data communication, Camera operation and record operate associated operation.Processing component 2002 may include one or more processors 2020 to execute Instruction, to perform all or part of the steps of the methods described above.In addition, processing component 2002 may include one or more moulds Block, convenient for the interaction between processing component 2002 and other assemblies.For example, processing component 2002 may include multi-media module, To facilitate the interaction between multimedia component 2008 and processing component 2002.

Memory 2004 is configured as storing various types of data to support the operation in equipment 2000.These data Example includes the instruction of any application or method for operating on device 2000, contact data, telephone book data, Message, picture, video etc..Memory 2004 can by any kind of volatibility or non-volatile memory device or they Combination is realized, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), it is erasable can Program read-only memory (EPROM), programmable read only memory (PROM), read-only memory (ROM), magnetic memory, flash memory Reservoir, disk or CD.

Power supply module 2006 provides electric power for the various assemblies of device 2000.Power supply module 2006 may include power management System, one or more power supplys and other with for device 2000 generate, manage, and distribute the associated component of electric power.

Multimedia component 2008 includes the screen of one output interface of offer between above-mentioned apparatus 2000 and user.? In some embodiments, screen may include liquid crystal display (LCD) and touch panel (TP).If screen includes touch panel, Screen may be implemented as touch screen, to receive input signal from the user.Touch panel includes that one or more touch passes Sensor is to sense the gesture on touch, slide, and touch panel.Above-mentioned touch sensor can not only sense touch or sliding is dynamic The boundary of work, but also detect duration and pressure relevant to above-mentioned touch or slide.In some embodiments, more Media component 2008 includes a front camera and/or rear camera.When equipment 2000 is in operation mode, as shot mould When formula or video mode, front camera and/or rear camera can receive external multi-medium data.Each preposition camera shooting Head and rear camera can be a fixed optical lens system or have focusing and optical zoom capabilities.

Audio component 2010 is configured as output and/or input audio signal.For example, audio component 2010 includes a wheat Gram wind (MIC), when device 2000 is in operation mode, when such as call mode, recording mode, and voice recognition mode, microphone quilt It is configured to receive external audio signal.The received audio signal can be further stored in memory 2004 or via communication Component 2016 is sent.In some embodiments, audio component 2010 further includes a loudspeaker, is used for output audio signal.

I/O interface 2012 provides interface, above-mentioned peripheral interface module between processing component 2002 and peripheral interface module It can be keyboard, click wheel, button etc..These buttons may include, but are not limited to: home button, volume button, start button and Locking press button.

Sensor module 2014 includes one or more sensors, and the state for providing various aspects for device 2000 is commented Estimate.For example, sensor module 2014 can detecte the state that opens/closes of equipment 2000, the relative positioning of component, such as on The display and keypad that component is device 2000 are stated, sensor module 2014 can be with detection device 2000 or device 2,000 1 The position change of a component, the existence or non-existence that user contacts with device 2000,2000 orientation of device or acceleration/deceleration and dress Set 2000 temperature change.Sensor module 2014 may include proximity sensor, be configured in not any physics It is detected the presence of nearby objects when contact.Sensor module 2014 can also include optical sensor, as CMOS or ccd image are sensed Device, for being used in imaging applications.In some embodiments, which can also include acceleration sensing Device, gyro sensor, Magnetic Sensor, pressure sensor or temperature sensor.

Communication component 2016 is configured to facilitate the communication of wired or wireless way between device 2000 and other equipment.Dress The wireless network based on communication standard, such as WiFi, 2G or 3G, 4G LTE, 5G NR or their combination can be accessed by setting 2000. In one exemplary embodiment, communication component 2016 receives the broadcast from external broadcasting management system via broadcast channel and believes Number or broadcast related information.In one exemplary embodiment, above-mentioned communication component 2016 further includes near-field communication (NFC) mould Block, to promote short range communication.For example, radio frequency identification (RFID) technology, Infrared Data Association (IrDA) skill can be based in NFC module Art, ultra wide band (UWB) technology, bluetooth (BT) technology and other technologies are realized.

In the exemplary embodiment, device 2000 can be by one or more application specific integrated circuit (ASIC), number Signal processor (DSP), digital signal processing appts (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), controller, microcontroller, microprocessor or other electronic components are realized, for executing the above method.

In the exemplary embodiment, a kind of non-transitorycomputer readable storage medium is additionally provided, for example including instruction Memory 2004 enable device 2000 when the instruction in storage medium is executed by the processor 2020 of device 2000 The method for sending information is executed, this method comprises:

Store the target information.

The non-transitorycomputer readable storage medium can be ROM, random access memory (RAM), CD-ROM, magnetic Band, floppy disk and optical data storage devices etc..

As shown in figure 21, Figure 21 is shown according to an exemplary embodiment a kind of to use flow for monitoring application program Device 2100 a structural schematic diagram.For example, device 2100 may be provided as an application server.Referring to Figure 21, device 2100 include processing component 2122, further comprises one or more processors, and deposit as representated by memory 2116 Memory resource, can be by the instruction of the execution of processing component 2122, such as application program for storing.It is stored in memory 2116 Application program may include it is one or more each correspond to one group of instruction module.In addition, processing component 2122 It is configured as executing instruction, the method to execute above-mentioned transmission information.

Device 2100 can also include that a power supply module 2126 be configured as the power management of executive device 2100, and one Wired or wireless network interface 2150 is configured as device 2100 being connected to network and input and output (I/O) interface 2158.Device 2100 can be operated based on the operating system for being stored in memory 2116, such as Android, iOS, Windows Server^TM, Mac OS X^TM, Unix^TM, Linux^TM, FreeBSD^TMOr it is similar.

In the exemplary embodiment, a kind of non-transitorycomputer readable storage medium including instruction, example are additionally provided It such as include the memory 2116 of instruction, above-metioned instruction can be executed by the processing component 2122 of device 2100 to complete the above method. For example, the non-transitorycomputer readable storage medium can be ROM, random access memory (RAM), CD-ROM, tape, Floppy disk and optical data storage devices etc..

Wherein, when the instruction in the memory 2116 is executed by the processing component 2122, enable device 2100 Enough execute a kind of method that monitoring application program uses flow, comprising:

Store the target information.

Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to its of the disclosure Its embodiment.The disclosure is intended to cover any variations, uses, or adaptations of the disclosure, these modifications, purposes or Person's adaptive change follows the general principles of this disclosure and including the undocumented common knowledge in the art of the disclosure Or conventional techniques.The description and examples are only to be considered as illustrative, and the true scope and spirit of the disclosure are by following Claim is pointed out.

It should be understood that the present disclosure is not limited to the precise structures that have been described above and shown in the drawings, and And various modifications and changes may be made without departing from the scope thereof.The scope of the present disclosure is only limited by the accompanying claims.

Claims

1. a kind of method that monitoring application program uses flow, which is characterized in that the described method includes:

Target information is obtained according to the network request, the target information is used to indicate the application program and uses flow；

Store the target information.

2. the method according to claim 1, wherein the method also includes:

The network request is sent to the physical network card so that the network request be sent to by the physical network card it is described Transmission medium outside terminal.

3. the method according to claim 1, wherein the target information includes: the identity of the application program Indicate information, described to indicate that information includes any one of following according to the network request acquisition identity:

The internet protocol of the corresponding server of the application program is extracted from the uniform resource position mark URL of the network request Discuss address/IP address；

Domain-name information is extracted from the URL of the network request.

4. the method according to claim 1, wherein the target information includes: the identity of the application program Indicate information and flow use information, after the acquisition target information according to the network request, the method also includes:

5. according to the method described in claim 4, it is characterized in that, described indicate that information determines the application according to the identity The identity of program includes:

It indicates that information inquires default application information list according to the identity, obtains identity corresponding with identity instruction information Mark, the default application information list include: the corresponding relationship of default identity instruction information and default identity.

6. according to the method described in claim 4, judgement has institute it is characterized in that, described according to the flow use information The application program flow of whether escaping for stating identity includes at least one of the following:

Judge that the application program sends in preset duration in running background including the network request at least Whether the request number of times of primary network request is greater than preset times threshold value, and the request number of times of the multiple network request is greater than described When preset times threshold value, the application program is judged as escaption flow；

Judge that the application program sends whether the occupied duration of the network request is greater than preset duration in running background Threshold value, when the occupied duration of network request is greater than the preset duration threshold value, the application program is judged as escaping Flow；

Judge that the application program sends whether the occupied flow value of the network request is greater than default stream in running background Threshold value is measured, when the occupied flow value of network request is greater than the preset flow threshold value, the application program is determined steathily Run flow.

7. the device that a kind of monitoring application program uses flow, which is characterized in that described device includes:

First obtains module, is configured as obtaining the network request of Microsoft Loopback Adapter forwarding, the network request is by application program Using shared user identifier ShareUserId mechanism initiate, and the network request by the application program through physical network card It is sent to the Microsoft Loopback Adapter；

Second obtains module, is configured as obtaining target information according to the network request, the target information is used to indicate institute It states application program and uses flow；

Memory module is configured as storing the target information.

8. device according to claim 7, which is characterized in that described device further include:

Sending module is configured as the network request being sent to the physical network card, so that the network request is by described Physical network card is sent to the transmission medium outside the terminal.

9. device according to claim 7, which is characterized in that the second acquisition module includes any one of following:

First extracting sub-module is configured as extracting from the uniform resource position mark URL of the network request described using journey The Internet protocol address IP address of the corresponding server of sequence, the target information include: the identity instruction of the application program Information；

Second extracting sub-module is configured as extracting domain-name information from the URL of the network request, the target information packet It includes: the identity instruction information of the application program.

10. device according to claim 7, which is characterized in that described device further include:

Determining module is configured as after the acquisition target information according to the network request, is indicated according to the identity Information determines the identity of the application program, the target information include: the application program identity instruction information and Flow use information；

Judgment module is configured as judging the application program with the identity according to the flow use information Whether escape flow；

Output module exports the alarm of the application program escaption flow if being configured as the application program escaption flow.

11. device according to claim 10, it is characterised in that:

The determining module is configured as indicating that information inquires default application information list according to the identity, obtain with it is described Identity indicates the corresponding identity of information, and the default application information list includes: default identity instruction information and default body The corresponding relationship of part mark.

12. device according to claim 10, which is characterized in that the judgment module includes at least one of the following:

First judging submodule, being configured as judging that the application program sends in preset duration in running background includes Whether the request number of times of the network request at least once including the network request is greater than preset times threshold value, the multiple network When the request number of times of request is greater than the preset times threshold value, the application program is judged as escaption flow；

Second judgment submodule is configured as judging that the application program is sent in running background occupied by the network request Duration whether be greater than preset duration threshold value, when the occupied duration of network request is greater than the preset duration threshold value, institute It states application program and is judged as escaption flow；

Third judging submodule is configured as judging that the application program is sent in running background occupied by the network request Flow value whether be greater than preset flow threshold value, the occupied flow value of network request is greater than the preset flow threshold value When, the application program is determined escaption flow.

13. a kind of non-transitorycomputer readable storage medium, is stored thereon with computer program, which is characterized in that the program The step of claim 1~6 any the method is realized when being executed by processor.

14. the device that a kind of monitoring application program uses flow characterized by comprising

Processor；

Memory for storage processor executable instruction；

Wherein, the processor is configured to:

Store the target information.