CN110149298A - A kind of method and apparatus for kidnapping detection - Google Patents
A kind of method and apparatus for kidnapping detection Download PDFInfo
- Publication number
- CN110149298A CN110149298A CN201810145070.4A CN201810145070A CN110149298A CN 110149298 A CN110149298 A CN 110149298A CN 201810145070 A CN201810145070 A CN 201810145070A CN 110149298 A CN110149298 A CN 110149298A
- Authority
- CN
- China
- Prior art keywords
- channel information
- abduction
- activation
- service platform
- downloading
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a kind of method and apparatus for kidnapping detection, are related to field of computer technology.One specific embodiment of this method includes: the identification information according to equipment, obtains the downloading channel information of device downloads application and the activation channel information of installation activation application；When downloading channel information and activation channel information is not identical, determine that first service platform corresponding with activation channel information is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.The embodiment can be adapted for a plurality of types of abduction detections, improve the versatility of anti-hijacking means, reduce anti-hijacking cost, and it is capable of detecting when specific abduction side, the person of being convenient for application and promotion activates the case where kidnapping during grasping application, and the application management for after provides foundation.
Description
Technical field
The present invention relates to field of computer technology more particularly to a kind of method and apparatus for kidnapping detection.
Background technique
With the rapid development of mobile Internet, applied to the APP (Application, application software) on smart machine
Also it continues to bring out.For the downloading activation amount for improving APP, APP promoter would generally launch advertisement on different advertising platforms, so
The APP activation quantity of each advertising platform is counted, afterwards for the investment return ratio for closing the account, calculating conversion ratio, assessment is launched
Deng.
But in APP extension process, part advertising platform passes through itself platform advantage, APP download phase or
Erection stage, the activation of other advertising platforms is robbed to be had for oneself, to achieve the purpose that make profit.
At present there are mainly three types of existing abduction modes: network is kidnapped, cell phone manufacturer kidnaps, Browser Hijack.Wherein,
Network is kidnapped --- and the downloading request for kidnapping other advertising platforms carries out the installation kit that APP installation kit replaces with oneself platform
It kidnaps；Browser Hijack --- recommended user is using installation is recommended, so that user clicks the corresponding button and jumps to answering for the manufacturer
It is downloaded with market；Cell phone manufacturer kidnaps --- and user has been downloaded in other platforms and has started the APP of installation, the mobile phone
Platform prompts the installation kit without safety detection, it is proposed that and user is induced to carry out re-downloading peace to manufacturer's application shop
Dress.
The prior art kidnaps network, generallys use the mode of testing, sends specific business operation life to user equipment
It enables, the business operation process of analog subscriber, and judges a certain IP address (Internet according to the business operation result of return
Protocol Address, Internet protocol address) or region whether there is abduction behavior；For Browser Hijack and mobile phone vendor
Quotient kidnaps, and discovery abduction behavior is usually gone by way of reappearing user experience.
In the implementation of the present invention, at least there are the following problems for inventor's discovery prior art:
(1) testing mode used by kidnapping for network, testing result is more coarse, can only secondary IP address, region, fortune
It seeks the detections such as quotient and kidnaps behavior, can not know detailed abduction data, cause the advertisement that cannot detect to initiate abduction behavior flat
Platform；
(2) tool is kidnapped in the mode of reproduction user experience, discovery used by kidnapping for Browser Hijack and cell phone manufacturer
There is hysteresis quality, in addition, which needs lasting human input, can not equally determine the specific data for kidnapping activation.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of method and apparatus for kidnapping detection, it is at least able to solve existing skill
Abduction data can not be determined in art, the problem for causing to detect specific abduction side.
To achieve the above object, according to an aspect of an embodiment of the present invention, a kind of method for kidnapping detection, packet are provided
It includes: according to the identification information of equipment, obtaining the downloading channel information of device downloads application and the activation canal of installation activation application
Road information；When downloading channel information and activation channel information is not identical, first service corresponding with activation channel information is determined
Platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
Optionally, according to the identification information of equipment, downloading channel information and the installation activation of device downloads application are obtained
The activation channel information of application includes: the identification information according to equipment, determines download time and the installation of device downloads application
Activate the activationary time of application；It is located at after download time between when activating and is less than pre- timing with the time interval of download time
Between threshold value when, obtain downloading channel information and activation channel information.
Optionally, determining that first service platform corresponding with activation channel information is abduction side and downloading channel information
Corresponding second service platform is after the side of being held as a hostage, further includes: obtains all kidnap associated with first service platform and divides
Information is analysed, rule is determined according to scheduled abduction mode, determines first service platform to the abduction mode of application, is obtained with institute really
The corresponding anti-hijacking mode of fixed abduction mode.
Optionally, determining that first service platform corresponding with activation channel information is abduction side and downloading channel information
Corresponding second service platform is after the side of being held as a hostage, further includes: first service platform is to application in statistics predetermined amount of time
Abduction amount determines that first service platform is exception service platform when abduction amount exceeds predetermined quantity threshold value.
Optionally, downloading channel information includes at least downloading channel number, and activation channel information includes at least activation channel number.
To achieve the above object, according to another aspect of an embodiment of the present invention, a kind of device for kidnapping detection, packet are provided
Include: data obtaining module obtains downloading channel information and the installation of device downloads application for the identification information according to equipment
Activate the activation channel information of application；Determining module is kidnapped, is used for when downloading channel information and activation channel information is not identical,
Determine that first service platform corresponding with activation channel information is abduction side, second service platform corresponding with downloading channel information
For the side of being held as a hostage.
Optionally, data obtaining module is used for: according to the identification information of equipment, when determining the downloading of device downloads application
Between and installation activation application activationary time；Between when activating be located at download time after and the time interval with download time
When less than scheduled time threshold value, downloading channel information and activation channel information are obtained.
Optionally, further include abduction mode determining module, be used for: obtaining all abduction associated with first service platform
Information is analyzed, rule is determined according to scheduled abduction mode, determines first service platform to the abduction mode of application, acquisition and institute
The corresponding anti-hijacking mode of determining abduction mode.
Optionally, further include abnormal determining module, be used for: misfortune of the first service platform to application in statistics predetermined amount of time
The amount of holding determines that first service platform is exception service platform when abduction amount exceeds predetermined quantity threshold value.
Optionally, downloading channel information includes at least downloading channel number, and activation channel information includes at least activation channel number.
To achieve the above object, according to an embodiment of the present invention in another aspect, provide it is a kind of kidnap detection electronics set
It is standby.
The electronic equipment of the embodiment of the present invention includes: one or more processors；Storage device, for storing one or more
A program, when one or more of programs are executed by one or more of processors, so that one or more of processing
The method that device realizes any of the above-described abduction detection.
To achieve the above object, according to an embodiment of the present invention in another aspect, provide a kind of computer-readable medium,
On be stored with computer program, the method for any of the above-described abduction detection is realized when described program is executed by processor.
The scheme of the offer according to the present invention, one embodiment in foregoing invention have the following advantages that or beneficial to effects
Fruit: it can be adapted for a plurality of types of abduction detections, improve the versatility of anti-hijacking means, be able to detect that specific abduction
Side, reduces anti-hijacking cost, and the person of being convenient for application and promotion activates the concrete condition kidnapped during grasping application.
Further effect possessed by above-mentioned non-usual optional way adds hereinafter in conjunction with specific embodiment
With explanation.
Detailed description of the invention
Attached drawing for a better understanding of the present invention, does not constitute an undue limitation on the present invention.Wherein:
Fig. 1 is a kind of main flow schematic diagram of method for kidnapping detection according to an embodiment of the present invention；
Fig. 2 is a kind of flow diagram of optional method for kidnapping detection according to an embodiment of the present invention；
Fig. 3 is the flow diagram of another optional method for kidnapping detection according to an embodiment of the present invention；
Fig. 4 is the flow diagram of another optional method for kidnapping detection according to an embodiment of the present invention；
Fig. 5 is the flow diagram for the method that one kind according to an embodiment of the present invention specifically kidnaps detection；
Fig. 6 is a kind of main modular schematic diagram of device for kidnapping detection according to an embodiment of the present invention；
Fig. 7 is that the embodiment of the present invention can be applied to exemplary system architecture figure therein；
Fig. 8 is adapted for the structural representation for realizing the mobile device of the embodiment of the present invention or the computer system of server
Figure.
Specific embodiment
Below in conjunction with attached drawing, an exemplary embodiment of the present invention will be described, including the various of the embodiment of the present invention
Details should think them only exemplary to help understanding.Therefore, those of ordinary skill in the art should recognize
It arrives, it can be with various changes and modifications are made to the embodiments described herein, without departing from scope and spirit of the present invention.Together
Sample, for clarity and conciseness, descriptions of well-known functions and structures are omitted from the following description.
It should be noted that kidnapping detection provided by the embodiment of the present invention is suitable for Android (Android) system, service
Platform is to provide the advertising platform of downloading APP application channel；Equipment is downloading, the electronic equipment for installing and activating APP, such as hand
Mechanical, electrical brain etc..
When user is when advertising platform clicks APP and promotes advertisement and be downloaded, it has been shown that the user, which has, clearly to install
The wish of the APP.The present invention is based on the premise and it is directed to present in other abduction detection modes that the prior art is previously mentioned not
Foot proposes a kind of method and apparatus for kidnapping detection.
Referring to Fig. 1, thus it is shown that a kind of broad flow diagram for the method for kidnapping detection provided in an embodiment of the present invention, including
Following steps:
S101: according to the identification information of equipment, the downloading channel information and installation activation for obtaining device downloads application are answered
Activation channel information.
S102: when downloading channel information and activation channel information is not identical, corresponding with channel information is activated the is determined
One service platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
In above embodiment, for step S101, APP promoter can launch APP in multiple advertising platforms and promote advertisement,
Each advertising platform has respective channel information, for counting the installation source of APP, assesses the popularization effect of each advertising platform
Fruit.
The channel information includes at least downloading channel information and activation channel information；Wherein downloading channel information is packaged in
In APP installation kit, to identify downloaded installation kit from which advertising platform；Channel information is activated, it is sharp for identifying
It is living which advertising platform derived from.It downloads channel information and includes at least downloading channel number, activation channel information includes at least activation
Channel number, and channel number, activation channel number usually character string forms are downloaded, and can be only fitted to the Android of system
In Manifest.xml.
Further, when equipment downloads APP installation kit by advertising platform, download information can be generated, which can
To be stored in the database of advertising platform, detection use is kidnapped to be uploaded to APP promoter.It includes downloading that download message, which is removed,
It can also include the identification information of equipment except channel information；Wherein, equipment identification information is used for and APP active information carries out
Equipment obtains.
Activation channel information can store in activate message, after equipment installs and activates APP, can upload activate message extremely
APP promoter.The active information can store in the activation library of APP promoter, and APP promoter can activate message knot accordingly
Download message is closed to advertising platform payment services expense.Activate message equally can also include setting in addition to including activation channel
Standby identification information.
According to equipment identification information, obtains associated downloading channel message and the mode of channel message is activated to can be
It is a variety of, such as:
(1) according to the identification information of equipment, associated downloading channel information is obtained in the database of advertising platform, with
And associated activation channel information is obtained in the activation library of APP promoter；
(2) it is obtained respectively first with the associated download message of equipment identification information and activate message, extracts it later
In downloading channel message or activation channel message, specifically, download channel number and activation channel number:
1) it obtains first in certain time period in advertising platform for all download informations of APP, traverses download information, really
The equipment identification information of fixed downloaded APP, and based on identified equipment identification information, it is looked into the activation library of APP promoter
Ask whether there is active information corresponding with equipment identification information, if result be it is yes, abduction detection can be carried out；If but result is
It is no, it indicates user's downloading but the APP is not installed；
2) active information is received first, determines the equipment identification information in activate message, later, traverses all advertising platforms
Database, corresponding with equipment identification information download information is obtained, if the equipment carries out the APP in multiple advertising platforms
Downloading, download information at this time derive from multiple advertising platforms.
, can whether identical according to downloading channel number and activation channel number for step S102, judge swashing for advertising platform
Living whether there is is kidnapped.
When download channel number it is identical as channel number is activated when, then it represents that user download and the APP installation kit installed from
The same advertising platform；If not identical, then it represents that user sees APP popularization advertisement in advertising platform and has click to download
Movement, but APP installation after report be another advertising platform activation channel number, it is determined that APP download or install
Abduction behavior has occurred in stage, and activating the corresponding advertising platform of channel number is abduction side (first service platform), downloads channel
Number corresponding advertising platform is the side of being held as a hostage (second service platform).
For example, user has downloaded APP in A advertising platform, but the APP of last installation activation is derived from B advertising platform,
Prove that B advertising platform has carried out APP activation abduction behavior to A advertising platform, B advertising platform is abduction side, and A advertising platform is
The side of being held as a hostage.
Method provided by above-described embodiment provides the downloading channel information and activation channel of a kind of foundation service platform
Information, the activation of Analysis Service platform detect abduction side with the presence or absence of abduction with this.Above-described embodiment is suitable for multiple types
Abduction detection, integrated operation is easy easily to be executed, and is grasped the activation in APP extension process convenient for APP promoter and is kidnapped specific feelings
Condition, the application management for after provide foundation.
Referring to fig. 2, the optional method flow signal for kidnapping detection of the one kind provided according to embodiments of the present invention is provided
Figure, includes the following steps:
S201: according to the identification information of equipment, determine what the download time of device downloads application and installation activation were applied
Activationary time.
S202: being located at after download time between when activating and is less than scheduled time threshold value with the time interval of download time
When, obtain downloading channel information and activation channel information.
S203: when downloading channel information and activation channel information is not identical, corresponding with channel information is activated the is determined
One service platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
In above embodiment, step S203 can be found in the description of step S102 shown in Fig. 1, and details are not described herein.
In above embodiment, step S201 is needed before obtaining downloading channel information and activation channel information
First determine whether download information and active information for judging that it is whether effective that activation is kidnapped.
Wherein, download information can also can also include that equipment is pacified including download time of device downloads APP, activate message
Fill and activate the activationary time of APP；Wherein, download time and activationary time disappear compared with downloading channel message and activation channel
Breath, it is easier to judge above embodiment for judging whether activation abduction is effective, specifically, judges whether time window has
Effect.
The judgment mode includes but is not limited to be:
1) activationary time will be later than the download time；
2) time difference between activationary time and download time is less than scheduled time threshold.Wherein, the scheduled time
Threshold value is usually arranged as a hour, can also be set according to the characteristics of advertising platform, such as A advertising platform --- and two
Hour, B advertising platform --- one day.
For beyond accounting is less the case where installation activation APP after time threshold, when activating between download time
Time interval be greater than time threshold, then it is assumed that this time APP downloading installation and this judgement detection it is unrelated.For example, user is in A
Advertising platform has downloaded APP, but the time for installing activation is later, then confirms the model that this downloading activation is not considered in anti-hijacking
In enclosing.Equally, if APP is held as a hostage in download phase or among the activation stage, and the set-up time is later, also to be invalid, no
In the range of anti-hijacking is considered, i.e., anti-hijacking behavior has timeliness.
If time window is effective, check download information downloading channel number and active information channel number whether one
It causes, if unanimously, then it represents that this time activation is not held as a hostage.
Method provided by above-described embodiment provides a kind of determining feasible condition of anti-hijacking method, i.e., under corresponding
Information carrying breath and active information will meet judgment mode, reduce the workload of subsequent processing, improve sentencing for anti-hijacking
Disconnected treatment effeciency.
Referring to Fig. 3, the optional method flow for kidnapping detection of the another kind provided according to embodiments of the present invention is provided and is shown
It is intended to, includes the following steps:
S301: according to the identification information of equipment, the downloading channel information and installation activation for obtaining device downloads application are answered
Activation channel information.
S302: when downloading channel information and activation channel information is not identical, corresponding with channel information is activated the is determined
One service platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
S303: obtaining all abduction associated with first service platform and analyze information, true according to scheduled abduction mode
Set pattern then, determines that first service platform to the abduction mode of application, obtains anti-hijacking side corresponding with identified abduction mode
Formula.
In above embodiment, step S301 can be found in step S101 shown in Fig. 1, also may refer to step shown in Fig. 2
The description of S201 and S202；Step S302 can be found in the description of step S102 shown in Fig. 1, and details are not described herein.
In above embodiment, for step S303, activation is kidnapped, a certain advertising platform using its channel by other
The device activation of advertising platform channel is converted into the activation of oneself channel by certain mode, to obtain interests.
It is kidnapped for activation, corresponding abduction analytical database can be set, included at least and kidnap analysis information, activation canal
Road information, downloading channel information, to be used when statisticalling analyze abduction mode.Abduction analysis information is stored in download message
In, including browser, version, type, IP, Referer etc.；Wherein, Referer can inform which APP advertising platform is from
What page link came, advertising platform base this can obtain it is some for kidnaps analysis handle information.
After determining to abduction side, all misfortunes corresponding with abduction side can be counted based on kidnapping in analytical database
Analysis information is held, determines abduction mode, specifically:
1) concentrate (for example, accounting exceeds certain threshold value) in a certain IP sections specific, region or fortune if there is the behavior of abduction
Battalion quotient, and the no obvious characteristic of distribution on type, browser then can be determined that as network abduction；For example, kidnapping Fang Suojie
80% is at 103.214.84ip sections in the equipment held, but exceeds respective threshold without the accounting of type, browser；
2) some particular brand equipment is concentrated on if there is abduction behavior and the side's of abduction advertising platform is the brand
The application market of equipment then can be determined that as device manufacturer's abduction；For example, equipment is equipped with C browser, user is browsed by C
Device has downloaded APP installation kit, but equipment forbids installing the installation kit in non-brand source, therefore user needs corresponding brand to answer
The APP is re-downloaded with market；
3) browser of a certain manufacturer is concentrated on if there is abduction behavior and the side's of abduction advertising platform is the manufacturer pair
The application market answered then can be determined that as Browser Hijack；For example, the APP of browser downloading can calculate corresponding channel, but
It is that browser directs the user to corresponding application market (such as the corresponding application market of C browser is exactly C application market) again
It downloads and installs, just belong to abduction.
It is available and execute corresponding anti-hijacking processing mode for the abduction mode determined, such as:
1) it is kidnapped for network, APP promoter can be according to the abduction amount that detected, in disbursement and sattlement to abduction side
Service fee is carried out to reduce.Subtracted simultaneously according to the abduction behavior that detected in IP address, region and the distribution situation of operator
Less or the advertisement of pause abduction side's advertising platform is launched；
2) it is directed to device manufacturer and Browser Hijack, by detected activation abduction amount, in conjunction with reappearing abduction
When experience screenshot promote manufacturer can by the addition of the APP installation kit of advertising platform of being held as a hostage by linking up with manufacturer's application market
Believe in the table of source.
But if the behavior of abduction, all without obvious characteristic, and passes through in IP sections, region, operator, type, browser etc.
The identification information for kidnapping equipment goes to look into download information with the channel number of abduction side and the side of being held as a hostage respectively, if misfortune can be found simultaneously
The side of holding and the download information put of being held as a hostage, then illustrate same period abduction side and the side's of being held as a hostage advertising platform all in this equipment
On launched the popularization advertisement of the APP, then correcting the activation is normal Activate.
Method provided by above-described embodiment, provides a kind of thinking for analyzing abduction mode, kidnaps analysis by judgement
Information and activation channel information are able to analyze the specific abduction type that abduction side kidnaps application downloading or installation APP, are
APP promoter provides foundation for activation anti-hijacking management.
Referring to fig. 4, the optional method flow for kidnapping detection of another provided according to embodiments of the present invention is shown to show
It is intended to, includes the following steps:
S401: according to the identification information of equipment, the downloading channel information and installation activation for obtaining device downloads application are answered
Activation channel information.
S402: when downloading channel information and activation channel information is not identical, corresponding with channel information is activated the is determined
One service platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
S403: first service platform is to the abduction amount of application in statistics predetermined amount of time, when abduction amount exceeds predetermined quantity
When threshold value, determine that first service platform is exception service platform.
In above embodiment, step S401 can be found in step S101 shown in Fig. 1, also may refer to step shown in Fig. 2
The description of S201 and S202；Step S402 can be found in the description of step S102 shown in Fig. 1, and details are not described herein.
In above embodiment, for step S403, APP promoter can monitor each advertising platform in real time and push away to APP
Wide situation is the advertising platform that number one is promoted by abduction mode especially, can carry out certain anti-hijacking strategy, with maintenance
The interests of each advertising platform, guaranteed benefit are rationalized.
Specifically, the interior abduction side of predetermined amount of time (for example, one day, 8 hours) can be counted in APP download phase or installation
The quantity that stage is kidnapped, when the quantity is without departing from predetermined quantity threshold value, it is possible to implement warning behavior；But when the quantity exceeds
When the predetermined quantity threshold value, the advertising platform can be determined for abnormal advertising platform.For abnormal advertising platform, APP promoter
Its advertisement promotion function can be cancelled, or take certain restriction.
Method provided by above-described embodiment provides a kind of for pipe used by the service platform with abduction behavior
Limitation mode is managed, especially abnormal advertising platform saves popularization funds convenient for APP promoter, reduces the loss of new user.
Referring to Fig. 5, the method flow signal that the one kind provided according to embodiments of the present invention specifically kidnaps detection is shown
Figure, includes the following steps:
S501: according to the identification information of equipment, determine what the download time of device downloads application and installation activation were applied
Activationary time.
S502: being located at after download time between when activating and is less than scheduled time threshold value with the time interval of download time
When, obtain downloading channel information and activation channel information.
S503: when downloading channel information and activation channel information is not identical, corresponding with channel information is activated the is determined
One service platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
S504: obtaining all abduction associated with first service platform and analyze information, true according to scheduled abduction mode
Set pattern then, determines that first service platform to the abduction mode of application, obtains anti-hijacking side corresponding with identified abduction mode
Formula.
S505: first service platform is to the abduction amount of application in statistics predetermined amount of time, when abduction amount exceeds predetermined quantity
When threshold value, determine that first service platform is exception service platform.
Equipment is being obtained after first service platform is to the download information of APP, is needing the identification information according to equipment, it is right
Download information carries out duplicate removal processing, is operated with removing same equipment in repeated downloads of the same service platform to the APP.
Wherein, equipment identification information includes device hardware identification information and device software identification information；Wherein, hardware mark
Know information include IMEI (International Mobile Equipment Identity, International Mobile Equipment Identity code),
At least one of MAC (Medium/Media Access Control), AndriodID, are also possible to the mode of a combination thereof,
Distinct device to be distinguished；Device software identification information includes that IP address, OS Type and version, type etc. are soft
At least one of part fingerprint is also possible to the mode of a combination thereof.It should be noted that equipment identification information includes but is not limited to
It is aforesaid way, can also be the information such as equipment brand, IDFA (Identifier For Identifier, advertisement identifier),
The present invention is herein with no restrictions.
It should be noted that there may be obtaining less than device hardware identification information in download information, at this time only
Device software identification information can be used, corresponding to the software identification information in active information；If device hardware mark can be got
Information then preferentially uses the identification information, corresponds to the device hardware identification information in active information at this time.
Method provided by above-described embodiment can be adapted for a plurality of types of abduction detections, and be able to detect specific misfortune
The side of holding, determine it is specific kidnap data, determine that the side of abductioning, while can foundation within a predetermined period of time to using kidnapped quantity
Download information determines that abduction side for the specific abduction mode of application, takes correlation right convenient for APP promoter for abduction mode
Plan, and save popularization funds, reduce customer churn.
Referring to Fig. 6, a kind of main modular signal of device 600 for kidnapping detection provided in an embodiment of the present invention is shown
Figure, comprising:
Data obtaining module 601 obtains the downloading channel information of device downloads application for the identification information according to equipment
And the activation channel information of installation activation application；
Determining module 602 is kidnapped, for when downloading channel information and activation channel information is not identical, determining and activation canal
Information corresponding first service platform in road is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
Data obtaining module 601 in implementing device of the present invention, is used for:
According to the identification information of equipment, when determining the activation that the download time of device downloads application and installation activation are applied
Between；
When being located at after download time between when activating and being less than scheduled time threshold value with the time interval of download time, obtain
It removes and carries channel information and activation channel information.
Implementing device of the present invention further includes abduction mode determining module 603, is used for: being obtained associated with first service platform
All abduction analyze information, according to scheduled abduction mode determine rule, determine first service platform to the abduction side of application
Formula obtains anti-hijacking mode corresponding with identified abduction mode.
Implementing device of the present invention further includes abnormal determining module 604, is used for: first service platform in statistics predetermined amount of time
To the abduction amount of application, when abduction amount exceeds predetermined quantity threshold value, determine that first service platform is exception service platform.
Implementing device of the present invention further includes that downloading channel information includes at least downloading channel number, and activation channel information is at least
Including activating channel number.
Device provided by above-described embodiment can be adapted for a plurality of types of abduction detections, and be able to detect specific misfortune
The side of holding, determine it is specific kidnap data, determine that the side of abductioning, while can foundation within a predetermined period of time to using kidnapped quantity
Download information determines that abduction side for the specific abduction mode of application, takes correlation right convenient for APP promoter for abduction mode
Plan, and save popularization funds, reduce customer churn.
In addition, the specific implementation content of the abduction detection device described in embodiments of the present invention, abduction described above
It has been described in detail in detection method, therefore has no longer illustrated in this duplicate contents.
The exemplary of the abduction detection method or abduction detection device that can apply the embodiment of the present invention is shown referring to Fig. 7
System architecture 700.
As shown in fig. 7, system architecture 700 may include terminal device 701,702,703, network 704 and server 705.
Network 704 between terminal device 701,702,703 and server 705 to provide the medium of communication link.Network 704 can be with
Including various connection types, such as wired, wireless communication link or fiber optic cables etc..
User can be used terminal device 701,702,703 and be interacted by network 704 with server 705, to receive or send out
It delivers letters breath etc..Various telecommunication customer end applications, such as the application of shopping class, net can be installed on terminal device 701,702,703
(merely illustrative) such as the application of page browsing device, searching class application, instant messaging tools, mailbox client, social platform softwares.
Terminal device 701,702,703 can be the various electronic equipments with display screen and supported web page browsing, packet
Include but be not limited to smart phone, tablet computer, pocket computer on knee and desktop computer etc..
Server 705 can be to provide the server of various services, such as utilize terminal device 701,702,703 to user
The shopping class website browsed provides the back-stage management server (merely illustrative) supported.Back-stage management server can be to reception
To the data such as information query request analyze etc. processing, and by processing result (such as target push information, product letter
Breath -- merely illustrative) feed back to terminal device.
It should be noted that predictive behavior method provided by the embodiment of the present invention is generally executed by server 705, accordingly
Ground, predictive behavior device are generally positioned in server 705.
It should be understood that the number of terminal device, network and server in Fig. 7 is only schematical.According to realization need
It wants, can have any number of terminal device, network and server.
Referring to Fig. 8, it illustrates the knots of the computer system 800 for the terminal device for being suitable for being used to realize the embodiment of the present invention
Structure schematic diagram.Terminal device shown in Fig. 8 is only an example, should not function and use scope band to the embodiment of the present invention
Carry out any restrictions.
As shown in figure 8, computer system 800 includes central processing unit (CPU) 801, it can be read-only according to being stored in
Program in memory (ROM) 802 or be loaded into the program in random access storage device (RAM) 803 from storage section 808 and
Execute various movements appropriate and processing.In RAM 803, also it is stored with system 800 and operates required various programs and data.
CPU 801, ROM 802 and RAM 803 are connected with each other by bus 804.Input/output (I/O) interface 805 is also connected to always
Line 804.
I/O interface 805 is connected to lower component: the importation 806 including keyboard, mouse etc.；It is penetrated including such as cathode
The output par, c 807 of spool (CRT), liquid crystal display (LCD) etc. and loudspeaker etc.；Storage section 808 including hard disk etc.；
And the communications portion 809 of the network interface card including LAN card, modem etc..Communications portion 809 via such as because
The network of spy's net executes communication process.Driver 810 is also connected to I/O interface 805 as needed.Detachable media 811, such as
Disk, CD, magneto-optic disk, semiconductor memory etc. are mounted on as needed on driver 810, in order to read from thereon
Computer program be mounted into storage section 808 as needed.
Particularly, disclosed embodiment, the process described above with reference to flow chart may be implemented as counting according to the present invention
Calculation machine software program.For example, embodiment disclosed by the invention includes a kind of computer program product comprising be carried on computer
Computer program on readable medium, the computer program include the program code for method shown in execution flow chart.?
In such embodiment, which can be downloaded and installed from network by communications portion 809, and/or from can
Medium 811 is dismantled to be mounted.When the computer program is executed by central processing unit (CPU) 801, system of the invention is executed
The above-mentioned function of middle restriction.
It should be noted that computer-readable medium shown in the present invention can be computer-readable signal media or meter
Calculation machine readable storage medium storing program for executing either the two any combination.Computer readable storage medium for example can be --- but not
Be limited to --- electricity, magnetic, optical, electromagnetic, infrared ray or semiconductor system, device or device, or any above combination.Meter
The more specific example of calculation machine readable storage medium storing program for executing can include but is not limited to: have the electrical connection, just of one or more conducting wires
Taking formula computer disk, hard disk, random access storage device (RAM), read-only memory (ROM), erasable type may be programmed read-only storage
Device (EPROM or flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), light storage device, magnetic memory device,
Or above-mentioned any appropriate combination.In the present invention, computer readable storage medium can be it is any include or storage journey
The tangible medium of sequence, the program can be commanded execution system, device or device use or in connection.And at this
In invention, computer-readable signal media may include in a base band or as carrier wave a part propagate data-signal,
Wherein carry computer-readable program code.The data-signal of this propagation can take various forms, including but unlimited
In electromagnetic signal, optical signal or above-mentioned any appropriate combination.Computer-readable signal media can also be that computer can
Any computer-readable medium other than storage medium is read, which can send, propagates or transmit and be used for
By the use of instruction execution system, device or device or program in connection.Include on computer-readable medium
Program code can transmit with any suitable medium, including but not limited to: wireless, electric wire, optical cable, RF etc. are above-mentioned
Any appropriate combination.
Flow chart and block diagram in attached drawing are illustrated according to the system of various embodiments of the invention, method and computer journey
The architecture, function and operation in the cards of sequence product.In this regard, each box in flowchart or block diagram can generation
A part of one module, program segment or code of table, a part of above-mentioned module, program segment or code include one or more
Executable instruction for implementing the specified logical function.It should also be noted that in some implementations as replacements, institute in box
The function of mark can also occur in a different order than that indicated in the drawings.For example, two boxes succeedingly indicated are practical
On can be basically executed in parallel, they can also be executed in the opposite order sometimes, and this depends on the function involved.Also it wants
It is noted that the combination of each box in block diagram or flow chart and the box in block diagram or flow chart, can use and execute rule
The dedicated hardware based systems of fixed functions or operations is realized, or can use the group of specialized hardware and computer instruction
It closes to realize.
Being described in module involved in the embodiment of the present invention can be realized by way of software, can also be by hard
The mode of part is realized.Described module also can be set in the processor, for example, can be described as: a kind of processor packet
It includes data obtaining module, kidnap determining module.Wherein, the title of these modules is not constituted under certain conditions to the module sheet
The restriction of body, for example, data obtaining module is also described as " channel information acquisition module ".
As on the other hand, the present invention also provides a kind of computer-readable medium, which be can be
Included in equipment described in above-described embodiment；It is also possible to individualism, and without in the supplying equipment.Above-mentioned calculating
Machine readable medium carries one or more program, when said one or multiple programs are executed by the equipment, makes
Obtaining the equipment includes:
According to the identification information of equipment, the downloading channel information of device downloads application and swashing for installation activation application are obtained
Channel information living；
When downloading channel information and activation channel information is not identical, first service corresponding with activation channel information is determined
Platform is abduction side, second service platform corresponding with downloading channel information is the side of being held as a hostage.
Technical solution according to an embodiment of the present invention can be adapted for a plurality of types of abduction detections, and be able to detect tool
Body abduction side, determine it is specific kidnap data, determine that the side of abductioning, while can be within a predetermined period of time to using kidnapped quantity
Determine that abduction side for the specific abduction mode of application, takes phase for abduction mode convenient for APP promoter according to download information
Countermeasure is closed, and saves popularization funds, reduce customer churn.
Above-mentioned specific embodiment, does not constitute a limitation on the scope of protection of the present invention.Those skilled in the art should be bright
It is white, design requirement and other factors are depended on, various modifications, combination, sub-portfolio and substitution can occur.It is any
Made modifications, equivalent substitutions and improvements etc. within the spirit and principles in the present invention, should be included in the scope of the present invention
Within.
Claims (12)
1. a kind of method for kidnapping detection characterized by comprising
According to the identification information of equipment, the downloading channel information and installation for obtaining the device downloads application activate the application
Activation channel information；
When the downloading channel information and the activation channel information be not identical, determination is corresponding with the activation channel information
First service platform is abduction side, second service platform corresponding with the downloading channel information is the side of being held as a hostage.
2. the method according to claim 1, wherein the identification information according to equipment, obtains the equipment
The downloading channel information of downloading application and the activation channel information of the installation activation application include:
According to the identification information of the equipment, the download time applied described in the device downloads and installation activation are determined
The activationary time of the application；
It is less than the predetermined time after activationary time is located at the download time and with the time interval of the download time
When threshold value, the downloading channel information and the activation channel information are obtained.
3. the method according to claim 1, wherein in the determination corresponding with the activation channel information
One service platform is abduction side, second service platform corresponding with the downloading channel information for after the side of being held as a hostage, further includes:
It obtains all abduction associated with the first service platform and analyzes information, determined and advised according to scheduled abduction mode
Then, the first service platform is determined to the abduction mode of the application, obtains counter rob corresponding with identified abduction mode
Hold mode.
4. the method according to claim 1, wherein in the determination corresponding with the activation channel information
One service platform is abduction side, second service platform corresponding with the downloading channel information for after the side of being held as a hostage, further includes:
Count in predetermined amount of time that the first service platform is to the abduction amount of the application, when the abduction amount exceeds predetermined number
When measuring threshold value, determine that the first service platform is exception service platform.
5. method according to any of claims 1-4, which is characterized in that the downloading channel information includes at least down
Channel number is carried, the activation channel information includes at least activation channel number.
6. a kind of device for kidnapping detection characterized by comprising
Data obtaining module, for the identification information according to equipment, obtain the downloading channel information of the device downloads application with
And installation activates the activation channel information of the application；
Kidnap determining module, for when the downloading channel information and the activation channel information it is not identical when, determine with it is described
The activation corresponding first service platform of channel information is abduction side, second service platform corresponding with the downloading channel information is
The side of being held as a hostage.
7. device according to claim 6, which is characterized in that the data obtaining module is used for:
According to the identification information of the equipment, the download time applied described in the device downloads and installation activation are determined
The activationary time of the application；
It is less than the predetermined time after activationary time is located at the download time and with the time interval of the download time
When threshold value, the downloading channel information and the activation channel information are obtained.
8. device according to claim 6, which is characterized in that further include abduction mode determining module, be used for:
It obtains all abduction associated with the first service platform and analyzes information, determined and advised according to scheduled abduction mode
Then, the first service platform is determined to the abduction mode of the application, obtains counter rob corresponding with identified abduction mode
Hold mode.
9. device according to claim 6, which is characterized in that further include abnormal determining module, be used for:
Count in predetermined amount of time that the first service platform is to the abduction amount of the application, when the abduction amount exceeds predetermined number
When measuring threshold value, determine that the first service platform is exception service platform.
10. the device according to any one of claim 6-9, which is characterized in that the downloading channel information includes at least
Channel number is downloaded, the activation channel information includes at least activation channel number.
11. a kind of electronic equipment characterized by comprising
One or more processors；
Storage device, for storing one or more programs,
When one or more of programs are executed by one or more of processors, so that one or more of processors are real
Now such as method as claimed in any one of claims 1 to 5.
12. a kind of computer-readable medium, is stored thereon with computer program, which is characterized in that described program is held by processor
Such as method as claimed in any one of claims 1 to 5 is realized when row.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810145070.4A CN110149298B (en) | 2018-02-12 | 2018-02-12 | Hijacking detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810145070.4A CN110149298B (en) | 2018-02-12 | 2018-02-12 | Hijacking detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110149298A true CN110149298A (en) | 2019-08-20 |
| CN110149298B CN110149298B (en) | 2023-08-08 |
Family
ID=67588346
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810145070.4A Active CN110149298B (en) | 2018-02-12 | 2018-02-12 | Hijacking detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110149298B (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110648180A (en) * | 2019-09-27 | 2020-01-03 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel and electronic equipment |
| CN110659943A (en) * | 2019-09-27 | 2020-01-07 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel based on user structure characteristics and electronic equipment |
| CN111092993A (en) * | 2020-03-20 | 2020-05-01 | 北京热云科技有限公司 | Method and system for detecting hijacking behavior of apk file |
| CN111367963A (en) * | 2020-02-28 | 2020-07-03 | 北京百度网讯科技有限公司 | Method, device and equipment for determining source channel and computer storage medium |
| CN111510429A (en) * | 2020-03-11 | 2020-08-07 | 南京大学 | Analysis and detection method and system for flow hijacking in android system application and popularization |
| CN111784380A (en) * | 2020-06-05 | 2020-10-16 | 北京沃东天骏信息技术有限公司 | Advertisement putting attribution method and device |
| CN111818019A (en) * | 2020-06-19 | 2020-10-23 | 五八有限公司 | Method, device, equipment and medium for determining network hijacking data or network hijacking |
| CN112256520A (en) * | 2020-09-17 | 2021-01-22 | 北京一亩田新农网络科技有限公司 | Method and device for monitoring webpage publishing channel of application program |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103617544A (en) * | 2013-11-27 | 2014-03-05 | 友盟同欣（北京）科技有限公司 | Channel effect monitoring method and system |
| CN104182686A (en) * | 2013-05-23 | 2014-12-03 | 阿里巴巴集团控股有限公司 | Method and device for detecting Activity hijacking risk of Android system |
| CN104217140A (en) * | 2014-08-29 | 2014-12-17 | 北京奇虎科技有限公司 | Method and device for reinforcing application program |
| CN104216748A (en) * | 2014-09-03 | 2014-12-17 | 腾讯科技（深圳）有限公司 | Application program installation method, device and system |
| CN105574410A (en) * | 2015-12-15 | 2016-05-11 | 北京金山安全软件有限公司 | Application program safety detection method and device |
| CN106060046A (en) * | 2016-05-30 | 2016-10-26 | 努比亚技术有限公司 | Device for preventing downloading hijack, mobile terminal and method |
| WO2017078199A1 (en) * | 2015-11-05 | 2017-05-11 | 주식회사 수산이앤티 | Mobile application embedding method, control server for realizing mobile application embedding, and computer-readable recording medium |
-
2018
- 2018-02-12 CN CN201810145070.4A patent/CN110149298B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104182686A (en) * | 2013-05-23 | 2014-12-03 | 阿里巴巴集团控股有限公司 | Method and device for detecting Activity hijacking risk of Android system |
| CN103617544A (en) * | 2013-11-27 | 2014-03-05 | 友盟同欣（北京）科技有限公司 | Channel effect monitoring method and system |
| CN104217140A (en) * | 2014-08-29 | 2014-12-17 | 北京奇虎科技有限公司 | Method and device for reinforcing application program |
| CN104216748A (en) * | 2014-09-03 | 2014-12-17 | 腾讯科技（深圳）有限公司 | Application program installation method, device and system |
| WO2017078199A1 (en) * | 2015-11-05 | 2017-05-11 | 주식회사 수산이앤티 | Mobile application embedding method, control server for realizing mobile application embedding, and computer-readable recording medium |
| CN105574410A (en) * | 2015-12-15 | 2016-05-11 | 北京金山安全软件有限公司 | Application program safety detection method and device |
| CN106060046A (en) * | 2016-05-30 | 2016-10-26 | 努比亚技术有限公司 | Device for preventing downloading hijack, mobile terminal and method |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110659943A (en) * | 2019-09-27 | 2020-01-07 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel based on user structure characteristics and electronic equipment |
| CN110648180A (en) * | 2019-09-27 | 2020-01-03 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel and electronic equipment |
| CN110648180B (en) * | 2019-09-27 | 2023-05-12 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel and electronic equipment |
| CN110659943B (en) * | 2019-09-27 | 2023-03-31 | 上海淇玥信息技术有限公司 | Method and device for adjusting delivery channel based on user structure characteristics and electronic equipment |
| CN111367963B (en) * | 2020-02-28 | 2023-07-25 | 北京百度网讯科技有限公司 | Method, device, equipment and computer storage medium for determining source channel |
| CN111367963A (en) * | 2020-02-28 | 2020-07-03 | 北京百度网讯科技有限公司 | Method, device and equipment for determining source channel and computer storage medium |
| CN111510429B (en) * | 2020-03-11 | 2021-07-09 | 南京大学 | Analysis and detection method and system for flow hijacking in android system application and popularization |
| CN111510429A (en) * | 2020-03-11 | 2020-08-07 | 南京大学 | Analysis and detection method and system for flow hijacking in android system application and popularization |
| CN111092993B (en) * | 2020-03-20 | 2020-06-30 | 北京热云科技有限公司 | Method and system for detecting hijacking behavior of apk file |
| CN111092993A (en) * | 2020-03-20 | 2020-05-01 | 北京热云科技有限公司 | Method and system for detecting hijacking behavior of apk file |
| CN111784380A (en) * | 2020-06-05 | 2020-10-16 | 北京沃东天骏信息技术有限公司 | Advertisement putting attribution method and device |
| CN111784380B (en) * | 2020-06-05 | 2024-05-24 | 北京沃东天骏信息技术有限公司 | Advertisement putting attribution method and device |
| CN111818019A (en) * | 2020-06-19 | 2020-10-23 | 五八有限公司 | Method, device, equipment and medium for determining network hijacking data or network hijacking |
| CN112256520A (en) * | 2020-09-17 | 2021-01-22 | 北京一亩田新农网络科技有限公司 | Method and device for monitoring webpage publishing channel of application program |
| CN112256520B (en) * | 2020-09-17 | 2023-12-15 | 北京一亩田新农网络科技有限公司 | Method and device for monitoring webpage distribution channel of application program |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110149298B (en) | 2023-08-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110149298A (en) | A kind of method and apparatus for kidnapping detection | |
| CN102651856B (en) | Method, system and device for improving Internet surfing security of terminal | |
| CN105389263B (en) | Application software authority monitoring method, system and equipment | |
| CN108319662A (en) | Page processing method, device, electronic equipment and readable storage medium storing program for executing | |
| CN105939362A (en) | User account management method and device | |
| CN105610819B (en) | The method and apparatus of the query service of server info are provided | |
| CN106845223A (en) | Method and apparatus for detecting malicious code | |
| CN109254914A (en) | Software development kit test method, system, computer installation and readable storage medium storing program for executing | |
| CN107634947A (en) | Limitation malice logs in or the method and apparatus of registration | |
| CN109347921A (en) | A kind for the treatment of method and apparatus of digital certificate business | |
| CN109582873A (en) | Method and apparatus for pushed information | |
| CN109815105A (en) | Applied program testing method and device based on Btrace | |
| CN104426960B (en) | A kind of trial method and device of payment applications | |
| CN106682491A (en) | Application downloading method and device | |
| CN112308590B (en) | Parameter processing method and device, computing equipment and storage medium | |
| CN104462934B (en) | A kind of information processing method and electronic equipment | |
| CN107609953A (en) | The quick treating method and apparatus of order | |
| CN106856474A (en) | A kind of processing method and processing device of checking information | |
| CN109818972A (en) | A kind of industrial control system information security management method, device and electronic equipment | |
| CN107067244A (en) | Service implementation method, method of payment, business realizing device and payment services end | |
| CN109587197A (en) | It is associated with the methods, devices and systems of reported data | |
| CN105188059A (en) | Authentication method based on Portal server abnormity, and wireless access point | |
| CN105591842B (en) | A kind of method and apparatus obtaining mobile terminal operating system version | |
| CN105447348B (en) | A kind of hidden method of display window, device and user terminal | |
| CN109145591B (en) | Plug-in loading method of application program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |