CN116991748B

CN116991748B - Early warning method and device for abnormal application, electronic equipment and storage medium

Info

Publication number: CN116991748B
Application number: CN202311257226.5A
Authority: CN
Inventors: 杜麒麟; 李斌; 李志超; 黄声成; 陈育武
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2023-09-27
Filing date: 2023-09-27
Publication date: 2024-01-12
Anticipated expiration: 2043-09-27
Also published as: CN116991748A

Abstract

The application discloses an early warning method, device, electronic equipment and storage medium for abnormal application, which can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic, internet of vehicles and the like, and the method comprises the following steps: executing automatic test on a third party application in the preset application, and acquiring a test result page; determining the similarity between the test result page and a preset blank page; if the similarity is smaller than a preset similarity threshold, extracting text information in a test result page; if the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page; and under the condition that the popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application. The method and the device improve the identification efficiency and the identification accuracy of the abnormal third party application in the preset application.

Description

Early warning method and device for abnormal application, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a method and apparatus for early warning of abnormal applications, an electronic device, and a storage medium.

Background

The third party applications that are currently searchable in the preset applications are less available. There are a number of applications for reporting errors and applications for obtaining user clues for the casing that need to be cleaned urgently.

In the prior art, the third party application released by the third party application market in the preset application is manually screened, so that the abnormal application is identified, a large amount of human resources are required to be consumed, the identification cost of the abnormal application is higher, and the identification efficiency is lower.

Disclosure of Invention

The application provides an early warning method and device for abnormal applications, electronic equipment and a storage medium, which can improve the recognition efficiency and recognition accuracy of abnormal third party applications in preset applications; the probability of abnormal third party applications published in the preset application is reduced, and the quality of the third party applications in the preset application is improved.

In one aspect, the present application provides a method for early warning of abnormal applications, where the method includes:

executing automatic test on a third party application in preset applications, and acquiring a test result page corresponding to the third party application;

determining the similarity between the test result page and a preset blank page;

if the similarity is smaller than a preset similarity threshold, extracting text information in the test result page;

If the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; the target text characterizes the test result page as an error display page;

if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page;

and under the condition that a popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In another aspect, an early warning device for abnormal applications is provided, the device includes:

the test result acquisition module is used for executing automatic test on a third party application in preset applications and acquiring a test result page corresponding to the third party application;

the similarity determining module is used for determining the similarity between the test result page and a preset blank page;

the text information extraction module is used for extracting text information in the test result page if the similarity is smaller than a preset similarity threshold value;

the injection result determining module is used for injecting a preset test tool into the test result page if the text information does not contain the target text, so as to obtain an injection result; the target text characterizes the test result page as an error display page;

The popup determining module is used for determining that a popup exists in the test result page if the injection result represents the injection failure of the preset test tool;

and the application early warning module is used for determining the third party application as an abnormal application under the condition that a popup window exists in the test result page, and executing an early warning strategy on the abnormal application.

In another aspect, an electronic device is provided, where the device includes a processor and a memory, where at least one instruction or at least one program is stored, where the at least one instruction or the at least one program is loaded and executed by the processor to implement a method for warning of abnormal applications as described above.

Another aspect provides a computer storage medium storing at least one instruction or at least one program loaded and executed by a processor to implement the method of warning of abnormal applications as described above.

Another aspect provides a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions so that the computer device executes to implement the method of early warning of abnormal applications as described above.

The early warning method, the early warning device, the electronic equipment and the storage medium for abnormal application have the following technical effects:

the method comprises the steps that automatic testing is conducted on a third party application in preset applications, and a testing result page corresponding to the third party application is obtained; determining the similarity between the test result page and a preset blank page; if the similarity is smaller than a preset similarity threshold, extracting text information in a test result page; if the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; the target text characterizes the test result page as an error display page; if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page; and under the condition that the popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application. Compared with a manual identification method, the identification efficiency and the identification accuracy of the abnormal third party application in the preset application are improved, and the identification cost of the abnormal application is reduced; and early warning is carried out on the abnormal application in time, so that the probability of the abnormal third party application released in the preset application can be reduced, and the quality of the third party application in the preset application is improved.

Drawings

In order to more clearly illustrate the embodiments of the present description or the technical solutions and advantages of the prior art, the following description will briefly explain the drawings used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort to a person skilled in the art.

FIG. 1 is a schematic diagram of an early warning system for abnormal applications provided in an embodiment of the present disclosure;

fig. 2 is a flow chart of an early warning method for abnormal application according to an embodiment of the present disclosure;

FIG. 3 is a flowchart illustrating a method for determining the similarity between the test result page and the preset blank page according to the embodiment of the present disclosure;

FIG. 4 is a flowchart illustrating an example of a method for executing an early warning policy on an abnormal application according to an embodiment of the present disclosure;

FIG. 5 is a flowchart illustrating an exemplary second method for executing an early warning policy for an abnormal application according to an embodiment of the present disclosure;

FIG. 6 is a flowchart illustrating an example III of a method for executing an early warning policy for an abnormal application according to an embodiment of the present disclosure;

Fig. 7 is a schematic diagram of a display interface of a target terminal according to an embodiment of the present disclosure;

fig. 8 is a flow chart of an early warning method corresponding to an early warning system for abnormal application according to an embodiment of the present disclosure;

fig. 9 is a flow chart of another method for early warning of abnormal applications according to an embodiment of the present disclosure;

fig. 10 is a schematic structural diagram of an early warning device for abnormal application according to an embodiment of the present disclosure;

fig. 11 is a schematic structural diagram of a server according to an embodiment of the present disclosure.

Detailed Description

The technical solutions of the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present application based on the embodiments herein.

It should be noted that the terms "first," "second," and the like in the description and claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that embodiments of the present application described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or server that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Referring to fig. 1, fig. 1 is a schematic diagram of an early warning system for abnormal applications according to an embodiment of the present disclosure, and as shown in fig. 1, the early warning system for abnormal applications may at least include a server 01 and a client 02.

Specifically, in the embodiment of the present disclosure, the server 01 may include a server that operates independently, or a distributed server, or a server cluster that is formed by a plurality of servers, and may also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network ), and basic cloud computing services such as big data and artificial intelligence platforms. The server 01 may include a network communication unit, a processor, a memory, and the like. Specifically, the server 01 may be used for screening a third party application having an abnormality in the preset application.

Specifically, in the embodiment of the present disclosure, the client 02 may include smart phones, desktop computers, tablet computers, notebook computers, digital assistants, smart wearable devices, smart speakers, vehicle terminals, smart televisions, and other types of physical devices, or may include software running in the physical devices, for example, web pages provided by some service providers to users, or may also provide applications provided by the service providers to users. Specifically, the client 02 may be configured to display a third party application having an abnormality in the preset application.

In the following, an early warning method for abnormal applications of the present application is described, and fig. 2 is a schematic flow chart of an early warning method for abnormal applications provided in an embodiment of the present disclosure, where the method operation steps described in the embodiment or the flowchart are provided, but more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps recited in the embodiments is merely one way of performing the order of steps and does not represent a unique order of execution. When implemented in a real system or server product, the methods illustrated in the embodiments or figures may be performed sequentially or in parallel (e.g., in a parallel processor or multithreaded environment). As shown in fig. 2, the method may include:

s201: and executing automatic test on a third party application in the preset application, and acquiring a test result page corresponding to the third party application.

In the embodiment of the present specification, the preset applications may include, but are not limited to, an instant messaging application, a video application, and the like, and the third party applications in the preset applications may be applications published in a third party application market corresponding to the preset applications, and the third party applications may be at least two; third party applications are related software developed by other organizations or individuals than the software composer for some software or application's functional inadequacies. For example, a preset number of third party applications may be screened from the third party application market for automated testing; the preset number may be set according to actual situations, for example, 300. Or can be automatically tested for all searched third party applications in the third party application market; and then obtaining a test result page corresponding to each third party application.

In the embodiment of the specification, an automated test may be performed on a third party application in a preset application every a first preset period; for example, automated testing is performed on third party applications in a preset application every other week or two weeks, and for example, automated testing may be performed on third party applications every week day.

S203: and determining the similarity between the test result page and a preset blank page.

In this embodiment of the present disclosure, as shown in fig. 3, determining the similarity between the test result page and the preset blank page includes:

s2031: obtaining a screenshot corresponding to the test result page;

s2033: cutting the edge area of the screenshot to obtain a cut image;

s2035: acquiring a white screen image corresponding to the preset blank page;

s2037: determining the similarity between the clipping image and the white screen image;

s2039: and determining the similarity between the test result page and a preset blank page according to the similarity between the cut image and the white screen image.

In embodiments of the present description, a test results page may be screenshot, and an edge region may include a top region, a bottom region (e.g., a system notification bar) in the page, etc.; then cutting the edge area to obtain a cutting image, wherein the cutting image comprises the text content of the test result in the test result page; by cutting the screenshot, the accuracy of the similarity result can be improved. The preset blank page can be a page without any interactive Interface display (UI) element; default setting of a preset blank page is a white screen image, and similarity between a cut image and the white screen image can be calculated through image feature extraction; and determining the similarity between the test result page and a preset blank page according to the similarity between the cut image and the white screen image. For example, the similarity between the clipping image and the white screen image can be directly used as the similarity between the test result page and the preset blank page.

In an embodiment of the present disclosure, determining, according to a similarity between the cropped image and the white screen image, a similarity between the test result page and a preset blank page includes:

and if the similarity between the cut image and the white screen image is greater than or equal to the preset similarity threshold, determining the similarity between the cut image and the white screen image as the similarity between the test result page and the preset blank page.

In the embodiment of the present disclosure, if the similarity between the cut image and the white screen image is greater than or equal to the preset similarity threshold, the similarity between the cut image and the white screen image may be determined as the similarity between the test result page and the preset blank page. If the similarity between the cut image and the white screen image is smaller than a preset similarity threshold value, determining that the initial result of the cut image is a non-blank image; in order to improve the accuracy of the image judgment result, for example, in order to eliminate the influence of the dark area in the cut image on the similarity result, a black screen image corresponding to the preset blank page can be further obtained, and then the similarity between the cut image and the black screen image is calculated, so that whether the interactive interface display element exists in the cut image is further judged.

In the embodiment of the present disclosure, determining, according to the similarity between the clip image and the white screen image, the similarity between the test result page and the preset blank page includes:

if the similarity between the cut image and the white screen image is smaller than the preset similarity threshold value, acquiring a black screen image corresponding to the preset blank page;

determining the similarity between the clipping image and the black screen image;

and determining the similarity between the cut image and the black screen image as the similarity between the test result page and the preset blank page.

In the embodiment of the present disclosure, in order to eliminate the influence of the dark area in the cut image on the similarity result, if the similarity between the cut image and the white screen image is smaller than the preset similarity threshold, the black screen image corresponding to the preset blank page may be further obtained, and then the similarity between the cut image and the black screen image is calculated, so as to further determine whether the interactive interface display element exists in the cut image, thereby improving the accuracy of the image determination result.

S205: and if the similarity is smaller than a preset similarity threshold, extracting text information in the test result page.

In the embodiment of the present disclosure, it may be determined that the test result page is a non-blank page including the interactive interface display element when the similarity between the test result page and the preset blank page is less than the preset similarity threshold. The preset similarity threshold value can be set according to actual conditions; under the condition that the test result page is determined to be a non-blank page, text information in the test result page can be extracted; illustratively, characters in the test results page may be extracted by OCR (Optical Character Recognition ) techniques to obtain text information; OCR refers to the process in which an electronic device (e.g., a scanner or digital camera) examines characters printed on paper, determines their shape by detecting dark and light patterns, and then translates the shape into computer text using a character recognition method.

In an embodiment of the present disclosure, the method further includes:

if the similarity is greater than or equal to the preset similarity threshold, determining that no interactive interface element exists in the test result page;

and under the condition that the interactive interface element does not exist in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In the embodiment of the present disclosure, it may be determined that no interactive interface element exists in the test result page when the similarity between the test result page and the preset blank page is greater than or equal to a preset similarity threshold; the text page in the test result page can be determined to be a blank page, at the moment, the test result page can be determined to be an abnormal page, the third party application corresponding to the test result page is determined to be an abnormal application, and an early warning strategy is executed on the abnormal application.

In the embodiment of the specification, under normal conditions, the text page in the normal third-party application includes an interactive interface display element, and if the text page in the third-party application includes the interactive interface display element, the corresponding third-party application can be determined to be an abnormal application; according to the similarity between the test result page and the preset blank page, whether the third party application is an abnormal application or not can be determined, and therefore the recognition accuracy and recognition efficiency of the abnormal application are improved.

S207: if the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; the target text characterizes the test result page as an error display page.

In this specification embodiment, the target text may include, but is not limited to, error, failure, authority, invalid, unassociated, unauthorized, contact with a facilitator, contact with an administrator, contact with a customer service, no use, etc. The target text characterizes the test result page as an error display page; if the target text does not exist in the text information, the test result page is determined to be a non-error display page. At this time, it may be further determined whether a pop-up window exists in the test result page, and in particular, may be determined by injecting a preset test tool into the test result page. The preset test tool may be webdriver or other test tools, where webdriver is a tool for performing complex automated web page testing. The injection result can comprise an injection success result and an injection failure result, if the injection result is the injection success result, the fact that no popup window exists in the test result page is indicated, and the non-abnormal application of the third party application corresponding to the test result page can be preliminarily determined; if the injection result is the injection failure result, the test result page is indicated to contain a popup window, and the third party application corresponding to the test result page can be determined to be an abnormal application. The popup window is a system popup window applied by a third party, a single-process language is used in an automatic test process, and if the popup window appears, the whole process can be blocked, and at the moment, the injection failure of a preset test tool can be caused. Therefore, whether a popup window exists in the test result page can be determined according to the injection result of the preset test tool. The popup window is a reminding popup window corresponding to page acquisition failure; therefore, in the case that the test result page is determined to contain the popup window, the third party application corresponding to the test result page can be determined to be the abnormal application.

In an embodiment of the present disclosure, the method further includes:

if the text information contains a target text, determining that the test result page is an error display page;

and under the condition that the test result page is an error display page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In this specification embodiment, the target text may include, but is not limited to, error, failure, authority, invalid, unassociated, unauthorized, contact with a facilitator, contact with an administrator, contact with a customer service, no use, etc. The target text characterizes the test result page as an error display page; if the text information contains the target text, determining that the test result page is an error display page; and under the condition that the test result page is an error display page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In the embodiment of the present specification, whether the test result page is an error display page may be determined according to text information extracted from the test result page; therefore, whether the third party application is an abnormal application or not is further determined, and the recognition accuracy and recognition efficiency of the abnormal application are improved.

S209: if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page.

In the embodiment of the present disclosure, if the injection result is the injection failure result, it is indicated that the test result page includes a popup window, and it may be determined that the third party application corresponding to the test result page is an abnormal application. The popup window is a system popup window applied by a third party, a single-process language is used in an automatic test process, and if the popup window appears, the whole process can be blocked, and at the moment, the injection failure of a preset test tool can be caused. Therefore, whether a popup window exists in the test result page can be determined according to the injection result of the preset test tool.

S2011: and under the condition that a popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In the embodiment of the present disclosure, the popup window is a prompting popup window corresponding to a page acquisition failure; therefore, in the case that the test result page is determined to contain the popup window, the third party application corresponding to the test result page can be determined to be the abnormal application.

In the embodiment of the present disclosure, as shown in fig. 4, the method further includes:

S401: if the injection result represents that the injection of the preset test tool is successful, determining that a popup window exists in the test result page;

s403: acquiring a page control element set corresponding to the third party application based on the preset test tool;

s405: if no target element exists in the page control element set, determining that no page jump link exists in the test result page; the target element is an element in the page jump link;

s407: and under the condition that the page jump link does not exist in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

In the embodiment of the present disclosure, if the injection result is a successful injection result, it is indicated that there is no popup window in the test result page, and it may be determined preliminarily that the third party application corresponding to the test result page is not an abnormal application; at this time, a page control element set corresponding to all pages in the third party application can be obtained through a preset test tool. The target element may be an element in the page jump link, e.g., the target element may be an element < a/>, < href/>, etc.; this element is typically an element that would not exist in the page jump link. Whether the page jump link exists in the test result page or not can be judged through the target element.

In the embodiment of the specification, the page jump link is used for performing page jump, and if the page jump link does not exist in the test result page, it can be determined that the third party application cannot perform page jump, and the third party application is determined to be an abnormal application, so that the recognition accuracy and recognition efficiency of the abnormal application are improved; and executing an early warning strategy for the abnormal application.

In this embodiment of the present disclosure, as shown in fig. 5, the method further includes:

s501: if the target elements exist in the page control element set, determining that the page jump links exist in the test result page, and acquiring a preset open source visual library; the target element is an element carried in a page jump link; the preset open source visual library is used for determining whether a two-dimensional code exists in the test result page;

s503: if the two-dimensional code exists in the test result page based on the preset open source visual library, determining that the third party application is an abnormal application, and executing the early warning strategy on the abnormal application.

In the embodiment of the present disclosure, if the target element does not exist in the page control element set, it may be determined that the page jump link does not exist in the test result page, and at this time, the preset open source visual library may be further obtained to further determine whether the two-dimensional code exists in the test result page.

In this embodiment of the present disclosure, the preset open source visual library may be an openCV library, which is an open source computer visual library. The method is lightweight and efficient, is composed of a series of C functions and a small number of C++ types, and can be applied to the fields of object recognition, machine vision and the like. In this embodiment, the two-dimensional code in the test result page can be identified through the openCV library. If the two-dimensional code exists in the test result page based on the preset open source visual library, the third party application can be determined to be an abnormal application, and the early warning strategy is executed on the abnormal application. In order to avoid excessive disturbance to a user, the two-dimensional code is usually an advertisement of a third party application, and the third party application corresponding to the page with the two-dimensional code can be determined to be an abnormal application, so that the recognition accuracy and recognition efficiency of the abnormal application are improved, and the user experience is improved.

In an embodiment of the present disclosure, the method further includes:

and if the two-dimensional code does not exist in the test result page based on the preset open source visual library, determining that the third party application is a normal application.

In the embodiment of the present disclosure, if it is determined, based on the preset open source visual library, that the two-dimensional code does not exist in the test result page, it may be determined that the third party application is a normal application, under the conditions that the interactive interface element exists in the test result page, the test result page is not displayed in error, no popup window exists in the test result page, and a page jump link exists in the test result page.

In this embodiment of the present disclosure, the early warning policy may be executed for abnormal applications every second preset period, which may be the same or different from the first preset period, and the second preset period may be set according to actual conditions, for example, may be set to one week; the automatic test time and the early warning release time can be the same or different; for example, automated testing may be performed on a weekly basis, with early warning information being issued and early warning strategies being performed weekly.

In the embodiment of the present disclosure, the third party application in the preset application is an application published in a third party application market corresponding to the preset application, and the number of the third party applications may be at least two; for example, a preset number of third party applications may be screened from the third party application market for automated testing; the preset number may be set according to actual situations, for example, 300. The abnormal application may be one or at least two.

In this embodiment of the present disclosure, as shown in fig. 6, the executing the early warning policy on the abnormal application includes:

s20111: sending early warning information to a target terminal corresponding to the preset application, wherein the early warning information carries an abnormal application identifier corresponding to the abnormal application, so that the target terminal displays the abnormal application identifier and a strategy screening control corresponding to the abnormal application; the target terminal is used for managing a third party application in the preset application;

S20113: receiving a target processing strategy sent by the target terminal, wherein the target processing strategy is generated by the target terminal in response to an operation instruction triggered based on the strategy screening control;

s20115: and processing the abnormal application based on the target processing strategy.

In the embodiment of the present specification, the target terminal may be a terminal for managing a third party application in the preset application; a plurality of processing strategies can be set for the abnormal application, for example, the plurality of processing strategies can comprise the off-shelf abnormal application, the abnormal application is set to be the application which can not be searched by a user corresponding to the preset application, and the abnormal application is determined to be the normal application; and a corresponding policy screening control may be set for each processing policy, e.g., a first processing policy: the strategy screening control corresponding to the off-shelf abnormal application is off-shelf, and the second processing strategy is as follows: setting the abnormal application as a policy screening control corresponding to the preset application, wherein the policy screening control corresponding to the application cannot be searched by a user; third processing strategy: determining the abnormal application as a policy screening control corresponding to the normal application as pass; an administrator corresponding to the target terminal can determine a target processing strategy corresponding to the abnormal application according to the abnormal determination condition corresponding to the abnormal application and the historical experience data; and then processing the abnormal application according to the target processing strategy.

In this embodiment of the present disclosure, before sending the early warning information to the target terminal corresponding to the preset application, the method further includes:

acquiring an abnormality determination condition corresponding to the abnormality application; the abnormal determination condition comprises that no interactive interface element exists in the test result page, the test result page is an error display page, a popup window exists in the test result page, a page jump link does not exist in the test result page, and a two-dimensional code exists in the test result page;

and generating the early warning information based on the abnormal application identifier and the abnormal determination condition.

In this embodiment of the present disclosure, the abnormality determination condition may be determined according to a determination method of an abnormality application, and the abnormality determination condition may include that no interactive interface element exists in the test result page, the test result page is an error display page, a popup window exists in the test result page, a page jump link does not exist in the test result page, a two-dimensional code exists in the test result page, and the like. The early warning information can be generated according to the abnormal application identification and the abnormal determination condition; when at least two abnormal applications are identified, early warning information may be constructed for each abnormal application.

In this embodiment of the present disclosure, as shown in fig. 7, fig. 7 is a schematic diagram of a display interface of a target terminal, where the displayed abnormal applications include application 1, application 2, application 3, application 4, and application 5; the method comprises the steps of displaying application classification, time, reasons and strategy screening controls corresponding to each application, wherein the reasons are abnormal determination conditions, and include that no interactive interface element (blank) exists in a test result page, the test result page is an error display page (text error report), a popup window (popup window) exists in the test result page, a page jump link (no link) does not exist in the test result page, and a two-dimensional code (two-dimensional code) exists in the test result page; the strategy screening control comprises a lower frame, no searching and passing; the administrator can determine the processing policy corresponding to each exception application through the control.

In this embodiment of the present disclosure, as shown in fig. 8, fig. 8 is an early warning method corresponding to an early warning system for abnormal application, where the early warning system includes an automatic test system, an operation service module, and a storage module, and the method includes:

(1) The automatic test system sends an application list acquisition request of a searchable third party application in the preset application to the operation service module; receiving an application list sent by an operation service module;

(2) The automatic test system authorizes each third party application in the application list of the test enterprise and sends an authorization message to the operation service module;

(3) The automatic test system performs automatic test on authorized third-party applications in the application list;

(4) The automatic test system sends an application test result to the operation service module;

(5) The operation business module sends an application test result to the storage module;

(6) The storage module stores the application test result.

In this embodiment of the present disclosure, as shown in fig. 9, fig. 9 is a flow chart of an early warning method for abnormal application, including:

s901: when the automatic test is finished, a third party application is opened and a test result page is captured;

s902: after cutting the screenshot, calculating the similarity between the cut image and the blank image; the blank image may be a white screen image or a black screen image;

s903: judging whether the similarity reaches a preset similarity threshold value or not;

s904: if the similarity reaches a preset similarity threshold, determining that the page has no interactive interface display element; determining that the third party application is an abnormal application;

s905: if the similarity does not reach the preset similarity threshold, identifying text information in the page;

S906: judging whether the text information comprises a target text or not; the target text is a text with error rules;

s907: if the text information comprises a target text, determining that a fault text exists in the page; and determining the third party application as an abnormal application;

s908: if the text information does not include the target text, a preset test tool is injected into the page;

s909: judging whether the injection of a preset test tool fails;

s9010: if the injection of the preset test tool fails, determining that a system popup window exists in the page;

s9011: if the preset test tool is successfully injected, acquiring a page control element set through the preset test tool;

s9012: judging whether the page control element set comprises a target element or not;

s9013: if the page control element set does not comprise the target element, determining that no page jump link exists in the page, and determining that the third party application is an abnormal application;

s9014: if the page control element set comprises the target element, determining that a page jump link exists in the page, and judging whether a two-dimensional code exists in the page or not through a preset open source visual library;

s9015: if the two-dimensional code exists in the page, determining that the third party application is abnormal;

s9016: if the two-dimensional code does not exist in the page, determining that the third party application passes the automatic test, namely the third party application is a normal application.

As can be seen from the technical solutions provided in the embodiments of the present disclosure, the embodiments of the present disclosure execute an automatic test on a third party application in a preset application, and obtain a test result page corresponding to the third party application; determining the similarity between the test result page and a preset blank page; if the similarity is smaller than a preset similarity threshold, extracting text information in a test result page; if the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; the target text characterizes the test result page as an error display page; if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page; and under the condition that the popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application. Compared with a manual identification method, the identification efficiency and the identification accuracy of the abnormal third party application in the preset application are improved, and the identification cost of the abnormal application is reduced; and early warning is carried out on the abnormal application in time, so that the probability of the abnormal third party application released in the preset application can be reduced, and the quality of the third party application in the preset application is improved.

The embodiment of the present disclosure further provides an early warning device for abnormal application, as shown in fig. 10, where the device includes:

the test result obtaining module 1010 is configured to perform an automatic test on a third party application in a preset application, and obtain a test result page corresponding to the third party application;

a similarity determining module 1020, configured to determine a similarity between the test result page and a preset blank page;

a text information extraction module 1030, configured to extract text information in the test result page if the similarity is less than a preset similarity threshold;

the injection result determining module 1040 is configured to inject a preset test tool into the test result page if the text information does not include the target text, so as to obtain an injection result; the target text characterizes the test result page as an error display page;

the popup determining module 1050 is configured to determine that a popup exists in the test result page if the injection result indicates that the injection of the preset test tool fails;

and the application early warning module 1060 is configured to determine the third party application as an abnormal application and execute an early warning policy on the abnormal application when a popup window exists in the test result page.

In some embodiments, the apparatus may further include:

the non-popup window determining module is used for determining the non-popup window in the test result page if the injection result represents that the injection of the preset test tool is successful;

the control element acquisition module is used for acquiring a page control element set corresponding to the third party application based on the preset test tool;

the jump link determining module is used for determining that the page jump link does not exist in the test result page if the page control element set does not have the target element; the target element is an element in the page jump link;

the first abnormal application determining module is used for determining the third party application as an abnormal application and executing an early warning strategy on the abnormal application under the condition that the page jump link does not exist in the test result page.

In some embodiments, the apparatus may further include:

the visual library acquisition module is used for determining that the page jump link exists in the test result page and acquiring a preset open source visual library if the page control element is concentrated to the target element; the target element is an element carried in a page jump link; the preset open source visual library is used for determining whether a two-dimensional code exists in the test result page;

And the second abnormal application determining module is used for determining that the third party application is an abnormal application if the two-dimensional code exists in the test result page based on the preset open source visual library, and executing the early warning strategy on the abnormal application.

In some embodiments, the apparatus may further include:

the interface element determining module is used for determining that no interactive interface element exists in the test result page if the similarity is greater than or equal to the preset similarity threshold value;

and the third abnormal application determining module is used for determining the third party application as an abnormal application and executing an early warning strategy on the abnormal application under the condition that the interactive interface element does not exist in the test result page.

In some embodiments, the apparatus may further include:

the error page determining module is used for determining that the test result page is an error display page if the target text exists in the text information;

and a fourth abnormal application determining module, configured to determine the third party application as an abnormal application and execute an early warning policy on the abnormal application when the test result page is the error display page.

In some embodiments, the similarity determining module includes:

the screenshot obtaining unit is used for obtaining a screenshot corresponding to the test result page;

the cutting image determining unit is used for cutting the edge area of the screenshot to obtain a cutting image;

the white screen image acquisition unit is used for acquiring a white screen image corresponding to the preset blank page;

a first similarity determining unit configured to determine a similarity between the cut image and the white screen image;

and the second similarity determining unit is used for determining the similarity between the test result page and a preset blank page according to the similarity between the cut image and the blank image.

In some embodiments, the second similarity determination unit includes:

a black screen image obtaining subunit, configured to obtain a black screen image corresponding to the preset blank page if the similarity between the cut image and the white screen image is smaller than a preset similarity threshold;

a first similarity determining subunit, configured to determine a similarity between the cropped image and the black screen image;

and the second similarity determination subunit is used for determining the similarity between the clipping image and the black screen image as the similarity between the test result page and the preset blank page.

In some embodiments, the application early warning module comprises:

the early warning information sending unit is used for sending early warning information to a target terminal corresponding to the preset application, wherein the early warning information carries an abnormal application identifier corresponding to the abnormal application, so that the target terminal displays the abnormal application identifier and a strategy screening control corresponding to the abnormal application; the target terminal is used for managing a third party application in the preset application;

the target policy receiving unit is used for receiving a target processing policy sent by the target terminal, wherein the target processing policy is a policy generated by the target terminal in response to an operation instruction triggered based on the policy screening control;

and the application processing unit is used for processing the abnormal application based on the target processing strategy.

In some embodiments, the apparatus further comprises:

the abnormal determination condition acquisition module is used for acquiring abnormal determination conditions corresponding to the abnormal application; the abnormal determination condition comprises that no interactive interface element exists in the test result page, the test result page is an error display page, a popup window exists in the test result page, a page jump link does not exist in the test result page, and a two-dimensional code exists in the test result page;

And the early warning information generation module is used for generating the early warning information based on the abnormal application identifier and the abnormal determination condition.

The apparatus and method embodiments described above in the apparatus embodiments are based on the same inventive concept.

The embodiment of the specification provides an electronic device, which comprises a processor and a memory, wherein at least one instruction or at least one section of program is stored in the memory, and the at least one instruction or the at least one section of program is loaded and executed by the processor to realize the method for early warning of abnormal application provided by the embodiment of the method.

The embodiment of the application also provides a computer storage medium, which can be arranged in a terminal to store at least one instruction or at least one section of program related to the early warning method for implementing the abnormal application in the method embodiment, and the at least one instruction or the at least one section of program is loaded and executed by the processor to implement the early warning method for the abnormal application provided in the method embodiment.

Embodiments of the present application also provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes to implement the method for early warning of abnormal applications provided in the above method embodiment.

Alternatively, in the present description embodiment, the storage medium may be located in at least one network server among a plurality of network servers of the computer network. Alternatively, in the present embodiment, the storage medium may include, but is not limited to: a U-disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The memory according to the embodiments of the present disclosure may be used to store software programs and modules, and the processor executes the software programs and modules stored in the memory to perform various functional applications and data processing. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, application programs required for functions, and the like; the storage data area may store data created according to the use of the device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide access to the memory by the processor.

The embodiment of the method for early warning of abnormal applications provided in the embodiments of the present disclosure may be implemented in a mobile terminal, a computer terminal, a server, or a similar computing device. Taking the operation on the server as an example, fig. 11 is a block diagram of a hardware structure of the server of an abnormal application early warning method provided in the embodiment of the present disclosure. As shown in fig. 11, the server 1100 may vary considerably in configuration or performance and may include one or more central processing units (Central Processing Units, CPU) 1110 (the central processing unit 1110 may include, but is not limited to, a microprocessor MCU or a processing device such as a programmable logic device FPGA), a memory 1130 for storing data, one or more storage mediums 1120 (e.g., one or more mass storage devices) storing applications 1123 or data 1122. Wherein the memory 1130 and the storage medium 1120 may be transitory or persistent storage. The program stored on the storage medium 1120 may include one or more modules, each of which may include a series of instruction operations on a server. Still further, the central processor 1110 may be configured to communicate with a storage medium 1120 and execute a series of instruction operations in the storage medium 1120 on the server 1100. The server 1100 may also include one or more power supplies 1160, one or more wired or wireless network interfaces 1150, one or more input output interfaces 1140, and/or one or more operating systems 1121, such as Windows Server, mac OS XTM, unixTM, linuxTM, freeBSDTM, etc.

The input-output interface 1140 may be used to receive or transmit data via a network. The specific example of the network described above may include a wireless network provided by a communication provider of the server 1100. In one example, the input-output interface 1140 includes a network adapter (Network Interface Controller, NIC) that may be connected to other network devices through a base station to communicate with the internet. In one example, the input/output interface 1140 may be a Radio Frequency (RF) module for communicating with the internet wirelessly.

It will be appreciated by those of ordinary skill in the art that the configuration shown in fig. 11 is merely illustrative and is not intended to limit the configuration of the electronic device described above. For example, the server 1100 may also include more or fewer components than shown in fig. 11, or have a different configuration than shown in fig. 11.

According to the embodiment of the method, the device, the electronic equipment or the storage medium for early warning of the abnormal application, which are provided by the application, the application executes automatic test on the third party application in the preset application, and a test result page corresponding to the third party application is obtained; determining the similarity between the test result page and a preset blank page; if the similarity is smaller than a preset similarity threshold, extracting text information in a test result page; if the text information does not contain the target text, a preset test tool is injected into the test result page to obtain an injection result; the target text characterizes the test result page as an error display page; if the injection result represents the injection failure of the preset test tool, determining that a popup window exists in the test result page; and under the condition that the popup window exists in the test result page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application. Compared with a manual identification method, the identification efficiency and the identification accuracy of the abnormal third party application in the preset application are improved, and the identification cost of the abnormal application is reduced; and early warning is carried out on the abnormal application in time, so that the probability of the abnormal third party application released in the preset application can be reduced, and the quality of the third party application in the preset application is improved.

It should be noted that: the embodiment sequence of the present disclosure is only for description, and does not represent the advantages and disadvantages of the embodiments. And the foregoing description has been directed to specific embodiments of this specification. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for the apparatus, electronic device, storage medium embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and references to the parts of the description of the method embodiments are only needed.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The foregoing description of the preferred embodiments of the present application is not intended to limit the invention to the particular embodiments of the present application, but to limit the scope of the invention to the particular embodiments of the present application.

Claims

1. An early warning method for abnormal application, which is characterized by comprising the following steps:

obtaining a screenshot corresponding to the test result page;

cutting the edge area of the screenshot to obtain a cut image;

acquiring a white screen image corresponding to a preset blank page;

according to the similarity between the cut image and the white screen image, determining the similarity between the test result page and a preset blank page; the preset blank page is a page without an interactive interface display element;

if the similarity is greater than or equal to a preset similarity threshold, determining the third party application as an abnormal application;

under the condition that a popup window exists in the test result page, determining the third party application as an abnormal application, and sending early warning information to a target terminal corresponding to the preset application, wherein the early warning information carries an abnormal application identifier corresponding to the abnormal application, so that the target terminal displays the abnormal application identifier and a strategy screening control corresponding to the abnormal application; the target terminal is used for managing a third party application in the preset application; the policy screening control comprises: the method comprises the steps of taking off a policy screening control corresponding to abnormal application, setting the abnormal application as a policy screening control which is corresponding to preset application and cannot be searched by a user, and determining the abnormal application as a policy screening control corresponding to normal application;

receiving a target processing strategy sent by the target terminal, wherein the target processing strategy is generated by the target terminal in response to an operation instruction triggered based on the strategy screening control;

and processing the abnormal application based on the target processing strategy.

2. The method according to claim 1, wherein the method further comprises:

If the injection result represents that the injection of the preset test tool is successful, determining that a popup window exists in the test result page;

acquiring a page control element set corresponding to the third party application based on the preset test tool;

if the page control element set does not have the target element, determining that a page jump link does not exist in the test result page; the target element is an element in the page jump link;

and under the condition that the page jump link does not exist in the test result page, determining the third party application as an abnormal application, and executing the early warning strategy on the abnormal application.

3. The method according to claim 2, wherein the method further comprises:

if the target elements exist in the page control element set, determining that the page jump links exist in the test result page, and acquiring a preset open source visual library; the target element is an element carried in a page jump link; the preset open source visual library is used for determining whether a two-dimensional code exists in the test result page;

if the two-dimensional code exists in the test result page based on the preset open source visual library, determining that the third party application is an abnormal application, and executing the early warning strategy on the abnormal application.

4. The method according to claim 1, wherein the method further comprises:

and under the condition that the interactive interface element does not exist in the test result page, determining the third-party application as an abnormal application, and executing an early warning strategy on the abnormal application.

5. The method according to claim 1, wherein the method further comprises:

if the target text exists in the text information, determining that the test result page is an error display page;

and under the condition that the test result page is the error display page, determining the third party application as an abnormal application, and executing an early warning strategy on the abnormal application.

6. The method of claim 1, wherein determining the similarity between the test result page and a preset blank page according to the similarity between the cropped image and the white screen image comprises:

if the similarity between the cut image and the white screen image is smaller than the preset similarity threshold, acquiring a black screen image corresponding to the preset blank page;

7. The method of claim 1, wherein before the sending the pre-warning information to the target terminal corresponding to the preset application, the method further comprises:

and generating the early warning information based on the abnormal application identification and the abnormal determination condition.

8. An alert device for abnormal applications, the device comprising:

The similarity determining module is used for obtaining a screenshot corresponding to the test result page; cutting the edge area of the screenshot to obtain a cut image; acquiring a white screen image corresponding to a preset blank page; according to the similarity between the cut image and the white screen image, determining the similarity between the test result page and a preset blank page; the preset blank page is a page without an interactive interface display element; if the similarity is greater than or equal to a preset similarity threshold, determining the third party application as an abnormal application;

the application early warning module is used for determining the third party application as an abnormal application under the condition that a popup window exists in the test result page, and executing an early warning strategy on the abnormal application;

The application early warning module comprises:

the early warning information sending unit is used for sending early warning information to a target terminal corresponding to the preset application, wherein the early warning information carries an abnormal application identifier corresponding to the abnormal application, so that the target terminal displays the abnormal application identifier and a strategy screening control corresponding to the abnormal application; the target terminal is used for managing a third party application in the preset application; the policy screening control comprises: the method comprises the steps of taking off a policy screening control corresponding to abnormal application, setting the abnormal application as a policy screening control which is corresponding to preset application and cannot be searched by a user, and determining the abnormal application as a policy screening control corresponding to normal application;

the target strategy receiving unit is used for receiving a target processing strategy sent by the target terminal, wherein the target processing strategy is generated by the target terminal in response to an operation instruction triggered based on the strategy screening control;

9. The apparatus of claim 8, wherein the apparatus further comprises:

the non-popup window determining module is used for determining a non-popup window in the test result page if the injection result represents that the injection of the preset test tool is successful;

10. The apparatus of claim 9, wherein the apparatus further comprises:

the visual library acquisition module is used for determining that the page jump link exists in the test result page and acquiring a preset open source visual library if the target element exists in the page control element set; the target element is an element carried in a page jump link; the preset open source visual library is used for determining whether a two-dimensional code exists in the test result page;

11. The apparatus of claim 8, wherein the apparatus further comprises:

and the third abnormal application determining module is used for determining the third party application as an abnormal application under the condition that the interactive interface element does not exist in the test result page, and executing an early warning strategy on the abnormal application.

12. The apparatus of claim 8, wherein the apparatus further comprises:

and the fourth abnormal application determining module is used for determining the third party application as an abnormal application and executing an early warning strategy on the abnormal application under the condition that the test result page is the error display page.

13. The apparatus of claim 8, wherein the similarity determination module comprises:

the black screen image acquisition subunit is used for acquiring a black screen image corresponding to the preset blank page if the similarity between the cut image and the white screen image is smaller than a preset similarity threshold;

A first similarity determining subunit, configured to determine a similarity between the clipping image and the black screen image;

14. The apparatus of claim 13, wherein the apparatus further comprises:

the abnormal determination condition acquisition module is used for acquiring an abnormal determination condition corresponding to the abnormal application; the abnormal determination condition comprises that no interactive interface element exists in the test result page, the test result page is an error display page, a popup window exists in the test result page, a page jump link does not exist in the test result page, and a two-dimensional code exists in the test result page;

15. An electronic device, the device comprising: a processor and a memory, wherein at least one instruction or at least one program is stored in the memory, and the at least one instruction or at least one program is loaded and executed by the processor to implement the method for early warning of abnormal applications according to any one of claims 1 to 7.

16. A computer storage medium storing at least one instruction or at least one program loaded and executed by a processor to implement the method of warning of abnormal applications according to any one of claims 1 to 7.

17. A computer program product comprising computer instructions which, when executed by a processor, implement the method of pre-warning of abnormal applications according to any one of claims 1 to 7.