WO2012065381A1

WO2012065381A1 - Method and apparatus for preventing malicious softwares from transmitting data

Info

Publication number: WO2012065381A1
Application number: PCT/CN2011/071428
Authority: WO
Inventors: 马震宇; 王冲
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-11-15
Filing date: 2011-03-01
Publication date: 2012-05-24
Also published as: CN101984692A; CN101984692B

Abstract

A method for preventing malicious softwares from transmitting data is disclosed. The method includes: intercepting a data transmission request and obtaining the process information corresponding to the data transmission request; matching the obtained process information with the process information preset in a list database; according to the matched result, correspondingly transmitting or discarding the intercepted data transmission request. An apparatus for preventing malicious softwares from transmitting data is also disclosed. With the method and the apparatus in the present invention, the malicious softwares are prevented from transmitting data in the background, and thereby the expense loss is reduced and the user experience is satisfied.

Description

Method and device for preventing malware from transmitting data

The present invention relates to mobile terminal technology, and more particularly to a method and apparatus for preventing malware from transmitting data. Background technique

With the development of science and technology, the use of intelligent mobile terminals such as smart phones has gradually become popular, and smart phones are no longer the favorite of business people, and their user base has expanded rapidly. A notable feature of smartphones is the flexibility to install application software. As the user base continues to expand, this feature has also attracted some attention from malware. Malware that only appeared on computers has begun to appear on smartphones. . Since the mobile phone involves a call charge problem, that is, there is an economic benefit, the malware on the smartphone is more harmful than the one on the computer. In general, malware is bundled in some of the more popular normal software, using normal software to induce users to download. When users download packages that are bundled with malware and install them, the malware will sneak in the background.

There are many types of malware behaviors, one of which is to send text messages in the background, such as: using the SMS interface provided by the smart phone, ordering some consumer services, etc., or constantly sending out text messages, these operations will cause user calls. A lot of losses, but also not easy to be detected, only after the operator to carefully check the list to find some clues, economic losses are generally more difficult to recover. Therefore, how to detect and prevent such malware in advance, and prevent the loss of telephone charges, is particularly important, and has become an urgent need of users.

Currently, there are no technical solutions to prevent malware from sending text messages. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for preventing malware from transmitting data, which can prevent malware from transmitting data in the background and reduce cost loss.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides a method for preventing malware from transmitting data, the method comprising: intercepting a data transmission request, and acquiring process information corresponding to the data transmission request; and acquiring the process information and process information in a preset list database Matching is performed, and according to the matching result, the intercepted data sending request is sent or discarded accordingly.

In the foregoing solution, the sending or discarding the intercepted data sending request according to the matching result is:

And when the acquired process information matches the process information in the whitelist, sending the intercepted data sending request;

When the acquired process information matches the process information in the blacklist, the intercepted data transmission request is discarded;

When the acquired process information cannot match the process information in the list database, the related information including the data content and the acquired process information is presented to the user.

In the above solution, the method further includes:

After the related information including the data content and the acquired process information is presented to the user, corresponding processing is performed according to the received user's command.

In the above solution, the corresponding processing is performed according to the received user's command, when: the received user's command is a command to agree to send, the intercepted data sending request is sent, and the acquired process is obtained. Information is added to the whitelisted process information;

When the received user's command is a disagreement with the sent command, the intercepted data transmission request is discarded, and the acquired process information is added to the blacklisted process information.

In the above solution, the method further includes: saving the transmission record to the record database. In the above solution, the method further includes: saving the discarded data transmission request to the record database.

The present invention also provides an apparatus for preventing malware from transmitting data, the apparatus comprising: a data intercepting module, a list judging module, and a processing module;

a data intercepting module, configured to intercept a data sending request, obtain process information corresponding to the data sending request, and send the obtained process information to the list determining module;

The list judging module is configured to: after receiving the acquired process information sent by the data intercepting module, matching the obtained process information with the process information in the preset list database, and sending the matching result to the processing module;

The processing module is configured to: after receiving the matching result sent by the list judging module, perform corresponding sending or discarding processing on the intercepted data sending request according to the matching result.

In the foregoing solution, the processing module is specifically configured to: when the acquired process information matches the process information in the whitelist, send the intercepted data sending request, when the acquired process information is black When the process information in the list matches, the intercepted data transmission request is discarded, and when the acquired process information cannot match the process information in the list database, the data content and the acquired process information are included. Relevant information is presented to the user.

In the above solution, the processing module is further configured to: after receiving the command sent by the user, send the intercepted data sending request, and add the acquired process information to the whitelist process information; or After receiving the command that the user does not agree to send, the intercepted data sending request is discarded, and the obtained process information is added to the blacklisted process information.

In the above solution, the device further includes: a recording module, configured to: after receiving the transmission record sent by the processing module, save the transmission record to the record database, or after receiving the discarded data transmission request sent by the processing module, The discarded data transmission request is also saved to the record database and marked as intercepted;

The processing module is further configured to send a record after sending the intercepted data sending request After being sent to the recording module, or discarding the intercepted data sending request, the discarded data sending request is sent to the recording module.

The invention provides a scheme for preventing malware from transmitting data, intercepts a data transmission request, and acquires corresponding process information, and matches the acquired process information with process information in a preset list database, and according to the matching result, the intercepted data. Sending a request for corresponding sending or discarding processing can prevent malware from sending data in the background, thereby reducing cost loss and satisfying the user experience.

In addition, the transmission record can be saved to the record database, so that the user can query the transmission history to further improve the user experience. DRAWINGS

1 is a schematic flow chart of a method for preventing malware from transmitting data according to the present invention;

2 is a schematic flowchart of a method for preventing malware from sending a short message according to an embodiment;

FIG. 3 is a schematic structural diagram of an apparatus for preventing malware from transmitting data according to the present invention. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

The method for preventing malware from transmitting data, as shown in FIG. 1 , includes the following steps: Step 101: intercepting a data sending request, and acquiring process information corresponding to the data sending request; where the data sending request may be a short message sending request , MMS send request or other data packet transmission request;

If the intercepted data sending request is a short message sending request, the intercepted short message sending request includes the short message content, the destination address of the short message, and the sending time;

In actual use, the data intercepting module of the smart mobile terminal needs to be set under the short message interface of the smart mobile terminal to intercept each short message sending request;

When an application software such as malware or normal SMS software sends a text message, it needs to call smart shift. The mobile terminal, such as the short message interface of the smart phone, at this time, the process information of the short message interface calling the mobile phone is saved in the process of the smart phone, therefore, the process information that can be saved from the process of the smart phone after intercepting the short message sending request Obtaining process information corresponding to the short message sending request;

If the intercepted data sending request is a MMS sending request, the intercepted MMS sending request includes the MMS content, the destination address of the MMS, and the sending time;

If the intercepted data transmission request is a data packet transmission request, the intercepted data transmission request includes the destination URL of the data packet, the content of the data packet, and the sending time;

Similarly, when sending a multimedia message or a data packet, the corresponding interface of the smart phone needs to be called. At this time, the process information of the corresponding interface of the mobile phone is saved in the process of the smart phone, so after intercepting the data transmission request, The process information corresponding to the data transmission request is obtained from the process information saved in the process of the smartphone.

Step 102: Match the obtained process information with the process information in the preset list database, and perform corresponding sending or discarding the intercepted data sending request according to the matching result;

Here, the list database includes the process information of the whitelist and the process information of the blacklist. The process information of the whitelist is: the process information of the data that can be sent out, and the process information of the blacklist is: Process information;

And performing, according to the matching result, the sending or discarding the intercepted data sending request, specifically:

When the obtained process information matches the process information in the whitelist, the intercepted data transmission request is sent, and when the acquired process information matches the process information in the blacklist, the device is discarded. The intercepting data sending request, when the acquired process information cannot match the process information in the list database, displaying relevant information including the data content and the acquired process information to the user;

The data content may be a short message content, a multimedia message content, or a data packet content; The related information may further include a destination address of the short message or the multimedia message, a sending time or a destination URL of the data packet, a sending time, and the like; after displaying the related information including the data content and the acquired process information to the user, according to the received user The command performs corresponding processing. Specifically, if the received user's command is a command to agree to send, the intercepted data sending request is sent, and if the received user's command is a disagreement with the sent command, the command is lost. The intercepted data sending request is discarded; at this time, the acquired process information may be added to the list database, and specifically, if the data sending request is sent, the acquired process information is added. If the intercepted data transmission request is discarded, the obtained process information is added to the blacklisted process information.

When the intercepted data sending request is a short message sending request, the sending the intercepted data sending request is specifically:

Calling the short message module of the mobile terminal, and sending the short message by the short message module; wherein the specific processing flow of sending the short message by the short message module is exactly the same as the existing processing flow;

After the intercepting the data sending request, the method may further include: saving the sending record to the record database, so that the user can query the sending history afterwards; further, the discarded data sending request may also be saved. Go to the record database and mark it as being intercepted; the send history record contains data content, corresponding process information, and the like.

The following takes the short message as an example. The method for preventing malware from sending a short message in this embodiment, as shown in FIG. 2, includes the following steps:

Step 201: Block the short message sending request, and obtain the process information corresponding to the short message sending request. Here, the intercepted short message sending request includes the short message content, the destination address of the short message, and the sending time.

Step 202: Determine whether the acquired process information matches the process information in the preset list database, where the list database includes the whitelist process information and the blacklist process information. If the acquired process information matches the process information in the whitelist, perform the step

203a. If the obtained process information matches the process information in the blacklist, step 203b is performed. If the acquired process information cannot match the process information in the list database, step 204 is performed.

Step 203a: Send the intercepted short message sending request, and then perform step 207.

Step 203b: Discard the intercepted short message sending request, and then perform step 208.

Step 204: Display the related information including the short message content and the obtained process information to the user, and after receiving the command to agree to send, perform step 205, and after receiving the command disagreeing to send, perform step 206;

Here, the related information includes: a short message content, the acquired process information, a destination address of the short message, a sending time, and the like.

Step 205: Send the intercepted short message sending request, and add the acquired process information to the whitelisted process information, and then perform step 207.

Step 206: Discard the intercepted short message sending request, and add the acquired process information to the blacklisted process information, and then perform step 208.

Step 207: Save the transmission record to the record database, and then go to step 209.

Step 208: Save the discarded intercepted short message sending request to the record database, and mark it as being intercepted, and then perform step 209.

Step 209: End the current processing flow.

In order to implement the above method, the present invention further provides an apparatus for preventing malware from transmitting data. As shown in FIG. 3, the apparatus includes: a data intercepting module 31, a list judging module 32, and a processing module 33;

The data intercepting module 31 is configured to intercept the data sending request, obtain the process information corresponding to the data sending request, and send the obtained process information to the list determining module 32;

The list determining module 32 is configured to receive the acquired process information sent by the data intercepting module 31, Matching the obtained process information with the process information in the preset list database, and sending the matching result to the processing module 33;

The processing module 33 is configured to: after receiving the matching result sent by the list determining module 32, perform corresponding sending or discarding processing on the intercepted data sending request according to the matching result.

The data intercepting module 31 is disposed under the short message interface of the smart mobile terminal to intercept each short message sending request.

The processing module 33 is specifically configured to:

When the obtained process information matches the process information in the whitelist, the intercepted data transmission request is sent, and when the acquired process information matches the process information in the blacklist, the device is discarded. The intercepted data sending request is displayed to the user when the acquired process information cannot match the process information in the list database, and the related information including the data content and the acquired process information is displayed.

The device may further include: a recording module, configured to: after receiving the transmission record sent by the processing module 33, save the transmission record to the record database;

The processing module 33 is further configured to: after sending the intercepted data transmission request, send the transmission record to the recording module.

The processing module 33 is further configured to: after discarding the intercepted data sending request, send the discarded data sending request to the recording module;

The recording module is further configured to: after receiving the discarded data transmission request sent by the processing module 33, save the discarded data transmission request to the record database, and mark it as being intercepted.

The processing module 33 is further configured to: after receiving the command sent by the user, send the intercepted data sending request, and add the acquired process information to the whitelist process information; After the command is sent, the intercepted data sending request is discarded, and the obtained process information is added to the blacklisted process information.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. All modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim

A method for preventing malware from transmitting data, the method comprising: intercepting a data transmission request, and acquiring process information corresponding to the data transmission request; and acquiring the process information and a preset list database The process information is matched, and according to the matching result, the intercepted data transmission request is sent or discarded accordingly.

The method according to claim 1, wherein the method for transmitting or discarding the intercepted data transmission request according to the matching result is:

The method according to claim 2, wherein the method further comprises: displaying related information including the data content and the acquired process information to the user, and performing corresponding processing according to the received user command. .

The method according to claim 3, wherein the processing according to the received user's command is:

When the received user's command is a command to be sent, the intercepted data sending request is sent, and the obtained process information is added to the whitelisted process information;

The method according to any one of claims 1 to 4, characterized in that the method further comprises:

Save the send record to the record database.

Save the dropped data send request to the record database.

A device for preventing malware from transmitting data, the device comprising: a data intercepting module, a list judging module, and a processing module;

The device according to claim 7, wherein the processing module is specifically configured to:

The device according to claim 8, wherein the processing module is further configured to: after receiving a command sent by the user, send the intercepted data sending request, and send the acquired process information Adding to the whitelisted process information; or, after receiving the command that the user does not agree to send, discarding the intercepted data sending request, and adding the obtained process information to the blacklisted process information.

10. Apparatus according to any one of claims 7 to 9, wherein the apparatus The step includes: a recording module, configured to: after receiving the sending record sent by the processing module, save the sending record to the record database, or after receiving the discarded data sending request sent by the processing module, the discarded data The sending request is also saved in the record database and marked as being intercepted; the processing module is further configured to send the sent data to the recording module after sending the intercepted data sending request, or discard the intercepted data After the request is sent, the discarded data transmission request is sent to the recording module.