Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/30—Monitoring
  • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
  • G06F11/3466—Performance evaluation by tracing or monitoring
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
  • G06F2201/865—Monitoring of software

Definitions

• the present disclosure relates generally to the field of computer technology, and more particularly to a method, device and computer-readable storage medium for monitoring unmstallation event in an operation platform.
• a method for monitoring unmstallation event on an operation platform includes:
• a device for monitoring unmstallation event on an operation platform includes:
• a code injection module configured to inject a first code snippet into a target system process in a terminal
• a code operation module configured to run a virtual machine and the first code snippet in the target system process
• a event monitoring module configured to control, by interaction between the first code snippet and the virtual machine, the virtual machine to load a second code snippet, and monitor, with the second code snippet, unmstallation event of application program in the terminal.
• a non-transitory computer-readable storage medium storing an executable program to execute a method for monitoring unmstallation event in an operation platform. The method includes the following steps:
• Method, device, and computer-readable storage medium for monitoring unmstallation event on an operation platform are disclosed as above, which injects a first code snippet into a target system process in a terminal, controls a virtual machine to load a second code snippet by interaction between the first code snippet and the virtual machine, and monitors unmstallation events of application program in the terminal via the second code snippet. Since the target system process is not easily deletable while running, by injecting the first code snippet into a target system process, the unmstallation event of application program can be monitored, and the causes of unmstallation can be analyzed in a further step based on the acquired monitoring results.
• Fig. 1 is a flowchart showing a method for monitoring unmstallation event on an operation platform in accordance with one embodiment of the disclosure.
• Fig. 2 is a schematic diagram showing an implementation of a method for monitoring unmstallation event on an operation platform on a mobile terminal installed with Android platform in accordance with one embodiment of the disclosure.
• Fig. 3 is a structural block diagram showing a device for monitoring unmstallation event on an operation platform in accordance with one embodiment of the disclosure.
• Fig. 4 is a structure block diagram showing a device for monitoring unmstallation event on an operation platform in accordance with another embodiment of the disclosure.
• Fig. 5 is a structure block diagram showing a device for monitoring unmstallation event on an operation platform in accordance with yet another embodiment of the disclosure.
• Fig. 6 is a structural schematic diagram showing a terminal for monitoring unmstallation event on an operation platform in accordance with one embodiment of the disclosure.
• a method for monitoring uninstallation event on an operation platform is described.
• the method is illustrated as being applied to a terminal including an operation platform.
• the terminal may include, for example, a smart phone, a tablet computer, an ebook reader, a MP3 (Moving Picture Experts Group Audio Layer III) player, a MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, and so on.
• the method for monitoring uninstallation event in an operation platform includes the following steps.
• Step 102 injecting a first code snippet into a target system process in a terminal.
• the first code snippet is a piece of code that may enable a virtual machine to load a second code snippet. Furthermore, the first code snippet may be injected into a target system process in a terminal via a third-party process, the third-party process being a process different from the application program monitored. Since the target system process is not easily deletable, the first code snippet injected may continue running stably without being shut down by memory cleaning programs or malwares.
• the target system process may be system_server , which is a crucial system process on the Android platform.
• the process may not be deleted, or the Android platform will be unable to function.
• the virtual machine may be a Java virtual machine (JVM) for Android, which can execute Java bytecode.
• JVM provides a Java platform for code execution of the first code snippet injected into a target system process in the Android platform.
• the Step 102 includes: acquiring the process identification of the target system process, and injecting, according to the acquired process identification, the first code snippet into the target system process using a system function for remote injection.
• Process identification is a unique identification of a target system process, which may be an ID or name of the process.
• the system function for remote injection is the ptrace function, which may carry out remote injection and inject a first code snippet into the target system process.
• a target system process may be exclusively targeted by acquiring the process identification of the process.
• a first code snippet may be injected into the target system process precisely using a system function for remote injection.
• Step 104 running a virtual machine and the first code snippet in the target system process.
• the first code snippet may be run in the target system process.
• a virtual machine may also be actuated in the target system process.
• Step 106 interacting the first code snippet with the virtual machine, controlling the virtual machine to load a second code snippet, and monitoring the unmstallation event of the application program in the terminal.
• the first code snippet may interact with the virtual machine and further control the virtual machine to load a second code snippet.
• the second code snippet which may be stored in the file system of the operation platform, acts to monitor the unmstallation events of the application programs in the terminal.
• the unmstallation events of the application programs may be monitored by executing the second code snippet.
• the second code snippet may act to monitor a designated application program, to monitor a set of application programs in a pre-set configuration file by reading the file, or to monitor all application programs.
• the first code snippet does not directly monitor the unmstallation events of the application programs, but only interacts with a virtual machine.
• the first code snippet is of fewer codes, occupying a small memory space without affecting the operation of the operation system when executing.
• the first code snippet is a C/C++ code snippet, the virtual machine being a Java virtual machine for Android, the second code snippet being a Java code snippet.
• the C/C++ code snippet interacts with the Java virtual machine, controlling it to load the Java code snippet through a JNI (Java Native Interface).
• the first code snippet is injected into the target system process, interacts with the Java virtual machine for Android to control it to load the second code snippet, so as to monitor the unmstallation event of the application program.
• the target system process is not easily deletable while running, so the unmstallation event of application program can be monitored after the first code snippet is injected into the target system process, and the cause of unmstallation can be analyzed in a further step based on the acquired monitoring results.
• the method for monitoring unmstallation event in an operation platform further includes: when an unmstallation event of application program is detected, recording the environmental information of the application program being uninstalled, and uploading the information to a server.
• the server may determine whether to upload the environmental information to the server based on a pre-set configuration file, wherein the configuration file may be set via the terminal, so that the user may determine whether to collect and upload the environmental information.
• the terminal may also receive the analysis result from the server and, based on the results, determine whether an unmstallation event was a malicious unmstallation caused by a malware, or a mandatory unmstallation caused by a competitor program.
• the environmental information includes process identification of the running process, identification of installed application programs, identification code of the terminal device, and the root privilege information of the terminal.
• the process identification of a running process may be a unique process name or process ID.
• the identification of an installed application program may be a unique program name for the program.
• the identification code of a terminal device may be a unique identification number for the terminal, such as IMEI (International Mobile Equipment Identity), which is a unique identification for mobile phones.
• the server may detect, according to the process identification, whether a running process is in a pre-set list of malicious programs, and thus determine whether an uninstallation event was caused by a malicious program. Uninstallation of some application programs requires root privilege, and it is therefore possible to determine whether an uninstallation event was triggered voluntarily by the user by determining whether the terminal has obtained the root privilege.
• the identification code of a terminal device is unique. When multiple uninstallation events occur at the same terminal, it is probably a malicious uninstallation caused by a malware or a mandatory uninstallation caused by a competitor program, which may be determined by referring to the identification of application programs already installed or the process identification of the running process.
• the environmental information may be uploaded to the server.
• the identification of the running process the identification of the installed application programs, the identification code of the terminal device, and the root privilege information of the terminal, the cause of the uninstallation event may be determined.
• FIG. 2 A specific application scene is described below to illustrate the principle of the aforementioned method for monitoring operation platform.
• an Android platform operated in a mobile terminal, is used in the scene.
• FIG. 2 there is a plurality of system processes (System Process 1, System Process 2 ...System Process n) and a third-party process running in the mobile terminal.
• a first code snippet is injected into System Process 2 (preferably, System Process 2 herein is system_server) by the third-party process.
• System Process 2 preferably, System Process 2 herein is system_server
• a virtual machine for Android (Android virtual machine) and the first code snippet are actuated in System Process 2 by system call.
• the first code snippet interacts with the virtual machine for Android platform, so as to control the virtual machine to load and execute a second code snippet.
• the uninstallation events of application programs may be monitored by the second code snippet.
• the environmental information of the application program being uninstalled is collected, i.e., name of the running process, name of the installed application program, the identification code of the terminal device, and the root privilege information of the terminal.
• Such environmental information is uploaded to the server and analyzed by the server to determine the cause of the uninstallation event.
• a device for monitoring operation platform includes:
• a code injection module 320 configured to inject a first code snippet into a target system process in a terminal
• a module 340 for code operation configured to operate a virtual machine and the first code snippet in the target system process
• an event monitoring module 360 configured to control, by interaction between the first code snippet and the virtual machine, the virtual machine to load a second code snippet, and to monitor, by the second code snippet, uninstallation event of application program in the terminal.
• the device for monitoring uninstallation event in an operation platform further includes:
• an injection executing module 322 configured to inject, according to the process identification of the target system process, the first code snippet into the target system process by a system function for remote injection.
• the operation platform is an Android platform, the first code snippet being a C/C++ code snippet, the virtual machine being a Java virtual machine, the second code snippet being a Java code snippet.
• the device for monitoring uninstallation event in an operation platform further includes:
• a collecting and uploading module 380 configured to record, when detecting an uninstallation event of application program, the environmental information of the application program being uninstalled, and to upload the information to a server.
• the environmental information includes identification of the running process, identification of the installed application programs, identification code of the terminal device, and the root privilege information of the terminal.
• the program can be stored in a computer readable storage medium and the program can include the process of the embodiments of the above methods.
• the storage medium can be a disk, a light disk, a Read-Only Memory or a Random Access Memory, etc.
• the embodiments herein also disclose a terminal for monitoring uninstallation event in an operation platform, as show in Fig. 6.
• Fig. 6 only shows a partial structure that is relevant to the embodiments, while specific technical details not shown may be found in the methods described in the embodiments.
• the terminal may comprise any terminal device such as a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), an onboard computer, etc.
• a mobile phone is described as an example herein.
• Fig. 6 shows a block diagram of a partial structure of a mobile phone corresponding to the terminal in one embodiment.
• the mobile phone includes: a RF (Radio Frequency) circuit 1110, storage 1120, an input unit 1130, a display unit 1140, a sensor 1150, an audio circuit 1160, a wireless communication module 1170, a processor 1180, and a power source 1190, etc.
• RF Radio Frequency
• the RF circuit 1110 may send and receive signals during a message conversation or phone call. Specifically, it may receive downward messages from the base station and send them to the processor 1180 for processing; meanwhile, it may also send upward messages to the base station.
• the RF circuit includes, but not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a LNA (Low Noise Amplifier), a duplexer, and so on.
• the RF circuit 1110 may also communicate with the internet and other devices wirelessly.
• Such wireless communication may adopt any communication standard or protocol, including, but not limited to, GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA ( Wideband Code Division Multiple Access), LTE (Long Term Evolution), E-Mail, SMS (Short Messaging Service), and so on.
• GSM Global System of Mobile communication
• GPRS General Packet Radio Service
• CDMA Code Division Multiple Access
• WCDMA Wideband Code Division Multiple Access
• LTE Long Term Evolution
• E-Mail Short Messaging Service
• the storage 1120 may store software programs and modules, which may be run by the processor 1180 to execute various functional applications and process data in the mobile phone.
• Software programs in the storage 1120 may be used to execute a method for monitoring operation platform, comprising: injecting a first code snippet into a target system process in a terminal; running a virtual machine and the first code snippet in the target system process; and interacting the first code snippet with the virtual machine, controlling the virtual machine to load a second code snippet, and monitoring uninstallation event of an application in the terminal using the second code snippet.
• the storage 1120 may mainly include a program storage area and a data storage area.
• the program storage area may store the operation system, application programs required by at least one function (such as voice playing function, image displaying function, etc.), and so on.
• the data storage area may store data created by mobile phone usage (such as voice data, contacts, etc.), and so on.
• the storage 1120 may further include a high-speed random-access memory storage and also a nonvolatile storage, e.g., at least one disk storage device, flash memory device, or any other nonvolatile solid state storage device.
• the input unit 1130 may receive input of number or character information, and generate input of key signal associated with user setting and function control of the mobile phone. Specifically, the input unit 1130 may comprise a touch panel 1131 and an extra input device 1132.
• the touch panel 1131 may collect touch operation by the user on or near the touch panel (e.g., operation on or near the touch panel 1131 with fingers, a touch pen, or any other suitable object or accessory, conducted by the user), and actuate a corresponding connection device according to a pre-set program.
• the touch panel 1131 may include two portions: a touch detection device and a touch controller.
• the touch detection device may detect the touch position of the user and the signal generated by the touch operation, and send the signal to the touch controller.
• the touch controller may receive the touch information from the touch detection device, convert it to contact coordinates, and sends the coordinates to the processor 1180.
• the touch control device also receives controls from the processor 1180 to execute.
• the touch panel 1131 may be configured in many types, such as resistance-type, capacitance, infrared, SAW (surface acoustic wave), and so on.
• the input unit 1130 may also include an extra input device 1132.
• the extra input device 1132 may be any one of the following including but not limited to: a physical keyboard, function keys (such as volume control keys, switch buttons, etc.), a trackball, a mouse, a joystick, and so on.
• the display unit 1140 may display information received from or provided to the user as well as display various mobile phone menus.
• the display unit 1140 may include a display panel 1141.
• the display panel 1141 may be configured with a LCD (Liquid Crystal Display), or alternatively, an OLED (Organic Light-Emitting Diode).
• a touch panel 1131 may cover the display panel 1141.
• a touch operation when detected on or near the touch panel 1131, is sent to the processor 1180, which decides the type of the touch event and accordingly provides corresponding visual output on the display panel 1141.
• the touch panel 1131 and the display panel 1141 carry out the input and output functions of the mobile phone as two independent components, but they may also be integrated to realize the input and output functions in some embodiments.
• the mobile phone may further include at least one sensor 1150, such as an optical sensor, a motion sensor, or any other sensor.
• an optical sensor may include an ambient light sensor and a proximity sensor.
• the ambient light sensor may regulate the brightness of the display panel 1141 according to the intensity of ambient light, while the proximity sensor may turn off the display panel 1141 and/or the backlight when the mobile phone moves close to the ear.
• an accelerometer sensor may detect the acceleration in every direction (usually triaxially) or the magnitude and direction of gravity when the mobile phone is still.
• the mobile phone may be used in applications that requires posture detection of the mobile phone (such as switching between vertical and horizontal position, games related to such switching, and posture calibration of magnetometer), functions associated with vibration detection (such as a pedometer and knocking), and so on.
• the mobile phone may further configured with other sensors, such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which will not be discussed in details here.
• the audio circuit 1160, speaker 1161, and microphone 1162 may provide an audio interface between the user and the mobile phone.
• the voice-frequency circuit 1160 may transmit the electric signals, transformed from voice data received, to the speaker 1161, where the electric signals are converted to voice signal output.
• the microphone 1162 transforms voice signals collected to electric signals, which are received by the audio circuit 1160 and converted to voice data.
• the voice data may be transmitted to the processor 1180, processed, and sent to, e.g., another mobile phone, by the RF circuit 1110. Alternatively, the voice data may be sent to the storage 1120 before further processing.
• the wireless communication module 1170 comprises, but not limited to, a WiFi module (Wireless Fidelity, a short-distance wireless communication technology), a Bluetooth module, an infrared communication module, and so on.
• a WiFi module Wireless Fidelity, a short-distance wireless communication technology
• a Bluetooth module Bluetooth module
• an infrared communication module and so on.
• a user can use the mobile phone to receive and send emails, browse webpage, visit streaming media, etc, via the wireless communication module 1170.
• the wireless communication module 1170 is shown in Fig. 6, it is understandable that it is not a required component of the mobile phone and may be omitted, if necessary, without changing the essential scope of the application.
• the processor 1180 is the control center of the mobile phone, connected to every component of the entire mobile phone by various ports and lines, By running or executing the software programs and/or modules stored in the storage 1120 and calling the data stored in the storage 1120, the processor 1180 executes various functions of the mobile phone and processes data in order to realize overall supervision and control of the mobile phone.
• the processor 1180 may include one or more processing units.
• the processor 1180 may integrate an application processor and a modem processor.
• the application processor may act mainly in charge of the operation systems, user interface, and application programs, while the modem processor may act mainly in charge of wireless communication. It is understandable, though, that it is not required that the aforementioned modem processor must be integrated into the processor 1180.
• the mobile phone further comprises a power supply 1190 (e.g., battery) to supply power to every mobile phone component.
• a power supply 1190 e.g., battery
• the power source may have a logical connection with the processor 1180 through the power management system, so that the power management system may manage the functions of charging, discharging, power dissipation management, and so on.
• the mobile phone may further include a camera, a Bluetooth module, etc, though not shown. Such details will not be discussed in details herein.
• the processor 1180 included in the terminal may further have the following function: injecting a first code snippet into the target system process of the terminal; running a virtual machine and the first code snippet in the target system process; interacting the first code snippet with the virtual machine, controlling it to load a second code snippet, and monitoring uninstallation event of application program in the terminal using the second code snippet.
• the processor 1180 may further have the following function: acquiring the process identification of a target system process, and injecting, according to the acquired process identification, the first code snippet into the target system process using a system function for remote injection.
• the operation platform is an Android platform, the first code snippet being a C/C++ code snippet, the virtual machine being a Java virtual machine, and the second code snippet being a Java code snippet.
• the processor 1180 may further have the following function: when detecting an uninstallation event of application program, recording the environmental information of the application program being uninstalled and uploading the information to a server.
• the environmental information includes identification of the running process, identification of the installed application programs, identification code of the terminal device, and the root privilege information of the terminal.

Landscapes

• Engineering & Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computer Hardware Design (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Telephonic Communication Services (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=51806435

Family Applications (1)

Country Status (2)

Cited By (2)

Families Citing this family (4)

Citations (4)

Family Cites Families (3)

• 2013
  • 2013-06-25 CN CN201310257186.4A patent/CN104133752B/zh active Active
• 2014
  • 2014-06-25 WO PCT/CN2014/080715 patent/WO2014206295A1/en active Application Filing

Patent Citations (4)

Also Published As

Similar Documents

Legal Events