WO2017036042A1

WO2017036042A1 - Information collection method and apparatus

Info

Publication number: WO2017036042A1
Application number: PCT/CN2015/099897
Authority: WO
Inventors: 邹荣新
Original assignee: 安一恒通（北京）科技有限公司
Priority date: 2015-08-31
Filing date: 2015-12-30
Publication date: 2017-03-09
Also published as: CN105224880A; CN105224880B

Abstract

Provided are an information collection method and apparatus. The method comprises: collecting client system information, and performing fuzzification processing on the system information; collecting various running-related data; in a case in which the running-related data comprises an identity, performing filtering processing on the running-related data; and uploading the processed system information and the processed running-related data to a server after encryption, the uploaded system information and the uploaded running-related data being stored in the server on a block basis. The method reduces the security problem brought by information collection.

Description

Information collection method and device

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 201510548965.9, filed on Aug. 31, 2015, the entire content of

Technical field

The present application relates to the field of computer technologies, and in particular, to the field of Internet technologies, and in particular, to an information collection method and apparatus.

Background technique

With the rapid development of the Internet, the black interest chain of malicious code has been formed. There are tens of thousands of malicious code samples added every day. The traditional client detection method has changed to the detection method of cloud killing, so the cloud needs to collect a large amount. File data. In order to improve the accuracy of client detection, it is necessary to collect behavior log information of related client software, form big data log analysis in the cloud, and adjust the authentication strategy through massive data analysis, thereby effectively improving the detection capability of the product. However, the prerequisite for improving product detection capability is to collect relevant data information through the client, and transmit the data information back to the data storage center in the cloud through the transmission mechanism, and then analyze and process the big data and feedback to the product application.

The prior art adopts a cloud data collection method. When collecting client data information, the system system information is generally used directly as the user identification number. For example, using the machine name as the user identification number, the collected data information is completely uploaded, and the machine system Information may have sensitive information such as the user's personal information, so there is a lack of security considerations.

Summary of the invention

The purpose of the present application is to propose a privacy-removing information collecting method and apparatus to solve the technical problems mentioned in the above background art.

In a first aspect, the application provides an information collection method, and the method includes: Collecting client system information, and obfuscating the system information; collecting various running related data; and filtering the running related data if the running related data includes an identity identifier; The system information and the operation related data are uploaded to the server by encryption, wherein the uploaded system information and the operation related data are stored in blocks in the server.

In some embodiments, the processing of the processed system information and the operation related data by the encrypted uploading and transmitting server comprises: detecting the running related data; if an unrecognizable portable execution is detected And uploading the path information of the portable executable file; uploading the portable executable file according to the fragmentation acquisition instruction, wherein the fragmentation acquisition instruction is based on the path by the server Generated and delivered by information.

In some embodiments, if the unrecognizable portable executable file is detected, uploading the path information of the portable executable file includes: uploading the portable executable file file In the case of the path information, the user name included in the path information is filtered.

In some embodiments, the system information includes at least one of the following: installed software list information, system configuration utility list information, service list information, operating system version information, browser version information, network card Mac address, hard disk sequence Number, memory information, system structure information.

In some embodiments, the collecting client system information and obscuring the system information includes: collecting client system information, generating a file by using the system information, performing hash calculation on the file, and generating Unique identification number.

In some embodiments, the various operational related data includes at least one of the following: software behavior data, user operational behavior data, user uniform resource locator data, detected threat log data, file information, and content data.

In a second aspect, the present application provides an information collecting apparatus, where the apparatus includes a first collecting unit configured to collect client system information and obfuscate the system information; and a second collecting unit configured to be used for Collecting various operation related data; filtering a processing unit configured to filter the operation related data if the operation related data includes an identity identifier; and a transmission unit configured to process the processed system The information and the operation related data are uploaded to the server by encryption, wherein the uploaded system information and the operation related data are stored in blocks in the server. In some embodiments, the transmission unit is further configured to: detect the operation related data; upload an path information of the portable executable file if an unrecognizable portable executable file is detected; And uploading the portable executable file according to the fragmentation acquisition instruction, wherein the fragmentation acquisition instruction is generated and delivered by the server based on the path information.

In some embodiments, the filtering processing unit is further configured to: when uploading the path information of the portable executable file, perform filtering processing on a username included in the path information.

In some embodiments, the system information includes at least one of the following: a network card Mac address, a hard disk serial number, memory information, and system structure information.

In some embodiments, the obfuscation processing unit is further configured to: collect client system information, generate a file by using the system information, perform hash calculation on the file, and generate a unique identification number.

The information collecting method and device provided by the present application collects the client system information, obfuscates the above system information, and collects various running related data, and if the running related data includes the identity identifier, the operation is related. The data is filtered, and finally the processed system information and the operation related data are encrypted and uploaded, thereby reducing the sensitivity of collecting information and reducing the security problem brought by information collection.

DRAWINGS

Other features, objects, and advantages of the present application will become more apparent from the detailed description of the accompanying drawings.

1 is an exemplary system architecture diagram to which the present application can be applied;

2 is a flow chart of one embodiment of an information collection method according to the present application;

3 is a flow chart of still another embodiment of an information collecting method according to the present application;

4 is a schematic structural diagram of an embodiment of an information collecting apparatus according to the present application;

FIG. 5 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server of an embodiment of the present application.

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention, rather than the invention. It is also to be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 illustrates an exemplary system architecture 100 in which an embodiment of an information collection method or information collection device of the present application may be applied.

As shown in FIG. 1, system architecture 100 can include

terminal devices

101, 102, 103, network 104, and server 105. The network 104 is used to provide a medium for communication links between the

terminal devices

101, 102, 103 and the server 105. Network 104 may include various types of connections, such as wired, wireless communication links, fiber optic cables, and the like.

The user can interact with the server 105 over the network 104 using the

terminal devices

101, 102, 103 to receive or transmit messages and the like. Various client software applications, such as instant messaging tools, email clients, social platform software, etc., which may involve user information collection, may be installed on the

terminal devices

101, 102, and 103.

The

terminal devices

101, 102, 103 can be various electronic devices including, but not limited to, personal computers, smart phones, smart watches, tablets, personal digital assistants, and the like.

The server 105 can be a server that provides various services. The server can store, analyze, and the like the received data, and feed back the processing result to the terminal device.

It should be noted that the information collection method provided by the embodiment of the present application is generally performed by the

terminal devices

101, 102, and 103. Correspondingly, the information collecting device is generally disposed in the

terminal devices

101, 102, and 103.

It should be understood that the number of terminal devices, networks and servers in Figure 1 is merely illustrative. Sexual. Depending on the implementation needs, there can be any number of terminal devices, networks, and servers.

With continued reference to FIG. 2, an exemplary process 200 of one embodiment of an information collection method in accordance with the present application is illustrated. The information collection method includes the following steps:

In step 201, the client system information is collected, and the system information is blurred.

In this embodiment, an electronic device (such as the terminal device shown in FIG. 1) on which the information collecting method runs can collect system information. Specifically, when the user installs the client software on the electronic device, the client software may locally acquire the system information and obfuscate the system information.

In some optional implementation manners of the embodiment, the foregoing system information may include at least one of the following: an installed software list information, a system configuration utility (Microsoft System Configuration, msconfig) list information, a service list information, and an operating system. Version information, browser version information, network card Mac address, hard disk serial number, memory information, system structure information.

In some optional implementation manners of the embodiment, the system information fuzzification process may first generate a file by using the system information, and then perform a hash calculation on the file to obtain a hash value of the file, where the hash value is obtained. The hash value is a unique identification number after the system information of the user's machine is blurred.

In step 202, various operational related data are collected.

In this embodiment, after running, the client software installed on the electronic device collects various operation related data.

In some optional implementation manners of the embodiment, the foregoing various operation related data may include at least one of the following: software behavior data, user operation behavior data, user uniform resource locator data, detection threat log data, file information, and Content data. Here, the software behavior data is the behavior data of the client software itself, wherein the behavior of the client software itself may include software installation, uninstallation, daily behavior, upgrade requirements, and the like. The user operation behavior data may include data of a user's usage characteristics, a click button, and the like. When the user accesses the Uniform Resoure Locator (URL) URL through the browser, the client software collects the Uniform Resource Locator URL data.

Step 203: Perform filtering processing on the operation related data if the operation related data includes an identity identifier.

In this embodiment, some user personal information may exist in the foregoing operation related data. For example, the user uniform resource locator data includes a user account and a password. In this case, the user personal information needs to be filtered. As an example, the user's personal information can be removed and occlusion can be performed, for example, the user account and password can be occluded with "******".

Step 204: The processed system information and the operation related data are encrypted and uploaded to the server, wherein the uploaded system information and the operation related data are stored in blocks in the server.

In this embodiment, the system information processed by step 201 and step 203 and the operation related data are encrypted and uploaded to the server, wherein the uploaded system information and the operation related data are stored in blocks in the server, for example, When storing, use a storage machine cluster across the equipment room, and upload the interface uniformly, and store the uploaded content separately.

With further reference to FIG. 3, a flow 300 of yet another embodiment of an information collection method is illustrated. The process 300 of the information collection method includes the following steps:

Step 301: Collect client system information, and obfuscate the system information.

In this embodiment, the electronic device (for example, the terminal device shown in FIG. 1) on which the information collecting method runs can collect system information. Specifically, when the user installs the client software on the electronic device, the client may locally obtain the system information and obfuscate the system information. The foregoing system information may include at least one of the following: an installed software list information, a system configuration utility list information, a service list information, an operating system version information, a browser version information, a network card Mac address, a hard disk serial number, and a memory information. , system structure information.

The system information fuzzification process may be as follows: first, generating the file by using the above system information; and then performing a hash calculation on the file to obtain a hash value of the file, and the hash value is a system of the user machine. The unique identification number after the information is blurred.

In step 302, various operational related data are collected.

In this embodiment, after running, the client software installed on the electronic device collects various operation related data. Wherein, the above various operation related data may include the following At least one item: software behavior data, user operation behavior data, user uniform resource locator data, detection threat log data, file information, and content data.

Step 303: Perform filtering processing on the operation related data if the operation related data includes an identity identifier.

In this embodiment, some user personal information may exist in the above operation related data. In this case, the user personal information needs to be filtered.

Step 304: The processed system information and the operation related data are transmitted to the server through encryption, wherein the uploaded system information and the operation related data are stored in blocks in the server.

In this embodiment, the system information and the operation related data processed in

steps

301 and 303 are encrypted and uploaded to the server, wherein the uploaded system information and the operation related data are stored in blocks in the server.

In step 305, the operation related data is detected.

In this embodiment, the running related data of the uploading server is detected, and the portable running data (Portable Executable (PE) file) that is not recognized by the client software is detected in the running related data. The above portable executable file may include an Executable Program (EXE) file, a Dynamic Link Library (DLL) file, and an Object Linking and Embedding (OLE) Control eXtension (OCX) file. , System (SYS) files or other portable executable files that will be developed in the future.

Step 306: If an unrecognizable portable executable file is detected, upload path information of the portable executable file.

In this embodiment, based on the detection result of step 305, if an unrecognizable portable executable file is detected, the path information of the detected unrecognizable portable executable file is uploaded to the server.

In some optional implementation manners of the embodiment, when the path information of the portable executable file that cannot be identified is uploaded, the path information may be filtered to remove the personal information in the path information, where Personal information can include a username.

Step 307: Upload the portable executable file according to the fragmentation acquisition instruction fragment, wherein the fragment acquisition instruction is generated by the server based on the path information and Made.

In this embodiment, the portable executable file that is not recognized is detected according to the fragmentation acquisition instruction fragment uploading step 305.

As can be seen from FIG. 3, the flow 300 of the information collection method in the present embodiment highlights the step of fragmentation transmission of an unrecognizable portable executable file as compared with the embodiment corresponding to FIG. Therefore, the scheme described in this embodiment can implement the fragment uploading of the file, and the fragment uploading makes the data collected on each machine limited, and the data privacy problem cannot be analyzed according to the fragment data collected on one machine. , thereby effectively reducing the generation of personal privacy sensitive data.

With reference to FIG. 4, as an implementation of the method shown in the above figures, the present application provides an embodiment of an information collecting apparatus, and the apparatus embodiment corresponds to the method embodiment shown in FIG. Used in a variety of electronic devices.

As shown in FIG. 4, the information collecting apparatus 400 described in this embodiment includes: a first collecting unit 401, a second collecting unit 402, a filtering processing unit 403, and a transmitting unit 404. The first collecting unit 401 is configured to collect client system information, and the above system information is fuzzified; the second collecting unit 402 is configured to collect various running related data; and the filtering processing unit 403 is configured to be used in the foregoing operation. When the related data includes the identity identifier, the foregoing operation related data is filtered; the transmission unit 404 is configured to pass the processed system information and the operation related data to the server after being encrypted, wherein the uploaded system information and The above operation related data is stored in blocks in the above server.

In this embodiment, the first collection unit 401 of the information collection device 400 can collect system information. Specifically, when the client software is installed on the electronic device, the client software may obtain the system information locally through the first collecting unit 401, and the system information acquired by the first acquisition unit 401 by the Shanghai-Soviet unit 401. The blurring process is performed, and the system information after the blurring process is transmitted to the transmission unit 404.

In this embodiment, after the client software installed on the electronic device is running, the second collection unit 402 may collect various operation related data of the client software, and send the collected operation related data to the The filtering processing unit 403 described above.

In the embodiment, the filtering processing unit 403 filters the operation related data in the case that the operation related data includes the identity identifier, removes the identity identifier in the operation related data, and performs the filtering operation. The relevant data is sent to the above transmission unit 404.

In this embodiment, the transmission unit 404 may upload the system information and the operation related data to the server by using a wired connection method or a wireless connection manner.

Those skilled in the art will appreciate that the above-described information collection device 400 also includes other well-known structures, such as processors, memories, etc., which are not shown in FIG. 4 in order to unnecessarily obscure the embodiments of the present disclosure.

Referring now to Figure 5, there is shown a block diagram of a computer system 500 suitable for use in implementing a terminal device or server of an embodiment of the present application.

As shown in FIG. 5, computer system 500 includes a central processing unit (CPU) 501 that can be loaded into a program in random access memory (RAM) 503 according to a program stored in read only memory (ROM) 502 or from storage portion 508. And perform various appropriate actions and processes. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input/output (I/O) interface 505 is also coupled to bus 504.

The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 508 including a hard disk or the like. And a communication portion 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the Internet. Driver 510 is also coupled to I/O interface 505 as needed. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 510 as needed so that a computer program read therefrom is installed into the storage portion 508 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as a computer software program in accordance with an embodiment of the present disclosure. For example, an embodiment of the present disclosure includes a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart. In such an implementation In an example, the computer program can be downloaded and installed from the network via the communication portion 509, and/or installed from the removable medium 511.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality and operation of possible implementations of systems, methods and computer program products in accordance with various embodiments of the present application. In this regard, each block of the flowchart or block diagrams can represent a module, a program segment, or a portion of code that includes one or more logic for implementing the specified. Functional executable instructions. It should also be noted that in some alternative implementations, the functions noted in the blocks may also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.

The units involved in the embodiments of the present application may be implemented by software or by hardware. The described unit may also be provided in the processor, for example, as a processor comprising a first acquisition unit, a second acquisition unit, a filtering processing unit, and a transmission unit. The name of these units does not constitute a limitation on the unit itself in some cases. For example, the first collection unit may also be described as “used to collect client system information and obfuscate the system information. Unit."

In another aspect, the present application further provides a computer readable storage medium, which may be a computer readable storage medium included in the apparatus described in the foregoing embodiment, or may exist separately, not A computer readable storage medium that is assembled into a terminal. The computer readable storage medium stores one or more programs that are used by one or more processors to perform the information collection methods described herein.

The above description is only a preferred embodiment of the present application and a description of the principles of the applied technology. It should be understood by those skilled in the art that the scope of the invention referred to in the present application is not limited to the specific combination of the above technical features, and should also be covered by the above technical features without departing from the inventive concept. Other technical solutions formed by any combination of their equivalent features. For example, the above features are disclosed in the application (but not limited to) A technical solution in which technical features having similar functions are replaced with each other.

Claims

An information collecting method, characterized in that the method comprises:

Collecting client system information and obfuscating the system information;

Collect various operational related data;

And in the case that the operation related data includes an identity identifier, the operation related data is filtered;

The processed system information and the operation related data are transmitted to the server through encryption, wherein the uploaded system information and the operation related data are stored in blocks in the server.
The method according to claim 1, wherein the processing of the processed system information and the operation related data by the encrypted uploading server comprises:

Detecting the operation related data;

Uploading path information of the portable executable file if an unrecognizable portable executable file is detected;

And uploading the portable executable file according to the fragmentation acquisition instruction, wherein the fragmentation acquisition instruction is generated and delivered by the server based on the path information.
The method according to claim 2, wherein the uploading the path information of the portable executable file, if the unrecognizable portable executable file is detected, comprises:

When the path information of the portable executable file is uploaded, the user name included in the path information is filtered.
The method of claim 1 wherein said system information comprises at least one of the following:

Installed software list information, system configuration utility list information, service list information, operating system version information, browser version information, network card Mac address, hard disk serial number, memory information, system structure information.
The method according to claim 1, wherein the collecting client system information and obfuscating the system information comprises:

Collect client system information;

Generating the system information into a file;

A hash calculation is performed on the file to generate a unique identification number.
The method of claim 1 wherein said various operational related data comprises at least one of the following:

Software behavior data, user operation behavior data, user uniform resource locator data, detection threat log data, file information, and content data.
An information collecting device, characterized in that the device comprises:

a first collecting unit, configured to collect client system information, and obfuscate the system information;

a second collection unit configured to collect various operational related data;

a filtering processing unit, configured to perform filtering processing on the running related data if the running related data includes an identity identifier;

a transmission unit configured to pass the processed system information and the operation related data to an encrypted upload server, where the uploaded system information and the operation related data are stored in blocks in the server .
The information collecting apparatus according to claim 7, wherein the transmission unit is further configured to:

Detecting the operation related data;

Uploading path information of the portable executable file if an unrecognizable portable executable file is detected;

And uploading the portable executable file according to the fragmentation acquisition instruction, wherein the fragmentation acquisition instruction is generated and delivered by the server based on the path information.
The information collecting apparatus according to claim 8, wherein the filtering processing unit is further configured to:

When the path information of the portable executable file is uploaded, the user name included in the path information is filtered.
The information collecting apparatus according to claim 7, wherein the system information comprises at least one of the following:

NIC Mac address, hard disk serial number, memory information, system structure information.
The information collecting apparatus according to claim 7, wherein the blur processing unit is further configured to:

Collecting client system information, generating a file by using the system information, performing hash calculation on the file, and generating a unique identification number.
The information collecting apparatus according to claim 7, wherein said various operation related data comprises at least one of the following:

Software behavior data, user operation behavior data, user uniform resource locator data, detection threat log data, file information, and content data.
A device that includes:

Processor; and

Memory,

The memory stores computer readable instructions executable by the processor, the processor executing the method of any one of claims 1 to 6 when the computer readable instructions are executed.
A non-volatile computer storage medium storing computer readable instructions executable by a processor, the processor executing claim 1 to when the computer readable instructions are executed by a processor The method of any of 6.