WO2017113561A1 - 一种信息拦截处理方法及终端、计算机存储介质 - Google Patents

一种信息拦截处理方法及终端、计算机存储介质 Download PDF

Info

Publication number
WO2017113561A1
WO2017113561A1 PCT/CN2016/081742 CN2016081742W WO2017113561A1 WO 2017113561 A1 WO2017113561 A1 WO 2017113561A1 CN 2016081742 W CN2016081742 W CN 2016081742W WO 2017113561 A1 WO2017113561 A1 WO 2017113561A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
application
interception
network request
intercepted
Prior art date
Application number
PCT/CN2016/081742
Other languages
English (en)
French (fr)
Inventor
陈猛
胡晶晶
刘慧�
张枫枫
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2017113561A1 publication Critical patent/WO2017113561A1/zh
Priority to US15/707,414 priority Critical patent/US10567841B2/en
Priority to US16/725,839 priority patent/US11206451B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/454—Content or additional data filtering, e.g. blocking advertisements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/564—Enhancement of application control based on intercepted application data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/81—Monomedia components thereof
    • H04N21/812—Monomedia components thereof involving advertisement data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/81—Monomedia components thereof
    • H04N21/8166—Monomedia components thereof involving executable data, e.g. software
    • H04N21/8173—End-user applications, e.g. Web browser, game
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity

Definitions

  • the present invention relates to an interception technology, and in particular, to an information interception processing method, a terminal, and a computer storage medium.
  • the active or passive information interception method can not only effectively intercept information, locate the source of information, but also occupy the system resources of the terminal, so that the terminal user increases unnecessary communication cost. There is no effective solution.
  • the embodiment of the present invention is to provide an information interception processing method, a terminal, and a computer storage medium, which at least solves the problems existing in the prior art, can effectively perform information interception, locate information sources, and avoid occupying system resources of the terminal. So that the end user does not need to increase unnecessary Communication costs.
  • An information interception processing method includes:
  • the communication information is matched with a preset policy, and if the communication information is determined to be the specified target information by matching, the network request is intercepted, and the positioning is traced back to the to-be-intercepted application that issues the network request.
  • the configuration unit is configured to start the first application, extract the application list that needs to be intercepted, and configure an interception policy for each to-be-intercepted application in the application list;
  • the intercepting unit is configured to acquire a network request sent by the application to be intercepted, and in the case that the first application enters the interception mode, the network request sent by the to-be-intercepted application is monitored according to the configured interception policy to match Corresponding to the communication information of the interception policy, the communication information is associated with the network request;
  • the intercepting unit is configured to match the communication information with a preset policy, and if the communication information is determined to be the specified target information by matching, intercept the network request, and locate the traceback to send the network request The application to be intercepted.
  • the embodiment of the invention further provides a computer storage medium, wherein computer executable instructions are stored, and the computer executable instructions are configured to execute the information interception processing method.
  • An information interception processing method includes: starting a first response And extracting an application list that needs to be intercepted, and configuring an interception policy for each of the to-be-intercepted applications in the application list; acquiring a network request sent by the application to be intercepted, and in the case that the first application enters the interception mode, according to the configured
  • the interception policy intercepts the network request sent by the to-be-intercepted application to match the communication information that meets the interception policy, the communication information is associated with the network request, and matches the communication information with a preset policy. And if it is determined by the matching that the communication information is the specified target information, intercepting the network request, and locating the to-be-intercepted application that issues the network request.
  • an interception policy may be separately configured for at least one to-be-intercepted application except the first application. Since the interception policy may be separately set for a single application, the interception is more targeted, so that the interception process is performed. Faster and more accurate interception.
  • the network request After entering the interception mode, after the network request is monitored, if the communication information associated with the network request is matched with the preset policy to obtain the specified target information, the network request is intercepted, and the location is traced back to the issue.
  • the intercepted application of the network request can not only realize information interception, but also locate the to-be-intercepted application that issues the network request, and also makes the interception processing more efficient, the interception precision is higher, and the user can be prompted to know the waiting Intercepting applications has security risks and improves security.
  • 1 is a schematic diagram of hardware entities of each party performing information interaction in an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an implementation process according to Embodiment 1 of the present invention.
  • Embodiment 2 of the present invention is a schematic flowchart of an implementation process of Embodiment 2 of the present invention.
  • FIG. 4 is a schematic diagram of an application example of prompt information according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a structure according to Embodiment 4 of the present invention.
  • FIG. 6 is a schematic structural diagram of a hardware component according to Embodiment 5 of the present invention.
  • FIGS. 7-10 are schematic diagrams of multiple terminal user interfaces to which an embodiment of the present invention is applied.
  • FIG. 11 is a schematic diagram of an original network communication node in a network communication architecture according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of a network communication node in which a new monitoring and detecting point is added in a network communication architecture according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of hardware entities of each party performing information interaction according to an embodiment of the present invention.
  • FIG. 1 includes: a server 11...1n, a terminal device 21-24, and a terminal device 21-24 performs a connection with a server through a wired network or a wireless network.
  • the terminal device includes a mobile phone, a desktop computer, a PC, an all-in-one, etc.
  • the server 11...1n can also communicate with the first type of terminal through the network (such as the terminal where the advertiser is located, or called advertising)
  • the material and the content promotion object interact with each other.
  • the first type of terminal (such as the terminal where the advertiser is located, or the object that provides the creative and content promotion) submits the advertisement to be served and is stored in the server cluster. It can be equipped with a series of processes such as an administrator reviewing the advertisements of the first type of terminal (such as the terminal where the advertiser is located, or the object that provides advertising and content promotion).
  • the terminal device 21-24 may be referred to as a terminal of the second type (such as a terminal where the ordinary user is located) with respect to the terminal of the first type (such as the terminal where the advertiser is located, or the object that provides the promotion of the advertisement and the content promotion).
  • the embodiment of the present invention includes: starting a first application, extracting an application list that needs to be intercepted, and configuring an interception policy for each to-be-intercepted application in the application list; The network request sent by the application is intercepted, and the interception mode of the first application is detected.
  • the network request sent by the to-be-intercepted application is monitored according to the interception policy to match Corresponding to the communication information of the interception policy, the communication information is associated with the network request; matching the communication information with a preset policy, such as an information multi-feature audit policy, if matched Determining that the communication information is the specified target information, intercepting the network request, and locating the to-be-intercepted application that issues the network request.
  • a preset policy such as an information multi-feature audit policy
  • FIG. 1 is only a system architecture example for implementing the embodiment of the present invention.
  • the embodiment of the present invention is not limited to the system structure described in FIG. 1 above, and various embodiments of the present invention are proposed based on the system architecture.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • An information interception processing method includes:
  • Step 101 Receive a first operation to start the first application, extract an application list that needs to be intercepted, and configure an interception policy for each to-be-intercepted application in the application list.
  • the terminal in this step refers to the terminal of the second type mentioned in the above overview, and the second terminal may be a terminal where the ordinary user is located, or an object that is displayed or exposed by an advertisement.
  • the first application as an application for information interception, may include, but is not limited to, an optimization master or the like, and the at least one to-be-intercepted application except the first application may be a video application installed by the terminal.
  • Music player apps reading apps, browser apps and more.
  • the web request is an ad request, the ad information is intercepted by the app for information interception.
  • a lot of information is invalid information for the user's needs, or information that the user does not want to pay attention to, for example, the product advertisement information or the latest game pushed by the user through reading the application when reading the application.
  • the class information is mostly in the advertisement information. Therefore, by blocking the advertisement information by the application for information interception, and configuring the interception policy separately for at least one to-be-intercepted application other than the first application, the interception policy can be separately set for the individual application. Therefore, the interception of advertising information is more targeted, making the interception processing more efficient and the interception accuracy higher.
  • Step 102 Obtain a network request sent by the at least one application to be intercepted, and detect that the current is No, the interception mode of the first application is entered. If yes, step 103 is performed. Otherwise, step 106 is executed to release the network request and perform communication according to the normal communication mode, that is, the network request is not intercepted.
  • the interception mode 1) if the user sets a request for intercepting which applications are sent in the application for information interception, for example, setting the applications in the interception list, then opening the information for use After the intercepted application performs the interception mode, the applications in the interception list are intercepted and monitored, that is, whether the request sent by these applications is monitored as a network request, whether it is a normal network request or an advertisement request that needs to be intercepted, so that Monitor advertising information. 2) It is also possible to set the interception requirement in multiple applications that need to be monitored. After the application for intercepting the information is opened for interception mode, multiple applications are intercepted and monitored according to the interception requirement, that is, issued for these applications. Request to monitor whether it is a network request, whether it is a normal network request or an ad request that needs to be intercepted in order to monitor the advertisement information.
  • Step 103 Enter an interception mode of the first application, and listen to the network request sent by the at least one application to be intercepted according to the interception policy, to match communication information that meets the interception policy, where the communication information and the information are The network request is associated.
  • the communication information is information that complies with the interception policy and is associated with the network request, including but not limited to: two types of information, and the network request is an abnormal communication request (advertising request) as an example.
  • the advertisement request is discarded, and the application information can be located and traced back to the application that issues the advertisement request, so that the interception strategy, the multi-feature auditing strategy, and the two types of information can not only realize information interception but also locate The application that issued the network request also makes the interception processing faster and the interception accuracy higher.
  • the interception strategy can be a hook listening policy.
  • the hook is a monitoring method. Taking a window instance as an example, hook is a platform of the Windows message processing mechanism.
  • the application can set a child process on the hook to monitor a certain message of the specified window, and the monitored window can be created by other child processes.
  • the hook mechanism allows the application to intercept the window message or a specific event.
  • the hook mechanism is actually a program segment that processes the message. It is hooked into the system through the system call.
  • the hook program first captures the window message or the issuance of a specific event, that is, the hook function first obtains control.
  • the hook function can process the window message or a specific event, or continue to pass the processing without processing.
  • a window message or a specific event can also force the end of the window message or the delivery of a specific event.
  • Step 104 Match the communication information according to the information multi-feature auditing policy. If the communication information is determined to be the specified target information, go to step 105. Otherwise, go to step 106 to release the network request.
  • the normal communication mode communicates, that is, the network request is not intercepted.
  • the communication information includes two types of information: information corresponding to the network request (such as advertisement information), and information corresponding to the current application (such as application information) that initiates the network request.
  • information corresponding to the network request such as advertisement information
  • information corresponding to the current application such as application information
  • step 104 if the communication information is determined to be the specified target information, such as the advertisement information corresponding to the abnormal communication request (advertising request), the network request is intercepted and the network request is discarded. The location is traced back to the current application that issued the network request. Since not only information interception but also an application that issues the network request can be located, the interception processing is faster and the interception accuracy is higher.
  • Step 105 Intercept the network request, discard the network request, and locate the current application that sends the network request.
  • Step 106 Release the network request, perform communication according to a normal communication mode, that is, not intercept the network request.
  • the network request for the network request to be an abnormal communication request (such as an advertisement request), it is possible to prevent the normal network request from being intercepted due to the interception error in the advertisement information interception of the advertisement request, and may also be caused by Blocking errors and missing the interception of real advertising information requests, because these conditions will reduce the accuracy of the interception of advertising information.
  • these problems can be ruled out, thereby maximizing the interception accuracy and improving the interception processing efficiency.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • FIG. 3 An information interception processing method according to an embodiment of the present invention is shown in FIG. 3, where the method includes:
  • Step 201 Receive a first operation to start the first application, extract an application list that needs to be intercepted, and configure an interception policy for each to-be-intercepted application in the application list, and configure different interception policies for each to-be-intercepted application.
  • the advertisement information corresponding to the same advertisement request can be set for information interception for some different applications, and some need not set the information interception strategy.
  • a shopping-related advertisement form is displayed in the form of a screen advertisement or an in-line advertisement.
  • the advertisement form is inherent to the shopping application, and therefore, For a shopping app, there is no need to set up information blocking for that ad form; for a music app or video app or reading app, if a form of ad-related ad is also shown in the form of a screen ad or an inline ad, Then, you need to set up information interception for this form of advertising.
  • the same policy can be set, that is, there is no need to set information interception for the advertising form.
  • the terminal in this step Refers to the second type of terminal mentioned in the above review, and the second terminal may be a terminal where an ordinary user is located, or an object that is displayed or exposed by an advertisement.
  • the first application as an application for information interception, may include, but is not limited to, an optimization master or the like, and the at least one to-be-intercepted application except the first application may be a video application installed by the terminal. Music player apps, reading apps, browser apps and more. If the net If the request is an advertisement request, the advertisement information is intercepted by the application for information interception. In the scenario where a large amount of information is pushed to the user, a lot of information is invalid information for the user's needs, or information that the user does not want to pay attention to, for example, the product advertisement information or the latest game pushed by the user through reading the application when reading the application.
  • the class information is mostly in the advertisement information. Therefore, by blocking the advertisement information by the application for information interception, and configuring the interception policy separately for at least one to-be-intercepted application other than the first application, the interception policy can be separately set for the individual application. Therefore, the interception of advertising information is more targeted, making the interception processing more efficient and the interception accuracy higher.
  • Step 202 Acquire a network request sent by the at least one application to be intercepted, and detect whether the interception mode of the first application is currently entered. If yes, execute step 203. Otherwise, perform step 207 to release the network request, according to normal communication. The mode communicates, that is, the network request is not intercepted.
  • the interception mode 1) if the user sets a request for intercepting which applications are sent in the application for information interception, for example, setting the applications in the interception list, then opening the information for use After the intercepted application performs the interception mode, the applications in the interception list are intercepted and monitored, that is, whether the request sent by these applications is monitored as a network request, whether it is a normal network request or an advertisement request that needs to be intercepted, so that Monitor advertising information. 2) It is also possible to set the interception requirement in multiple applications that need to be monitored. After the application for intercepting the information is opened for interception mode, multiple applications are intercepted and monitored according to the interception requirement, that is, issued for these applications. Request to monitor whether it is a network request, whether it is a normal network request or an ad request that needs to be intercepted in order to monitor the advertisement information.
  • Step 203 Enter an interception mode of the first application, and listen to the network request sent by the at least one to-be-intercepted application according to the interception policy, to match the pass that meets the interception policy.
  • the information is associated with the network request.
  • the communication information is information that complies with the interception policy and is associated with the network request, including but not limited to: two types of information, and the network request is an abnormal communication request (advertising request) as an example.
  • the advertisement request is discarded, and the application information can be located and traced back to the application that issues the advertisement request, so that the interception strategy, the multi-feature auditing strategy, and the two types of information can not only realize information interception, but also Being able to locate the application that issued the network request also makes the interception process more efficient and the interception accuracy higher.
  • the interception strategy can be a hook listening policy.
  • the hook is a kind of listening mode.
  • the window instance is taken as an example.
  • the hook is a platform of the Windows message processing mechanism.
  • the application can set a child process on the hook to monitor a certain message of the specified window, and the monitored window can be It is created by other child processes.
  • the hook mechanism allows the application to intercept the window message or a specific event.
  • the hook mechanism is actually a program segment that processes the message. It is hooked into the system through the system call.
  • the hook program first captures the window message or the issuance of a specific event, that is, the hook function first obtains control.
  • the hook function can process the window message or a specific event, or continue to pass the processing without processing.
  • a window message or a specific event can also force the end of the window message or the delivery of a specific event.
  • Step 204 Parsing the first information corresponding to the network request (such as advertisement information) and the second information corresponding to the current to-be-intercepted application that initiates the network request (such as application information corresponding to the application that sends the network request), The first information and the second information are used as the communication information.
  • Step 205 Extract multiple advertisement feature parameters included in the advertisement cloud list database, according to multiple The feature reviewing policy compares the plurality of advertisement feature parameters with the communication information, and if the comparison is successful, determining that the communication information is advertisement information, performing step 206; otherwise, performing step 207, releasing the network
  • the request is to communicate in accordance with the normal communication mode, that is, the network request is not intercepted.
  • the communication information includes two types of information: information corresponding to the network request (such as advertisement information), and information corresponding to the current application (such as application information) that initiates the network request.
  • information corresponding to the network request such as advertisement information
  • information corresponding to the current application such as application information
  • step 104 if the communication information is determined to be the specified target information, such as the advertisement information corresponding to the abnormal communication request (advertising request), the network request is intercepted and the network request is discarded. The location is traced back to the current application that issued the network request. Since not only information interception but also an application that issues the network request can be located, the interception processing is faster and the interception accuracy is higher.
  • Step 206 Intercept the network request, discard the network request, locate the current application to the network request, and send a prompt message to the terminal user.
  • the prompt information is used to represent the current application existence information security risk, and an example of the prompt information is shown in A11 of FIG. 4 .
  • Step 207 Release the network request, perform communication according to a normal communication mode, that is, not intercept the network request.
  • the network request to be an abnormal communication request (such as an advertisement request)
  • an abnormal communication request such as an advertisement request
  • these problems can be ruled out, thereby maximizing the interception accuracy and improving the interception processing efficiency.
  • the user may be prompted to know that the application has a security risk, thereby improving security.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • the information interception method further includes: associating the first application with X target processes of at least one to-be-intercepted application except the first application, X is a natural number greater than 1; the first application is entered into the X target processes according to the established association to implement monitoring of X target processes.
  • This mechanism for monitoring the association between the X target processes and the first application process can be an injection mechanism.
  • the network request sent by the at least one to-be-intercepted application is monitored according to the interception policy, to match the communication that meets the interception policy.
  • the information includes: monitoring the interaction of the network request in the X target processes, intercepting the network request; setting a snoop detection interface on the request message forwarding node of the network request according to the interception policy, and acquiring the interception detection interface according to the interception detection interface The communication information.
  • the request message forwarding node of the network request may be a node that sends a message or receives a message, specifically, by sending a function and a receiving function.
  • the snoop detection interface can be implemented by the hook monitoring method mentioned above.
  • the first function sendto and the second function recvfrom for characterizing the request message forwarding node the first function sendto is a specific example of the sending function, and the second function recvfrom is A specific instance of the receiving function.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • the terminal of the embodiment of the present invention as shown in FIG. 5, the terminal includes:
  • the configuration unit 11 is configured to receive the first operation to start the first application, extract the application list that needs to be intercepted, and configure an interception policy for each to-be-intercepted application in the application list;
  • the monitoring unit 12 is configured to acquire the network request sent by the at least one to be intercepted application, and if the first application enters the interception mode, perform the network request sent by the to-be-intercepted application according to the configured interception policy. Listening to match communication information that meets the interception policy, the communication information being associated with the network request;
  • the intercepting unit 13 is configured to match the communication information according to the information multi-feature auditing policy. If the communication information is determined to be the specified target information by matching, the network request is intercepted, and the positioning is traced back to the issuing office. The application to be intercepted of the network request.
  • the terminal in this step refers to the terminal of the second type mentioned in the above overview, and the second terminal may be a terminal where the ordinary user is located, or an object that is displayed or exposed by an advertisement.
  • the first application as an application for information interception, may include, but is not limited to, an optimization master or the like, and the at least one to-be-intercepted application except the first application may be a video application installed by the terminal.
  • Music player apps reading apps, browser apps and more.
  • the web request is an ad request, the ad information is intercepted by the app for information interception.
  • a lot of information is invalid information for the user's needs, or information that the user does not want to pay attention to, for example, the product advertisement information or the latest game pushed by the user through reading the application when reading the application.
  • the class information is mostly in the advertisement information. Therefore, by blocking the advertisement information by the application for information interception, and configuring the interception policy separately for at least one to-be-intercepted application other than the first application, the interception policy can be separately set for the individual application. Therefore, the interception of advertising information is more targeted, making the interception processing more efficient and the interception accuracy higher.
  • the interception mode 1) if the user sets a request for intercepting which applications are sent in the application for information interception, for example, setting the applications in the interception list, then opening the information for use After the intercepted application performs the interception mode, it will block the interception list. These applications are intercepted and monitored, that is, whether the requests sent by these applications are monitored as network requests, whether they are normal network requests or advertisement requests that need to be intercepted, so as to monitor advertisement information. 2) It is also possible to set the interception requirement in multiple applications that need to be monitored. After the application for intercepting the information is opened for interception mode, multiple applications are intercepted and monitored according to the interception requirement, that is, issued for these applications. Request to monitor whether it is a network request, whether it is a normal network request or an ad request that needs to be intercepted in order to monitor the advertisement information.
  • the communication information is information that complies with the interception policy and is associated with the network request, including but not limited to: two types of information, and the network request is an abnormal communication request (advertising request) as an example.
  • the advertisement request can also be traced back to the application that issues the advertisement request by using the application information, so that not only information interception but also information can be located through the interception strategy, the multi-feature auditing strategy and the two types of information.
  • the requested application also makes the interception processing faster and the interception accuracy higher.
  • the communication information includes two types of information: information corresponding to the network request (such as advertisement information), and information corresponding to the current application (such as application information) that initiates the network request.
  • the communication information is determined to be the specified target information, such as the advertisement information corresponding to the abnormal communication request (advertising request), and then the network request is subsequently intercepted, the network request is discarded, and the positioning is traced.
  • the interception processing is faster and the interception accuracy is higher.
  • the network request for the network request to be an abnormal communication request (such as an advertisement request), it is possible to prevent the normal network request from being intercepted due to the interception error in the advertisement information interception of the advertisement request, and may also be caused by Blocking errors and missing the interception of real advertising information requests, because these conditions will reduce the accuracy of the interception of advertising information.
  • the embodiment of the present invention Take these problems in order to maximize the interception accuracy and improve the interception processing efficiency.
  • the intercepting unit further includes: a parsing unit, configured to parse the first information corresponding to the network request and the second corresponding to the current to-be-intercepted application that initiates the network request Information, the first information and the second information are used as the communication information;
  • An audit sub-unit configured to extract a plurality of advertisement feature parameters included in the advertisement cloud list database, and compare the plurality of advertisement feature parameters with the communication information according to the multi-feature audit policy, if the comparison is successful, Determining that the communication information is an advertisement information, positioning a current application that initiates the network request, intercepting the network request, and sending a prompt message to the terminal user; the prompt information is used to represent that the current application exists Information security risks.
  • the configuration unit is further configured to separately configure the interception policy for each of the at least one to-be-intercepted applications except the first application; the intercepting The strategy is the same strategy, or a different strategy.
  • the terminal further includes: a process injection association unit, configured to: the first application and the X target processes of the at least one application to be intercepted except the first application Establishing an association, the X is a natural number greater than 1; the first application is entered into the X target processes according to the established association to implement monitoring of X target processes.
  • a process injection association unit configured to: the first application and the X target processes of the at least one application to be intercepted except the first application Establishing an association, the X is a natural number greater than 1; the first application is entered into the X target processes according to the established association to implement monitoring of X target processes.
  • the monitoring unit further includes: a network request monitoring subunit configured to monitor an interaction of the network request in the X target processes, intercept the network request; and the information monitoring subunit, configured And setting a snoop detection interface on the request message forwarding node of the network request according to the interception policy, and acquiring the communication information according to the interception detection interface.
  • the information monitoring subunit is further configured to: set a hook hook function in the first function sendto and the second function recvfrom for characterizing the request message forwarding node, and generate The first listener function that listens to network request interactions The hook_sendto and the second listener function hook_recvfrom; use the first listener function hook_sendto and the second listener function hook_recvfrom as the listener detection interface.
  • Embodiment 5 is a diagrammatic representation of Embodiment 5:
  • the above terminal may be an electronic device such as a PC, and may also be a portable electronic device such as a PAD, a tablet computer, a laptop computer, or an intelligent mobile terminal such as a mobile phone, and is not limited to the description herein;
  • the server may be an electronic device that is configured by a cluster system and integrated into one or each unit function to implement each unit function.
  • the client and the server at least include a database for storing data and for data processing.
  • the processor includes either a storage medium provided in the server or a separately set storage medium.
  • a microprocessor for the processor for data processing, a microprocessor, a central processing unit (CPU), a digital signal processor (DSP, Digital Singnal Processor) or programmable logic may be used when performing processing.
  • An FPGA Field-Programmable Gate Array
  • An operation instruction for a storage medium, includes an operation instruction, where the operation instruction may be computer executable code, and the operation instruction is used to implement the information processing method in the foregoing embodiment of the present invention.
  • the apparatus includes a processor 31, a storage medium 32, and at least one external communication interface 33; the processor 31, the storage medium 32, and the external communication interface 33 are all connected by a bus 34.
  • the embodiment of the invention further provides a computer storage medium, wherein computer executable instructions are stored, and the computer executable instructions are configured to execute the information interception processing method.
  • This application scenario is that the information interception is for the advertisement information, and the application scenario adopts the present disclosure.
  • the embodiment is specifically a technical solution capable of more flexibly and accurately intercepting information of advertisement information.
  • the HTTP URL format referred to in this article refers to http://host[:port][abs_path], which is included in the domain name (host) file.
  • the host file is a system file without an extension. Its main function is to speed up. Domain name resolution, you can also block websites, etc.
  • the legal Internet host domain name or IP address is abs_path, which is used to specify the Uniform Resource Locator (URL) of the requested resource.
  • the URL mentioned in the following is the part of abs_path.
  • Passive advertising interception means obtaining the advertising information host through static scanning, then modifying the system host file or using iptable redirection to prohibit the mobile phone from accessing the advertising information host.
  • the advertising information is finally intercepted by the system, and the application of this type only sets the host. I don't know when the advertising information was intercepted or even if I was intercepted. There is no tracking of the source of the advertising information.
  • Intercept accuracy means that in the interception of the advertisement information, the normal network request may be intercepted due to the interception error, and the interception of the real advertisement information request may be missed due to the interception error, which will reduce the accuracy of intercepting the advertisement information.
  • the information interception method of an instance is a passive information interception method (static interception) as an example, and the interception of the advertisement information can be realized, and the interception of the advertisement information needs a static scan application, so that Extract the advertisement features in the application, write the advertisement features into the host file, and obtain the corresponding advertisement information host in the host file.
  • the advertisement information host is a mapping for the local domain name, and in order to intercept the information, the advertisement information host is modified to Requests are mapped to invalid or incorrect IP addresses to enable interception of advertising information.
  • the disadvantage is that this method is very time consuming in the startup phase, and the advertisement feature does not have a real-time dynamic update mechanism; the interception accuracy is low only for host interception; some advertisement applications can use plug-in or encryption to avoid static scanning; After relying on the system to intercept, but when it is for advertising The request, whether the request is unaware, cannot locate the source of the tracking information.
  • the information interception method of another example is the active information interception method (dynamic interception) as an example, and the local communication vpn is used to realize the interception of the network communication data, and the advertisement information interception can also be realized.
  • the disadvantage is: on the one hand, because the form of the local vpn is for all http requests, that is, in addition to the ad request, and for normal network requests, the interception rule is also valid for all applications corresponding to the http request, then, because It is not possible to distinguish between ad requests and normal network requests, so it is very likely that the normal network request that should not be intercepted and blocked is incorrectly intercepted.
  • the forwarding of the http request cannot be implemented in the form of the local vpn, and the forwarding of the http request can only be performed by the system, so that the processing node that intercepts and forwards the request is different (intercepting is performed by the processing node on the vpn side, forwarding The request is executed by the processing node on the system side, which causes the processing node on the vpn side to be unable to track the entire processing flow of the entire http request, that is, the communication data on the forwarded vpn cannot be traced, and therefore, the same as the above passive
  • the information interception method is the same, and it is impossible to locate the source of the advertisement information, thereby completely erasing and intercepting the advertisement information.
  • the advertisement information on the vpn cannot be traced, although the advertisement information can be intercepted, it is not known which application is requested by the advertisement information, so it is not possible to set a single application, which is not flexible enough to prevent the single application from initiating an advertisement request again;
  • the data needs to be forwarded by the vpn process. If the process quits unexpectedly, it affects the communication of the entire system, and the disaster tolerance is poor.
  • the lack of interaction between the cloud and the local information causes the advertisement characteristics in the advertisement database to be dynamically updated in time.
  • the application scenario adopts the embodiment of the present invention, and can adopt an active information interception mode (dynamic interception), and adopts an interception mechanism different from the above two examples, and the interception mechanism includes two parts:
  • the interception system architecture designed on the terminal side Firstly through the injection technology, will be used in the terminal for advertising information interception (such as the Android platform based purification master application or other based on the Android platform) Block apps or other platforms
  • a new thread is created in which the processes of other applications that want to be monitored by the application for intercepting the advertisement information, such as a browser application, a reading application, are invoked.
  • the process of video application, music playing application, etc. that is, establishing a mapping association between the application for intercepting advertisement information and other applications to be monitored and intercepted, so as to facilitate hook detection of processes of other applications through hook technology.
  • the http request is intercepted to obtain the network communication data, and the original path of the process of the other application is changed, and the hook listening path of the embodiment of the present invention is entered.
  • this implementation process is implemented by the interception module in FIG.
  • Real-time traceability the part that is statically scanned is omitted.
  • the advertisement information can be intercepted in real time and traced back to the advertisement application that initiated the advertisement request to notify the user that the application has an advertisement. .
  • Host applications also known as ads for advertising information interception, such as the Android platform-based cleansing master application or other interception applications based on the Android platform or other interception applications based on other platforms such as the ISO platform
  • the host application's process dies unexpectedly, it does not affect the normal network usage of the mobile app.
  • the network communication data intercepting the network communication data is reviewed based on the multi-feature cloud advertisement review mechanism, and if the advertisement information is determined by the audit, the advertisement request can be monitored and traced in real time. To the app that made the ad request.
  • a set of advertisement cloud list database including multiple package feature parameters including package name, version, signature MD5, host, URL, etc., combined with local hook technology, Each http request performs a comparison check of the above-mentioned advertisement feature parameters to ensure maximum accuracy of the advertisement information interception; meanwhile, the advertisement cloud list database has multiple advertisements.
  • the characteristics of the arbitrage comparison check make the update of the advertisement library more timely and flexible.
  • a multi-feature-based cloud advertisement review mechanism is adopted, a single application can be differentiated in a targeted manner, and specifically, a switch setting for ad blocking of a single application is provided. In this way, 1) can track the source of the advertisement information, thereby completely erasing and intercepting the advertisement information; 2) not a static scanning process, but a process of dynamically updating the advertisement features, having a better scan The effect is processed so that the latest advertisement features can be known in time for comparison, interception, blocking, etc.
  • the application is applied in a cleansing master application (such as in the pure mode of the application) to help the user automatically intercept the advertisement request sent by the application, so that the user avoids the information that is not desired or the invalid information (such as advertising information).
  • a cleansing master application such as in the pure mode of the application
  • the problem is that the terminal system resources are consumed, and the communication cost of the terminal is increased due to the consumption of the traffic generated by the push of the advertisement information.
  • Figure 7-10 shows the user interface of the terminal when applying the purification master.
  • An example of a scenario of the advertisement interception opening process is shown in FIG. 7.
  • the purification is enabled immediately, and the interception mode is entered, and the interception mode is successfully turned on and then transferred to the result page.
  • An example of a scenario used for ad blocking is shown in Figure 8.
  • the intercept mode is on.
  • the advertisement interception will automatically run.
  • the purification master will automatically intercept and prompt, an example of the prompt information is shown as A11 in FIG.
  • An example of a scenario for intercepting information and intercepting settings is shown in Figure 8-9, where a detailed intercept log is recorded for specific software.
  • FIG. 10 shows an example of the video ad blocking setting.
  • the user interface of the video ad blocking function can be opened on the product side of the elite master.
  • the cloud ad library also adds video ad features.
  • the advertisement the opening process is shown in Figure 10. The user activates the developer mode by clicking 5 times in the top of the purification setting page, and clicks the top menu to select the developer mode setting to enter the setting list, and the user can start the video application advertisement purification.
  • the application scenario adopts the embodiment of the present invention.
  • the interception process is implemented through an injection mechanism, a hook monitoring mode, and a multi-advertisement feature cloud auditing mode.
  • the specific scheme is as follows:
  • the network communication framework For each application installed on the Android platform, the network communication framework is shown in Figure 11. As can be seen from Figure 11, no matter whether the network request (http request) is called at the Java layer, the Native layer, or the Framework layer, Eventually, it will return to the position of the function (sendto and / or recvfrom function) B11 corresponding to the request forwarding node. That is to say, all network communication finally passes the sendto and recvfrom functions. Therefore, the monitoring detection point of the hook monitoring mode can be considered. Set at the location of the B11, then the App's network request can be monitored by the hook function to match the first function sendto (used to characterize the request message transmission) in the forwarding node for characterizing the request message.
  • the hook function used to characterize the request message transmission
  • hook hook function in the second function recvfrom (a function for characterizing the request message reception), generating a first listen function hook_sendto and a second listen function hook_recvfrom for intercepting the network request interaction; and the first listener function
  • the number of hook_sendto (a listener function for characterizing the listener request message transmission) and the second listener function hook_recvfrom (a listener function for characterizing the listener request message reception) are used as the listener detection interface, as shown in FIG.
  • FIG. 12 is a schematic diagram of a network communication framework after adding an interception module and an audit module.
  • the first listener function hook_sendto and the second listener function hook_recvfrom are obtained; the first listener function hook_sendto (A listener function for characterizing the listener request message transmission) and a second listener function hook_recvfrom (a listener function for characterizing the reception of the listen request message), as shown by the position of B12 in FIG.
  • the interception process is implemented by the interception module, mainly: detecting whether the interception mode is enabled, and if it is enabled, the hook monitoring mode is used for monitoring, and the monitoring result is packaged into the auditing module for review, and after the audit result is obtained, the audit result is for the advertisement. The advertisement request is discarded. Otherwise, the normal network communication is performed.
  • the specific process is as shown in steps 301-307.
  • the audit process is implemented by the audit module, mainly: real-time dynamic update from the server cloud to the terminal local, including multiple The advertisement database of the advertisement feature parameters is compared, and the audit result obtained by the comparison is returned to the interception module for targeted interception processing.
  • the specific process is as shown in the following steps 401-4405.
  • the optimization master application is first loaded into the target process of other applications to be monitored through the injection mechanism, and then the key functions recvfrom and sendto of the network communication are hooked, and then the application can be awaited.
  • the callback of the network communication, the callback processing flow includes the following steps:
  • Step 301 After receiving the network request, determine whether the interception module is enabled, that is, determine whether to enter the intercept mode, and if yes, execute step 303; otherwise, perform step 302.
  • the determination to enter the interception mode is achieved by the ad blocking switch settings for individual users as shown in Figures 8-9.
  • Step 302 Call the original communication function to perform a normal network communication process.
  • the function performs a normal network communication process.
  • Step 303 packaging the requested data and the current application information.
  • the requested data and the current application information are packaged, and the request is submitted to the audit module for review.
  • Step 304 Submit the packaged information to the remote audit process (the audit process corresponding to the audit module) through the IPC communication, and wait for the audit result.
  • Step 305 The application obtains an audit result of the remote process (the audit process corresponding to the audit module) by using IPC communication.
  • Step 306 Analyze the audit result, and determine whether it is an advertisement request. If yes, execute step 307; otherwise, if the parsed audit result is not an advertisement request, step 302 is performed.
  • Step 307 If the parsed audit result is an advertisement request, perform an interception process, that is, discard the advertisement request.
  • the specific process of the audit module includes the following steps:
  • Step 401 host audit.
  • Step 402 URL review.
  • Step 403 the package name verification.
  • Step 404 signature, version verification.
  • Step 405 audit verification.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
  • the units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit;
  • the unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • ROM read-only memory
  • RAM random access memory
  • magnetic disk or an optical disk.
  • optical disk A medium that can store program code.
  • the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a RAM, a magnetic disk, or an optical disk.
  • an interception policy may be separately configured for at least one to-be-intercepted application except the first application. Since the interception policy may be separately set for a single application, the interception is more targeted, so that the interception process is performed. Faster and more accurate interception.
  • the network request After entering the interception mode, after the network request is monitored, if the communication information associated with the network request is matched with the preset policy to obtain the specified target information, the network request is intercepted, and the location is traced back to the issue.
  • the intercepted application of the network request can not only realize information interception, but also locate the to-be-intercepted application that issues the network request, and also makes the interception processing more efficient, the interception precision is higher, and the user can be prompted to know the waiting Intercepting applications has security risks and improves security.

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Databases & Information Systems (AREA)
  • Marketing (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Telephonic Communication Services (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种信息拦截处理方法及终端、计算机存储介质，其中，所述方法包括：启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。

Description

一种信息拦截处理方法及终端、计算机存储介质 技术领域
本发明涉及拦截技术，尤其涉及一种信息拦截处理方法及终端、计算机存储介质。
背景技术
互联网技术的发展，使得信息能够大量地进行分享和传播，比如用户看到一则很棒的新闻，可以通过微博转发这条新闻，这是一种信息分享；比如用户在看视频时除了可以看到想要观看的视频节目，还可以看到一些插播的广告推荐，热点新闻或头条新闻提示，这也是一种信息分享；但是，大量的信息中，很多信息针对用户需求来说是无效信息、或者是用户不想关注的信息，比如，用户通过阅读应用读书时，通过该阅读应用推送的商品广告信息或最新游戏信息等，这类信息越多，就越会占用终端的系统资源，而且终端处于联网状态时，这类信息的推送也会产生大量的网络流量，从而使得终端用户增加不必要的通信成本。
对于上述这类信息，需要进行信息拦截处理。然而，相关技术中，采用的主动或被动的信息拦截方式，不仅无法有效地进行信息拦截，定位信息来源，而且仍然会占用终端的系统资源，使得终端用户增加不必要的通信成本，对于该问题，尚无有效解决方案。
发明内容
有鉴于此，本发明实施例希望提供一种信息拦截处理方法及终端、计算机存储介质，至少解决了现有技术存在的问题，能有效地进行信息拦截，定位信息来源，避免占用终端的系统资源，使得终端用户无需增加不必要 的通信成本。
本发明实施例的技术方案是这样实现的：
本发明实施例的一种信息拦截处理方法，所述方法包括：
启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；
获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；
将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
本发明实施例的一种终端，所述终端包括：
配置单元，配置为启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；
监听单元，配置为获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；
拦截单元，配置为将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
本发明实施例还提供一种计算机存储介质，其中存储有计算机可执行指令，该计算机可执行指令配置执行上述信息拦截处理方法。
本发明实施例的一种信息拦截处理方法，所述方法包括：启动第一应 用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
采用本发明实施例，可以对除所述第一应用之外的至少一个待拦截应用分别配置拦截策略，由于可以对单个的应用分别设置拦截策略，因此，拦截起来更有针对性，使得拦截处理效率更快，拦截精度更高。进入拦截模式后，监听到网络请求后，如果将与所述网络请求相关联的通信信息与预设策略进行匹配得到指定的目标信息，则会对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用，由于不仅可以实现信息拦截，还能定位到发出该网络请求的待拦截应用，也使得拦截处理效率更快，拦截精度更高，还可以提示给用户知道这个待拦截应用存在安全隐患，提高安全性。
附图说明
图1为本发明实施例中进行信息交互的各方硬件实体的示意图；
图2为本发明实施例一的一个实现流程示意图；
图3为本发明实施例二的一个实现流程示意图；
图4为本发明实施例一提示信息应用示例的示意图；
图5为本发明实施例四的一个组成结构示意图；
图6为本发明实施例五的一个硬件组成结构示意图；
图7-10为应用本发明实施例的多个终端用户界面示意图；
图11为应用本发明实施例网络通信架构中原有网络通信节点示意图；
图12为应用本发明实施例网络通信架构中新增监控检测点的网络通信节点示意图。
具体实施方式
下面结合附图对技术方案的实施作进一步的详细描述。
图1为本发明实施例中进行信息交互的各方硬件实体的示意图，图1中包括：服务器11……1n、终端设备21-24，终端设备21-24通过有线网络或者无线网络与服务器进行信息交互，终端设备包括手机、台式机、PC机、一体机等类型，一个示例中，服务器11……1n还可以通过网络与第一类终端(如广告主所在的终端，或称为提供广告素材和内容推广的对象)进行交互，第一类终端(如广告主所在的终端，或称为提供广告素材和内容推广的对象)将想要投放的广告提交后，被存储在服务器集群中，可以配备管理员对第一类终端(如广告主所在的终端，或称为提供广告素材和内容推广的对象)投放的广告进行审核等一系列处理。其中，相对于第一类终端(如广告主所在的终端，或称为提供广告素材和内容推广的对象)而言，终端设备21-24可以称为第二类终端(如普通用户所在的终端，或称为广告展示或曝光的对象)，可以为通过视频应用看视频的用户，通过游戏应用打游戏的用户等等。其中，终端设备中安装的所有应用或者指定的应用(如游戏应用，视频应用，导航应用等等)都可以添加广告以展示给用户更多的推荐信息。采用本发明实施例，基于上述图1所示的系统，本发明实施例包括：启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；获取所述待拦截应用发出的网络请求，检测当前是否进入第一应用的拦截模式，如果进入第一应用的拦截模式，则按照所述拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；将所述通信信息与预设策略，如信息多特征审核策略进行匹配，如果经匹配 确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
上述图1的例子只是实现本发明实施例的一个系统架构实例，本发明实施例并不限于上述图1所述的系统结构，基于该系统架构，提出本发明各个实施例。
实施例一：
本发明实施例的一种信息拦截处理方法，如图2所示，所述方法包括：
步骤101、接收第一操作以启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略。
这里，本步骤中的终端指的是上文综述中提及的第二类终端，所述第二终端可以为普通用户所在的终端，或称为广告展示或曝光的对象。
这里，所述第一应用作为用于信息拦截的应用，可以包括但不限于优化大师等等，所述除所述第一应用之外的至少一个待拦截应用，可以为终端安装的视频应用，音乐播放应用，阅读应用，浏览器应用等等。如果网络请求为广告请求，则通过该用于信息拦截的应用拦截广告信息。在大量信息推送给用户的场景中，很多信息针对用户需求来说是无效信息、或者是用户不想关注的信息，比如，用户通过阅读应用读书时，通过该阅读应用推送的商品广告信息或最新游戏信息等，这类信息越多，就越会占用终端的系统资源，而且终端处于联网状态时，这类信息的推送也会产生大量的网络流量，从而使得终端用户增加不必要的通信成本，这类信息以广告信息居多，所以，通过该用于信息拦截的应用拦截广告信息，通过对第一应用之外的至少一个待拦截应用分别配置拦截策，则可以对单个的应用分别设置拦截策略，因此，对广告信息的拦截更有针对性，使得拦截处理效率更快，拦截精度更高。
步骤102、获取所述至少一个待拦截应用发出的网络请求，检测当前是 否进入第一应用的拦截模式，如果是，则执行步骤103，否则，执行步骤106，放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
这里，针对拦截模式而言，1)如果用户在该用于信息拦截的应用中设置了对哪些应用发出的请求进行拦截，比如，将这些应用设置于拦截名单中，那么，开启该用于信息拦截的应用进行拦截模式后，就会对拦截名单中的这些应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。2)还可以在需要监控的多个应用中设置拦截需求，那么开启该用于信息拦截的应用进行拦截模式后，就会按照拦截需求对多个应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。
步骤103，进入第一应用的拦截模式，按照所述拦截策略对所述至少一待拦截个应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联。
这里，通信信息为符合所述拦截策略，并且与网络请求相关联的信息，包括但不限于：两类信息，以网络请求为非正常的通信请求(广告请求)为例，这两类信息具体为广告请求针对的广告信息，以及发出所述广告请求的应用所对应的应用信息，以便在通过后续步骤104匹配出该网络请求针对的是广告信息，那么认定该网络请求为广告请求，需要进行拦截，则丢弃该广告请求，还能通过所述应用信息定位追溯到发出所述广告请求的应用，从而通过拦截策略，多特征审核策略及这两类信息，不仅可以实现信息拦截，还能定位到发出该网络请求的应用，也使得拦截处理效率更快，拦截精度更高。
这里，拦截策略可以为hook监听策略。所述hook是一种监听方式， 以窗口实例为例进行说明，hook作为Windows消息处理机制的一个平台，应用可以在hook上面设置子进程以监视指定窗口的某种消息，而且所监视的窗口可以是其他子进程所创建的。当消息到达后，在目标窗口处理函数之前处理它。hook机制允许应用程序截获处理window消息或特定事件，hook机制实际上是一个处理消息的程序段，通过系统调用，把它挂入系统，每当所述window消息或特定事件发出，在没有到达目的窗口前，hook程序就先捕获该window消息或特定事件的发出，亦即hook函数先得到控制权，这时hook函数可以加工处理所述window消息或特定事件，也可以不作处理而继续传递所述window消息或特定事件，还可以强制结束所述window消息或特定事件的传递。
步骤104、将所述通信信息按照信息多特征审核策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则执行步骤105，否则，执行步骤106，放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
这里，通信信息包括两类信息：网络请求对应的信息(如广告信息)，及发起网络请求的当前应用对应的信息(如应用信息)这两类数据。通过步骤104，经匹配确定出所述通信信息为指定的目标信息，如非正常通信请求(广告请求)对应的广告信息，则结合步骤105，对所述网络请求进行拦截，丢弃所述网络请求，定位追溯至发出所述网络请求的当前应用。由于不仅可以实现信息拦截，还能定位到发出该网络请求的应用，因此，使得拦截处理效率更快，拦截精度更高。
步骤105、对所述网络请求进行拦截，丢弃所述网络请求，定位追溯至发出所述网络请求的当前应用。
步骤106、放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
采用本发明实施例，对于网络请求为非正常通信请求(如广告请求)而言，避免了在对广告请求的广告信息拦截中有可能因拦截错误而拦截了正常的网络请求，及也可能因拦截错误而漏掉了拦截真正的广告信息请求，因为这些情况都会降低对广告信息的拦截精度。而采用本发明实施例，可以规则这些问题，从而最大化的提升拦截精度，提高拦截处理效率。
实施例二：
本发明实施例的一种信息拦截处理方法，如图3所示，所述方法包括：
步骤201、接收第一操作以启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略时，为每一个待拦截应用分别配置不同的拦截策略。
这里，针对设置不同的拦截策略而言，是指同一个广告请求对应的广告信息对不同应用来说，有的可以设置信息拦截，有的不需要设置信息拦截策略。比如，对于一个购物应用，在该购物应用中会以插屏广告或内嵌广告的形式展示与购物相关的广告形式，对于本购物应用来说，该广告形式是本购物应用固有的，因此，对于购物应用来说，不需要设置对该广告形式的信息拦截；对于一个音乐应用或视频应用或阅读应用来说，如果也以插屏广告或内嵌广告的形式展示与购物相关的广告形式，那么，就需要设置对该广告形式的信息拦截。当然，如果对于同为购物类型的多个购物应用，如当当应用，京东应用等等，可以设置相同的策略，即：不需要设置对该广告形式的信息拦截。
这里，本步骤中的终端。指的是上文综述中提及的第二类终端，所述第二终端可以为普通用户所在的终端，或称为广告展示或曝光的对象。
这里，所述第一应用作为用于信息拦截的应用，可以包括但不限于优化大师等等，所述除所述第一应用之外的至少一个待拦截应用，可以为终端安装的视频应用，音乐播放应用，阅读应用，浏览器应用等等。如果网 络请求为广告请求，则通过该用于信息拦截的应用拦截广告信息。在大量信息推送给用户的场景中，很多信息针对用户需求来说是无效信息、或者是用户不想关注的信息，比如，用户通过阅读应用读书时，通过该阅读应用推送的商品广告信息或最新游戏信息等，这类信息越多，就越会占用终端的系统资源，而且终端处于联网状态时，这类信息的推送也会产生大量的网络流量，从而使得终端用户增加不必要的通信成本，这类信息以广告信息居多，所以，通过该用于信息拦截的应用拦截广告信息，通过对第一应用之外的至少一个待拦截应用分别配置拦截策，则可以对单个的应用分别设置拦截策略，因此，对广告信息的拦截更有针对性，使得拦截处理效率更快，拦截精度更高。
步骤202、获取所述至少一个待拦截应用发出的网络请求，检测当前是否进入第一应用的拦截模式，如果是，则执行步骤203，否则，执行步骤207，放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
这里，针对拦截模式而言，1)如果用户在该用于信息拦截的应用中设置了对哪些应用发出的请求进行拦截，比如，将这些应用设置于拦截名单中，那么，开启该用于信息拦截的应用进行拦截模式后，就会对拦截名单中的这些应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。2)还可以在需要监控的多个应用中设置拦截需求，那么开启该用于信息拦截的应用进行拦截模式后，就会按照拦截需求对多个应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。
步骤203，进入第一应用的拦截模式，按照所述拦截策略对所述至少一个待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通 信信息，所述通信信息与所述网络请求相关联。
这里，通信信息为符合所述拦截策略，并且与网络请求相关联的信息，包括但不限于：两类信息，以网络请求为非正常的通信请求(广告请求)为例，这两类信息具体为广告请求针对的广告信息，以及发出所述广告请求的应用所对应的应用信息，以便在通过后续步骤204-205匹配出该网络请求针对的是广告信息，那么认定该网络请求为广告请求，需要进行拦截，则丢弃该广告请求，还能通过所述应用信息定位追溯到发出所述广告请求的应用，从而通过拦截策略，多特征审核策略及这两类信息，不仅可以实现信息拦截，还能定位到发出该网络请求的应用，也使得拦截处理效率更快，拦截精度更高。
这里，拦截策略可以为hook监听策略。所述hook是一种监听方式，以窗口实例为例进行说明，hook作为Windows消息处理机制的一个平台，应用可以在hook上面设置子进程以监视指定窗口的某种消息，而且所监视的窗口可以是其他子进程所创建的。当消息到达后，在目标窗口处理函数之前处理它。hook机制允许应用程序截获处理window消息或特定事件，hook机制实际上是一个处理消息的程序段，通过系统调用，把它挂入系统，每当所述window消息或特定事件发出，在没有到达目的窗口前，hook程序就先捕获该window消息或特定事件的发出，亦即hook函数先得到控制权，这时hook函数可以加工处理所述window消息或特定事件，也可以不作处理而继续传递所述window消息或特定事件，还可以强制结束所述window消息或特定事件的传递。
步骤204、解析出所述网络请求对应的第一信息(如广告信息)和发起所述网络请求的当前待拦截应用对应的第二信息(如发出网络请求的应用对应的应用信息)，将所述第一信息和所述第二信息作为所述通信信息。
步骤205、提取广告云名单数据库中包含的多个广告特征参数，按照多 特征审核策略将所述多个广告特征参数与所述通信信息进行比对，如果比对成功，则确定出所述通信信息为广告信息，执行步骤206，否则，执行步骤207，放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
这里，通信信息包括两类信息：网络请求对应的信息(如广告信息)，及发起网络请求的当前应用对应的信息(如应用信息)这两类数据。通过步骤104，经匹配确定出所述通信信息为指定的目标信息，如非正常通信请求(广告请求)对应的广告信息，则结合步骤206，对所述网络请求进行拦截，丢弃所述网络请求，定位追溯至发出所述网络请求的当前应用。由于不仅可以实现信息拦截，还能定位到发出该网络请求的应用，因此，使得拦截处理效率更快，拦截精度更高。
步骤206、对所述网络请求进行拦截，丢弃所述网络请求，定位追溯至发出所述网络请求的当前应用，并发出提示信息给终端用户。
这里，所述提示信息用于表征所述当前应用存在信息安全隐患，提示信息的一个实例如图4中的A11所示。
步骤207、放行所述网络请求，按照正常通信模式进行通信，即：不对所述网络请求进行拦截。
采用本发明实施例，对于网络请求为非正常通信请求(如广告请求)而言，避免了在对广告请求的广告信息拦截中有可能因拦截错误而拦截了正常的网络请求，及也可能因拦截错误而漏掉了拦截真正的广告信息请求，因为这些情况都会降低对广告信息的拦截精度。而采用本发明实施例，可以规则这些问题，从而最大化的提升拦截精度，提高拦截处理效率。且除了会对所述网络请求进行拦截，并定位追溯至发出所述网络请求的当前应用，还可以提示给用户知道这个应用存在安全隐患，从而提高安全性。
实施例三：
基于上述实施例一-二，本发明实施例的信息拦截方法还包括：将所述第一应用与除所述第一应用之外的至少一个待拦截应用的X个目标进程建立关联，所述X为大于1的自然数；根据所建立的关联使所述第一应用进入所述X个目标进程中，以实现对X个目标进程的监控。这个对X个目标进程与本第一应用进程间通过建立关联而进行监控的机制可以成为注入机制。
在本发明实施例一实施方式中，本发明实施例的信息拦截方法中，按照所述拦截策略对所述至少一个待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，包括：监控X个目标进程中网络请求的交互，截获到所述网络请求；按照所述拦截策略在所述网络请求的请求消息转发节点设置监听检测接口，根据所述监听检测接口获取到所述通信信息。
这里，所述网络请求的请求消息转发节点可以成为发送消息或接收消息的节点，具体是通过发送函数和接收函数来实现的。监听检测接口可以通过上文提及的hook监听方式来实现。其中，针对发送函数和接收函数而言，在用于表征所述请求消息转发节点的第一函数sendto和第二函数recvfrom，第一函数sendto即为发送函数的一个具体实例，第二函数recvfrom即为接收函数的一个具体实例。在第一函数sendto和第二函数recvfrom中设置hook函数，生成用于监听网络请求交互的第一监听函数hook_sendto和第二监听函数hook_recvfrom，将所述第一监听函数hook_sendto和第二监听函数hook_recvfrom作为所述监听检测接口。
实施例四：
本发明实施例的终端，如图5所示，所述终端包括：
配置单元11，配置为接收第一操作以启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；
监听单元12，配置为获取所述至少一个待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；
拦截单元13，配置为将所述通信信息按照信息多特征审核策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
在实际应用中，本步骤中的终端指的是上文综述中提及的第二类终端，所述第二终端可以为普通用户所在的终端，或称为广告展示或曝光的对象。
这里，所述第一应用作为用于信息拦截的应用，可以包括但不限于优化大师等等，所述除所述第一应用之外的至少一个待拦截应用，可以为终端安装的视频应用，音乐播放应用，阅读应用，浏览器应用等等。如果网络请求为广告请求，则通过该用于信息拦截的应用拦截广告信息。在大量信息推送给用户的场景中，很多信息针对用户需求来说是无效信息、或者是用户不想关注的信息，比如，用户通过阅读应用读书时，通过该阅读应用推送的商品广告信息或最新游戏信息等，这类信息越多，就越会占用终端的系统资源，而且终端处于联网状态时，这类信息的推送也会产生大量的网络流量，从而使得终端用户增加不必要的通信成本，这类信息以广告信息居多，所以，通过该用于信息拦截的应用拦截广告信息，通过对第一应用之外的至少一个待拦截应用分别配置拦截策，则可以对单个的应用分别设置拦截策略，因此，对广告信息的拦截更有针对性，使得拦截处理效率更快，拦截精度更高。
这里，针对拦截模式而言，1)如果用户在该用于信息拦截的应用中设置了对哪些应用发出的请求进行拦截，比如，将这些应用设置于拦截名单中，那么，开启该用于信息拦截的应用进行拦截模式后，就会对拦截名单 中的这些应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。2)还可以在需要监控的多个应用中设置拦截需求，那么开启该用于信息拦截的应用进行拦截模式后，就会按照拦截需求对多个应用进行拦截监控，即：对这些应用发出的请求进行监控是否为网络请求，是否为正常的网络请求还是需要拦截的广告请求，以便对广告信息进行监控。
这里，通信信息为符合所述拦截策略，并且与网络请求相关联的信息，包括但不限于：两类信息，以网络请求为非正常的通信请求(广告请求)为例，这两类信息具体为广告请求针对的广告信息，以及发出所述广告请求的应用所对应的应用信息，以便后续匹配出该网络请求针对的是广告信息，那么认定该网络请求为广告请求，需要进行拦截，则丢弃该广告请求，还能通过所述应用信息定位追溯到发出所述广告请求的应用，从而通过拦截策略，多特征审核策略及这两类信息，不仅可以实现信息拦截，还能定位到发出该网络请求的应用，也使得拦截处理效率更快，拦截精度更高。
这里，通信信息包括两类信息：网络请求对应的信息(如广告信息)，及发起网络请求的当前应用对应的信息(如应用信息)这两类数据。通过步骤104，经匹配确定出所述通信信息为指定的目标信息，如非正常通信请求(广告请求)对应的广告信息，则后续对所述网络请求进行拦截，丢弃所述网络请求，定位追溯至发出所述网络请求的当前应用。由于不仅可以实现信息拦截，还能定位到发出该网络请求的应用，因此，使得拦截处理效率更快，拦截精度更高。
采用本发明实施例，对于网络请求为非正常通信请求(如广告请求)而言，避免了在对广告请求的广告信息拦截中有可能因拦截错误而拦截了正常的网络请求，及也可能因拦截错误而漏掉了拦截真正的广告信息请求，因为这些情况都会降低对广告信息的拦截精度。而采用本发明实施例，可 以规则这些问题，从而最大化的提升拦截精度，提高拦截处理效率。
在本发明实施例的实施方式中，所述拦截单元，还包括：解析子单元，配置为解析出所述网络请求对应的第一信息和发起所述网络请求的当前待拦截应用对应的第二信息，将所述第一信息和所述第二信息作为所述通信信息；
审核子单元，配置为提取广告云名单数据库中包含的多个广告特征参数，按照所述多特征审核策略将所述多个广告特征参数与所述通信信息进行比对，如果比对成功，则确定出所述通信信息为广告信息，定位至发起所述网络请求的当前应用，对所述网络请求进行拦截，并发出提示信息给终端用户；所述提示信息，用于表征所述当前应用存在信息安全隐患。
在本发明实施例的实施方式中，所述配置单元，还配置为：为所述第一应用之外的至少一个待拦截应用中的每一个待拦截应用分别配置所述拦截策略；所述拦截策略为相同的策略、或者不同的策略。
在本发明实施例的实施方式中，所述终端还包括：进程注入关联单元，配置为：将所述第一应用与除所述第一应用之外的至少一个待拦截应用的X个目标进程建立关联，所述X为大于1的自然数；根据所建立的关联使所述第一应用进入所述X个目标进程中，以实现对X个目标进程的监控。
在本发明实施例的实施方式中，所述监听单元，还包括：网络请求监控子单元，配置为监控X个目标进程中网络请求的交互，截获到所述网络请求；信息监听子单元，配置为按照所述拦截策略在所述网络请求的请求消息转发节点设置监听检测接口，根据所述监听检测接口获取到所述通信信息。
在本发明实施例的实施方式中，所述信息监听子单元，还配置为：在用于表征所述请求消息转发节点的第一函数sendto和第二函数recvfrom中设置钩子hook函数，生成用于监听网络请求交互的第一监听函数 hook_sendto和第二监听函数hook_recvfrom；将所述第一监听函数hook_sendto和第二监听函数hook_recvfrom作为所述监听检测接口。
实施例五：
这里需要指出的是，上述终端可以为PC这种电子设备，还可以为如PAD，平板电脑，手提电脑这种便携电子设备、还可以为如手机这种智能移动终端，不限于这里的描述；所述服务器可以是通过集群系统构成的，为实现各单元功能而合并为一或各单元功能分体设置的电子设备，客户端和服务器都至少包括用于存储数据的数据库和用于数据处理的处理器，或者包括设置于服务器内的存储介质或独立设置的存储介质。
其中，对于用于数据处理的处理器而言，在执行处理时，可以采用微处理器、中央处理器(CPU，Central Processing Unit)、数字信号处理器(DSP，Digital Singnal Processor)或可编程逻辑阵列(FPGA，Field－Programmable Gate Array)实现；对于存储介质来说，包含操作指令，该操作指令可以为计算机可执行代码，通过所述操作指令来实现上述本发明实施例信息处理方法流程中的各个步骤。
该终端和该服务器作为硬件实体S11的一个示例如图6所示。所述装置包括处理器31、存储介质32以及至少一个外部通信接口33；所述处理器31、存储介质32以及外部通信接口33均通过总线34连接。
这里需要指出的是：以上涉及终端和服务器项的描述，与上述方法描述是类似的，同方法的有益效果描述，不做赘述。对于本发明客户端和服务器实施例中未披露的技术细节，请参照本发明方法实施例的描述。
本发明实施例还提供一种计算机存储介质，其中存储有计算机可执行指令，该计算机可执行指令配置执行上述信息拦截处理方法。
以一个现实应用场景为例对本发明实施例阐述如下：
本应用场景是信息拦截为针对广告信息的情况，本应用场景采用本发 明实施例，具体是一种能够更加灵活和精确地对广告信息进行信息拦截的技术方案。其中，本文中涉及的HTTP URL格式，指http://host[:port][abs_path]，包含在域名(host)文件中，host文件是一个没有扩展名的系统文件，其主要作用是能加快域名解析，还可以屏蔽网站等，合法的Internet主机域名或IP地址为abs_path，用于指定请求资源的统一资源定位符(URL)，后文中提到的URL即为abs_path的部分。被动广告拦截，指：通过静态扫描获得广告信息host，然后修改系统host文件或者使用iptable重定向的方式禁止手机对广告信息host的访问，广告信息最终由系统实现拦截，该类型的应用只管设置host，而不知道广告信息是何时被拦截的甚至不知道有没有被拦截，对广告信息的来源也无从定位跟踪。主动广告拦截，指：通过钩子(hook)关键网络通信接口或者通过本地虚拟专用网(vpn)，截获网络通信数据，解析其中的广告请求，加以拦截。该类型的应用是真正的广告拦截者，能实时的监控应用的广告请求。拦截精度，指：在广告信息拦截中有可能因拦截错误而拦截了正常的网络请求，也可能因拦截错误而漏掉了拦截真正的广告信息请求，这些情况都会降低对广告信息的拦截精度。
针对信息拦截为针对广告信息的情况，一个实例的信息拦截方式为被动的信息拦截方式(静态拦截)为例，可以实现对广告信息的拦截，对广告信息的拦截开启是需要静态扫描应用，以便提取应用中的广告特征，将广告特征写入host文件中，获得host文件中对应的广告信息host，广告信息host是针对本地域名的映射，为了拦截信息，则通过修改广告信息host，以将广告请求映射到无效或错误的IP地址来实现对广告信息的拦截。缺点是：这种方式在开启阶段非常耗时，且该广告特征不存在实时动态更新机制；仅针对host拦截，拦截精度较低；一些广告应用可以使用插件化或者加密的方式规避静态扫描；开启后依靠系统拦截，而自身却对于广告何时 请求、是否有请求一无所知，无法定位跟踪到广告信息的来源。
针对信息拦截为针对广告信息的情况，另一个实例的信息拦截方式为主动的信息拦截方式(动态拦截)为例，使用本地vpn的形式实现对网络通信数据的截获，也可以实现广告信息拦截，缺点是：一方面，由于本地vpn的形式是针对所有http请求的监听，也就是说，除了针对广告请求，也针对正常的网络请求，拦截规则也是对所有应用对应的http请求生效，那么，由于无法很好的区分广告请求和正常的网络请求，因此，很有可能把本不该拦截并予以屏蔽的该正常的网络请求进行错误拦截。另一方面，转发http请求采用所述本地vpn的形式无法实现，只能由系统来执行http请求的转发，从而，拦截和转发请求的处理节点不同(拦截由vpn侧的处理节点来执行，转发请求由系统侧的处理节点来执行)，会导致在vpn侧的处理节点无法跟踪整个http请求的整个处理流程，也就是说，被转发的vpn上的通信数据无法追溯，因此，同上述被动的信息拦截方式一样，也无法定位跟踪到广告信息的来源，从而对广告信息进行彻底的根除和拦截处理。由于vpn上的通信数据无法追溯，虽然可以拦截广告信息，但是并不知道广告信息是哪个应用请求的，因此无法对单个应用进行设置，不够灵活，以避免该单个应用再次发起广告请求；所有的数据都需要vpn进程转发，如果进程意外退出，则影响整个系统的通信，容灾性差；缺乏云端与本地的信息交互能力，导致广告数据库中的广告特征在本地无法及时动态更新。
本应用场景采用本发明实施例，可以采取主动的信息拦截方式(动态拦截)，并采用与上述2个实例不同的拦截机制，该拦截机制包括两部分内容：
一，以注入技术和hook技术为基础设计在终端侧的拦截系统架构，首先通过注入技术，将在终端用于广告信息拦截的本应用(如基于Android平台的净化大师应用或基于Android平台的其他拦截应用或基于其他平台 如ISO平台的其他拦截应用)的开始进程中创建一个新线程，在这个新线程中调用想通过该用于广告信息拦截的本应用去监控的其他应用的进程，比如浏览器应用，阅读应用，视频应用，音乐播放应用等等的进程，也就是说，在该用于广告信息拦截的本应用与要监控拦截的其他应用间建立映射关联，以方便通过hook技术对其他应用的进程进行hook监听，截获http请求以获取网络通信数据，改变其他应用的进程原有的路径，而进入本发明实施例的hook监听路径。具体的，是通过图12中的拦截模块来实现这一个实现过程。
采用上述注入技术和hook技术，具备以下有益效果：
1)实时可追溯：省去静态扫描的部分，当有应用发起广告请求以发送广告信息时，可以对该广告信息进行实时拦截并追溯到发起广告请求的广告应用以通知用户，这个应用存在广告。
2)更灵活易用：如果用户不想拦截某个应用的广告请求，则用户可以针对单个应用设置开启或者关闭广告拦截。
3)容灾性更好：宿主应用，也称为用于广告信息拦截的本应用，如基于Android平台的净化大师应用或基于Android平台的其他拦截应用或基于其他平台如ISO平台的其他拦截应用，在宿主应用的进程意外死亡后，并不会影响手机应用的正常网络使用。
二，通过hook技术的关键接口来截获该网络通信数据后，将截获该网络通信数据基于多特征的云广告审核机制进行审核，如果经审核确定为广告信息，则还可以实时监控广告请求并追溯到发出广告请求的应用。其中，对基于多特征的云广告审核机制进行审核而言，建立了一套包括包名、版本、签名MD5、host、URL等多个广告特征参数的广告云名单数据库，结合本地hook技术，对每一个http请求进行上述广告特征参数的比对审核，以确保最大化的广告信息拦截精度；同时，广告云名单数据库多个广告特 征参数比对审核的特性使得广告库的更新更加及时和灵活。采用基于多特征的云广告审核机制时，可以对单个应用进行针对性的区分，具体的，提供对单个应用的广告拦截的开关设置来实现。如此一来，1)可以定位跟踪到广告信息的来源，从而对广告信息进行彻底的根除和拦截处理；2)不是静态扫描过程，而是一种广告特征动态更新的过程，拥有更好的扫描处理效果，从而能及时获知最新的广告特征，以便进行广告特征的比对，拦截，屏蔽等等操作处理；3)除了可以追溯到广告请求是哪个应用发出的请求，而且，对单个应用进行拦截设置，这种通过单个应用进行针对性的区分，而不是对于所有的应用都进行拦截设置的规则设定(提供对单个应用的广告拦截开关设置)，使得拦截处理更加灵活，交互更加灵活，这种通过单个应用进行针对性的区分，也可以避免该单个应用再次发起广告请求，则基于多特征的云广告审核机制，审核通过如图12中的审核模块来实现这一个区分广告特征和审核的过程，使得广告拦截更加精确，同时广告特征数据库名单的更新也更加快速和及时。
以基于Android平台的净化大师应用为例，结合终端开启净化大师应用的用户界面(如图7-图10对应的不同场景)进行如下阐述：
采用本发明实施例，应用在净化大师应用中(如应用的纯净模式中)，以帮助用户自动拦截应用发出的广告请求，使用户避免被不想关注的信息或无效的信息(如广告信息)所打扰，避免终端系统资源的耗费，同时减少因为广告信息的推送产生流量的消耗而使得终端的通信成本增加的问题。
如图7-图10所示为应用净化大师时，在终端的用户界面示意图。其中，广告拦截开启流程的一个场景示例如图7所示，图7中，进入净化大师应用的主页后，立即启用净化，则进入拦截模式，拦截模式开启成功后调至结果页。广告拦截使用的一个场景示例如图8所示，图8中，拦截模式开 启成功后，广告拦截会自动运行，当用户打开有广告的软件时，净化大师会自动拦截并提示，提示信息的一个示例如图4中的A11所示。拦截信息和拦截设置的一个场景示例如图8-9所示，图8中针对具体软件记录了详细的拦截日志。点击广告净化就可以按照对每个应用单独设置的拦截策略进行信息拦截处理(也可以成为净化处理)，点击广告净化后进入单个app设置的一个示例如图9所示，针对所有广告软件的拦截记录，点击广告净化，进入单个app设置，同时展示具体广告请求的行为。图10为视频广告拦截设置的一个示例，可以在精华大师的产品侧开放对视频广告拦截功能的用户使用接口，同时云端广告库也新增了视频广告特征，目前已支持拦截大多数主流视频软件广告，开启流程如图10所示，用户在净化设置页面顶部连续点击5次激活开发者模式，点击顶部菜单选择开发者模式设置进入设置列表，用户开启视频应用广告净化即可。
以Android平台为例，本应用场景采用本发明实施例，实现拦截处理的过程中，通过注入机制，hook监听方式，多广告特征云审核方式来实现该拦截处理，具体方案如下所示：
针对终端在Android平台下安装的各个应用而言，网络通信框架如图11所示，从图11可以看出：无论网络请求(http请求)是在Java层，Native层，还是Framework层被调用，最终都会回归到请求转发节点对应的函数(sendto和/或recvfrom函数)B11的位置，也就是说，所有的网络通信最后都通过sendto和recvfrom函数，因此，可以考虑将hook监听方式的监听检测点设置于该B11的位置，那么，通过hook这两个函数就可以监控App的网络请求，以便对在用于表征所述请求消息转发节点的第一函数sendto(用于表征请求消息发送的函数)和第二函数recvfrom(用于表征请求消息接收的函数)中设置钩子hook函数，生成用于监听网络请求交互的第一监听函数hook_sendto和第二监听函数hook_recvfrom；将所述第一监听函 数hook_sendto(用于表征监听请求消息发送的监听函数)和第二监听函数hook_recvfrom(用于表征监听请求消息接收的监听函数)作为所述监听检测接口，如图12所示。
图12为增加拦截模块和审核模块后的网络通信框架示意图，其中，对sendto和/或recvfrom函数设置hook后，得到第一监听函数hook_sendto和第二监听函数hook_recvfrom；将所述第一监听函数hook_sendto(用于表征监听请求消息发送的监听函数)和第二监听函数hook_recvfrom(用于表征监听请求消息接收的监听函数)，如图12中B12的位置所示。拦截流程通过拦截模块来实现，主要是：检测是否开启拦截模式，如果开启，则采用hook监听方式进行监听，将监听结果打包给审核模块进行审核，得到审核结果后，针对审核结果为广告而言，则丢弃该广告请求，否则，进行正常的网络通信，具体流程如下步骤301-307所示；审核流程通过审核模块来实现，主要是：与从服务器云端实时动态更新到终端本地的，包含多个广告特征参数的广告数据库进行比对，将比对得到的审核结果返回拦截模块进行针对性的拦截处理，具体流程如如下步骤401-405所示。
如图11所示，拦截模块的具体流程中，首先通过注入机制将优化大师应用加载到想要监控的其他应用的目标进程中，再hook网络通信的关键函数recvfrom和sendto，随后便可以等待应用网络通信的回调，回调处理流程包括如下步骤：
步骤301、接收到网络请求后，判断拦截模块是否开启，即判断是否进入拦截模式，如果是，则执行步骤303，否则，执行步骤302。
这里，实现进入拦截模式的判断，是通过图8-9所示的针对单个用户的广告拦截开关设置来实现的。
步骤302、调用原有的通信函数执行正常的网络通信流程。
这里，如果用户设置了对该应用不拦截，则可以直接调用原有的通信 函数执行正常的网络通信流程。
步骤303、将请求的数据和当前应用的信息打包。
这里，如果用户设置了对该应用进行广告拦截，则将请求的数据和当前应用的信息打包，请求到审核模块进行审核。
步骤304、将打包的信息通过IPC通信提交到远端的审核进程(审核模块对应的审核进程)，并等待审核结果。
步骤305、应用通过IPC通信获取远端进程(审核模块对应的审核进程)的审核结果。
步骤306、解析审核结果，判断是否为广告请求，如果是，则执行步骤307；否则，解析出的审核结果不是广告请求，则执行步骤302。
步骤307、如果解析出的审核结果是广告请求，则进行拦截处理，即丢弃该广告请求。
如图11所示，审核模块的具体流程，包括如下步骤：
步骤401、host审核。
步骤402、URL审核。
步骤403、包名验证。
步骤404、签名、版本验证。
步骤405、审核验证。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个处理单元中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
或者，本发明上述集成的单元如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：移动存储设备、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明 的保护范围应以所述权利要求的保护范围为准。
工业实用性
采用本发明实施例，可以对除所述第一应用之外的至少一个待拦截应用分别配置拦截策略，由于可以对单个的应用分别设置拦截策略，因此，拦截起来更有针对性，使得拦截处理效率更快，拦截精度更高。进入拦截模式后，监听到网络请求后，如果将与所述网络请求相关联的通信信息与预设策略进行匹配得到指定的目标信息，则会对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用，由于不仅可以实现信息拦截，还能定位到发出该网络请求的待拦截应用，也使得拦截处理效率更快，拦截精度更高，还可以提示给用户知道这个待拦截应用存在安全隐患，提高安全性。

Claims (13)

  1. 一种信息拦截处理方法，所述方法包括：
    启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；
    获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信信息与所述网络请求相关联；
    将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
  2. 根据权利要求1所述的方法，其中，所述预设策略具体为多特征审核策略时，所述将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用，包括：
    解析出所述网络请求对应的第一信息和发起所述网络请求的待拦截应用对应的第二信息，将所述第一信息和所述第二信息作为所述通信信息；
    提取广告云名单数据库中包含的多个广告特征参数，按照多特征审核策略将所述多个广告特征参数与所述通信信息进行比对，如果比对成功，则确定出所述通信信息为广告信息，定位至发起所述网络请求的待拦截应用，对所述网络请求进行拦截，并发出提示信息给终端用户；
    所述提示信息，用于表征所述待拦截应用存在信息安全隐患。
  3. 根据权利要求1或2所述的方法，其中，所述对应用列表中每一个待拦截应用分别配置拦截策略，包括：
    为所述应用列表中每一个待拦截应用分别配置所述拦截策略，所述拦 截策略为相同的策略、或者不同的策略。
  4. 根据权利要求1或2所述的方法，其中，所述方法还包括：
    将所述第一应用与应用列表中每一个待拦截应用的X个目标进程建立关联，所述X为大于1的自然数；
    根据所建立的关联使所述第一应用进入所述X个目标进程中，以实现对X个目标进程的监控。
  5. 根据权利要求4所述的方法，其中，所述按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，包括：
    监控X个目标进程中网络请求的交互，截获到所述网络请求；
    按照所述拦截策略在所述网络请求的请求消息转发节点设置监听检测接口，根据所述监听检测接口获取到所述通信信息。
  6. 根据权利要求5所述的方法，其中，所述按照所述拦截策略在所述网络请求的请求消息转发节点设置监听检测接口，包括：
    在用于表征所述请求消息转发节点的第一函数sendto和第二函数recvfrom中设置钩子hook函数，生成用于监听网络请求交互的第一监听函数hook_sendto和第二监听函数hook_recvfrom；
    将所述第一监听函数hook_sendto和第二监听函数hook_recvfrom作为所述监听检测接口。
  7. 一种终端，所述终端包括：
    配置单元，配置为启动第一应用，提取需要拦截的应用列表，对应用列表中每一个待拦截应用分别配置拦截策略；
    监听单元，配置为获取待拦截应用发出的网络请求，在所述第一应用进入拦截模式的情况下，按照所述配置的拦截策略对所述待拦截应用发出的网络请求进行监听，以匹配出符合所述拦截策略的通信信息，所述通信 信息与所述网络请求相关联；
    拦截单元，配置为将所述通信信息与预设策略进行匹配，如果经匹配确定出所述通信信息为指定的目标信息，则对所述网络请求进行拦截，并定位追溯至发出所述网络请求的待拦截应用。
  8. 根据权利要求7所述的终端，其中，所述拦截单元，还包括：
    解析子单元，配置为解析出所述网络请求对应的第一信息和发起所述网络请求的待拦截应用对应的第二信息，将所述第一信息和所述第二信息作为所述通信信息；
    审核子单元，配置为提取广告云名单数据库中包含的多个广告特征参数，按照多特征审核策略将所述多个广告特征参数与所述通信信息进行比对，如果比对成功，则确定出所述通信信息为广告信息，定位至发起所述网络请求的待拦截应用，对所述网络请求进行拦截，并发出提示信息给终端用户；
    所述提示信息，用于表征所述待拦截应用存在信息安全隐患。
  9. 根据权利要求7或8所述的终端，其中，所述配置单元，还配置为：为所述应用列表中每一个待拦截应用分别配置所述拦截策略，所述拦截策略为相同的策略、或者不同的策略。
  10. 根据权利要求7或8所述的终端，其中，所述终端还包括：进程注入关联单元，配置为：
    将所述第一应用与应用列表中每一个待拦截应用的X个目标进程建立关联，所述X为大于1的自然数；
    根据所建立的关联使所述第一应用进入所述X个目标进程中，以实现对X个目标进程的监控。
  11. 根据权利要求10所述的终端，其中，所述监听单元，还包括：
    网络请求监控子单元，配置为监控X个目标进程中网络请求的交互， 截获到所述网络请求；
    信息监听子单元，配置为按照所述拦截策略在所述网络请求的请求消息转发节点设置监听检测接口，根据所述监听检测接口获取到所述通信信息。
  12. 根据权利要求11所述的终端，其中，所述信息监听子单元，还配置为：
    在用于表征所述请求消息转发节点的第一函数sendto和第二函数recvfrom中设置钩子hook函数，生成用于监听网络请求交互的第一监听函数hook_sendto和第二监听函数hook_recvfrom；
    将所述第一监听函数hook_sendto和第二监听函数hook_recvfrom作为所述监听检测接口。
  13. 一种计算机存储介质，其中存储有计算机可执行指令，该计算机可执行指令配置执行上述权利要求1至6任一项所述的信息拦截处理方法。
PCT/CN2016/081742 2015-12-30 2016-05-11 一种信息拦截处理方法及终端、计算机存储介质 WO2017113561A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/707,414 US10567841B2 (en) 2015-12-30 2017-09-18 Information interception processing method, terminal, and computer storage medium
US16/725,839 US11206451B2 (en) 2015-12-30 2019-12-23 Information interception processing method, terminal, and computer storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201511025764.7 2015-12-30
CN201511025764.7A CN106936793B (zh) 2015-12-30 2015-12-30 一种信息拦截处理方法及终端

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/707,414 Continuation US10567841B2 (en) 2015-12-30 2017-09-18 Information interception processing method, terminal, and computer storage medium

Publications (1)

Publication Number Publication Date
WO2017113561A1 true WO2017113561A1 (zh) 2017-07-06

Family

ID=59224330

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/081742 WO2017113561A1 (zh) 2015-12-30 2016-05-11 一种信息拦截处理方法及终端、计算机存储介质

Country Status (3)

Country Link
US (2) US10567841B2 (zh)
CN (1) CN106936793B (zh)
WO (1) WO2017113561A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112948822A (zh) * 2021-03-04 2021-06-11 中电鹰硕(深圳)智慧互联有限公司 一种应用于智慧教育系统的大数据审计场景分析方法和系统
CN113467692A (zh) * 2021-06-30 2021-10-01 北京百度网讯科技有限公司 信息拦截方法、装置、设备、介质及程序产品
CN113722020A (zh) * 2020-05-26 2021-11-30 腾讯科技（深圳）有限公司 接口调用方法、装置和计算机可读存储介质
CN114338145A (zh) * 2021-12-27 2022-04-12 绿盟科技集团股份有限公司 一种安全防护方法、装置及电子设备

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106936793B (zh) 2015-12-30 2020-03-17 腾讯科技（深圳）有限公司 一种信息拦截处理方法及终端
WO2018045545A1 (en) * 2016-09-09 2018-03-15 Microsoft Technology Licensing, Llc Automated performance debugging of production applications
CN108256014B (zh) * 2018-01-05 2021-06-25 创新先进技术有限公司 页面展示方法及装置
CN110022340B (zh) * 2018-01-10 2021-05-25 腾讯科技（深圳）有限公司 应用安装方法、装置及终端
CN108566643A (zh) * 2018-04-24 2018-09-21 深信服科技股份有限公司 App访问控制方法、系统、终端设备及存储介质
CN109766689B (zh) * 2018-12-27 2023-12-12 百视通网络电视技术发展有限责任公司 基于Hook实现电视盒子的应用监控授权系统及方法
US11128644B2 (en) * 2019-03-19 2021-09-21 Five Media Marketing Limited Automatic security scanning of advertisements during runtime of software applications
US10467408B1 (en) 2019-03-19 2019-11-05 Five Media Marketing Limited Automatic security scanning of advertisements during runtime of software applications
US10678923B1 (en) 2019-07-10 2020-06-09 Five Media Marketing Limited Security management of advertisements at online advertising networks and online advertising exchanges
CN111901354B (zh) * 2020-08-03 2022-09-30 北京指掌易科技有限公司 数据处理方法、装置及电子终端
CN112084502B (zh) * 2020-09-18 2024-06-21 珠海豹趣科技有限公司 一种软件识别方法、装置、电子设备及存储介质
CN114500496A (zh) * 2020-10-27 2022-05-13 华为终端有限公司 一种目标数据的下载方法及设备
CN114928458B (zh) * 2021-02-03 2024-09-24 中国移动通信有限公司研究院 数据处理方法、装置及智能家居网关
CN112905890B (zh) * 2021-03-04 2024-10-11 深信服科技股份有限公司 一种待拦截窗口识别方法、装置、设备及存储介质
CN113259243B (zh) * 2021-04-26 2023-02-17 深圳市奇虎智能科技有限公司 路由器的自动应用拦截方法、系统、存储介质及计算机设备
CN114465960A (zh) * 2022-02-07 2022-05-10 北京沃东天骏信息技术有限公司 流量切换方法、装置和存储介质
CN114579204A (zh) * 2022-03-07 2022-06-03 网易（杭州）网络有限公司 一种风险控制方法、装置、终端及存储介质
CN114785607A (zh) * 2022-05-06 2022-07-22 深圳创维－Rgb电子有限公司 广告拦截方法、装置、设备及计算机可读存储介质
CN117473487A (zh) * 2023-10-24 2024-01-30 联通(广东)产业互联网有限公司 一种数据处理的方法及电子设备、计算机可读存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101620529A (zh) * 2008-07-03 2010-01-06 联想(北京)有限公司 拦截弹出窗口的方法和系统
CN103150513A (zh) * 2013-03-20 2013-06-12 北京奇虎科技有限公司 拦截应用程序中的植入信息的方法及装置
CN104092792A (zh) * 2014-07-15 2014-10-08 北京奇虎科技有限公司 基于域名解析请求来实现流量优化的方法及系统、客户端
CN104123276A (zh) * 2013-04-23 2014-10-29 腾讯科技（深圳）有限公司 一种浏览器中弹窗的拦截方法、装置和系统
CN104123120A (zh) * 2013-04-23 2014-10-29 腾讯科技（深圳）有限公司 一种浏览器页面数据过滤方法、装置和系统
CN104468551A (zh) * 2014-11-28 2015-03-25 北京奇虎科技有限公司 一种基于广告拦截节省流量的方法及装置

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5802304A (en) * 1996-04-18 1998-09-01 Microsoft Corporation Automatic dialer responsive to network programming interface access
US6675229B1 (en) * 1999-11-29 2004-01-06 Lucent Technologies Inc. Methods and apparatus for providing quality of service for legacy applications
US7979889B2 (en) * 2005-01-07 2011-07-12 Cisco Technology, Inc. Methods and apparatus providing security to computer systems and networks
US20060288096A1 (en) * 2005-06-17 2006-12-21 Wai Yim Integrated monitoring for network and local internet protocol traffic
US8869262B2 (en) * 2006-08-03 2014-10-21 Citrix Systems, Inc. Systems and methods for application based interception of SSL/VPN traffic
US8326985B2 (en) * 2010-11-01 2012-12-04 Seven Networks, Inc. Distributed management of keep-alive message signaling for mobile network resource conservation and optimization
US20120278886A1 (en) * 2011-04-27 2012-11-01 Michael Luna Detection and filtering of malware based on traffic observations made in a distributed mobile traffic management system
US9116717B2 (en) * 2011-05-27 2015-08-25 Cylance Inc. Run-time interception of software methods
US8984581B2 (en) * 2011-07-27 2015-03-17 Seven Networks, Inc. Monitoring mobile application activities for malicious traffic on a mobile device
EP2737732A4 (en) * 2011-07-27 2015-02-18 Seven Networks Inc MOBILE DEVICE USE CONTROL IN A MOBILE NETWORK BY A DISTRIBUTED PROXY SYSTEM
US20140040979A1 (en) * 2011-10-11 2014-02-06 Citrix Systems, Inc. Policy-Based Application Management
EP2774104A4 (en) * 2011-11-02 2015-04-15 Seven Networks Inc SENDING ADVERTISEMENTS AND ELECTRONIC COUPONS, STRATEGICALLY PROGRAMMED, TO A MOBILE DEVICE IN A MOBILE NETWORK
US9203864B2 (en) * 2012-02-02 2015-12-01 Seven Networks, Llc Dynamic categorization of applications for network access in a mobile network
US8844032B2 (en) * 2012-03-02 2014-09-23 Sri International Method and system for application-based policy monitoring and enforcement on a mobile device
US9270765B2 (en) * 2013-03-06 2016-02-23 Netskope, Inc. Security for network delivered services
US9608916B2 (en) * 2013-03-11 2017-03-28 Symantec Corporation Collaborative application classification
CN103530560A (zh) * 2013-09-29 2014-01-22 北京金山网络科技有限公司 广告拦截的方法、装置和客户端
CN104598815B (zh) * 2013-10-30 2018-09-11 北京猎豹移动科技有限公司 恶意广告程序的识别方法、装置及客户端
GB201915196D0 (en) * 2014-12-18 2019-12-04 Sophos Ltd A method and system for network access control based on traffic monitoring and vulnerability detection using process related information
CN106936793B (zh) 2015-12-30 2020-03-17 腾讯科技（深圳）有限公司 一种信息拦截处理方法及终端
US10586045B2 (en) * 2016-08-11 2020-03-10 The Mitre Corporation System and method for detecting malware in mobile device software applications

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101620529A (zh) * 2008-07-03 2010-01-06 联想(北京)有限公司 拦截弹出窗口的方法和系统
CN103150513A (zh) * 2013-03-20 2013-06-12 北京奇虎科技有限公司 拦截应用程序中的植入信息的方法及装置
CN104123276A (zh) * 2013-04-23 2014-10-29 腾讯科技（深圳）有限公司 一种浏览器中弹窗的拦截方法、装置和系统
CN104123120A (zh) * 2013-04-23 2014-10-29 腾讯科技（深圳）有限公司 一种浏览器页面数据过滤方法、装置和系统
CN104092792A (zh) * 2014-07-15 2014-10-08 北京奇虎科技有限公司 基于域名解析请求来实现流量优化的方法及系统、客户端
CN104468551A (zh) * 2014-11-28 2015-03-25 北京奇虎科技有限公司 一种基于广告拦截节省流量的方法及装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113722020A (zh) * 2020-05-26 2021-11-30 腾讯科技（深圳）有限公司 接口调用方法、装置和计算机可读存储介质
CN113722020B (zh) * 2020-05-26 2024-06-11 腾讯科技（深圳）有限公司 接口调用方法、装置和计算机可读存储介质
CN112948822A (zh) * 2021-03-04 2021-06-11 中电鹰硕(深圳)智慧互联有限公司 一种应用于智慧教育系统的大数据审计场景分析方法和系统
CN113467692A (zh) * 2021-06-30 2021-10-01 北京百度网讯科技有限公司 信息拦截方法、装置、设备、介质及程序产品
CN113467692B (zh) * 2021-06-30 2024-01-12 北京百度网讯科技有限公司 信息拦截方法、装置、设备、介质及程序产品
CN114338145A (zh) * 2021-12-27 2022-04-12 绿盟科技集团股份有限公司 一种安全防护方法、装置及电子设备
CN114338145B (zh) * 2021-12-27 2023-09-26 绿盟科技集团股份有限公司 一种安全防护方法、装置及电子设备

Also Published As

Publication number Publication date
US20200137451A1 (en) 2020-04-30
US10567841B2 (en) 2020-02-18
CN106936793A (zh) 2017-07-07
US20180027291A1 (en) 2018-01-25
CN106936793B (zh) 2020-03-17
US11206451B2 (en) 2021-12-21

Similar Documents

Publication Publication Date Title
WO2017113561A1 (zh) 一种信息拦截处理方法及终端、计算机存储介质
US11153226B2 (en) Incorporating web applications into web pages at the network level
US20220014552A1 (en) Detecting malicious behavior using an accomplice model
US8739249B1 (en) Push notifications for web applications and browser extensions
US9936330B2 (en) Methods for exchanging data amongst mobile applications using superlinks
US10491451B2 (en) Timestamp-based matching of identifiers
US9535755B2 (en) Tiers of data storage for web applications and browser extensions
US11445032B2 (en) Matching and attribution of user device events
US11503070B2 (en) Techniques for classifying a web page based upon functions used to render the web page
US9830139B2 (en) Application experience sharing system
US8694520B1 (en) Method and apparatus for providing virtual content to a mobile device
US20220353157A1 (en) Techniques for detection and analysis of network assets under common management
US20230096236A1 (en) Systems and methods for mobile advertisement review
US11336737B2 (en) Opt-out compliance
US20230073437A1 (en) Tamper-proof interaction data
US11210453B2 (en) Host pair detection
US20150347112A1 (en) Providing data analytics for cohorts
WO2020026011A1 (zh) 物料的对接方法、装置、设备/终端/服务器及计算机可读存储介质
US20140279624A1 (en) Social campaign network and method for dynamic content delivery in same
US20220350901A1 (en) Methods, apparatus and articles of manufacture for confidential sketch processing
US20210075808A1 (en) Method and system for identifying malicious activity of pre-determined type
US20120324574A1 (en) Engine, system and method of providing a domain social network having business intelligence logic
AU2011296129B2 (en) Creative quality validation
WO2019098989A1 (en) Improving opt-out compliance

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16880369

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/10/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16880369

Country of ref document: EP

Kind code of ref document: A1