WO2019091028A1 - 应用软件恶意行为的动态告警方法和终端 - Google Patents

应用软件恶意行为的动态告警方法和终端 Download PDF

Info

Publication number
WO2019091028A1
WO2019091028A1 PCT/CN2018/077937 CN2018077937W WO2019091028A1 WO 2019091028 A1 WO2019091028 A1 WO 2019091028A1 CN 2018077937 W CN2018077937 W CN 2018077937W WO 2019091028 A1 WO2019091028 A1 WO 2019091028A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
alarm
malicious behavior
information
application software
Prior art date
Application number
PCT/CN2018/077937
Other languages
English (en)
French (fr)
Inventor
林子敏
刘艺锋
袁中举
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201880019202.7A priority Critical patent/CN110447215B/zh
Publication of WO2019091028A1 publication Critical patent/WO2019091028A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of terminal security, and in particular, to a dynamic alarm method and terminal for malicious behavior of an application software.
  • the embodiment of the present application provides a dynamic alarm method and a terminal for malicious behavior of an application software, which are used for dynamically adjusting an alarm for malicious behavior of an application software.
  • the malicious behavior type generates alarm information, wherein each malicious behavior type corresponds to one alarm threshold; the terminal prompts the alarm information; the terminal acquires the first feedback information of the user for the alarm information, and the first feedback information is an acknowledgement alarm.
  • the terminal maintains the alarm threshold corresponding to the malicious behavior type in the alarm information according to the first feedback information; the terminal acquires the second feedback information of the user for the alarm information, and the second feedback information does not recognize the alarm information; the terminal improves according to the second feedback information.
  • the alarm threshold corresponding to the malicious behavior type in the alarm information.
  • N are invoked, and the N key functions are called according to the monitoring of the application software within a preset time.
  • Each dimension of the result vector corresponds to a malicious behavior type and its threat level; the terminal generates alarm information for the malicious behavior type whose threat level is greater than or equal to the alarm threshold, wherein each malicious behavior type corresponds to one alarm threshold; the terminal prompts the alarm information.
  • the terminal acquires the first feedback information of the user for the alarm information, and the first feedback information is the acknowledged alarm information; the terminal maintains the alarm threshold corresponding to the malicious behavior type in the alarm information according to the first feedback information; the terminal acquires the second information of the user for the alarm information.
  • anti- Information the second feedback information to the alarm information is not recognized; terminal malicious acts to improve alarm information corresponding to the type of the alarm threshold according to the second feedback information.
  • the terminal mathematically represents the number of times the application software calls the key function, and enters the malicious behavior model to obtain the malicious behavior type and its threat level result vector, and then generates the alarm information according to the threat level and the alarm threshold of each malicious behavior type. Then, according to the feedback of the user to the alarm information, the alarm threshold is adjusted to adapt to different users and terminals, and the alarm for dynamically adjusting the malicious behavior of the application software is realized.
  • the method further includes: acquiring, by the terminal, security information of the terminal, where the security information includes a security status and a security requirement; if the security status of the terminal is low or the security requirement is high, Reduce the alarm threshold for some or all malicious behavior types.
  • the alarm threshold may be adjusted according to the security information of the terminal.
  • each dimension of the result vector B (B 1 , B 2 , ..., B M ) corresponds to a malicious behavior type and its threat level; And generating alarm information for a malicious behavior type with a threat level greater than or equal to an alarm threshold, where each malicious behavior type corresponds to one alarm threshold;
  • the prompting unit is configured to prompt the generating unit to generate alarm information;
  • the first feedback information is the acknowledged alarm information;
  • the adjusting unit is configured to maintain the alarm threshold corresponding to the malicious behavior type in the alarm information according to the first feedback information acquired by the acquiring unit;
  • the unit is further configured to obtain the second feedback information of the user for the alarm information, and the second feedback information is that the alarm information is not recognized; the adjusting unit is further configured to: according to the second feedback information, improve the alarm threshold corresponding to the malicious behavior type in the alarm information.
  • the principles and benefits of the terminal can be solved.
  • the implementation of the terminal and the beneficial effects of the first aspect and the first aspect the implementation of the terminal can be referred to the first
  • the aspects and implementations of the various possible methods of the first aspect are not repeated here.
  • an embodiment of the present application provides a terminal, including: a processor, a memory, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is coupled to the memory, when the terminal is running, the processor Executing the memory stored by the memory to execute an instruction to enable the terminal to execute the dynamic alarm method of any of the above-mentioned application malicious actions.
  • an embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores an instruction, when the instruction is run on any one of the foregoing terminals, causing the terminal to execute any one of the foregoing application software Dynamic alerting method for malicious behavior.
  • an embodiment of the present application provides a computer program product that includes an instruction, when it runs on any of the foregoing terminals, causing the terminal to perform a dynamic alarm method of any of the above-mentioned application software malicious behaviors.
  • the names of the components in the terminal are not limited to the device itself, and in actual implementation, the components may appear under other names. As long as the functions of the various components are similar to the embodiments of the present application, they are within the scope of the claims and their equivalents.
  • FIG. 1 is a schematic front view of a terminal according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a hardware of a terminal according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart 1 of a dynamic alarm method for malicious behavior of an application software according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of obtaining a behavior vector according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of obtaining a result vector according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of displaying alarm information according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of displaying alarm information in a message box according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of displaying alarm information in a notification center according to an embodiment of the present application.
  • FIG. 9 is a schematic flowchart 2 of a dynamic alarm method for malicious behavior of an application software according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic flowchart 3 of a dynamic alarm method for malicious behavior of an application software according to an embodiment of the present disclosure
  • FIG. 11 is a schematic structural diagram 1 of a terminal according to an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram 2 of a terminal according to an embodiment of the present disclosure.
  • the terminal in the embodiment of the present application may be various electronic devices configured with a display screen, for example, may be a wearable electronic device (such as a smart watch, etc.), a tablet computer, a desktop computer, a virtual reality device, an augmented reality device, or
  • the mobile phone 200 shown in FIG. 1 or FIG. 2 is not limited to the specific form of the terminal in this embodiment.
  • the terminal in the embodiment of the present application may be the mobile phone 200.
  • 1 is a front view of a mobile phone 200
  • FIG. 2 is a schematic diagram of a hardware structure of the mobile phone 200.
  • the embodiment will be specifically described below by taking the mobile phone 200 as an example. It should be understood that the illustrated mobile phone 200 is merely an example of a terminal, which may have more or fewer components than those shown in the figures, may combine two or more components, or may have different component.
  • the mobile phone 200 may include: a radio frequency (RF) circuit 210, a memory 220, an input unit 230, a display unit 240, a sensor 250, an audio circuit 260, and a wireless fidelity (Wi-Fi).
  • RF radio frequency
  • Module 270, processor 280, Bluetooth module 281, and power supply 290 and the like may be included in the mobile phone 200.
  • the RF circuit 210 can be used for receiving and transmitting signals during transmission and reception of information or during a call.
  • the downlink data of the base station can be received and then sent to the processor 280 for processing; and the uplink data can be sent to the base station.
  • RF circuitry includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.
  • the RF circuit 210 of the present application can obtain a malicious behavior model and an alarm policy from the cloud.
  • the memory 220 can be used to store software programs and data.
  • the processor 280 performs various functions of the mobile phone 200 and data processing by running software programs or data stored in the memory 220.
  • the memory 220 may include a high speed random access memory, and may also include a nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the memory 220 stores an operating system that enables the mobile phone 200 to operate, such as developed by Apple. Operating system, developed by Google Inc. Open source operating system, developed by Microsoft Corporation Operating system, etc.
  • the memory 220 of the present application can store malicious behavior models and alarm policies from the cloud, can also store various application software, and can also store codes for monitoring and analyzing the behavior of the application software.
  • An input unit 230 such as a touch screen, can be used to receive input numeric or character information, producing signal inputs related to user settings and function control of the handset 200.
  • the input unit 230 may include a touch panel 231 disposed on the front surface of the mobile phone 200 as shown in FIG. 1, and may collect a touch operation on or near the user.
  • the input unit 230 of the present application can receive feedback information of the user for the alarm information.
  • the display unit 240 (ie, the display screen) can be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the mobile phone 200.
  • the display unit 240 may include a display panel 241 disposed on the front side of the mobile phone 200.
  • the display panel 241 can be configured in the form of a liquid crystal display, a light emitting diode, or the like.
  • Display unit 240 can be used to display the various graphical user interfaces described in this application.
  • the touch panel 231 can be overlaid on the display panel 241.
  • the touch panel 231 can be integrated with the display panel 241 to implement the input and output functions of the mobile phone 200.
  • the display unit 240 can display alarm information in the present application.
  • the handset 200 can also include at least one sensor 250, such as a light sensor, a motion sensor.
  • the mobile phone 200 can also be equipped with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor.
  • the audio circuit 260, the speaker 261, and the microphone 262 can provide an audio interface between the user and the handset 200.
  • the audio circuit 260 can transmit the converted electrical data of the received audio data to the speaker 261, and convert it into a sound signal output by the speaker 261.
  • the microphone 262 converts the collected sound signal into an electrical signal, and the audio circuit 260 After receiving, it is converted into audio data, and then the audio data is output to the RF circuit 210 for transmission to, for example, another mobile phone, or the audio data is output to the memory 220 for further processing.
  • Wi-Fi is a short-range wireless transmission technology
  • the mobile phone 200 can help users to send and receive emails, browse web pages, and access streaming media through the Wi-Fi module 270, which provides users with wireless broadband Internet access.
  • the Wi-Fi module 270 of the present application can obtain a malicious behavior model and an alarm policy from the cloud.
  • the processor 280 is a control center of the mobile phone 200, and connects various parts of the entire mobile phone by using various interfaces and lines, and executes the mobile phone 200 by running or executing a software program stored in the memory 220 and calling data stored in the memory 220.
  • the processor 280 can include one or more processing units; the processor 280 can also integrate an application processor and a baseband processor, wherein the application processor primarily processes an operating system, a user interface, an application, etc., a baseband The processor primarily handles wireless communications. It can be understood that the above baseband processor may not be integrated into the processor 280.
  • the Bluetooth module 281 is configured to perform information interaction with other Bluetooth devices having a Bluetooth module through a Bluetooth protocol.
  • the mobile phone 200 can establish a Bluetooth connection through a Bluetooth module 281 and a wearable electronic device (such as a smart watch) that also has a Bluetooth module, thereby performing data interaction.
  • the handset 200 also includes a power source 290 (such as a battery) that supplies power to the various components.
  • the power supply can be logically coupled to the processor 280 through a power management system to manage functions such as charging, discharging, and power consumption through the power management system.
  • an embodiment of the present application provides a dynamic alarm method for malicious behavior of an application software, and the method may include:
  • Step S101 The terminal monitors the running application software to invoke the behaviors of the N key functions F 1 , F 2 , . . . , F N .
  • the application software installed and running on the terminal may come from different download sources, such as an application store, an official website of the application software, a web link, etc., and the application is not limited. Regardless of the source of the application, if it is malware, there will be common malicious behavior at runtime, which may threaten the security of the terminal information. For example, malware may steal user privacy information, including call recordings, text messages, International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identification Number (IMSI), geographic location, communications.
  • IMEI International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identification Number
  • malware may send malicious deduction SMS, malicious call, intercept verification code SMS; malware may obtain ROOT permission through system vulnerability, silently install in the background Other programs, or fake users to install other programs by pseudo-antivirus software, prompt updates, etc.; malware may download a large amount of software in the background, consume user mobile phone traffic, or perform some power-consuming operations to consume mobile phone power, thereby affecting normal Cell phone communication.
  • malware may send malicious deduction SMS, malicious call, intercept verification code SMS; malware may obtain ROOT permission through system vulnerability, silently install in the background Other programs, or fake users to install other programs by pseudo-antivirus software, prompt updates, etc.; malware may download a large amount of software in the background, consume user mobile phone traffic, or perform some power-consuming operations to consume mobile phone power, thereby affecting normal Cell phone communication.
  • the SmsManager.sendDataMessage function is provided in the Android operating system to send short messages; the DefaultHttpClient.execute function is provided to send the Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) request; provide URLConnection.connect function to connect Uniform Resource Locator (URL); provide java.lang.Runtime.exec function for executing external commands.
  • HTTP Hyper Text Transfer Protocol
  • URLConnection.connect function to connect Uniform Resource Locator
  • URL Uniform Resource Locator
  • java.lang.Runtime.exec function for executing external commands.
  • the terminal can monitor whether the application software has malicious behavior by monitoring the frequency at which the application software calls the key function.
  • key function is used in the following embodiments of the present application.
  • the developer of the terminal software system can add relevant code to the N key functions F 1 , F 2 , . . . , F N so that the terminal can obtain the identifier of the application software that calls the key function, for example, the terminal can obtain the function through the getpid function.
  • the Process Identifier (PID) or the User Identifier (UID) is obtained through the getuid function.
  • key function is only a word used in the embodiment of the present application, and the meaning of the representative is already described in the embodiment of the present application, and the name does not constitute any limitation to the embodiment of the present application;
  • "key functions” may also be referred to as other words such as "important functions,” “sensitive functions,” “characteristic functions,” “dangerous functions,” and the like.
  • the developer may add a code for obtaining the PID or UID of the application software in the SmsManager.sendDataMessage function, and the terminal may count the number of times the function is called by an application software, because the behavior of calling the key function may involve malicious
  • the developer can add the code of the PID or UID of the application software in the killing process sys_kill function of the system call, and the terminal counts the number of times the function is called by an application software, because the function is called.
  • the behavior may involve breaking the system.
  • the terminal can abstract the number of times that each application software calls N key functions into an N-dimensional behavior vector within a preset time, and each dimension represents the number of times the application software calls a certain key function within a preset time, if no one is called.
  • the key function has a statistical value of 0 for the number of dimensions.
  • each dimension of the result vector B (B 1 , B 2 , . . . , B M ) corresponds to a malicious behavior type and its threat level.
  • each dimension of the behavior vector represents the number of times the application software calls a key function within a preset time, but because of the large number of key functions, multiple key functions may correspond to a malicious behavior and correspond to a malicious behavior. Different key functions have different threat levels, and it is not convenient to analyze the behavior of the application from the perspective of key functions.
  • the behavior vector can be summarized and summarized by the malicious behavior model, so as to obtain the malicious behavior type and its threat level corresponding to each key function, that is, the result vector.
  • Malicious behavior types may include, for example, privacy theft, malicious deductions, damage to the system, and the like.
  • the threat level refers to the severity of the malicious behavior of the application, such as may be represented by a numerical rating of 0-10.
  • each malicious behavior type corresponds to a threat level, such as a malicious application, and its malicious behavior types include privacy stealing and destruction systems, wherein the privacy stealing threat level is 3, destroying the system.
  • the threat level is 5.
  • the malicious behavior model is a mathematical model, which is obtained by the cloud training the behavior vector and result vector of a large number of applications according to the machine learning algorithm.
  • Each dimension of the result vector represents a malicious behavior type and its threat level.
  • the result vector is actually the result of the dimension reduction processing after summarizing the behavior vector. Since the type of malicious behavior is much less than the number of key functions, the lower dimension of the malicious behavior type and the corresponding threat level can be used to represent the higher dimension. The number of times the key function was called.
  • each application's malicious behavior type and threat level are respectively regarded as a vector, and two vectors form a result vector group, which is used for each application software.
  • the N-dimensional behavior vector and the result vector group are used as training data pairs. Based on the machine learning algorithm, the malicious behavior model is trained, and finally the malicious behavior model can be obtained.
  • each dimension represents the same meaning, so when the behavior vector obtained in step S102 is input into the malicious behavior model, the resulting vector is maliciously trained in the cloud.
  • the result vector entered in the behavioral model can also represent the same meaning per dimension. Referring to FIG. 5, the N-dimensional behavior vector of each application software is input as a malicious behavior model, and the M-dimensional result vector can be obtained based on the same machine learning method as when training the malicious behavior model, and the M-dimensional result vector includes each application software. The type of malicious behavior and the corresponding threat level.
  • the behavior vector of the application software may be sent by the terminal to the cloud, and the cloud generates a result vector of the application software according to the malicious behavior model stored in the cloud and the behavior vector of the application software.
  • the malicious behavior model may also be sent by the cloud to the terminal, and the terminal generates a result vector of the application software according to the malicious behavior model and the behavior vector of the application software.
  • Step S104 The terminal generates alarm information for a malicious behavior type whose threat level is greater than or equal to an alarm threshold.
  • Each type of malicious behavior corresponds to an alarm threshold.
  • the alarm thresholds of the multiple types of malicious behaviors can be collectively referred to as alarm policies.
  • the same malicious behavior type can correspond to the same or different alarm thresholds for all applications. If the threat level of a malicious behavior type of the application software is greater than or equal to the corresponding alarm threshold, the terminal generates alarm information. For example, if the alarm threshold of privacy stealing is 3, if the threat level of privacy stealing of an application is greater than or equal to 3, the system will prompt an alarm message, which can indicate that the application is stealing privacy.
  • the cloud may send the malicious behavior type and the threat level of the application software to the terminal, and the terminal generates the alarm information by combining the alarm policy.
  • the terminal can store the alarm policy locally or obtain the alarm policy from the cloud.
  • the alarm information may include: an application name that generates a malicious behavior, a malicious behavior type, and the like. If the threat level of the multiple malicious behavior types is greater than or equal to the corresponding alarm threshold, the alarm information may include the foregoing multiple malicious behavior types.
  • Step S105 The terminal prompts the alarm information.
  • the terminal determines whether to display the alarm information to the user according to the alarm policy issued by the cloud and the malicious behavior type and threat level of the application software.
  • the alarm policy alerts all malicious behavior types and threat levels of an application.
  • the threat level of a malicious behavior type of the application software is greater than or equal to the corresponding threshold, the user may prompt the user for the alarm information.
  • the threat level of all the malicious behavior types of the application software is less than the corresponding threshold, the user does not need to prompt the user for the alarm information. .
  • the WeChat may obtain the user's address book during operation. If the system determines that the WeChat behavior is privacy theft and the threat level is greater than or equal to 1, the system will prompt the alarm information.
  • the alert message can show that WeChat is stealing privacy.
  • the alarm information may be displayed in a message box format; or, as shown in FIG. 8 , the alarm information may be displayed in the notification center; or the alarm information may be displayed in other reminding manners. limited.
  • Step S106 The terminal acquires first feedback information of the user for the alarm information.
  • the first feedback information is the acknowledgement of the alarm information.
  • the user may have different perceptions and inclinations for different malicious behaviors.
  • the user may receive feedback on the alarm information.
  • the feedback of the user for the alarm information includes or does not recognize a malicious behavior for an application software.
  • Alarm information For example, referring to FIG. 7 and FIG. 8 , after seeing the alarm information, the user may click “accept reminder” to indicate that the user recognizes that the application software has alarm information for malicious behavior of stealing privacy.
  • Step S107 The terminal maintains an alarm threshold corresponding to the malicious behavior type in the alarm information according to the first feedback information.
  • the terminal can keep the alarm threshold unchanged, so that the next time the same malicious behavior can be correctly alerted.
  • Step S108 The terminal acquires second feedback information of the user for the alarm information.
  • the second feedback information is that the alarm information is not recognized.
  • the user may click “Ignore Reminder” to indicate that the user does not recognize the alarm information of the malicious behavior of stealing privacy of the application software.
  • Step S109 The terminal increases an alarm threshold corresponding to the malicious behavior type in the alarm information according to the second feedback information.
  • the terminal can increase the alarm threshold corresponding to the malicious behavior type in the alarm information, which is equivalent to the next time.
  • steps S106-S107 and steps S108-S109 are not sequentially executed, and the present application is not limited to being executed only once, and steps S106-S107 and steps S108-S109 must not be executed, for example, only Steps S106-S107 are performed one or more times, or steps S108-S109 are performed only once or more.
  • steps S106-S107 or steps S108-S109 are performed only once or more.
  • the behaviors of the N key functions F 1 , F 2 , . . . , F N are invoked, and the N key functions are called according to the monitoring of the application software within a preset time.
  • Each dimension of the result vector corresponds to a malicious behavior type and its threat level; the terminal generates alarm information for the malicious behavior type whose threat level is greater than or equal to the alarm threshold, wherein each malicious behavior type corresponds to one alarm threshold; the terminal prompts the alarm information.
  • the terminal acquires the first feedback information of the user for the alarm information, and the first feedback information is the acknowledged alarm information; the terminal maintains the alarm threshold corresponding to the malicious behavior type in the alarm information according to the first feedback information; the terminal acquires the second information of the user for the alarm information.
  • anti- Information the second feedback information to the alarm information is not recognized; terminal malicious acts to improve alarm information corresponding to the type of the alarm threshold according to the second feedback information.
  • the terminal mathematically represents the number of times the application software calls the key function, and enters the malicious behavior model to obtain the malicious behavior type and its threat level result vector, and then generates the alarm information according to the threat level and the alarm threshold of each malicious behavior type. Then, according to the feedback of the user to the alarm information, the alarm threshold is adjusted to adapt to different users and terminals, and the alarm for dynamically adjusting the malicious behavior of the application software is realized.
  • the foregoing method may further include step S201:
  • Step S201 The terminal sends the adjusted alarm policy to the cloud.
  • the purpose of this step is to improve the alarm policy of the cloud. If a large number of users select the same adjustment operation for the alarm information of a malicious behavior type of an application, the cloud can adjust the alarm policy in the same direction, for example.
  • the alarm information of a malicious behavior type of an application is not recognized by a large number of users, and the alarm threshold is set to be too low, and the cloud can raise the alarm threshold.
  • the time feedback by the terminal may include: periodic feedback, feedback after power-on, feedback before shutdown, feedback before updating the system, and after each adjustment of the alarm policy.
  • the above method may further include steps S301 and S302:
  • Step S301 The terminal acquires security information of the terminal.
  • the terminal's security information includes security status and security requirements.
  • security status it can include system integrity and the external environment.
  • the system file and file mount information of the terminal can be extracted to verify the system integrity of the terminal. For example, the system file or file mount information does not match the factory, indicating that the system may have been ROOT, the system integrity is destroyed, and thus the security is lower.
  • the system operating environment can be included, for example, if the system is running a process such as Alipay and banking software, the security requirements are high.
  • the alarm policy can be dynamically adjusted by analyzing the security information of the terminal.
  • Step S302 If the security status of the terminal is low or the security requirement is high, the alarm threshold of some or all malicious behavior types is reduced.
  • the terminal can adjust the alarm policy according to the security information of the terminal and the feedback of the user, so as to adapt to the terminals of different users.
  • the following example shows that the alarm policy is adjusted according to the security information of the terminal to improve the accuracy of malicious behavior determination and alarm.
  • two users A and B who hold the same terminal are installed with a certain malware disguised as ordinary game software in both terminals, but the user A's terminal has been ROOT or is running Alipay software. Reduce the alarm threshold of the malicious interception screen; the user B's terminal is not ROOT or the Alipay software is not running.
  • the terminal of the user A can display a prompt message indicating that the malware is maliciously intercepting the screen, and the terminal of the user B can not display the prompt information.
  • the solution provided by the embodiment of the present application can effectively monitor the execution process of the application software in the terminal, identify the malicious behavior type and the threat degree, quickly discover the malicious behavior according to the malicious behavior model, and prompt the user.
  • the alarm policy can be dynamically adjusted for different user feedback and terminal security information to improve the accuracy of malicious behavior determination and alarm.
  • the solution provided by the embodiment of the present application is not limited to the identification and alarm of the malware, and may also identify whether the user is a senior user or a novice user according to the behavior characteristics of the user feedback, and the frequency of reminding the alarm information may be reduced for the senior user. The user increases the frequency of reminding alarm information to achieve a better user experience.
  • the above terminal and the like include hardware structures and/or software modules corresponding to each function.
  • the embodiments of the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.
  • the embodiment of the present application may perform the division of the function modules on the terminal or the like according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present application is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 11 is a schematic diagram showing a possible structure of a terminal involved in the foregoing embodiment, where the terminal 200 includes: a monitoring unit 2011, a generating unit 2012, and an acquiring unit 2013. , prompting unit 2014 and adjusting unit 2015.
  • the monitoring unit 2011 is configured to support the terminal 200 to perform the process S101 in FIG. 3, FIG. 4, FIG. 9, and FIG. 10; the generating unit 2012 is configured to support the terminal 200 to perform the process S102 in FIG. 3, FIG. 4, FIG. 9, FIG.
  • the above-described monitoring unit 2011, generating unit 2012, acquiring unit 2013, prompting unit 2014, and adjusting unit 2015 can be integrated as a processing module.
  • the terminal may further include a storage module, a communication module, an input and output module, and the like.
  • the processing module 2021 is configured to control and manage the action of the terminal.
  • the communication module 2022 is configured to support communication between the terminal and other network entities such as a cloud server, other terminals, and the like.
  • the input/output module 2023 is for receiving information input by the user or outputting information provided to the user and various menus of the terminal.
  • the storage module 2024 is configured to save program codes and data of the terminal.
  • the processing module 2021 may be a processor or a controller, for example, may be a central processing unit (CPU), a GPU, a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit. (Application-Specific Integrated Circuit, ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 2022 may be a transceiver, a transceiver circuit, an input/output device, a communication interface, or the like.
  • the communication module 2022 may specifically be a Bluetooth device, a Wi-Fi device, a peripheral interface, or the like.
  • the memory module 2024 may be a memory, which may include a high speed random access memory (RAM), and may also include a nonvolatile memory such as a magnetic disk storage device, a flash memory device, or other volatile solid state storage device.
  • RAM high speed random access memory
  • nonvolatile memory such as a magnetic disk storage device, a flash memory device, or other volatile solid state storage device.
  • the input/output module 2023 can be an input/output device such as a touch screen, a keyboard, a microphone, and a display.
  • the display may specifically be configured in the form of a liquid crystal display, an organic light emitting diode or the like.
  • a touch panel can be integrated on the display for collecting touch events on or near the display, and transmitting the collected touch information to other devices (such as a processor, etc.).
  • the storage module is a memory
  • the input/output module is a display
  • the processing module is a processor
  • the communication module is a communication interface
  • the memory is used to store a computer execution instruction
  • the processor is coupled to the memory
  • the processor executes the memory.
  • the stored computer executes instructions to enable the terminal to perform a dynamic alerting method for malicious behavior of the application software as described in any of Figures 3, 4, 5, 6, 9, and 10.
  • An embodiment of the present invention further provides a computer storage medium storing one or more programs, the one or more programs including instructions, when executed by the terminal, causing the terminal to execute as shown in FIG. 3, FIG. 4, FIG. 5, FIG.
  • the embodiment of the invention further provides a computer program product comprising instructions, when the computer program product is run on the terminal, causing the terminal to perform any one of FIG. 3, FIG. 4, FIG. 5, FIG. 6, FIG. 9, FIG. A dynamic alerting method for malicious behavior of an application software as described in the accompanying drawings.
  • the terminal, the computer storage medium or the computer program product provided by the embodiments of the present invention are all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can be referred to the corresponding method provided above. The beneficial effects will not be described here.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not be applied to the embodiment of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephone Function (AREA)

Abstract

本申请公开了一种应用软件恶意行为的动态告警方法和终端，涉及终端安全领域，用于动态调整针对应用软件恶意行为的告警。该方法包括：终端监控应用软件调用关键函数的行为；终端根据在预设时间内监控到应用软件调用关键函数的次数生成行为向量；终端基于机器学习算法，将行为向量输入恶意行为模型得到应用软件的结果向量；终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息；终端提示告警信息；终端获取用户针对告警信息的第一反馈信息；终端根据第一反馈信息保持恶意行为类型对应的告警阈值；终端获取用户针对告警信息的第二反馈信息；终端根据第二反馈信息提高恶意行为类型对应的告警阈值。本申请实施例用于对恶意软件进行告警。

Description

应用软件恶意行为的动态告警方法和终端
本申请要求于2017年11月10日提交中国专利局、申请号为201711101431.7、申请名称为“一种适应用户的移动设备恶意行为判别与告警方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端安全领域，尤其涉及一种应用软件恶意行为的动态告警方法和终端。
背景技术
随着终端设备承载越来越多的用户隐私、财产等重要数据，恶意应用软件逐渐成为威胁终端安全的重要来源，针对应用软件的恶意行为分析技术也在不断发展。现有技术中，对于不同的用户采用相同的模型告警终端软件的恶意行为，但实际上存在许多应用软件的行为介于正常行为和恶意行为之间，不同的用户对于应用的这类行为有不同的判断标准，可能产生告警结果与用户感知不一致的情况。
发明内容
本申请实施例提供一种应用软件恶意行为的动态告警方法和终端，用于动态调整针对应用软件恶意行为的告警。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，提供了一种应用软件恶意行为的动态告警方法，其特征在于，包括：终端监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为；终端根据在预设时间内监控到应用软件调用N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，行为向量A＝(A 1,A 2,.......,A N)的第i维A i表示应用软件调用关键函数F i的次数，1≤i≤N；终端基于机器学习算法，将行为向量A＝(A 1,A 2,.......,A N)输入恶意行为模型得到应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，结果向量B＝(B 1,B 2,......,B M)的每一维对应一种恶意行为类型及其威胁等级；终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息，其中，每种恶意行为类型对应一个告警阈值；终端提示告警信息；终端获取用户针对告警信息的第一反馈信息，第一反馈信息为认可告警信息；终端根据第一反馈信息保持告警信息中的恶意行为类型对应的告警阈值；终端获取用户针对告警信息的第二反馈信息，第二反馈信息为不认可告警信息；终端根据第二反馈信息提高告警信息中的恶意行为类型对应的告警阈值。本申请实施例通过在终端设备中监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为，根据在预设时间内监控到该应用软件调用N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，行为向量的第i维A i表示应用软件调用关键函数F i的次数，1≤i≤N；终端基于机器学习算法，将行为向量输入恶意行为模型得到应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，结果向量的每一维对应一种恶意行为类型及其威胁等级；终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信 息，其中，每种恶意行为类型对应一个告警阈值；终端提示告警信息；终端获取用户针对告警信息的第一反馈信息，第一反馈信息为认可告警信息；终端根据第一反馈信息保持告警信息中的恶意行为类型对应的告警阈值；终端获取用户针对告警信息的第二反馈信息，第二反馈信息为不认可告警信息；终端根据第二反馈信息提高告警信息中的恶意行为类型对应的告警阈值。终端通过将应用软件调用关键函数的次数以行为向量进行数学表示，输入恶意行为模型后得到表示恶意行为类型及其威胁等级结果向量，再根据各个恶意行为类型的威胁等级和告警阈值来生成告警信息，然后根据用户对告警信息的反馈来调整告警阈值，以适应不同用户和终端，实现了动态调整针对应用软件恶意行为的告警。
在一种可能的实施方式中，该方法还包括：终端获取终端的安全性信息，安全性信息包括安全性状态和安全性要求；如果终端的安全性状态较低或者安全性要求较高，则降低部分或全部恶意行为类型的告警阈值。该实施方式可以根据终端的安全性信息来调整告警阈值。
第二方面，提供了一种终端，包括：监控单元，用于监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为；生成单元，用于根据监控单元在预设时间内监控到应用软件调用N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，行为向量A＝(A 1,A 2,.......,A N)的第i维A i表示应用软件调用关键函数F i的次数，1≤i≤N；获取单元，用于基于机器学习算法，将生成单元生成的行为向量A＝(A 1,A 2,.......,A N)输入恶意行为模型得到应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，结果向量B＝(B 1,B 2,......,B M)的每一维对应一种恶意行为类型及其威胁等级；生成单元，还用于对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息，其中，每种恶意行为类型对应一个告警阈值；提示单元，用于提示生成单元生成的告警信息；获取单元，还用于获取用户针对告警信息的第一反馈信息，第一反馈信息为认可告警信息；调整单元，用于根据获取单元获取的第一反馈信息保持告警信息中的恶意行为类型对应的告警阈值；获取单元，还用于获取用户针对告警信息的第二反馈信息，第二反馈信息为不认可告警信息；调整单元，还用于根据第二反馈信息提高告警信息中的恶意行为类型对应的告警阈值。基于同一发明构思，由于该终端解决问题的原理以及有益效果可以参见上述第一方面和第一方面的各可能的方法实施方式以及所带来的有益效果，因此该终端的实施可以参见上述第一方面和第一方面的各可能的方法的实施方式，重复之处不再赘述。
第三方面，本申请的实施例提供一种终端，包括：处理器、存储器和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器耦接，当终端运行时，该处理器执行该存储器存储的该计算机执行指令，以使终端执行上述任一项应用软件恶意行为的动态告警方法。
第四方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在上述任一项终端上运行时，使得终端执行上述任一项应用软件恶意行为的动态告警方法。
第五方面，本申请实施例提供一种包含指令的计算机程序产品，当其在上述任一 项终端上运行时，使得终端执行上述任一项应用软件恶意行为的动态告警方法。
本申请的实施例中，上述终端内各部件的名字对设备本身不构成限定，在实际实现中，这些部件可以以其他名称出现。只要各个部件的功能和本申请的实施例类似，即属于本申请权利要求及其等同技术的范围之内。
另外，第三方面至第五方面中任一种设计方式所带来的技术效果可参见上述第一方面中不同设计方法所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种终端的正面示意图；
图2为本申请实施例提供的一种终端的硬件结构示意图；
图3为本申请实施例提供的一种应用软件恶意行为的动态告警方法的流程示意图一；
图4为本申请实施例提供的得到行为向量的示意图；
图5为本申请实施例提供的得到结果向量的示意图；
图6为本申请实施例提供的显示告警信息的示意图；
图7为本申请实施例提供的以消息框形式显示告警信息的示意图；
图8为本申请实施例提供的在通知中心中显示告警信息的示意图；
图9为本申请实施例提供的一种应用软件恶意行为的动态告警方法的流程示意图二；
图10为本申请实施例提供的一种应用软件恶意行为的动态告警方法的流程示意图三；
图11为本申请实施例提供的一种终端的结构示意图一；
图12为本申请实施例提供的一种终端的结构示意图二。
具体实施方式
本申请实施例中的终端可以为配置有显示屏的各种电子设备，例如，可以为可穿戴电子设备(例如智能手表等)、平板电脑、台式电脑、虚拟现实装置、增强现实装置，也可以是图1或图2所示的手机200，本申请实施例对终端的具体形式不做限制。
以下实施例以手机作为例子来说明终端如何实现实施例中的具体技术方案。如图1或图2所示，本申请实施例中的终端可以为手机200。图1为手机200的正面示意图，图2为手机200的硬件结构示意图。下面以手机200为例对实施例进行具体说明。应该理解的是，图示手机200仅仅是终端的一个范例，其可以具有比图中所示出的更多的或者更少的部件，可以组合两个或更多的部件，或者可以具有不同的部件。
如图2所示，手机200可以包括：射频(Radio Frequency，RF)电路210、存储器220、输入单元230、显示单元240、传感器250、音频电路260、无线保真(Wireless Fidelity，Wi-Fi)模块270、处理器280、蓝牙模块281、以及电源290等部件。
RF电路210可用于在收发信息或通话过程中信号的接收和发送，可以接收基站的下行数据后交给处理器280处理；可以将上行数据发送给基站。通常，RF电路包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器、双工器等器件。本申请的RF电路210可以从云端获取恶意行为模型和告警策略。
存储器220可用于存储软件程序及数据。处理器280通过运行存储在存储器220 的软件程序或数据，从而执行手机200的各种功能以及数据处理。存储器220可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。存储器220存储有使得手机200能运行的操作系统，例如苹果公司所开发的
Figure PCTCN2018077937-appb-000001
操作系统，谷歌公司所开发的
Figure PCTCN2018077937-appb-000002
开源操作系统，微软公司所开发的
Figure PCTCN2018077937-appb-000003
操作系统等。本申请的存储器220可以存储来自云端的恶意行为模型和告警策略，还可以存储各种应用软件，还可以存储监控及分析应用软件的行为的代码。
输入单元230(例如触摸屏)可用于接收输入的数字或字符信息，产生与手机200的用户设置以及功能控制有关的信号输入。具体地，输入单元230可以包括如图1所示设置在手机200正面的触控面板231，可收集用户在其上或附近的触摸操作。本申请的输入单元230可以接收用户针对告警信息的反馈信息。
显示单元240(即显示屏)可用于显示由用户输入的信息或提供给用户的信息以及手机200的各种菜单的图形用户界面(Graphical User Interface，GUI)。显示单元240可包括设置在手机200正面的显示面板241。其中，显示面板241可以采用液晶显示器、发光二极管等形式来配置。显示单元240可以用于显示本申请中所述的各种图形用户界面。触控面板231可以覆盖在显示面板241之上，也可以将触控面板231与显示面板241集成而实现手机200的输入和输出功能，集成后可以简称触摸显示屏。显示单元240在本申请中可以显示告警信息。
手机200还可以包括至少一种传感器250，比如光传感器、运动传感器。手机200还可配置有陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器。
音频电路260、扬声器261、麦克风262可提供用户与手机200之间的音频接口。音频电路260可将接收到的音频数据转换后的电信号，传输到扬声器261，由扬声器261转换为声音信号输出；另一方面，麦克风262将收集的声音信号转换为电信号，由音频电路260接收后转换为音频数据，再将音频数据输出至RF电路210以发送给比如另一手机，或者将音频数据输出至存储器220以便进一步处理。
Wi-Fi属于短距离无线传输技术，手机200可以通过Wi-Fi模块270帮助用户收发电子邮件、浏览网页和访问流媒体等，它为用户提供了无线的宽带互联网访问。本申请的Wi-Fi模块270可以从云端获取恶意行为模型和告警策略。
处理器280是手机200的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器220内的软件程序，以及调用存储在存储器220内的数据，执行手机200的各种功能和处理数据。在一些实施例中，处理器280可包括一个或多个处理单元；处理器280还可以集成应用处理器和基带处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，基带处理器主要处理无线通信。可以理解的是，上述基带处理器也可以不集成到处理器280中。
蓝牙模块281，用于通过蓝牙协议来与其他具有蓝牙模块的蓝牙设备进行信息交互。例如，手机200可以通过蓝牙模块281与同样具备蓝牙模块的可穿戴电子设备(例如智能手表)建立蓝牙连接，从而进行数据交互。
手机200还包括给各个部件供电的电源290(比如电池)。电源可以通过电源管理系统与处理器280逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功 耗等功能。
以下实施例中的方法均可以在具有上述硬件结构的手机200中实现。
如图3所示，本申请一实施例提供一种应用软件恶意行为的动态告警方法，该方法可以包括：
步骤S101、终端监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为。
在终端上安装并运行的应用软件可能来自不同下载源，例如应用商城，该应用软件的官方网站，网页链接等，本申请并不限定。不管应用软件来源如何，如果是恶意软件则在运行时会有共同的恶意行为，可能威胁终端信息安全。例如，恶意软件可能窃取用户隐私信息，包括通话录音、短信内容、国际移动设备身份码(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)、地理位置、通讯录、浏览器历史记录等信息，然后上传到黑客控制的远程服务器；恶意软件可能发送恶意扣费短信，恶意拨打电话，拦截验证码短信；恶意软件可能通过系统漏洞获取ROOT权限，在后台静默安装其他程序，或者通过伪造成杀毒软件、提示更新等方式欺骗用户安装其他程序；恶意软件可能在后台下载大量软件，消耗用户手机流量，或者执行一些比较耗电的操作来消耗手机电量，进而影响正常的手机通信。这些恶意行为在软件实现上是通过调用函数来实现的，例如安卓(Android)操作系统中提供SmsManager.sendDataMessage函数用于发送短消息；提供DefaultHttpClient.execute函数发送超文本传输协议(Hyper Text Transfer Protocol，HTTP)请求；提供URLConnection.connect函数来连接统一资源定位符(Uniform Resource Locator，URL)；提供java.lang.Runtime.exec函数用于执行外部命令。需要说明的是，即使调用上述函数也不一定属于恶意行为，例如正常应用软件进行正常的短信验证也可能调用SmsManager.sendDataMessage函数，而恶意软件发送恶意扣费短信则会非常频繁地调用SmsManager.sendDataMessage函数。因此，终端可以通过监控应用软件调用关键函数的频率来监控该应用软件是否有恶意行为。
具体的，由于操作系统提供的可被应用软件调用的函数非常之多，许多函数的调用并不会被应用软件用于执行恶意行为，因此在本申请以下实施例中用“关键函数”一词指能够被应用软件调用以执行恶意行为的函数。
终端软件系统的开发者可以在这N个关键函数F 1、F 2、...、F N中增加相关代码，以便终端获取调用该关键函数的应用软件的标识，例如终端可以通过getpid函数获取进程标识符(Process Identifier，PID)或通过getuid函数获取用户标识符(User Identifier，UID)等。
可以理解的是，“关键函数”只是本申请实施例中所使用的一个词语，其代表的含义在本申请实施例中已经记载，其名称并不能对本申请实施例构成任何限制；另外，在本申请其他一些实施例中，“关键函数”也可以被称为例如“重要函数”、“敏感函数”、“特征函数”、“危险函数”等其他词语。
步骤S102、终端根据在预设时间内监控到上述应用软件调用N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)。
行为向量A＝(A 1,A 2,.......,A N)的第i维A i表示该应用软件调用关键函数F i的次数，其中，1≤i≤N。需要说明的是，本申请并不要求应用软件调用所有N个关键函数F 1、 F 2、...、F N，可以只调用其中的至少一个关键函数。
例如，开发者可以在发送短信SmsManager.sendDataMessage函数中增加获取应用软件的PID或UID的代码，由终端对该函数被某一应用软件调用的次数进行统计，因为调用该关键函数的行为可能涉及恶意扣费；又例如，开发者可以在系统调用的杀死进程sys_kill函数中增加获取应用软件的PID或UID的代码，由终端对该函数被某一应用软件调用的次数进行统计，因为调用该函数的行为可能涉及破坏系统。
终端可以将预设时间内每个应用软件调用N个关键函数的次数抽象为一个N维行为向量，每一维表示预设时间内该应用软件调用某一关键函数的次数，如果没有调用某一关键函数则对应维的次数统计值为0。N为应用软件可能调用的所有关键函数的数目。例如，参照图4中所示，假设得到的软件1的行为向量为A 1＝(A 11,A 12,.......,A 1N)，第一维A 11表示预设时间内软件1调用SmsManager.sendDataMessage函数的次数，第二维A 12表示预设时间内软件1调用sys_kill函数的次数。类似地，得到软件2的行为向量为A 2＝(A 21,A 22,.......,A 2N)，第一维A 21表示预设时间内软件2调用SmsManager.sendDataMessage函数的次数，第二维A 22表示预设时间内软件2调用sys_kill函数的次数，其他软件的行为向量以此类推。如果软件1在预设时间内调用SmsManager.sendDataMessage函数18次，调用sys_kill函数0次，则该软件1的行为向量可以表示为A 1＝(18,0,.......,A 1N)。
步骤S103、终端或云端基于机器学习算法，将行为向量A＝(A 1,A 2,.......,A N)输入恶意行为模型以得到该应用软件的M维结果向量B＝(B 1,B 2,......,B M)。
M<N，结果向量B＝(B 1,B 2,......,B M)的每一维对应一种恶意行为类型及其威胁等级。
如前文所述，行为向量的每一维表示预设时间内应用软件调用某一关键函数的次数，但是由于关键函数数目很多，可能多个关键函数对应一种恶意行为，并且对应一种恶意行为的不同关键函数的威胁程度也不同，不便于从关键函数角度分析应用软件的行为。
因此可以通过恶意行为模型对行为向量进行归纳总结，从而得到各个关键函数对应的恶意行为类型及其威胁等级，即结果向量。恶意行为类型可以包括例如隐私窃取、恶意扣费、破坏系统等。威胁等级指该应用软件的恶意行为的严重程度，例如可以以数字等级0-10表示。对于每个应用软件来说，其每一恶意行为类型都对应一威胁等级，例如某一恶意应用，其恶意行为类型包括隐私窃取和破坏系统，其中，隐私窃取的威胁等级为3，破坏系统的威胁等级为5。恶意行为模型为一种数学模型，是由云端根据机器学习算法对大量应用软件的行为向量和结果向量进行训练得到。结果向量的每一维表示某一恶意行为类型及其威胁等级。结果向量实际是对行为向量进行归纳总结后的降维处理结果，由于恶意行为的种类要远少于关键函数的数目，所以可以用较低维度的恶意行为类型及对应威胁等级来表示较高维度的调用关键函数的次数。
在云端训练恶意行为模型时，在云端可以构建大量真实或者模拟的终端设备系统环境，并在构建的系统环境上运行大量已知其M维结果向量(即恶意行为类型和威胁等级)的应用软件，来获取其N维行为向量，M表示恶意行为类型的数量。最后，将各应用软件的N维行为向量和M维结果向量作为训练数据对，基于机器学习算法对恶 意行为模型进行训练，最终可以得到恶意行为模型。参与训练的各应用软件的恶意行为类型和威胁等级作为输入信息是已知的，该信息可以通过第三方获取或者通过人工输入。机器学习算法可以包括决策树、逻辑回归等算法，机器学习算法适用于对已有知识的归纳。需要说明的是，还可以用其他数学方式来训练恶意行为模型，例如将每个应用软件的恶意行为类型和威胁等级分别作为一个向量，两个向量构成一个结果向量组，将每个应用软件的N维行为向量和结果向量组作为训练数据对，基于机器学习算法对恶意行为模型进行训练，最终同样可以得到恶意行为模型。
在云端训练恶意行为模型时输入的行为向量与步骤S102得到的行为向量，每一维表示相同含义，所以将步骤S102得到的行为向量输入该恶意行为模型时，得到的结果向量与在云端训练恶意行为模型时输入的结果向量每一维也可以表示相同含义。参照图5中所示，将各应用软件的N维行为向量作为恶意行为模型的输入，基于与训练恶意行为模型时相同的机器学习方法可以得到M维结果向量，M维结果向量包括各应用软件的恶意行为类型和对应的威胁等级。
例如，假设得到软件1的结果向量为B 1＝(B 11,B 12,......,B 1M)，第一维B 11表示软件1恶意扣费的威胁等级，第二维B 12表示软件1破坏系统的威胁等级。类似地，假设得到软件2的结果向量为B 2＝(B 21,B 22,......,B 2M)，第一维B 21表示软件2恶意扣费的威胁等级，第二维B 22表示软件2破坏系统的威胁等级。其他软件的结果向量以此类推。如果得到软件1的恶意扣费威胁等级为3，破坏系统的威胁等级为5，则该软件1的结果向量可以表示为B 1＝(3,5,......,B 1M)。
在本申请一些实施例中，可以由终端将该应用软件的行为向量发送给云端，由云端根据云端存储的恶意行为模型以及该应用软件的行为向量来生成应用软件的结果向量。在本申请其他一些实施例中，也可以由云端将恶意行为模型发送给终端，由终端根据恶意行为模型以及该应用软件的行为向量来生成该应用软件的结果向量。
步骤S104、终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息。
其中，每种恶意行为类型对应一个告警阈值，多种恶意行为类型对应的告警阈值可以统称为告警策略，同一恶意行为类型可以针对所有应用软件对应相同或不同的告警阈值。如果该应用软件的一个恶意行为类型的威胁等级大于等于对应告警阈值，则该终端生成告警信息。例如，假设隐私窃取的告警阈值为3，如果某一应用的隐私窃取的威胁等级大于等于3时，系统会提示告警信息，该告警信息可以显示该应用软件正在窃取隐私。
在本申请一些实施例中，如果由云端来生成应用软件的结果向量，则云端可以将该应用软件的恶意行为类型和威胁等级发送给终端，由终端结合告警策略生成告警信息。终端可以本地存储告警策略，或者，从云端获取告警策略。
告警信息可以包括：产生恶意行为的应用名称、恶意行为类型等，如果有多个恶意行为类型的威胁等级大于等于对应告警阈值，则告警信息可以包括上述多个恶意行为类型。
步骤S105、终端提示告警信息。
示例性的，参照图6中所示，完成某个应用软件的行为分析之后，终端根据云端 下发的告警策略以及该应用软件的恶意行为类型和威胁等级确定是否向用户显示告警信息。告警策略针对某一应用软件的所有恶意行为类型和威胁等级进行告警。当该应用软件的一个恶意行为类型的威胁等级大于等于对应阈值时，即可以通过GUI提示用户告警信息，当该应用软件的所有恶意行为类型的威胁等级小于对应阈值时，则不必提示用户告警信息。
例如，假设隐私窃取的初始告警阈值很低为1，由于微信在运行时可能获取用户的通讯录，如果系统判断微信该行为属于隐私窃取，并且其威胁等级大于等于1时，系统会提示告警信息，该告警信息可以显示微信正在窃取隐私。示例性的，如图7中所示，可以以消息框形式显示告警信息；或者，如图8中所示，可以在通知中心中显示告警信息；或者以其他提醒方式显示告警信息，本申请不作限定。
步骤S106、终端获取用户针对告警信息的第一反馈信息。
第一反馈信息为认可所述告警信息。
用户针对不同恶意行为的感知和倾向可能有所不同，在显示告警信息之后可以接收用户针对告警信息的反馈，用户针对告警信息的反馈包括认可或不认可针对某一应用软件的一种恶意行为的告警信息。例如，参照图7和图8中所示，用户在看到告警信息后，可以点击“接受提醒”，表示用户认可该应用软件存在窃取隐私的恶意行为的告警信息。
步骤S107、终端根据第一反馈信息保持告警信息中的恶意行为类型对应的告警阈值。
如果用户认可针对某一应用软件的一种恶意行为的告警信息，终端可以保持告警阈值不变，以便下次再有相同恶意行为时能正确告警。
步骤S108、终端获取用户针对告警信息的第二反馈信息。
其中，第二反馈信息为不认可告警信息。
例如，参照图7和图8中所示，用户在看到告警信息后，可以点击“忽略提醒”，表示用户不认可该应用软件存在窃取隐私的恶意行为的告警信息。
步骤S109、终端根据第二反馈信息提高告警信息中的恶意行为类型对应的告警阈值。
如果用户不认可针对某一应用软件的一种恶意行为的告警信息，说明当前告警阈值低于用户期望，则终端可以提高告警信息中的恶意行为类型对应的告警阈值，相当于提高了下一次该应用软件产生相同行为时提示告警信息的条件，或者，在用户一次或多次不认可针对某一应用软件的一种恶意行为的告警信息之后，停止对告警信息中的恶意行为类型进行告警。需要说明的是，可以只调整产生恶意行为的应用软件的该恶意行为类型的告警阈值，或者调整所有应用软件的该恶意行为类型的告警阈值。
云端对所有终端下发的告警策略和恶意行为模型都是一样的，通过以上方式在每个终端上都可以根据用户的反馈调整告警策略，从而适应不同用户。需要说明的是，步骤S106-S107与步骤S108-S109并没有先后执行顺序，并且本申请并不限定只能执行一次，也不限定步骤S106-S107与步骤S108-S109必须都执行，例如可以只执行一次或多次步骤S106-S107，或者，只执行一次或多次步骤S108-S109。下面举例对步骤S106-S107或步骤S108-S109执行后的效果进行说明：
例如，两个持有相同终端的用户A和用户B，在二者的终端中均安装有微信软件，如图7或图8中所示，由于微信在运行时可能获取用户的通讯录，使得二者的终端均提示告警信息“微信正在窃取您的隐私”。如果用户A对隐私比较敏感因此连续多次点击接受提醒，使得针对微信的隐私窃取的告警阈值降低；用户B对隐私不敏感或者认为可以接受微信的行为因此连续多次点击忽略提醒，使得针对微信的隐私窃取的告警阈值升高。可能在多次提醒后，微信再出现相同行为时，用户A的终端仍然会提示告警信息，而用户B的终端则会在一段时间内不再提示告警信息。
本申请实施例通过在终端设备中监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为，根据在预设时间内监控到该应用软件调用N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，行为向量的第i维A i表示应用软件调用关键函数F i的次数，1≤i≤N；终端基于机器学习算法，将行为向量输入恶意行为模型得到应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，结果向量的每一维对应一种恶意行为类型及其威胁等级；终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息，其中，每种恶意行为类型对应一个告警阈值；终端提示告警信息；终端获取用户针对告警信息的第一反馈信息，第一反馈信息为认可告警信息；终端根据第一反馈信息保持告警信息中的恶意行为类型对应的告警阈值；终端获取用户针对告警信息的第二反馈信息，第二反馈信息为不认可告警信息；终端根据第二反馈信息提高告警信息中的恶意行为类型对应的告警阈值。终端通过将应用软件调用关键函数的次数以行为向量进行数学表示，输入恶意行为模型后得到表示恶意行为类型及其威胁等级结果向量，再根据各个恶意行为类型的威胁等级和告警阈值来生成告警信息，然后根据用户对告警信息的反馈来调整告警阈值，以适应不同用户和终端，实现了动态调整针对应用软件恶意行为的告警。
在本申请另外一些实施例中，参照图9中所示，上述方法还可以包括步骤S201：
步骤S201、终端将调整后的告警策略发送给云端。
该步骤的目的在于改进云端的告警策略，如果非常多的用户针对某一应用软件的某一恶意行为类型的告警信息均选择相同的调整操作，则云端可以将告警策略按照相同方向进行调整，例如，非常多的用户都不认可针对某一应用软件的某一恶意行为类型的告警信息，说明该恶意行为类型对应的告警阈值设置过低，则云端可以提高该告警阈值。
在本申请一种实施例中，终端反馈的时间可以包括：周期性反馈，开机后反馈，关机前反馈，更新系统前反馈，每次调整告警策略之后等。
在本申请另外一些实施例中，参照图10中所示，上述方法还可以包括步骤S301和S302：
步骤S301、终端获取终端的安全性信息。
终端的安全性信息包括安全性状态和安全性要求。对于安全性状态来说，可以包括系统完整性和外部环境。可以提取终端的系统文件和文件挂载信息以验证终端的系统完整性，例如系统文件或文件挂载信息与出厂不符，表示系统可能已经被ROOT， 系统完整性被破坏，因此其安全性更低；可以根据连接Wi-Fi是否加密或是否连接USB接口等确定外部环境是否安全，例如，如果连接至未加密的Wi-Fi则安全性更低，如果连接USB接口容易被ROOT因此安全性更低等等。对于安全性要求来说，可以包括系统运行环境，例如如果系统正运行支付宝、银行类软件等进程时的安全性要求较高。通过分析终端的安全性信息能够动态调整告警策略。
步骤S302、如果终端的安全性状态较低或者安全性要求较高，则降低部分或全部恶意行为类型的告警阈值。
终端可以根据终端的安全性信息以及用户的反馈调整告警策略，从而适应不同用户的终端。
下面举例说明，根据终端的安全性信息调整告警策略，提高恶意行为判别和告警的准确度。例如，两个持有相同终端的用户A和用户B，在二者的终端中均安装有伪装成普通游戏软件的某一恶意软件，但是用户A的终端已经被ROOT或者正运行支付宝软件，可以降低恶意截录屏的告警阈值；用户B的终端未被ROOT或未运行支付宝软件。当恶意软件进行恶意截录屏时，用户A的终端可以显示提示信息，显示该恶意软件正在恶意截录屏，而用户B的终端可以不显示提示信息。
综上所述，本申请实施例提供的方案，可以有效监测终端中应用软件的执行过程，识别恶意行为类型和威胁度，根据恶意行为模型快速发现恶意行为，并对用户进行提示。还可以针对不同的用户反馈和终端安全性信息，动态调整告警策略，提高恶意行为判别和告警的准确度。另外，本申请实施例提供的方案，不局限于恶意软件的识别和告警，还可以根据用户反馈的行为特征识别用户是资深用户还是新手用户，对于资深用户可以减少提醒告警信息的频率，对于新手用户增加提醒告警信息的频率，能够达到更好的用户体验。
可以理解的是，上述终端等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
本申请实施例可以根据上述方法示例对上述终端等进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图11示出了上述实施例中所涉及的终端的一种可能的结构示意图，该终端200包括：监控单元2011、生成单元2012、获取单元2013、提示单元2014以及调整单元2015。
监控单元2011用于支持终端200执行图3、图4、图9、图10中的过程S101；生成单元2012用于支持终端200执行图3、图4、图9、图10中的过程S102，图3、图 6、图9、图10中的过程S104；获取单元2013用于支持终端200执行图3、图5、图9、图10中的过程S103，图3、图9、图10中的过程S106和S108，图10中的过程S301；提示单元2014用于支持终端200执行图3、图6、图9、图10中的过程S105；调整单元2015用于支持终端200执行图3、图9、图10中的过程S107和S109，图10中的过程S302。其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，可将上述监控单元2011、生成单元2012、获取单元2013、提示单元2014以及调整单元2015集成为处理模块。当然，终端中还可以包括存储模块、通信模块以及输入输出模块等。
此时，如图12所示，示出了上述实施例中所涉及的终端的一种可能的结构示意图。其中，处理模块2021用于对终端的动作进行控制管理。通信模块2022用于支持终端与其他网络实体例如云端服务器、其他终端等的通信。输入/输出模块2023用于接收由用户输入的信息或输出提供给用户的信息以及终端的各种菜单。存储模块2024用于保存终端的程序代码和数据。
示例性的，处理模块2021可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，GPU，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
通信模块2022可以是收发器、收发电路、输入输出设备或通信接口等。例如，通信模块2022具体可以是蓝牙装置、Wi-Fi装置、外设接口等等。
存储模块2024可以是存储器，该存储器可以包括高速随机存取存储器(RAM)，还可以包括非易失存储器，例如磁盘存储器件、闪存器件或其他易失性固态存储器件等。
输入/输出模块2023可以为触摸屏、键盘、麦克风以及显示器等输入输出设备。其中，显示器具体可以采用液晶显示器、有机发光二极管等形式来配置显示器。另外，显示器上还可以集成触控板，用于采集在其上或附近的触摸事件，并将采集到的触摸信息发送给其他器件(例如处理器等)。
当存储模块为存储器，输入/输出模块为显示器，处理模块为处理器，通信模块为通信接口时，存储器用于存储计算机执行指令，处理器与存储器耦接，当终端运行时，处理器执行存储器存储的计算机执行指令，以使终端执行如图3、图4、图5、图6、图9、图10中任一附图所述的应用软件恶意行为的动态告警方法。
本发明实施例还提供一种存储一个或多个程序的计算机存储介质，一个或多个程序包括指令，该指令当被终端执行时，使终端执行如图3、图4、图5、图6、图9、图10中任一附图所述的应用软件恶意行为的动态告警方法。
本发明实施例还提供了一种包含指令的计算机程序产品，当该计算机程序产品在终端上运行时，使得终端执行图3、图4、图5、图6、图9、图10中任一附图所述的 应用软件恶意行为的动态告警方法。
其中，本发明实施例提供的终端、计算机存储介质或者计算机程序产品均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。例如，以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (7)

  1. 一种应用软件恶意行为的动态告警方法，其特征在于，包括：
    终端监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为；
    所述终端根据在预设时间内监控到所述应用软件调用所述N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，所述行为向量A＝(A 1,A 2,.......,A N)的第i维A i表示所述应用软件调用关键函数F i的次数，1≤i≤N；
    所述终端基于机器学习算法，将所述行为向量A＝(A 1,A 2,.......,A N)输入恶意行为模型得到所述应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，所述结果向量B＝(B 1,B 2,......,B M)的每一维对应一种恶意行为类型及其威胁等级；
    所述终端对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息，其中，每种恶意行为类型对应一个告警阈值；
    所述终端提示所述告警信息；
    所述终端获取用户针对所述告警信息的第一反馈信息，所述第一反馈信息为认可所述告警信息；
    所述终端根据所述第一反馈信息保持所述告警信息中的恶意行为类型对应的告警阈值；
    所述终端获取所述用户针对所述告警信息的第二反馈信息，所述第二反馈信息为不认可所述告警信息；
    所述终端根据所述第二反馈信息提高所述告警信息中的恶意行为类型对应的告警阈值。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述终端获取所述终端的安全性信息，所述安全性信息包括安全性状态和安全性要求；
    如果所述终端的安全性状态较低或者安全性要求较高，则降低部分或全部恶意行为类型的告警阈值。
  3. 一种终端，其特征在于，包括：
    监控单元，用于监控运行的应用软件调用N个关键函数F 1、F 2、...、F N的行为；
    生成单元，用于根据所述监控单元在预设时间内监控到所述应用软件调用所述N个关键函数的次数生成N维行为向量A＝(A 1,A 2,.......,A N)，其中，所述行为向量A＝(A 1,A 2,.......,A N)的第i维A i表示所述应用软件调用关键函数F i的次数，1≤i≤N；
    获取单元，用于基于机器学习算法，将所述生成单元生成的行为向量A＝(A 1,A 2,.......,A N)输入恶意行为模型得到所述应用软件的M维结果向量B＝(B 1,B 2,......,B M)，M<N，所述结果向量B＝(B 1,B 2,......,B M)的每一维对应一种恶意行为类型及其威胁等级；
    所述生成单元，还用于对威胁等级大于或等于告警阈值的恶意行为类型生成告警信息，其中，每种恶意行为类型对应一个告警阈值；
    提示单元，用于提示所述生成单元生成的告警信息；
    所述获取单元，还用于获取用户针对所述告警信息的第一反馈信息，所述第一反 馈信息为认可所述告警信息；
    调整单元，用于根据所述获取单元获取的第一反馈信息保持所述告警信息中的恶意行为类型对应的告警阈值；
    所述获取单元，还用于获取所述用户针对所述告警信息的第二反馈信息，所述第二反馈信息为不认可所述告警信息；
    所述调整单元，还用于根据所述第二反馈信息提高所述告警信息中的恶意行为类型对应的告警阈值。
  4. 根据权利要求3所述的终端，其特征在于，
    所述获取单元，还用于获取所述终端的安全性信息，所述安全性信息包括安全性状态和安全性要求；
    所述调整单元，还用于如果所述终端的安全性状态较低或者安全性要求较高，则降低部分或全部恶意行为类型的告警阈值。
  5. 一种终端，其特征在于，包括：处理器、显示器、存储器和通信接口；
    所述存储器用于存储计算机执行指令，所述处理器与所述存储器耦接，当所述终端运行时，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述终端执行如权利要求1或2所述的应用软件恶意行为的动态告警方法。
  6. 一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，其特征在于，当所述指令在终端上运行时，使得所述终端执行如权利要求1或2所述的应用软件恶意行为的动态告警方法。
  7. 一种包含指令的计算机程序产品，其特征在于，当所述计算机程序产品在终端上运行时，使得所述终端执行如权利要求1或2所述的应用软件恶意行为的动态告警方法。
PCT/CN2018/077937 2017-11-10 2018-03-02 应用软件恶意行为的动态告警方法和终端 WO2019091028A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201880019202.7A CN110447215B (zh) 2017-11-10 2018-03-02 应用软件恶意行为的动态告警方法和终端

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711101431 2017-11-10
CN201711101431.7 2017-11-10

Publications (1)

Publication Number Publication Date
WO2019091028A1 true WO2019091028A1 (zh) 2019-05-16

Family

ID=66438224

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077937 WO2019091028A1 (zh) 2017-11-10 2018-03-02 应用软件恶意行为的动态告警方法和终端

Country Status (2)

Country Link
CN (1) CN110447215B (zh)
WO (1) WO2019091028A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113051560A (zh) * 2021-04-13 2021-06-29 北京安天网络安全技术有限公司 终端行为的安全识别方法和装置
CN114629696A (zh) * 2022-02-28 2022-06-14 天翼安全科技有限公司 一种安全检测方法、装置、电子设备及存储介质
CN114978867A (zh) * 2022-06-15 2022-08-30 中国电信股份有限公司 告警通知方法、装置、设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111783081A (zh) * 2020-06-08 2020-10-16 Oppo广东移动通信有限公司 一种恶意进程处理方法、终端设备及存储介质
CN111897630B (zh) * 2020-06-10 2023-07-18 广州杰赛科技股份有限公司 基于深度学习的设备告警知识库的构建方法和装置
CN112328977B (zh) * 2020-11-09 2024-03-22 杭州安恒信息技术股份有限公司 一种应用软件真伪检测方法、装置、设备及介质
CN113452717B (zh) * 2021-07-02 2023-02-28 安天科技集团股份有限公司 通信软件安全防护的方法、装置、电子设备及存储介质
CN115408696B (zh) * 2022-11-02 2023-04-07 荣耀终端有限公司 应用识别方法及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101140611A (zh) * 2007-09-18 2008-03-12 北京大学 一种恶意代码自动识别方法
CN102201928A (zh) * 2010-03-24 2011-09-28 中兴通讯股份有限公司 告警级别处理方法及告警服务器
CN103368904A (zh) * 2012-03-27 2013-10-23 百度在线网络技术（北京）有限公司 移动终端、可疑行为检测及判定系统和方法
WO2015113052A1 (en) * 2014-01-27 2015-07-30 Webroot Inc. Detecting and preventing execution of software exploits
CN106803037A (zh) * 2016-11-28 2017-06-06 全球能源互联网研究院 一种软件安全防护方法及装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103974259B (zh) * 2013-02-01 2017-11-03 中国电信股份有限公司 恶意扣费的防范方法、防范装置和防范系统
CN103679028A (zh) * 2013-12-06 2014-03-26 深圳酷派技术有限公司 软件行为监控方法和终端
CN104754629B (zh) * 2013-12-31 2020-01-07 中兴通讯股份有限公司 一种基站设备自愈的实现方法及装置
CN103927485A (zh) * 2014-04-24 2014-07-16 东南大学 基于动态监控的Android应用程序风险评估方法
CN104270277B (zh) * 2014-10-24 2018-07-10 深圳中兴网信科技有限公司 报警信息处理方法和报警信息处理装置
CN104462973B (zh) * 2014-12-18 2017-11-14 上海斐讯数据通信技术有限公司 移动终端中应用程序的动态恶意行为检测系统及方法
CN104598824B (zh) * 2015-01-28 2016-04-06 国家计算机网络与信息安全管理中心 一种恶意程序检测方法及其装置
CN106709342B (zh) * 2016-07-01 2018-11-09 腾讯科技（深圳）有限公司 恶意程序检测方法及装置
CN106357425A (zh) * 2016-08-26 2017-01-25 苏州华兴源创电子科技有限公司 一种网络管理代理方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101140611A (zh) * 2007-09-18 2008-03-12 北京大学 一种恶意代码自动识别方法
CN102201928A (zh) * 2010-03-24 2011-09-28 中兴通讯股份有限公司 告警级别处理方法及告警服务器
CN103368904A (zh) * 2012-03-27 2013-10-23 百度在线网络技术（北京）有限公司 移动终端、可疑行为检测及判定系统和方法
WO2015113052A1 (en) * 2014-01-27 2015-07-30 Webroot Inc. Detecting and preventing execution of software exploits
CN106803037A (zh) * 2016-11-28 2017-06-06 全球能源互联网研究院 一种软件安全防护方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113051560A (zh) * 2021-04-13 2021-06-29 北京安天网络安全技术有限公司 终端行为的安全识别方法和装置
CN113051560B (zh) * 2021-04-13 2024-05-24 北京安天网络安全技术有限公司 终端行为的安全识别方法和装置
CN114629696A (zh) * 2022-02-28 2022-06-14 天翼安全科技有限公司 一种安全检测方法、装置、电子设备及存储介质
CN114978867A (zh) * 2022-06-15 2022-08-30 中国电信股份有限公司 告警通知方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN110447215B (zh) 2021-02-12
CN110447215A (zh) 2019-11-12

Similar Documents

Publication Publication Date Title
WO2019091028A1 (zh) 应用软件恶意行为的动态告警方法和终端
US20210336780A1 (en) Key updating method, apparatus, and system
WO2018177124A1 (zh) 业务处理方法、装置、数据共享系统及存储介质
EP3200487B1 (en) Message processing method and apparatus
CN110651269A (zh) 隔离的容器事件监视
CN104580167B (zh) 一种传输数据的方法、装置和系统
WO2018153207A1 (zh) 数据处理方法、服务器、终端及系统
WO2019153479A1 (zh) 一种监听浏览器页面的方法、装置及计算机设备
CN112867988A (zh) 由移动设备实现合规设置以遵循配置场景
US11880450B2 (en) Method and apparatus for updating password of electronic device, device and storage medium
CN113821803B (zh) 安全架构系统、安全管理方法和计算设备
CN109905380A (zh) 一种分布式系统中的节点控制方法和相关装置
US20220255926A1 (en) Event-triggered reauthentication of at-risk and compromised systems and accounts
CN111539025A (zh) 一种页面展示方法、装置、电子设备及存储介质
CN116541865A (zh) 基于数据安全的密码输入方法、装置、设备及存储介质
CN113238868B (zh) 任务处理方法、装置、服务器、设备、系统及存储介质
CN110445746B (zh) cookie获取方法、装置及存储设备
US11516654B2 (en) Method for automatically encrypting short message, storage device and mobile terminal
WO2019179068A1 (zh) 风险检测方法、装置、移动终端和存储介质
US20190190951A1 (en) Honeypot adaptive security system
CN107786423B (zh) 一种即时通讯的方法和系统
CN111159738A (zh) 权限配置方法、应用登录方法及装置
CN108737341B (zh) 业务处理方法、终端及服务器
CN110166461A (zh) 用户统一标识处理方法、装置、设备及存储介质
CN113961911A (zh) 模型数据发送方法、模型数据整合方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18875614

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18875614

Country of ref document: EP

Kind code of ref document: A1