WO2021036450A1 - 一种模拟器检测方法及系统 - Google Patents

一种模拟器检测方法及系统 Download PDF

Info

Publication number
WO2021036450A1
WO2021036450A1 PCT/CN2020/097836 CN2020097836W WO2021036450A1 WO 2021036450 A1 WO2021036450 A1 WO 2021036450A1 CN 2020097836 W CN2020097836 W CN 2020097836W WO 2021036450 A1 WO2021036450 A1 WO 2021036450A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
parameters
mobile app
information
preset
Prior art date
Application number
PCT/CN2020/097836
Other languages
English (en)
French (fr)
Inventor
张�诚
陈海涛
叶国华
刘佳进
汪霄鹏
Original Assignee
苏宁云计算有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏宁云计算有限公司 filed Critical 苏宁云计算有限公司
Priority to CA3152837A priority Critical patent/CA3152837A1/en
Publication of WO2021036450A1 publication Critical patent/WO2021036450A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting

Definitions

  • the present invention relates to the field of computer technology, in particular to a simulator detection method and system.
  • the present invention provides an emulator detection method and system, which can effectively detect whether a mobile APP is running in the operating environment provided by the emulator.
  • a simulator detection method includes:
  • the SDK component obtains a plurality of preset parameters from the operating environment of the mobile APP running on the terminal and performs detection respectively, and the plurality of preset parameters include CPU architecture information, software parameters, and hardware parameters;
  • the SDK component obtains the detection results respectively corresponding to the multiple prediction parameters according to the detection, and uploads the detection results to the server;
  • the server performs a weighted calculation on all the detection results in combination with the weights corresponding to the multiple preset parameters according to a preset weight model, to obtain a weighted calculation result;
  • the server determines whether the terminal is an emulator terminal according to the weighted calculation result.
  • the software parameters include at least one of terminal identification information, mobile phone number, operator name, QEMU driver, and QEMU attributes
  • the hardware parameters include at least one of battery status, Bluetooth information, network card information, and sensor information
  • the sensor information includes sensor identification and environmental data detected by the sensor.
  • the CPU architecture information is obtained through the following process:
  • the SDK component executes assembly code pre-mapped in memory, where the assembly code includes loop jump instructions and accumulation instructions;
  • weights corresponding to the plurality of preset parameters in the weight model are preset or obtained by training using a machine learning method in advance.
  • the training process includes:
  • the SDK component For each sample terminal of a plurality of sample terminals, the SDK component is used to detect the operating environment of the mobile APP running on the sample terminal to obtain detection results corresponding to the multiple features, wherein:
  • the plurality of sample terminals include mobile terminals and simulator terminals;
  • a machine learning algorithm is used to perform weight training on the weight model, and the weights corresponding to the multiple preset parameters are obtained.
  • the method further includes:
  • the server determines that the terminal is an emulator terminal, it performs any one of the following operations:
  • an emulator detection system including a server and an SDK component built into the mobile APP, in which:
  • the SDK component is used to obtain a plurality of preset parameters from the operating environment of the mobile APP running on the terminal and respectively perform detection, and the plurality of preset parameters include CPU architecture information, software parameters, and hardware parameters;
  • the SDK component is further configured to obtain the detection results respectively corresponding to the multiple prediction parameters according to the detection, and upload the detection results to the server;
  • the server is configured to perform a weighted calculation on all the detection results in combination with the weights corresponding to the multiple preset parameters according to a preset weight model to obtain a weighted calculation result;
  • the server is further configured to determine whether the terminal is an emulator terminal according to the weighted calculation result.
  • the software parameters include at least one of terminal identification information, mobile phone number, operator name, QEMU driver, and QEMU attributes
  • the hardware parameters include at least one of battery status, Bluetooth information, network card information, and sensor information
  • the sensor information includes sensor identification and environmental data detected by the sensor.
  • the SDK component is specifically used for:
  • assembly code When the mobile APP is running, execute assembly code mapped in memory in advance, where the assembly code includes loop jump instructions and accumulation instructions;
  • weights corresponding to the plurality of preset parameters in the weight model are preset or obtained by training using a machine learning method in advance.
  • the server is specifically used for:
  • the weights corresponding to the plurality of preset parameters in the weight model are preset or obtained by training using a machine learning method in advance;
  • the server is specifically used for:
  • a plurality of preset parameters in the operating environment of the mobile APP running on the sample terminal are respectively detected through the SDK component to obtain the plurality of preset parameters.
  • a machine learning algorithm is used to perform weight training on the weight model, and the weights corresponding to the multiple preset parameters are obtained.
  • server is specifically used for:
  • a plurality of preset parameters are obtained from the operating environment of a mobile APP running on a terminal through an SDK component, and the plurality of preset parameters include software parameters, Hardware parameters and CPU architecture information, and upload the detection results corresponding to the multiple preset parameters obtained by the detection to the server, and then use the server to combine all the detection results with the weights corresponding to the multiple preset parameters according to the preset weight model. Weighted calculation results to determine whether the terminal is an emulator terminal. Because the CPU architecture information, software parameters, and hardware parameters in the mobile APP operating environment are integrated during the simulator detection process, it is possible to avoid using a single operating environment parameter for the simulator.
  • the misjudgment problem caused by detection improves the accuracy and stability of simulator detection; and, by using a pre-trained weight model to detect whether the terminal is a simulator terminal, it can effectively detect whether the mobile APP is running
  • the operating environment provided by the simulator helps prevent malicious network behaviors in mobile apps.
  • FIG. 1 is a flowchart of a simulator detection method provided by an embodiment of the present invention
  • FIG. 2a is a schematic diagram of the Cache mechanism of the ARM architecture provided by an embodiment of the present invention.
  • 2b is a schematic diagram of the Cache mechanism of the X86 architecture provided by an embodiment of the present invention.
  • 2c is a schematic diagram of the execution flow of a shellcode code segment provided by an embodiment of the present invention.
  • Fig. 3 is a structural block diagram of a simulator detection system provided by an embodiment of the present invention.
  • the present invention proposes a simulator detection method, which is applied in the simulator detection system to determine whether the mobile APP is running through the simulator, that is, whether the mobile APP is running in the operating environment provided by the simulator, wherein the simulator detection system Including the server and the SDK component (software tool development kit) built into the mobile APP.
  • the mobile APP can be any Android application, including but not limited to shopping applications, game applications, etc.
  • the mobile APP can be installed directly on the mobile terminal (For example, an Android mobile phone), it can also be implemented by using an emulator to install on a desktop terminal (for example, a desktop computer), where the server can be an independent server or a service cluster composed of multiple servers.
  • a simulator detection method is provided, which can be applied to a simulator detection system, and the method specifically includes the following steps:
  • Step 101 The SDK component obtains a plurality of preset parameters from the operating environment of the mobile APP running on the terminal and performs respective detections.
  • the plurality of preset parameters include CPU architecture information, software parameters, and hardware parameters.
  • the mobile APP is specifically an Android application.
  • the mobile APP of a mobile terminal if you want it to run on a PC, you need to use an emulator to provide it with a running environment, due to CPU architecture information, software parameters, and hardware parameters. It can characterize the operating environment of the mobile APP, so multiple preset parameters including CPU architecture information, software parameters, and hardware parameters can be obtained from the operating environment of the mobile APP, and then judged based on the obtained multiple preset parameters Whether the operating environment of the mobile APP is provided by the emulator, that is, it is detected whether the terminal is an emulator terminal or a mobile terminal.
  • the emulator terminal mentioned here refers to a terminal that uses an emulator to provide an operating environment for the mobile APP (for example, a desktop computer) ), the mobile terminal may specifically be an Android mobile phone and other terminals installed with the Android system.
  • the CPU architecture information is used to indicate whether the CPU architecture is an ARM architecture or an X86 architecture.
  • the CPU architecture is an ARM architecture or an X86 architecture.
  • the Android phones use the ARM architecture for the CPU, and a small number of models use the X86 architecture CPU.
  • the software parameters include but are not limited to device DeviceId, IMSI and other information
  • the hardware parameters include but are not limited to Bluetooth, gyroscope, gravity sensing and other information.
  • software parameters and hardware parameters can be set according to actual needs.
  • the SDK component is integrated in the mobile APP, and the SDK component is encapsulated with multiple code segments, and different code segments have different functional logic, so that different parameters can be obtained from the mobile APP operating environment and detected. That is: a code segment is used to obtain and detect a preset parameter.
  • Step 102 The SDK component obtains detection results corresponding to multiple prediction parameters according to the detection, and uploads the detection results to the server.
  • the server detects the preset parameter to obtain the detection result.
  • the CPU architecture information when the CPU architecture information is detected, if the CPU architecture information indicates that the CPU architecture is an ARM architecture, the detection result corresponding to the CPU architecture information is determined to be successful, and if the CPU architecture information indicates that the CPU architecture is an X86 architecture, the detection result is determined to be a failure .
  • the mobile phone number in the software parameters when the mobile phone number in the software parameters is detected, it can be detected whether the mobile phone number is a real mobile phone number, if it is a real mobile phone number, the detection result corresponding to the mobile phone number is determined to be successful, if it is a fake mobile phone number, the mobile phone number is determined The corresponding test result is failure.
  • the dynamic change of the environmental data can be calculated from the environmental data detected by the sensor. If it is detected, it is determined that the detection result corresponding to the sensor information is successful, otherwise it is determined The corresponding test result is failure. For example, by calculating the standard deviation of the environmental data recorded in real time when the displacement sensor is running, it can detect whether the terminal has a displacement change.
  • the SDK component can not only detect static hardware features from the hardware parameters in the operating environment of the mobile APP, but also dynamic hardware features, which can prevent the simulator from modifying the hardware configuration data of the terminal. This leads to the problem of inaccurate detection, which further improves the accuracy of subsequent simulator detection.
  • the SDK component cannot obtain a certain preset parameter from the operating environment of the mobile APP running on the terminal, it is directly determined that the detection result of the preset parameter is a failure.
  • Step 103 The server performs a weighted calculation on all the detection results in combination with the weights corresponding to the multiple preset parameters according to the preset weight model, to obtain the weighted calculation result.
  • the server can convert the detection results corresponding to each preset parameter into a number. For example, when the detection result of the preset parameter is successful, it is indicated by "1". When the detection result of the parameter is failed, it is represented by "0". In this way, the server can obtain a number sequence, and use the preset weight model to weight the corresponding weight of each preset parameter to obtain Weighted calculation result.
  • the respective weight parameters of the weight model may be preset, that is, for each preset parameter, the weight corresponding to each preset parameter is set in advance according to the importance of different preset parameters.
  • the weight corresponding to the CPU architecture information is much larger than the weight corresponding to the software parameter and the weight corresponding to the hardware parameter, and the weight corresponding to the hardware parameter is greater than the weight corresponding to the software parameter.
  • the respective weight parameters of the weight model can be obtained through the analytic hierarchy process.
  • the weights corresponding to the multiple preset parameters in the weight model may also be obtained through training using a machine learning method in advance.
  • the server may compare the weighted calculation result with the preset threshold. If the weighted calculation result exceeds the preset threshold, the terminal is determined to be an emulator terminal; otherwise, it is determined that the terminal is not an emulator terminal.
  • the preset threshold can be set according to actual needs. For example, set the threshold to 0.8.
  • a plurality of preset parameters are obtained from the operating environment of a mobile APP running on a terminal through an SDK component, and the plurality of preset parameters include software parameters and hardware parameters.
  • CPU architecture information and upload the detection results corresponding to the multiple preset parameters obtained by the detection to the server, and then use the server to perform weighting calculations on all the detection results combined with the weights corresponding to the multiple preset parameters according to the preset weight model.
  • the resulting misjudgment problem has improved the accuracy and stability of simulator detection; and, by using the pre-trained weight model to detect whether the terminal is a simulator terminal, it can effectively detect whether the mobile APP is running on the simulator.
  • the operating environment of the mobile app can help prevent malicious behaviors on the Internet in mobile apps.
  • the software parameters may include at least one of terminal identification information, mobile phone number, operator name, QEMU driver, and QEMU attributes
  • hardware parameters may include at least one of battery status, Bluetooth information, network card information, and sensor information , Where the sensor information includes sensor identification and environmental data detected by the sensor.
  • the SDK component can use a preset function to read the system configuration file of the terminal to obtain the software parameters in the running environment of the mobile APP, for example:
  • phoneNumber telephonyManager.getLine1Number()
  • the SDK component detects the preset parameters of the mobile APP
  • the preset parameter data that may be related to the user's privacy protection, such as mobile phone number and other information, usually needs to be detected with the user's permission.
  • the SDK component can read the hardware parameters of the mobile APP operating environment from the various hardware configuration files of the terminal, for example,
  • NetworkInterfaces NetworkInterface.getNetworkInterfaces().
  • Filter New intentfilter(ACTION_BATTERY_CHANGED);
  • Batterystatus registerReceiver(null,Filter);
  • Chargplug batterystatus.getintextra(extra_plugged, -1).
  • the SDK component can obtain real-time environmental data recorded by the hardware sensor while it is running, and calculate the dynamic changes of the environmental data, for example, calculate the standard deviation of the accelerator displacement time record and so on.
  • the hardware parameters in the operating environment of the mobile APP to be detected by the SDK component include not only static hardware parameters, but also dynamic hardware parameters. In this way, the accuracy of simulator detection can be further improved.
  • the SDK component obtains the CPU architecture information of the terminal, and the process may include:
  • the mobile APP When the mobile APP is running, it executes the assembly code mapped to the memory in advance, where the assembly code contains loop jump instructions and accumulation instructions;
  • the execution result of the assembly code is obtained, and the CPU architecture information is obtained according to the execution result, where the CPU architecture information is used to indicate whether the CPU architecture of the terminal is the ARM architecture or the X86 architecture.
  • the assembly code can be a shellcode code segment.
  • the loop jump instruction is used to indicate that the PC register is forcibly modified to realize the jump each time until the preset number of cycles is completed.
  • the shellcode code segment is finally injected into the Android application through the SDK component. After the shellcode code segment is executed, different execution results will be obtained on CPUs of different architectures. According to the execution results, it can be judged that the CPU architecture of the terminal is the ARM architecture. Still X86 architecture.
  • the above-mentioned SDK component obtains the CPU architecture information of the terminal based on the differences in the inherent characteristics of the hardware of different architecture versions of the CPU.
  • the technical principles are as follows:
  • FIGS. 2a and 2b The difference between the Cache mechanism of the ARM architecture and the Cache mechanism of the X86 architecture can be referred to FIGS. 2a and 2b, where FIG. 2a is a schematic diagram of the Cache mechanism of the ARM architecture, and FIG. 2b is a schematic diagram of the Cache mechanism of the X86 architecture.
  • the shellcode code segment in the SDK component is dynamically mapped to the memory, the execution permission is obtained and the execution is triggered when the mobile APP is executed.
  • This part of the code can be modified, and ARM’s I-Cache is read-only.
  • FIG. 2c is a schematic diagram of an execution flow of a shellcode code segment provided by an embodiment of the present invention.
  • the shellcode code segment is injected into the target Android program through the SDK component to be authorized to run.
  • the target Android program will trigger the shellcode execution when it is running.
  • the execution process includes: Step 1. Initialize register A and register B.
  • the shellcode executes a line of code for each line of code in register A. Add 1 to the value and add 1 to the value of register B.
  • step 2 continue to execute the shelcode line of code, the address of this line of code is Address_Y, and the value of register A increases by 1, forcibly modify the PC register , Make the code of Address_X replace the code in Address_Y; step 3, judge whether the value of register A or the value of register B is equal to the preset number of loops N, not equal to, then the loop executes step 2 until the end of the loop returns the value of register A as operation result.
  • the PC register is forcibly modified in step 2 for the ARM architecture, only the D-cache data cache is updated, but the I-cache instruction cache is not updated. As a result, the operation of the register B value that should be cyclically accumulated does not occur, and The value of register A has completed the accumulation operation.
  • the present invention by dynamically detecting whether the CPU architecture of the terminal is the ARM architecture or the X86 architecture based on the different characteristics of the cache structure between different CPU architectures, it can prevent the simulator from modifying the CPU architecture information of the terminal where the mobile APP is located. Misdetection problem.
  • the process of training the weights corresponding to the multiple preset parameters in the above-mentioned weight model using a machine learning method may include:
  • the SDK component For each of the multiple sample terminals, the SDK component detects multiple preset parameters in the operating environment of the mobile APP running on the sample terminal, and obtains the corresponding detection results of the multiple preset parameters.
  • multiple sample terminals include mobile terminals and simulator terminals;
  • a machine learning algorithm is used to perform weight training on the weight model, and weights corresponding to multiple preset parameters are obtained.
  • step 101 For the acquisition and detection process of multiple preset parameters of the aforementioned mobile APP, reference may be made to step 101 to step 102, which will not be repeated here.
  • N 50 sample terminals, including mobile terminals (such as Android phones) and emulator terminals (such as desktop computers), the corresponding mobile terminal label is 1, the emulator terminal label is 0, and for N samples
  • Each sample terminal in the terminal obtains the detection results corresponding to the multiple preset parameters of the mobile APP on the sample terminal through the SDK component and generates the training set, and uses the machine learning algorithm to perform weight training on the weight model.
  • the training ends when the number of iterations reaches the number threshold, and the weights corresponding to multiple preset parameters are obtained. In this way, the weight model obtained through training can achieve more accurate and reliable simulator prediction.
  • a small number of training samples can be used to train a weight model for the detection simulator, which is based on the trained weights.
  • the model can realize the accurate detection of the simulator.
  • the simulator detection method may further include:
  • the server determines that the terminal is an emulator terminal, it performs any of the following operations:
  • the server when the server determines that the terminal is an emulator terminal, by performing the above operations, it can effectively curb malicious network behaviors such as network scalpers, online shop ordering, game leveling, etc., using the emulator terminal. Ensure the legitimate interests of software operators and consumers.
  • an emulator detection system is provided.
  • the system includes a server 301 and an SDK component 302 built in a mobile APP, where:
  • the SDK component 302 is configured to obtain a plurality of preset parameters from the operating environment of the mobile APP running on the terminal and respectively perform detection.
  • the plurality of preset parameters include CPU architecture information, software parameters, and hardware parameters;
  • the SDK component 302 is also used to obtain detection results corresponding to multiple prediction parameters according to the detection, and upload the detection results to the server 301;
  • the server 301 is configured to perform a weighted calculation on all the detection results in combination with the weights corresponding to the multiple preset parameters according to a preset weight model to obtain a weighted calculation result;
  • the server 301 is also used to determine whether the terminal is an emulator terminal according to the weighted calculation result.
  • the software parameters include at least one of terminal identification information, mobile phone number, operator name, QEMU driver, and QEMU attributes
  • hardware parameters include at least one of battery status, Bluetooth information, network card information, and sensor information, where sensor information Including sensor identification and environmental data detected by the sensor.
  • SDK component 302 is specifically used for:
  • the mobile APP When the mobile APP is running, it executes the assembly code mapped to the memory in advance, where the assembly code contains loop jump instructions and accumulation instructions;
  • the execution result of the assembly code is obtained, and the CPU architecture information is obtained according to the execution result, where the CPU architecture information is used to indicate whether the CPU architecture of the terminal is the ARM architecture or the X86 architecture.
  • weights corresponding to the multiple preset parameters in the weight model are preset or obtained by training in advance using a machine learning method.
  • the server 301 is specifically used for:
  • the SDK component For each of the multiple sample terminals, the SDK component detects multiple preset parameters in the operating environment of the mobile APP running on the sample terminal, and obtains the corresponding detection results of the multiple preset parameters.
  • multiple sample terminals include mobile terminals and simulator terminals;
  • a machine learning algorithm is used to perform weight training on the weight model, and weights corresponding to multiple preset parameters are obtained.
  • server 301 is specifically used for:
  • the simulator detection system provided in the embodiment of the present invention belongs to the same inventive concept as the simulator detection method provided in the embodiment of the present invention, and can execute the simulator detection method provided in the embodiment of the present invention, and is equipped with corresponding methods for executing the simulator detection Functional modules and beneficial effects.
  • the simulator detection method provided in the embodiment of the present invention which will not be repeated here.
  • the embodiments in the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the embodiments of the present invention may adopt a form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. .
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Abstract

本发明公开了一种模拟器检测方法及系统，属于计算机技术领域。方法包括：SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，多个预设参数包括CPU架构信息、软件参数和硬件参数；SDK组件根据检测获得多个预测参数分别对应的检测结果，并上传至服务器；服务器根据预设的权重模型对所有检测结果结合多个预设参数分别对应的权重进行加权计算，获得加权计算结果；服务器根据加权计算结果判断终端是否为模拟器终端。本发明能够有效地检测移动APP是否运行在模拟器提供的运行环境，以预防移动APP中的网络恶意行为。

Description

一种模拟器检测方法及系统 技术领域
本发明涉及计算机技术领域，尤其涉及一种模拟器检测方法及系统。
背景技术
对于移动终端的移动APP来说，如果想要其运行在PC上，需要利用模拟器为其提供运行环境。但是由于模拟器的存在，作弊者会通过利用模拟器对移动app进行作弊和修改，进而产生网络黄牛、网店刷单、游戏代练等等网络恶意行为。
因此，如何有效地检测移动APP是否运行在模拟器提供的运行环境，成了亟需解决的问题。
发明内容
为了解决上述背景技术中提到的至少一个问题，本发明提供了一种模拟器检测方法及系统，能够有效地检测移动APP是否运行在模拟器提供的运行环境。
本发明实施例提供的具体技术方案如下：
第一方面，提供一种模拟器检测方法，所述方法包括：
SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，所述多个预设参数包括CPU架构信息、软件参数和硬件参数；
所述SDK组件根据所述检测获得所述多个预测参数分别对应的检测结果，并上传至服务器；
所述服务器根据预设的权重模型对所有所述检测结果结合所述多个预设参数分别对应的权重进行加权计算，获得加权计算结果；
所述服务器根据所述加权计算结果判断所述终端是否为模拟器终端。
进一步地，所述软件参数包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，所述硬件参数包括电池状态、蓝牙信息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
优选地，所述CPU架构信息通过如下过程得到：
在所述移动APP运行时，所述SDK组件执行预先映射到内存中的汇编代码，其中，所述汇编代码包含循环跳转指令和累加指令；
获取所述汇编代码的执行结果，并根据所述执行结果获取CPU架构信息，其中，所述CPU架构信息用于指示所述终端的CPU架构是ARM架构还是X86架构。
进一步地，所述权重模型中所述多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到。
优选地，所述训练的过程包括：
针对多个样本终端中的每一个样本终端，通过所述SDK组件对运行于所述样本终端上的所述移动APP的运行环境进行检测，获得所述多个特征分别对应的检测结果，其中，所述多个样本终端包括移动终端和模拟器终端；
根据每一个样本终端的所述多个特征分别对应的检测结果，生成训练集；
根据所述训练集，使用机器学习算法对所述权重模型进行权重训练，得到所述多个预设参数分别对应的权重。
进一步地，所述方法还包括：
所述服务器判断出所述终端为模拟器终端时，执行以下操作中的任意一个：
对所述终端上的所述移动APP的当前账号进行禁用；
对所述终端上的所述移动APP进行禁用；
向所述终端上的所述移动APP发送表征所述终端为模拟器终端的提示信息，以使所述提示信息显示在所述移动APP上。
第二方面，提供一种模拟器检测系统，包括服务器和内置于移动APP的SDK组件，其中：
所述SDK组件，用于从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，所述多个预设参数包括CPU架构信息、软件参数和硬件参数；
所述SDK组件，还用于根据所述检测获得所述多个预测参数分别对应的检测结果，并上传至所述服务器；
所述服务器，用于根据预设的权重模型对所有所述检测结果结合所述多个预设参数分别对应的权重进行加权计算，获得加权计算结果；
所述服务器，还用于根据所述加权计算结果判断所述终端是否为模拟器终端。
进一步地，所述软件参数包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，所述硬件参数包括电池状态、蓝牙信息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
优选地，所述SDK组件具体用于：
在所述移动APP运行时，执行预先映射到内存中的汇编代码，其中，所述汇编代码包含循环跳转指令和累加指令；
获取所述汇编代码的执行结果，并根据所述执行结果获取CPU架构信息，其中，所述CPU架构信息用于指示所述终端的CPU架构是ARM架构还是X86架构。
进一步地，所述权重模型中所述多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到。
优选地，所述服务器具体用于：
所述权重模型中所述多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到；
优选地，所述服务器具体用于：
针对多个样本终端中的每一个样本终端，通过所述SDK组件对运行于所述样本终端上的所述移动APP的运行环境中的多个预设参数分别进行检测，得到所述多个预设参数各自对应的检测结果，其中，所述多个样本终端包括移动终端和模拟器终端；
根据每一个所述样本终端的所述多个预设参数各自对应的检测结果，生成训练集；
根据所述训练集，使用机器学习算法对所述权重模型进行权重训练，得到所述多个预设参数分别对应的权重。
进一步地，所述服务器具体还用于：
判断出所述终端为模拟器终端时，执行以下操作中的任意一个：
对所述终端上的所述移动APP的当前账号进行禁用；
对所述终端上的所述移动APP进行禁用；
向所述终端上的所述移动APP发送表征所述终端为模拟器终端的提示信息，以使所述提示信息显示在所述移动APP上。
本发明实施例提供的一种模拟器检测方法及系统，通过SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，多个预设参数包括软件参数、硬件参数和CPU架构信息，并将检测获得的多个预设参数分别对应的检测结果上传至服务器，然后通过服务器根据预设的权重模型对所有检测结果结合多个预设参数分别对应的权重进行加权计算果，以判断终端是否为模拟器终端，由于模拟器检测过程中综合了移动APP的运行环境中的CPU架构信息、软件参数和硬件参数，能够避免单独采用一种运行环境参数进行模拟器检测而产生的误判问题，提高了模拟器检测的准确性和稳定性；并且，通过利用预先训练好的权重模型进行检测所述终端是否为模拟器终端，因此能够有效地检测移动APP是否运行在模拟器提供的运行环境，进而有助于预防移动APP中的网络恶意行为。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种模拟器检测方法的流程图；
图2a为本发明实施例提供的ARM架构的Cache机制的示意图；
图2b为本发明实施例提供的X86架构的Cache机制的示意图；
图2c为本发明实施例提供的shellcode代码段的执行流程示意图；
图3是本发明实施例提供的一种模拟器检测系统的结构框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
应当理解，在本发明的描述中，除非上下文明确要求，否则整个说明书和权利要求书中的“包括”、“包含”等类似词语应当解释为包含的含义而不是排他或穷举的含义；也就是说，是“包括但不限于”的含义。
还应当理解，术语“第一”、“第二”等仅用于描述目的，而不能理解为指示或暗示相对重要性。此外，在本发明的描述中，除非另有说明，“多个”的含义是两个或两个以上。
本发明提出了一种模拟器检测方法，应用于模拟器检测系统中，用于判断移动APP是否通过模拟器运行，即检测移动APP是否运行在模拟器提供的运行环 境，其中，模拟器检测系统包括服务器和内置于移动APP的SDK组件(软件工具开发包)，移动APP具体可以是任何的安卓应用程序，包括但不限于购物应用程序、游戏应用程序等，移动APP可以是直接安装在移动终端(例如，安卓手机)上，也可以是通过利用模拟器安装在台式终端上(例如，台式电脑)，其中，该服务器可以是独立的服务器或者是多个服务器组成的服务集群来实现。
在一个实施例中，如图1所示，提供了一种模拟器检测方法，该方法可以应用于模拟器检测系统中，该方法该模拟器检测方法具体包括如下步骤：
步骤101，SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，多个预设参数包括CPU架构信息、软件参数和硬件参数。
其中，移动APP具体为安卓应用程序，对于移动终端的移动APP来说，如果想要其运行在PC上，需要利用模拟器为其提供运行环境，由于CPU架构信息、软件参数和硬件参数等参数可以表征移动APP的运行环境，因此可以通过从移动APP的运行环境中获取包括CPU架构信息、软件参数和硬件参数在内的多个预设参数，进而基于获取到的多个预设参数来判断移动APP的运行环境是否为模拟器所提供的，即检测出终端是模拟器终端还是移动终端，这里所说的模拟器终端是指利用模拟器为移动APP提供运行环境的终端(例如，台式电脑)，移动终端具体可以是安卓手机以及安装有安卓系统的其他终端。
其中，CPU架构信息用于指示CPU架构是ARM架构还是X86架构，通常大部分的安卓手机的CPU采用ARM架构，有少量机型使用X86架构的CPU。
其中，软件参数包括但不限于设备DeviceId、IMSI等信息，硬件参数包括但不限于蓝牙、陀螺仪，重力感应等信息，在实际应用中，可以根据实际需要设定软件参数以及硬件参数。
本实施例中，SDK组件集成在移动APP中，SDK组件中封装有具有多个代码段，不同代码段具有不同的功能逻辑，实现从移动APP的运行环境中获取到不同的参数并进行检测，即：一个代码段用于获取并检测一个预设参数。
步骤102，SDK组件根据检测获得多个预测参数分别对应的检测结果，并上传至服务器。
本实施例中，对于任一预设参数，服务器获取到该预设参数后，对该预设参数进行检测得到检测结果。
其中，在CPU架构信息进行检测时，若CPU架构信息指示CPU架构是ARM架构时，确定CPU架构信息对应的检测结果为成功，若CPU架构信息指示CPU架构是X86架构时，确定检测结果为失败。
其中，在对软件参数中的手机号码进行检测时，可以检测该手机号码是否为真实手机号码，若为真实手机号码，确定手机号码对应的检测结果为成功，若为虚假手机号码，确定手机号码对应的检测结果为失败。
其中，在对硬件参数中的传感器信息进行检测时，判断是否可以从传感器所检测到的环境数据计算出环境数据的动态变化，若检测到，则确定传感器信息对应的检测结果为成功，否则确定对应的检测结果为失败。比如，通过对位移传感器运行时实时记录下来的环境数据进行标准偏差计算等，检测终端是否有位移变化。
本实施例中，SDK组件不但可以从移动APP的运行环境中的硬件参数中检测出静态的硬件特征，还可以检测出动态的硬件特征，由此可以避免模拟器通过修改终端的硬件配置数据而导致检测不准确的问题，进而进一步提高后续模拟器检测的准确性。
需要说明的是，若SDK组件从运行于终端上的移动APP的运行环境中获取不到某个预设参数时，则直接确定该预设参数的检测结果为失败。
步骤103，服务器根据预设的权重模型对所有检测结果结合多个预设参数分别对应的权重进行加权计算，获得加权计算结果。
其中，各预设参数分别对应的权重的累加之和为1。
本实施例中，服务器在获取到多个检测结果之后，可以对各个预设参数分别对应的检测结果转换为数字，例如，预设参数的检测结果为成功时，以“1”进 行表示，预设参数的检测结果为失败时，以“0”进行表示，如此，服务器可以获得一个数字序列，并对该数字序列利用预设的权重模型中各个预设参数分别对应的权重进行加权计算，得到加权计算结果。
其中，权重模型各自的权重参数可以为预先设定的，即针对每一个预设参数，预先根据不同预设参数的重要性程度依次设定各个预设参数对应的权重。于本实施例中，CPU架构信息对应的权重远大于软件参数对应的权重以及硬件参数对应的权重，硬件参数对应的权重大于软件参数对应的权重。在具体应用时，可以通过层次分析法得到权重模型各自的权重参数。此外，权重模型中多个预设参数分别对应的权重还可以为预先使用机器学习的方法训练得到的。
步骤104，服务器根据加权计算结果判断终端是否为模拟器终端。
本实施例中，服务器可以对加权计算结果与预设阈值进行比对，若加权计算结果超过预设阈值，则判定终端为模拟器终端，否则，则判定终端不是模拟器终端。其中，预设阈值可以根据实际需要进行设置。例如，设置阈值为0.8。
本发明实施例提供的一种模拟器检测方法，通过SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，多个预设参数包括软件参数、硬件参数和CPU架构信息，并将检测获得的多个预设参数分别对应的检测结果上传至服务器，然后通过服务器根据预设的权重模型对所有检测结果结合多个预设参数分别对应的权重进行加权计算果，以判断终端是否为模拟器终端，由于模拟器检测过程中综合了移动APP的运行环境中的CPU架构信息、软件参数和硬件参数，能够避免单独采用一种运行环境参数进行模拟器检测而产生的误判问题，提高了模拟器检测的准确性和稳定性；并且，通过利用预先训练好的权重模型进行检测终端是否为模拟器终端，因此能够有效地检测移动APP是否运行在模拟器提供的运行环境，进而有助于预防移动APP中的网络恶意行为。
在一个实施例中，软件参数可以包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，硬件参数可以包括电池状态、蓝牙信 息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
其中，SDK组件可以利用预设的函数读取终端的系统配置文件以获取到移动APP的运行环境中的软件参数，例如：
利用如下函数获取手机号码：
telephonyManager＝getSystemService(TELEPHONY_SERVICE)
phoneNumber＝telephonyManager.getLine1Number()
利用如下函数获取作为终端标识信息的IMSI编号：
telephonyManager＝getSystemService(TELEPHONY_SERVICE)
imsi＝telephonyManager.getSubscriberId()
利用如下函数获取运营商名：
telephonyManager＝getSystemService(TELEPHONY_SERVICE)
szOperatorName＝telephonyManager.getNetworkOperatorName()
值得注意的是，SDK组件在检测移动APP的预设参数时，对可能涉及到用户隐私保护的预设参数数据，例如手机号码等信息，通常需要在获得用户许可的情形下进行检测。
其中，SDK组件可以从终端的各个硬件配置文件读取到移动APP的运行环境的硬件参数，例如，
获取网卡相关信息：
networkinterfaces＝NetworkInterface.getNetworkInterfaces()。
检查电池温度：Filter＝New intentfilter(ACTION_BATTERY_CHANGED)；
轮询检查电量：Batterystatus＝registerReceiver(null,Filter)；
读取充电状态：Chargplug＝batterystatus.getintextra(extra_plugged,-1)。
其中，SDK组件可以实时获取硬件传感器运行时记录下来的环境数据，并计算出环境数据的动态变化，例如，对加速器位移时间记录进行标准偏差计算等等。
本发明实施例中，由于SDK组件所要检测的移动APP的运行环境中的硬件 参数，不仅仅包括静态的硬件参数，还包括动态的硬件参数，如此，可以进一步地提高模拟器检测的准确性。
在一个实施例中，SDK组件获取终端的CPU架构信息，该过程可以包括：
在移动APP运行时，执行预先映射到内存中的汇编代码，其中，汇编代码包含循环跳转指令和累加指令；
获取汇编代码的执行结果，并根据执行结果获取CPU架构信息，其中，CPU架构信息用于指示终端的CPU架构是ARM架构还是X86架构。
其中，汇编代码可以为shellcode代码段。
其中，循环跳转指令用于指示每次通过强制修改PC寄存器实现跳转，直至完成预设的循环次数。
本实施例中，通过SDK组件向安卓应用程序终注入shellcode代码段，通过执行shellcode代码段后，在不同架构CPU上会得到不一样的执行结果，根据执行结果可以判断终端的CPU架构是ARM架构还是X86架构。
上述SDK组件获取终端的CPU架构信息是基于CPU不同架构版本件硬件固有特性的差异而获取到的，其技术原理具体如下：
通常Android手机等安卓移动终端采用ARM处理器占绝大部分机型，而模拟器主要运行在X86为主的PC电脑上。ARM处理器基于—哈佛架构。ARM的一级缓存分为I-Cache(指令缓存)与D-Cahce(数据缓存)，但该架构设计不能保证I-Cache和D-Cache之间的一致性。而X86处理器基于—冯诺依曼架构，只有一块cache缓存。ARM架构的Cache机制与X86架构的Cache机制之间的区别可以参照图2a和图2b，其中，图2a为ARM架构的Cache机制的示意图，图2b为X86架构的Cache机制的示意图。
基于不同CPU架构间cache结构不一样的特性，于本实施例中，将SDK组件中的shellcode代码段动态映射到内存，获取执行权限并在移动APP执行时触发执行，在执行时，X86架构上这部分代码是可修改，而ARM的I-Cache是只读，这是因为，当往PC寄存器对应的地址写指令的时候，其实是往D-Cahce写， 而I-Cache中的指令并未被更新，这样，同样的一段程序通过其内部设有的固定次数的循环，在循环体内对数据寄存器进行累加，然后会在ARM与X86上输出不同的运行结果，就可判断出当前的CPU架构是ARM还是X86。
示例性地，参照图2c所示，图2c为本发明实施例提供的shellcode代码段的执行流程示意图。shellcode代码段通过SDK组件注入到目标Android程序中授权运行，目标Android程序在运行时会触发shellcode执行，执行流程包括：步骤1，初始化寄存器A和寄存器B，shellcode每执行一行代码，寄存器A内的值加1，寄存器B的值加1，假如此时该行代码的地址为Address_X；步骤2，继续执行shelcode代码行，该行代码的地址为Address_Y，寄存器A的值加1，强制修改PC寄存器，使Address_X的代码代替Address_Y中的代码；步骤3，判断寄存器A的值或寄存器B的值是否等于预设循环次数N，不等于，则循环执行步骤2，直至循环结束返回寄存器A的值作为运行结果。其中，步骤2中在强制修改PC寄存器时，对于ARM架构而言，仅D-cache数据缓存更新，而I-cache指令缓存未更新，如此导致应该循环累加的寄存器B值的操作未发生，而寄存器A值却完成了累加操作。
本发明实施例中，通过基于不同CPU架构间cache结构不一样的特性，动态地检测终端的CPU架构是ARM架构还是X86架构，能够避免模拟器对移动APP所在终端的CPU架构信息进行修改而导致的误测问题。
在一个实施例中，上述的权重模型中多个预设参数分别对应的权重使用机器学习的方法进行训练的过程，可以包括：
针对多个样本终端中的每一个样本终端，通过SDK组件对运行于样本终端上的移动APP的运行环境中的多个预设参数分别进行检测，得到多个预设参数各自对应的检测结果，其中，多个样本终端包括移动终端和模拟器终端；
根据每一个样本终端的多个预设参数各自对应的检测结果，生成训练集；
根据样本训练集，使用机器学习算法对权重模型进行权重训练，得到多个预设参数分别对应的权重。
其中，上述的移动APP的多个预设参数的获取以及检测过程可以参照步骤101至步骤102，此处不再加以赘述。
示例性地，确定N＝50个样本终端，包括移动终端(例如安卓手机)和模拟器终端(例如台式电脑)，对应移动终端的标签为1，模拟器终端的标签为0，对N个样本终端中的每一个样本终端，通过SDK组件获取该样本终端上的移动APP的多个预设参数分别对应的检测结果并生成训练集，使用机器学习算法对权重模型进行权重训练，当误差最小或迭代次数达到次数阈值时结束训练，得到多个预设参数分别对应的权重，这样通过训练得到的权重模型能够实现更加准确可靠地模拟器预测。
本发明实施例中，由于机器学习对训练样本的数量要求没有深度学习对训练样本的数量要求高，因此通过少量训练样本，可以训练得到用于检测模拟器的权重模型，从而基于训练好的权重模型可以实现模拟器的准确检测。
在一个实施例中，模拟器检测方法还可以包括：
服务器判断出终端为模拟器终端时，执行以下操作中的任意一个：
对终端上的移动APP的当前账号进行禁用；
对终端上的移动APP进行禁用；
向终端上的移动APP发送表征终端为模拟器终端的提示信息，以使提示信息显示在移动APP上。
本发明实施例中，在服务器判断出终端为模拟器终端时，通过执行上述操作，可以有效地遏制使用模拟器终端进行的网络黄牛、网店刷单、游戏代练等等网络恶意行为，从而确保了软件运营商及消费者的合法利益。
在一个实施例中，如图3所示，提供了一种模拟器检测系统，该系统包括服务器301和内置于移动APP的SDK组件302，其中：
SDK组件302，用于从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，多个预设参数包括CPU架构信息、软件参数和硬件参数；
SDK组件302，还用于根据检测获得多个预测参数分别对应的检测结果，并上传至服务器301；
服务器301，用于根据预设的权重模型对所有检测结果结合多个预设参数分别对应的权重进行加权计算，获得加权计算结果；
服务器301，还用于根据加权计算结果判断终端是否为模拟器终端。
进一步地，软件参数包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，硬件参数包括电池状态、蓝牙信息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
进一步地，SDK组件302具体用于：
在移动APP运行时，执行预先映射到内存中的汇编代码，其中，汇编代码包含循环跳转指令和累加指令；
获取汇编代码的执行结果，并根据执行结果获取CPU架构信息，其中，CPU架构信息用于指示终端的CPU架构是ARM架构还是X86架构。
进一步地，权重模型中多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到。
优选地，服务器301具体用于：
针对多个样本终端中的每一个样本终端，通过SDK组件对运行于样本终端上的移动APP的运行环境中的多个预设参数分别进行检测，得到多个预设参数各自对应的检测结果，其中，多个样本终端包括移动终端和模拟器终端；
根据每一个样本终端的多个预设参数各自对应的检测结果，生成训练集；
根据样本训练集，使用机器学习算法对权重模型进行权重训练，得到多个预设参数分别对应的权重。
进一步地，服务器301具体还用于：
判断出终端为模拟器终端时，执行以下操作中的任意一个：
对终端上的移动APP的当前账号进行禁用；
对终端上的移动APP进行禁用；
向终端上的移动APP发送表征终端为模拟器终端的提示信息，以使提示信息显示在移动APP上。
本发明实施例提供的模拟器检测系统，与本发明实施例所提供的模拟器检测方法属于同一发明构思，可执行本发明实施例所提供的模拟器检测方法，具备执行模拟器检测方法相应的功能模块和有益效果。未在本实施例中详尽描述的技术细节，可参见本发明实施例提供的模拟器检测方法，此处不再加以赘述。
本领域内的技术人员应明白，本发明实施例中的实施例可提供为方法、系统、或计算机程序产品。因此，本发明实施例中可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明实施例中可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明实施例中是参照根据本发明实施例中实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程 或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明实施例中的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明实施例中范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种模拟器检测方法，其特征在于，所述方法包括：
    SDK组件从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，所述多个预设参数包括CPU架构信息、软件参数和硬件参数；
    所述SDK组件根据所述检测获得所述多个预测参数分别对应的检测结果，并上传至服务器；
    所述服务器根据预设的权重模型对所有所述检测结果结合所述多个预设参数分别对应的权重进行加权计算，获得加权计算结果；
    所述服务器根据所述加权计算结果判断所述终端是否为模拟器终端。
  2. 根据权利要求1所述的方法，其特征在于，所述软件参数包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，所述硬件参数包括电池状态、蓝牙信息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
  3. 根据权利要求1所述的方法，其特征在于，所述CPU架构信息通过如下过程得到：
    在所述移动APP运行时，所述SDK组件执行预先映射到内存中的汇编代码，其中，所述汇编代码包含循环跳转指令和累加指令；
    获取所述汇编代码的执行结果，并根据所述执行结果获取CPU架构信息，其中，所述CPU架构信息用于指示所述终端的CPU架构是ARM架构还是X86架构。
  4. 根据权利要求1至3任意一项所述的方法，其特征在于，所述权重模型中所述多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到；
    优选地，所述训练的过程包括：
    针对多个样本终端中的每一个样本终端，通过所述SDK组件对运行于所述 样本终端上的所述移动APP的运行环境中的多个预设参数分别进行检测，得到所述多个预设参数各自对应的检测结果，其中，所述多个样本终端包括移动终端和模拟器终端；
    根据每一个所述样本终端的所述多个预设参数各自对应的检测结果，生成训练集；
    根据所述训练集，使用机器学习算法对所述权重模型进行权重训练，得到所述多个预设参数分别对应的权重。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述服务器判断出所述终端为模拟器终端时，执行以下操作中的任意一个：
    对所述终端上的所述移动APP的当前账号进行禁用；
    对所述终端上的所述移动APP进行禁用；
    向所述终端上的所述移动APP发送表征所述终端为模拟器终端的提示信息，以使所述提示信息显示在所述移动APP上。
  6. 一种模拟器检测系统，其特征在于，包括服务器和内置于移动APP的SDK组件，其中：
    所述SDK组件，用于从运行于终端上的移动APP的运行环境中获取多个预设参数并分别进行检测，所述多个预设参数包括CPU架构信息、软件参数和硬件参数；
    所述SDK组件，还用于根据所述检测获得所述多个预测参数分别对应的检测结果，并上传至所述服务器；
    所述服务器，用于根据预设的权重模型对所有所述检测结果结合所述多个预设参数分别对应的权重进行加权计算，获得加权计算结果；
    所述服务器，还用于根据所述加权计算结果判断所述终端是否为模拟器终端。
  7. 根据权利要求6所述的系统，其特征在于，所述软件参数包括终端标识信息、手机号码、运营商名、QEMU驱动、QEMU属性中的至少一个，所述硬 件参数包括电池状态、蓝牙信息、网卡信息、传感器信息中的至少一个，其中，传感器信息包括传感器标识以及传感器所检测到的环境数据。
  8. 根据权利要求6所述的系统，其特征在于，所述SDK组件具体用于：
    在所述移动APP运行时，执行预先映射到内存中的汇编代码，其中，所述汇编代码包含循环跳转指令和累加指令；
    获取所述汇编代码的执行结果，并根据所述执行结果获取CPU架构信息，其中，所述CPU架构信息用于指示所述终端的CPU架构是ARM架构还是X86架构。
  9. 根据权利要求6至8任意一项所述的系统，其特征在于，所述权重模型中所述多个预设参数分别对应的权重为预先设定或者预先使用机器学习的方法训练得到；
    优选地，所述服务器具体用于：
    针对多个样本终端中的每一个样本终端，通过所述SDK组件对运行于所述样本终端上的所述移动APP的运行环境中的多个预设参数分别进行检测，得到所述多个预设参数各自对应的检测结果，其中，所述多个样本终端包括移动终端和模拟器终端；
    根据每一个所述样本终端的所述多个预设参数各自对应的检测结果，生成训练集；
    根据所述训练集，使用机器学习算法对所述权重模型进行权重训练，得到所述多个预设参数分别对应的权重。
  10. 根据权利要求6所述的系统，其特征在于，所述服务器具体还用于：
    判断出所述终端为模拟器终端时，执行以下操作中的任意一个：
    对所述终端上的所述移动APP的当前账号进行禁用；
    对所述终端上的所述移动APP进行禁用；
    向所述终端上的所述移动APP发送表征所述终端为模拟器终端的提示信息，以使所述提示信息显示在所述移动APP上。
PCT/CN2020/097836 2019-08-27 2020-06-24 一种模拟器检测方法及系统 WO2021036450A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CA3152837A CA3152837A1 (en) 2019-08-27 2020-06-24 Simulator detection method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910797103.8A CN110619210A (zh) 2019-08-27 2019-08-27 一种模拟器检测方法及系统
CN201910797103.8 2019-08-27

Publications (1)

Publication Number Publication Date
WO2021036450A1 true WO2021036450A1 (zh) 2021-03-04

Family

ID=68922017

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/097836 WO2021036450A1 (zh) 2019-08-27 2020-06-24 一种模拟器检测方法及系统

Country Status (3)

Country Link
CN (1) CN110619210A (zh)
CA (1) CA3152837A1 (zh)
WO (1) WO2021036450A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114706630A (zh) * 2022-04-14 2022-07-05 上海上讯信息技术股份有限公司 一种基于文件格式识别模拟器的方法及系统

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110619210A (zh) * 2019-08-27 2019-12-27 苏宁云计算有限公司 一种模拟器检测方法及系统
CN112100615A (zh) * 2020-09-11 2020-12-18 北京明略昭辉科技有限公司 设备的识别方法及装置、存储介质、电子设备
CN112288428A (zh) * 2020-09-24 2021-01-29 咪咕文化科技有限公司 模拟器的检测方法、装置、电子设备及存储介质
CN114362980B (zh) * 2020-09-28 2023-07-28 腾讯科技（深圳）有限公司 协议挂登录账号识别方法、装置、计算机设备和存储介质
CN112468446B (zh) * 2020-11-02 2023-04-07 上海绊糖信息科技有限公司 一种保护用户隐私的移动运行环境安全检测系统
CN112559328A (zh) * 2020-12-04 2021-03-26 北京字节跳动网络技术有限公司 指令模拟引擎的判别方法、装置、设备及介质
CN112954575A (zh) * 2021-01-28 2021-06-11 歌尔科技有限公司 一种无线耳机故障检测方法、故障检测设备及无线耳机
CN112905301A (zh) * 2021-03-04 2021-06-04 中国科学院信息工程研究所 一种Android模拟器的检测方法及装置
CN113435103A (zh) * 2021-05-19 2021-09-24 深圳供电局有限公司 配电房异常检测方法、系统、服务器、边缘网关和介质
CN113613074B (zh) * 2021-07-27 2023-08-18 Oppo广东移动通信有限公司 直播场景检测方法、装置、终端及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106095927A (zh) * 2016-06-12 2016-11-09 北京三快在线科技有限公司 一种位置数据的处理方法和装置
CN106815058A (zh) * 2016-12-08 2017-06-09 同盾科技有限公司 一种模拟器的识别方法和系统
CN108064085A (zh) * 2017-12-13 2018-05-22 中国联合网络通信集团有限公司 一种无线资源分配方法及装置
CN109117250A (zh) * 2018-07-27 2019-01-01 平安科技（深圳）有限公司 一种模拟器识别方法、识别设备及计算机可读介质
CN109558739A (zh) * 2017-09-26 2019-04-02 腾讯科技（深圳）有限公司 程序运行方法、装置、终端及可读介质
CN110619210A (zh) * 2019-08-27 2019-12-27 苏宁云计算有限公司 一种模拟器检测方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6049866A (en) * 1996-09-06 2000-04-11 Silicon Graphics, Inc. Method and system for an efficient user mode cache manipulation using a simulated instruction
CN104951355B (zh) * 2015-07-03 2019-02-26 北京数字联盟网络科技有限公司 识别应用程序虚拟运行环境的方法和装置
CN107102886A (zh) * 2017-04-14 2017-08-29 北京洋浦伟业科技发展有限公司 安卓模拟器的检测方法及装置
CN107169351A (zh) * 2017-05-11 2017-09-15 北京理工大学 结合动态行为特征的Android未知恶意软件检测方法
CN108021805A (zh) * 2017-12-18 2018-05-11 上海众人网络安全技术有限公司 检测Android应用程序运行环境的方法、装置、设备及存储介质
CN109062667B (zh) * 2018-07-27 2023-04-18 平安科技（深圳）有限公司 一种模拟器识别方法、识别设备及计算机可读介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106095927A (zh) * 2016-06-12 2016-11-09 北京三快在线科技有限公司 一种位置数据的处理方法和装置
CN106815058A (zh) * 2016-12-08 2017-06-09 同盾科技有限公司 一种模拟器的识别方法和系统
CN109558739A (zh) * 2017-09-26 2019-04-02 腾讯科技（深圳）有限公司 程序运行方法、装置、终端及可读介质
CN108064085A (zh) * 2017-12-13 2018-05-22 中国联合网络通信集团有限公司 一种无线资源分配方法及装置
CN109117250A (zh) * 2018-07-27 2019-01-01 平安科技（深圳）有限公司 一种模拟器识别方法、识别设备及计算机可读介质
CN110619210A (zh) * 2019-08-27 2019-12-27 苏宁云计算有限公司 一种模拟器检测方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114706630A (zh) * 2022-04-14 2022-07-05 上海上讯信息技术股份有限公司 一种基于文件格式识别模拟器的方法及系统

Also Published As

Publication number Publication date
CA3152837A1 (en) 2021-03-04
CN110619210A (zh) 2019-12-27

Similar Documents

Publication Publication Date Title
WO2021036450A1 (zh) 一种模拟器检测方法及系统
US10346282B2 (en) Multi-data analysis based proactive defect detection and resolution
US10810115B2 (en) Systems and methods using artificial intelligence to identify, test, and verify system modifications
Hao et al. Puma: Programmable ui-automation for large-scale dynamic analysis of mobile apps
US20200410460A1 (en) Method and system for assessing future execution of a smart contract based on previous executions on a blockchain-based platform
US9519495B2 (en) Timed API rules for runtime verification
CN101964036B (zh) 漏洞检测方法及装置
US20160381057A1 (en) Customized Network Traffic Models To Detect Application Anomalies
CN107729749A (zh) 结合系统信息和硬件特性的安卓模拟器检测方法及装置
US20100146340A1 (en) Analyzing Coverage of Code Changes
US9921827B1 (en) Developing versions of applications based on application fingerprinting
CN102402479B (zh) 用于静态分析的中间表示结构
CN108804918B (zh) 安全性防御方法、装置、电子设备及存储介质
Sanz et al. Anomaly detection using string analysis for android malware detection
CN107392018A (zh) 应用程序脱壳方法及装置
CN112799940A (zh) 回归测试方法、装置、计算机系统和计算机可读存储介质
CN110580222A (zh) 一种软件测试用例生成方法及系统
Sanz et al. Instance-based anomaly method for Android malware detection
US20170300318A1 (en) Identifying low-quality code
US20160085664A1 (en) Generating a fingerprint representing a response of an application to a simulation of a fault of an external service
US20140107995A1 (en) Partitioning and parallel processing of a virtual prototype simulation of a hardware design
Liu et al. Exploring sensor usage behaviors of android applications based on data flow analysis
US20230259631A1 (en) Detecting synthetic user accounts using synthetic patterns learned via machine learning
US11934533B2 (en) Detection of supply chain-related security threats to software applications
US10521330B2 (en) Simulation of authorization checks using a debugger

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20859400

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 3152837

Country of ref document: CA

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20859400

Country of ref document: EP

Kind code of ref document: A1