WO2021243555A1

WO2021243555A1 - Quick application test method and apparatus, device, and storage medium

Info

Publication number: WO2021243555A1
Application number: PCT/CN2020/093913
Authority: WO
Inventors: 汪泽宇
Original assignee: 深圳市欢太科技有限公司; Oppo广东移动通信有限公司
Priority date: 2020-06-02
Filing date: 2020-06-02
Publication date: 2021-12-09
Also published as: CN115552401A

Abstract

Disclosed in the present application are a quick application test method and apparatus, a device, and a storage medium. The method comprises: acquiring an installation package of at least one quick application to be tested; acquiring test rules configured for the at least one quick application in advance; and performing security test on the at least one quick application on the basis of the test rules to obtain a test result, wherein the test for the quick application comprises static test and/or dynamic test, such that automatic batch test for quick applications is achieved by means of the preset test rules, which comprise static test rules and/or dynamic test rules, thereby quickly locating quick applications having security vulnerabilities, thus improving quick application security test efficiency.

Description

Fast application detection method, device, equipment and storage medium

Technical field

This application relates to the field of computer technology, and in particular to a fast application detection method, device, equipment and storage medium.

Background technique

Quick app is a new type of Android application form jointly formulated by the nine major mobile phone manufacturers. Users do not need to install it, just click and use. Quick application is divided into two parts: quick application rpk and quick application platform, where rpk is a file format of the quick application installation package.

At present, there are no automated tools and solutions for the security vulnerabilities and privacy compliance detection of fast apps. The security and privacy compliance detection of JS (JavaScript) code files are manually performed only by unpacking the rpk, or installing the rpk on the real machine and Run, check security vulnerabilities and privacy compliance through debugging and packet capture. JavaScript is a programming language used by KuaiApp.

However, manual static auditing of code, dynamic debugging, and packet capture cannot be automated batch implementation, and the efficiency is low. These two methods are basically completed by manual participation, so the quality of the test results completely depends on the experience and technical level of the test personnel, and the results may also have the problem of missed test and missed report.

Summary of the invention

In order to solve the foregoing technical problems, embodiments of the present application provide a fast application detection method, device, equipment, and storage medium.

In the first aspect, an embodiment of the present application provides a fast application detection method, wherein the method includes:

Obtain the installation package of at least one quick application to be detected;

Acquiring a detection rule configured for the at least one fast application in advance;

Based on the detection rule, perform security detection on the at least one fast application to obtain a detection result; wherein the detection of the fast application includes static detection and/or dynamic detection.

In the second aspect, an embodiment of the present application provides a fast application detection device, wherein the device includes:

An obtaining part, configured to obtain an installation package of at least one quick application to be detected; and obtain a detection rule configured for the at least one quick application in advance;

The detection part is configured to perform security detection on the at least one fast application to obtain a detection result based on the detection rule; wherein the detection of the fast application includes static detection and/or dynamic detection.

The embodiments of the present application provide a fast application detection method, device, device, and storage medium. The method includes: obtaining an installation package of at least one fast application to be detected; obtaining a detection rule configured for the at least one fast application in advance; Based on the detection rule, perform security detection on the at least one fast application to obtain a detection result; wherein the detection of the fast application includes static detection and/or dynamic detection. In this way, through pre-set detection rules, including static detection rules and/or dynamic detection rules, automatic batch detection of fast applications is realized according to the detection rules, so that fast applications with security vulnerabilities can be quickly located, and the security detection efficiency of fast applications can be improved .

Description of the drawings

FIG. 1 is a schematic flowchart of a fast application detection method in an embodiment of the present application;

2 is a schematic diagram of the first process of the fast application static detection method in an embodiment of this application;

FIG. 3 is a schematic diagram of the composition framework of the static detection principle in an embodiment of the application;

4 is a schematic diagram of the second process of the fast application static detection method in an embodiment of the application;

FIG. 5 is a schematic flowchart of a fast application dynamic detection method in an embodiment of this application;

FIG. 6 is a schematic diagram of the composition structure of a fast application detection device in an embodiment of the application;

FIG. 7 is a schematic diagram of the composition structure of a fast application detection device in an embodiment of the application;

FIG. 8 is a schematic block diagram of a chip provided by an embodiment of the present application.

detailed description

In order to have a more detailed understanding of the characteristics and technical content of the embodiments of the present application, the implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings. The attached drawings are for reference and description purposes only, and are not used to limit the embodiments of the present application.

The embodiment of the present application provides a fast application detection method. As shown in FIG. 1, the fast application detection method specifically includes:

Step 101: Obtain an installation package of at least one quick application to be detected;

Here, fast application is a new application ecosystem jointly launched by multiple mobile terminal manufacturers based on the hardware platform. Users do not need to download and install, click and use, and enjoy the performance experience of native applications.

For ordinary applications (Application, APP), users first need to know the role of APP. For example, gourmet apps such as APP1 and APP2 can find food, and then they need to download and install these apps in the application market, then open these apps and search for "pizza". With "Quick App", after you get a new phone, you don't need to know which App can help you find food, and you don't need to download that App. You only need to pull down the desktop to open the search box and enter "Pizza", that is The corresponding services can be easily obtained.

In actual applications, KuaiApp needs to test the security of KuaiApp before it is put on the app store, for example, whether KuaiApp can resist malicious network attacks, or whether it is compliant with user privacy management, etc. Therefore, a background detection device is established based on the quick application detection method of the present application, and the background detection device obtains the installation package of at least one quick application to be detected, and performs batch detection on the quick application. Here, the installation package of KuaiApp can be an rpk package, and rpk is a file format of the installation package of KuaiApp.

In practical applications, the quick application can run on a mobile terminal, and the mobile terminal can be a terminal with networking functions. The terminals described in this application can include such as mobile phones, tablet computers, notebook computers, handheld computers, and personal digital assistants (Personal Digital Assistant, PDA), Portable Media Player (PMP), navigation devices, wearable devices, smart bracelets, cameras, etc.

Step 102: Obtain a detection rule configured for the at least one fast application in advance;

In practical applications, the fast application detection includes static detection and/or dynamic detection. Correspondingly, the detection rules also include: a first detection rule for static detection and/or a second detection rule for dynamic detection.

In practical applications, static detection refers to analysis without executing binary programs, such as disassembly analysis, source code analysis, binary statistical analysis, decompilation, etc., which belong to reverse engineering analysis methods.

The first detection rule may be determined based on the known security vulnerabilities of the existing quick application or other common applications. For example, perform source code analysis on fast apps or other common apps with security vulnerabilities, determine the key source code that causes security problems and the types of security vulnerabilities, use this part of the source code as the identification information of this type of security vulnerabilities, and establish the first detection rule.

In practical applications, dynamic detection is to simulate the running process of a fast application, by detecting the interactive content between the terminal and the network side or other terminals when the fast application is running, to obtain known dynamic behavior characteristics that cause security problems. That is, the second detection rule may be to determine the known dynamic operating characteristics based on the dynamic operating behavior of the existing fast application or other ordinary applications that cause safety issues during the running process, and use the known dynamic operating characteristics to establish the second detection rule.

Step 103: Based on the detection rule, perform security detection on the at least one fast application to obtain a detection result; wherein the detection of the fast application includes static detection and/or dynamic detection.

Here, the detection rules are the detection rules preset by the detection personnel based on existing security issues, privacy non-compliance issues, etc. After the detection device obtains the installation package and detection rules of Quick App, it can be selected according to different installation packages or different detection types. Corresponding detection rules are used to detect fast-applied detection packets.

In some embodiments, when performing static detection on the fast application, the detection rule includes a first detection rule for static detection;

Correspondingly, the performing security detection on the at least one quick application to obtain a detection result based on the detection rule includes: parsing an installation package of the at least one quick application, and extracting the pending detection of the at least one quick application File; based on the first detection rule, static detection is performed on the file to be detected of the at least one fast application at the same time to obtain a static detection result; based on the static detection result of the at least one fast application, it is determined whether the at least one fast application There is a security breach.

That is to say, static detection is to determine whether there is a source code matching the first detection rule in the source code by statically scanning the source code, and if it exists, it is determined that the fast application has a security vulnerability.

In some embodiments, when performing dynamic detection on the fast application, the detection rule includes a second detection rule for dynamic detection;

Correspondingly, the performing security detection on the at least one fast application to obtain a detection result based on the detection rule includes:

The installation package of the at least one fast application is dynamically run in the virtual machine, the network request information of the fast application is monitored, and the dynamic behavior characteristics of the at least one fast application are obtained; based on the second detection rule, the at least one A dynamic behavior feature of a fast application is detected to obtain a dynamic detection result; based on the dynamic detection result of the at least one fast application, it is determined whether the at least one fast application has a security vulnerability.

That is to say, dynamic detection is to simulate the running process of the fast application, by detecting the interactive content between the terminal and the network side or other terminals when the fast application is running, to obtain the dynamic behavior characteristics of the fast application. It is determined whether there is a dynamic behavior feature that matches the second detection rule in the dynamic behavior feature, and if it exists, it is determined that the fast application has a security vulnerability.

In some embodiments, the method further includes: updating the detection rule according to a preset update strategy; wherein the update strategy includes at least one of the following: delete, add, and replace.

In actual applications, with the escalating variants of fast application security threats, the embodiments of the present application also include updating detection rules to adapt to the current security threat environment. Specifically, delete old detection rules, add new detection rules, and replace old detection rules.

Here, the execution subject of step 101 to step 103 may be the processor of the fast application detection device.

By adopting the above technical solution, automated batch detection of fast applications can be realized, including batch static detection and batch dynamic detection, saving a lot of manual operations, thereby quickly locating fast applications with security vulnerabilities, and improving the efficiency of security detection of fast applications.

On the basis of the above-mentioned embodiments of the present application, the static detection method of fast application is further exemplified. FIG. 2 is a schematic diagram of the first process of the fast application static detection method in an embodiment of the application. As shown in FIG. 2, the static detection method specifically includes:

Step 201: Obtain an installation package of at least one quick application to be detected;

In actual applications, KuaiApp needs to test the security of KuaiApp before it is put on the app store, for example, whether KuaiApp can resist malicious network attacks, or whether it is compliant with user privacy management, etc. Therefore, a background detection device is established based on the quick application detection method of the present application, and the background detection device obtains an installation package of at least one quick application to be detected. Here, the installation package of KuaiApp can be an rpk package, and rpk is a file format of the installation package of KuaiApp.

Step 202: Obtain a first detection rule configured for the at least one fast application in advance;

For example, the first detection rule includes identification information of at least one security vulnerability, and the identification information is used to indicate static behavior characteristics of the security vulnerability. For example, the identification information includes a single keyword or a logical combination of multiple keywords with a context relationship. If the identification information is a single keyword, it means that the security vulnerability can be represented by one keyword. If the identification information is multiple keys The logical combination of words indicates that there needs to be a certain context relationship between multiple lines of code in the source code of the security vulnerability, and it can be determined whether the fast application contains the security vulnerability according to the context relationship.

Exemplarily, the identification information of the first type of security vulnerability includes keyword 1, and the identification information of the second type of security vulnerability includes: keyword combination 1, which includes keyword 2, keyword 3, and keyword 4. And the logical relationship between each keyword.

Step 203: parse the installation package of the at least one quick application, and extract the file to be detected of the at least one quick application;

In some embodiments, the installation package of the at least one quick application is parsed, and all files of each quick application and the index identification of the file to be detected are extracted; based on the index identification of the file to be detected, from each quick application Determine the file to be detected among all the files in.

It should be noted that the installation package contains the first-type code files that implement the quick application function and the second-type code files inherent in the quick application framework. In actual applications, security vulnerabilities will only appear in the first type of code files, and no security vulnerabilities will appear when running the second type of code files. Therefore, we only need to perform a static scan on the first type of code file, so it is necessary to use the index mark of the first type of code file (that is, the file to be detected) to index to the first type of code file.

In actual applications, extract the JS file and manifest.xml file in the rpk package, determine the target JS file name to be scanned by parsing the routing configuration (ie index information) in the manifest.xml, and then load the rule configuration file and parse the first One detection rule.

Step 204: Based on the first detection rule, perform static detection on the file to be detected of the at least one fast application at the same time to obtain a static detection result;

In practical applications, the first detection rule includes identification information of at least one security vulnerability;

Correspondingly, based on the first detection rule, performing static detection on the file to be detected of the at least one quick application to obtain a static detection result at the same time includes: performing identification information corresponding to the file to be detected with the target security vulnerability Matching; wherein the target security vulnerability is any one of the security vulnerabilities in the first detection rule; if it matches, it is determined that the target security vulnerability exists in the file to be detected, and the matching file in the file to be detected is obtained Code line number; if it does not match, it is determined that the target security vulnerability does not exist in the file to be detected.

In actual applications, the background service device delivers the rpk package to the detection engine for detection, and the detection engine is used to detect the rpk package to generate a static detection report. Specifically, the detection engine loads the rule configuration file and parses the first detection rule, and matches the identification information of the different security vulnerabilities in the first detection rule with the file to be detected to obtain the matching result; when there is a match in the identification information, the detection The engine records the matching identification information number and JS code line number. After all JS files are scanned, the detection engine outputs the scanning results according to the recorded identification information number and JS code line number.

Here, the identification information number is used to locate the type of security vulnerability, and the JS code line number is used to locate the code location that brings the security vulnerability in the rpk package, which not only enables the inspector to quickly determine the type of security vulnerability in the fast application, but also enables the inspector Quickly locate the specific code location to facilitate the later upgrade and rectification of fast applications, improve the development efficiency of fast applications, and shorten the listing cycle.

Figure 3 is a schematic diagram of the composition framework of the static detection principle in the embodiment of the application. As shown in Figure 3, before the fast app is put on the app store, the background detection device obtains the rpk package of the fast app provided by the fast app developer, and the background service device will The rpk package is sent to the detection engine for detection. The detection engine parses the rpk package and extracts the key JS files in the rpk package; reads the detection rules in the configuration file that has been configured in advance, and parses the detection rules. According to the detection rules, the extracted fast application JS files are statically scanned, and a detection report is generated. When there are multiple fast applications to be detected, the background detection device pulls up multiple detection engines to perform parallel static scanning of the JS code files of multiple fast applications, generate detection reports, and realize batch static scanning of fast applications.

It should be noted that if the identification information is a single keyword, the code line number is the line number of a line of code; if the identification information is a logical combination of multiple keywords, the code line number may be the line number of multiple lines of code.

Step 205: Based on the static detection result of the at least one fast application, determine whether the at least one fast application has a security vulnerability.

Specifically, according to the static detection result, the target fast application stored in the security vulnerability is determined from at least one fast application, and the code positions corresponding to different security vulnerabilities in the target fast application are determined.

In some embodiments, the method further includes: updating the first detection rule according to a preset update strategy; wherein, the update strategy includes at least one of the following: delete, add, and replace.

A more specific detection process is provided on the basis of the above-mentioned quick application static detection method. FIG. 4 is a schematic diagram of the second process of the quick application static detection method in an embodiment of this application. As shown in FIG. 4, the static detection method Specifically:

Step 401: Start;

Step 402: Parse the rules;

Specifically, the detection engine loads the rule configuration file and parses the first detection rule.

Step 403: Parse the rpk package:

Step 404: Read the manifest.xml file;

The Manifest Android development file name belongs to the AndroidManifest.xml file, which presents important information in a simple Android system application. It can run any application code. Every Android application must have an AndroidManifest.xml file in the app/manifests directory. It presents important information in a simple Android system application, and the information system must have the code before it can run any application. Manifest names the Java package of the application, and the package name serves as a unique identifier for the application.

In other words, the manifest.xml file is used as the index information of the target JS file to be detected, and the name of the target JS file to be scanned is determined by parsing the routing configuration (ie index information) in the manifest.xml.

Step 405: Extract the target JS file;

Step 406: Scan the target JS file according to the analysis result of the first rule;

Step 407: Judge it to reach the end, if yes, go to step 410; if not, go to step 408;

Step 408: Judge whether it matches, if yes, go to step 409; if not, go to step 406;

Specifically, the detection engine matches the identification information of different security vulnerabilities in the first detection rule with the file to be detected to obtain a matching result; when there is a matching of identification information, the detection engine records the matching identification information number and JS code line No. After scanning all JS files, the detection engine outputs the scanning results according to the recorded identification information number and JS code line number.

Step 409: Record the matching result;

Here, the matching result includes: identification information number and JS code line number.

Step 410: Generate a test report;

In other words, if all target JS files in the fast app have been scanned, the detection result will be generated.

Step 411: End.

By adopting the above technical solution, it is possible to realize automatic batch static detection of fast applications, save a lot of manual operations, so as to quickly locate fast applications with security vulnerabilities, and improve the safety detection efficiency of fast applications.

On the basis of the above-mentioned embodiments of the present application, the dynamic detection method of fast application is further exemplified. Fig. 5 is a schematic flow chart of a fast application dynamic detection method in an embodiment of the application. As shown in Fig. 5, the dynamic detection method specifically includes:

Step 501: Obtain an installation package of at least one quick application to be detected;

Step 502: Obtain a second detection rule configured in advance for the at least one fast application;

Dynamic detection is to simulate the running process of the fast application, by detecting the interactive content of the terminal and the network side or other terminals when the fast application is running, to obtain the dynamic behavior characteristics of the fast application. It is determined whether there is a dynamic behavior feature that matches the second detection rule in the dynamic behavior feature, and if it exists, it is determined that the fast application has a security vulnerability.

Step 503: Dynamically run the installation package of the at least one fast application in the virtual machine, monitor the network request information of the fast application, and obtain the dynamic behavior characteristics of the at least one fast application;

The dynamic behavior characteristics of fast apps specifically represent at least one of the following: scanning system status, obtaining system permissions, registry operations, self-deleting operations, encryption and decryption, process/thread behaviors, file operations, and network access behaviors.

Step 504: Based on the second detection rule, detect the dynamic behavior feature of the at least one fast application to obtain a dynamic detection result;

In practical applications, the second detection rule includes at least one dynamic behavior characteristic of security vulnerabilities;

Correspondingly, the performing security detection on the at least one fast application based on the detection rule to obtain a detection result includes: matching the dynamic behavior feature of the fast application with the dynamic behavior feature of the target security vulnerability; wherein, The target security vulnerability is any security vulnerability in the second detection rule; if it matches, it is determined that the fast application has the target security vulnerability; if it does not match, it is determined that the fast application does not have the target security vulnerability .

Exemplarily, the installation package code is dynamically executed in a virtual machine (Virtual Machine, VM), the state changes during the running process are monitored, and the operation of key events in the system is intercepted by using HOOK. Here, HOOK is an important carrier of Windows system message transmission. The HOOK function provides an interface for message calling, intercepts the calling process between events, and forwards it to the corresponding API interface after processing. At this time, set user-defined HOOK in the operating system to monitor system behavior and realize dynamic monitoring.

In practical applications, the dynamic behavior characteristics of security vulnerabilities also specifically represent at least one of the following: scanning system status, obtaining system permissions, registry operations, self-deleting operations, encryption and decryption, process/thread behaviors, file operations, and network access behaviors.

Step 505: Based on the dynamic detection result of the at least one fast application, determine whether the at least one fast application has a security vulnerability.

When the dynamic detection result characterizes the security vulnerabilities of the target fast application, the type and number of the security vulnerabilities of the target fast application are determined.

In some embodiments, the method further includes: updating the second detection rule according to a preset update strategy; wherein, the update strategy includes at least one of the following: delete, add, and replace.

By adopting the above technical solution, it is possible to realize automatic batch dynamic detection of fast applications, save a lot of manual operations, so as to quickly locate fast applications with security vulnerabilities, and improve the safety detection efficiency of fast applications.

In order to implement the method of the embodiment of the present application, based on the same inventive concept, the embodiment of the present application also provides a fast application detection device. As shown in FIG. 6, the device includes:

The obtaining part 601 is configured to obtain an installation package of at least one quick application to be detected; and obtain a detection rule configured for the at least one quick application in advance;

The detection part 602 is configured to perform security detection on the at least one fast application to obtain a detection result based on the detection rule; wherein the detection of the fast application includes static detection and/or dynamic detection.

The detection part 602 is specifically configured to parse the installation package of the at least one quick application, and extract the file to be detected of the at least one quick application; The file is simultaneously subjected to static detection to obtain a static detection result; based on the static detection result of the at least one fast application, it is determined whether the at least one fast application has a security vulnerability.

In some embodiments, the detection part 602 is specifically configured to parse the installation package of the at least one quick application, extract all files of each quick application and the index identification of the file to be detected; based on the index of the file to be detected Identification, to determine the file to be detected from all files of each quick application.

In some embodiments, the first detection rule includes identification information of at least one security vulnerability;

The detection part 602 is specifically configured to match the identification information corresponding to the target security vulnerability with the file to be detected; wherein the target security vulnerability is any security vulnerability in the first detection rule; if it matches, determine The file to be detected has the target security vulnerability, and the matching code line number in the file to be detected is obtained; if it does not match, it is determined that the file to be detected does not have the target security vulnerability.

The detection part 602 is specifically configured to dynamically run the installation package of the at least one fast application in a virtual machine, monitor the network request information of the fast application, and obtain the dynamic behavior characteristics of the at least one fast application; based on the second The detection rule detects the dynamic behavior characteristics of the at least one fast application to obtain a dynamic detection result; based on the dynamic detection result of the at least one fast application, it is determined whether the at least one fast application has a security vulnerability.

In some embodiments, the second detection rule includes at least one dynamic behavior characteristic of a security vulnerability;

The detection part 602 is specifically configured to match the dynamic behavior characteristics of the fast application with the dynamic behavior characteristics of the target security vulnerability; wherein the target security vulnerability is any security vulnerability in the second detection rule; if Matching, it is determined that the fast application has the target security vulnerability; if it does not match, it is determined that the fast application does not have the target security vulnerability.

In some embodiments, the device further includes: an update part configured to update the detection rule according to a preset update strategy; wherein the update strategy includes at least one of the following: delete, add, and replace.

Based on the hardware implementation of each part of the fast application detection device, an embodiment of the present application also provides a fast application detection device. As shown in FIG. 7, the device includes a processor 701 and a storage device configured to run on the processor. Memory 702 of the computer program;

Wherein, the processor 701 is configured to execute the method steps in the foregoing embodiment when it is configured to run a computer program.

Of course, in actual application, as shown in FIG. 7, the various components in the device are coupled together through the bus system 703. It can be understood that the bus system 703 is used to implement connection and communication between these components. In addition to the data bus, the bus system 703 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear description, various buses are marked as the bus system 703 in FIG. 7.

An embodiment of the present application provides a computer storage medium, where the computer storage medium stores computer-executable instructions, and when the computer-executable instructions are executed, the method steps of the foregoing embodiment 1 or 2 are implemented.

If the above-mentioned device in the embodiment of the present application is implemented in the form of a software function module and sold or used as an independent product, it may also be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product in essence or a part that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for A computer device (which may be a personal computer, a server, or a network device, etc.) executes all or part of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, Read Only Memory (ROM, Read Only Memory), magnetic disk or optical disk and other media that can store program codes. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

An embodiment of the present application also provides a chip, which is used to implement the above-mentioned fast application detection method of the present application. FIG. 8 is a schematic structural diagram of the chip of the embodiment of the present application. The chip 800 shown in FIG. 8 includes a processor 810, and the processor 810 can call and run a computer program from the memory to implement the method in the embodiment of the present application.

Optionally, as shown in FIG. 8, the chip 800 may further include a memory 820. The processor 810 may call and run a computer program from the memory 820 to implement the method in the embodiment of the present application.

The memory 820 may be a separate device independent of the processor 810, or may be integrated in the processor 810.

Optionally, the chip 800 may further include an input interface 830. The processor 810 can control the input interface 830 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.

Optionally, the chip 800 may further include an output interface 840. The processor 810 can control the output interface 840 to communicate with other devices or chips, and specifically, can output information or data to other devices or chips.

Optionally, the chip can be applied to the fast application detection device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, details are not described herein again.

It should be understood that the chips mentioned in the embodiments of the present application may also be referred to as system-level chips, system-on-chips, system-on-chips, or system-on-chips.

Correspondingly, an embodiment of the present application further provides a computer storage medium in which a computer program is stored, and the computer program is configured to execute the data scheduling method of the embodiment of the present application.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence.

The methods disclosed in the several method embodiments provided in this application can be combined arbitrarily without conflict to obtain new method embodiments.

The features disclosed in the several product embodiments provided in this application can be combined arbitrarily without conflict to obtain new product embodiments.

The features disclosed in the several method or device embodiments provided in this application can be combined arbitrarily without conflict to obtain a new method embodiment or device embodiment.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Industrial applicability

The quick application detection solution provided by this application implements automatic batch detection of quick applications according to the detection rules through preset detection rules, including static detection rules and/or dynamic detection rules, so as to quickly locate fast applications with security vulnerabilities. Improve the safety detection efficiency of fast applications.

Claims

A fast application detection method, wherein the method includes:

Obtain the installation package of at least one quick application to be detected;

Acquiring a detection rule configured for the at least one fast application in advance;

Based on the detection rule, perform security detection on the at least one fast application to obtain a detection result; wherein the detection of the fast application includes static detection and/or dynamic detection.
The method according to claim 1, wherein, when performing static detection on the fast application, the detection rule includes a first detection rule for static detection;

The performing security detection on the at least one fast application to obtain a detection result based on the detection rule includes:

Parse the installation package of the at least one quick application, and extract the file to be detected of the at least one quick application;

Based on the first detection rule, perform static detection on the file to be detected of the at least one fast application at the same time to obtain a static detection result;

Based on the static detection result of the at least one fast application, it is determined whether the at least one fast application has a security vulnerability.
The method according to claim 2, wherein the parsing the installation package of the at least one quick application and extracting the file to be detected of the at least one quick application comprises:

Parse the installation package of the at least one quick application, and extract all the files of each quick application and the index identification of the file to be detected;

Based on the index identification of the file to be detected, the file to be detected is determined from all files of each fast application.
The method according to claim 2, wherein the first detection rule includes identification information of at least one security vulnerability;

The performing static detection on the file to be detected of the at least one quick application based on the first detection rule to obtain a static detection result at the same time includes:

Matching the identification information corresponding to the target security vulnerability with the file to be detected; wherein the target security vulnerability is any security vulnerability in the first detection rule;

If they match, determine that the target security vulnerability exists in the file to be detected, and obtain the matching code line number in the file to be detected;

If it does not match, it is determined that the target security vulnerability does not exist in the file to be detected.
The method according to claim 1, wherein, when the fast application is dynamically detected, the detection rule includes a second detection rule for dynamic detection;

The performing security detection on the at least one fast application to obtain a detection result based on the detection rule includes:

Dynamically running the installation package of the at least one fast application in a virtual machine, monitoring the network request information of the fast application, and obtaining the dynamic behavior characteristics of the at least one fast application;

Based on the second detection rule, detecting the dynamic behavior feature of the at least one fast application to obtain a dynamic detection result;

Based on the dynamic detection result of the at least one fast application, it is determined whether the at least one fast application has a security vulnerability.
The method according to claim 5, wherein the second detection rule includes at least one dynamic behavior characteristic of a security vulnerability;

The detecting the dynamic behavior feature based on the second detection rule to obtain a dynamic detection result includes:

Matching the dynamic behavior characteristics of the fast application with the dynamic behavior characteristics of the target security vulnerability; wherein the target security vulnerability is any security vulnerability in the second detection rule;

If it matches, it is determined that the fast application has the target security vulnerability;

If it does not match, it is determined that the fast application does not have the target security vulnerability.
The method according to claim 1, wherein the method further comprises:

The detection rule is updated according to a preset update strategy; wherein, the update strategy includes at least one of the following: delete, add, and replace.
A fast application detection device, wherein the device includes:

An obtaining part, configured to obtain an installation package of at least one quick application to be detected; and obtain a detection rule configured for the at least one quick application in advance;

The detection part is configured to perform security detection on the at least one fast application to obtain a detection result based on the detection rule; wherein the detection of the fast application includes static detection and/or dynamic detection.
A fast application detection device, wherein the device includes a processor and a memory for storing a computer program that can run on the processor,

Wherein, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1-7.
A computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program that enables a computer to execute the steps of the method according to any one of claims 1-7.