WO2022073340A1

WO2022073340A1 - Mobile terminal application security detection method and system, terminal, and storage medium

Info

Publication number: WO2022073340A1
Application number: PCT/CN2021/090494
Authority: WO
Inventors: 陈优优
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-10-09
Filing date: 2021-04-28
Publication date: 2022-04-14
Also published as: CN112199644A

Abstract

A mobile terminal application security detection method and system, a terminal, and a storage medium. The method comprises: when a target application is started, determining, by using a preset condition, whether to generate an instruction for detecting the target application; if yes, extracting first target feature information from the target application; acquiring first comparison information from a local SO library, and acquiring second comparison information from a cloud server at the same time, the first comparison information and the second comparison information forming comparison information; comparing the first target feature information with the comparison information to obtain a first comparison result, and outputting and displaying the first comparison result and feeding same back to the cloud server at the same time. By means of the method, in the present application, comparison information for application verification can be stored in a segmented manner, such that the comparison information is not prone to be tampered, thereby improving accuracy of a detection result; the method can also be applied to smart security protection scenarios, so as to promote construction of smart cities.

Description

Mobile terminal application security detection method, system, terminal and storage medium

This application claims the priority of the Chinese patent application filed on October 9, 2020 with the application number 202011073608.9 and the title of the invention is "Mobile terminal application security detection method, system, terminal and storage medium", the entire content of which is Incorporated herein by reference.

technical field

The present application relates to the technical field of application security, and in particular, to a mobile terminal application security detection method, system, terminal and storage medium.

Background technique

Android is an open source operating system based on Linux. It is mainly used in mobile terminals such as mobile phones. Currently, there is no unified Chinese name. The Android platform consists of an operating system, middleware, user interface and application software. An Android application refers to the application software under the Android platform.

With the popularity of Android smartphones, an industry chain of malware targeting Android systems has gradually formed. These malwares usually disguise themselves as normal application software or games to deceive users into installing them. Once they enter the user's mobile phone, they will quietly customize SP services in the background or make pay calls to collect user bills, or collect users' privacy, or steal users' online banking and third parties. Pay for passwords for further theft. According to statistics, there are more than 8,000 kinds of Android malware, and more than 5 million Android phones have been infected.

At present, in order to improve the efficiency of mobile terminal application security detection, it is mainly achieved through package name verification, signature verification, resource file verification, or APK file obfuscation reinforcement. The risk of compilation makes it difficult for the existing verification methods to accurately determine whether the application has been tampered with.

technical problem

The present application provides a mobile terminal application security detection method, system, terminal and storage medium, so as to solve the problem that the existing mobile terminal security protection detection results are not accurate enough.

technical solutions

In order to solve the above technical problems, a technical solution adopted in this application is to provide a mobile terminal application security detection method, including: when a target application is started, using a preset condition to determine whether to generate an instruction to detect the target application; if so, then The first target feature information is extracted from the target application, and the first target feature information includes the feature information used to identify and distinguish the target application; the first comparison information is obtained from the local so library, and the second comparison information is obtained from the cloud server at the same time. The comparison information, the first comparison information and the second comparison information constitute comparison information; the first target feature information is compared with the comparison information to obtain a first comparison result, and the first comparison result is output and displayed and displayed. At the same time feedback to the cloud server.

In order to solve the above-mentioned technical problem, another technical solution adopted in this application is to provide a mobile terminal application security detection method, including: when the target application is started, using a preset condition to determine whether to generate an instruction to detect the target application; Then extract the second target feature information from the target application, and the second target feature information includes the fixed name and picture information existing in the target application; send the second target feature information to the cloud server, and use the cloud server to Perform big data comparison and analysis on the feature information of the two targets and obtain a second comparison result; and receive the second comparison result fed back by the cloud server.

In order to solve the above technical problems, another technical solution adopted in this application is to provide a mobile terminal application security detection method, including: receiving a core code program issued by a cloud server; extracting third target feature information from a target application , the third target feature information includes the code program to be detected corresponding to the core code program in the target application; compare the core code program with the third target feature information to obtain a third comparison result, and output the third comparison result Displayed and fed back to the cloud server at the same time.

In order to solve the above-mentioned technical problems, another technical solution adopted in this application is to provide a mobile terminal application security detection system, including: a first judgment module, configured to use preset conditions to judge whether to generate a detection module when the target application is started The instruction of the target application; the first extraction module is used to extract the first target feature information from the target application when the instruction for detecting the target application is generated, and the first target feature information includes the feature information for identifying and distinguishing the target application; The acquisition module is used to obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information form the comparison information; the first comparison module is used to compare the first target feature information with the comparison information to obtain a first comparison result, output and display the first comparison result and feed it back to the cloud server at the same time.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a terminal, wherein the terminal includes a processor and a memory coupled to the processor, and the memory stores a program file that can be run on the processor, Wherein, when the processor executes the program file, the following steps are implemented: when the target application is started, use a preset condition to determine whether to generate an instruction to detect the target application; if so, extract first target feature information from the target application, and the first target feature The information includes the feature information for identifying and distinguishing the target application; the first comparison information is obtained from the local so library, and the second comparison information is obtained from the cloud server at the same time, and the first comparison information and the second comparison information form a comparison Comparing information; comparing the first target feature information with the comparison information to obtain a first comparison result, and outputting and displaying the first comparison result and feeding it back to the cloud server at the same time.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a terminal, wherein the terminal includes a processor and a memory coupled to the processor, and the memory stores a program file that can be run on the processor, Wherein, when the processor executes the program file, the following steps are implemented: when the target application starts, use a preset condition to determine whether to generate an instruction to detect the target application; if so, extract second target feature information from the target application, and the second target feature The information includes the fixed name and picture information existing in the target application; the second target feature information is sent to the cloud server, and the cloud server is used to perform big data comparison analysis on the second target feature information and obtain the second comparison result ; Receive the second comparison result fed back by the cloud server.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a terminal, wherein the terminal includes a processor and a memory coupled to the processor, and the memory stores a program file that can be run on the processor, Wherein, when the processor executes the program file, the following steps are implemented: receiving the core code program issued by the cloud server; extracting third target feature information from the target application, where the third target feature information includes the waiting list corresponding to the core code program in the target application Detecting the code program; comparing the core code program with the third target feature information to obtain a third comparison result, and outputting and displaying the third comparison result and feeding it back to the cloud server at the same time.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a storage medium, wherein a program file capable of realizing a mobile terminal application security detection method is stored, and the following steps are realized when the program file is executed by the processor: When the target application is started, the preset condition is used to determine whether to generate an instruction for detecting the target application; if so, the first target feature information is extracted from the target application, and the first target feature information includes feature information for identifying and distinguishing the target application. Obtain the first comparison information from the local so library, simultaneously obtain the second comparison information from the cloud server, the first comparison information and the second comparison information form the comparison information; The first target feature information and comparison The information is compared to obtain a first comparison result, and the first comparison result is output and displayed and fed back to the cloud server at the same time.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a storage medium, wherein a program file capable of realizing a mobile terminal application security detection method is stored, and the following steps are realized when the program file is executed by the processor: When the target application is started, the preset condition is used to determine whether to generate an instruction for detecting the target application; if so, the second target feature information is extracted from the target application, and the second target feature information includes the name that exists in the target application and is fixed. and picture information; send the second target feature information to the cloud server, use the cloud server to perform big data comparison analysis on the second target feature information and obtain a second comparison result; receive the second comparison result fed back by the cloud server.

In order to solve the above-mentioned technical problems, another technical solution adopted in the present application is to provide a storage medium, wherein a program file capable of realizing a mobile terminal application security detection method is stored, and the following steps are realized when the program file is executed by the processor: Receive the core code program issued by the cloud server; extract third target feature information from the target application, where the third target feature information includes the code program to be detected corresponding to the core code program in the target application; associate the core code program with the third target The feature information is compared to obtain a third comparison result, and the third comparison result is output and displayed and fed back to the cloud server at the same time.

beneficial effect

The beneficial effects of the present application are: the mobile terminal application security detection method of the present application divides the comparison information for verifying the first target feature information into two sections, one section is stored in the so library, and one section is stored in the cloud server, This method of storing comparison information in segments, even if it is attacked by a virus program, only a part of the comparison information will be tampered with, and the tampering of the complete comparison information cannot be completed. When the first comparison information is obtained from the so library, the second comparison information is obtained from the cloud server, and the comparison information composed of the first comparison information and the second comparison information is compared with the first target feature information. Yes, to confirm whether the first target feature information has been tampered with, which makes the final verification result accurate. In addition, the setting of the preset conditions makes it possible to control the number of detection target applications, reduce the amount of data processing, and avoid frequent resource occupation.

Description of drawings

1 is a schematic flowchart of a mobile terminal application security detection method according to a first embodiment of the present application;

2 is a schematic flowchart of a mobile terminal application security detection method according to a second embodiment of the present application;

3 is a schematic flowchart of a mobile terminal application security detection method according to a third embodiment of the present application;

4 is a schematic flowchart of a mobile terminal application security detection method according to a fourth embodiment of the present application;

5 is a schematic diagram of functional modules of the mobile terminal application security detection system according to the first embodiment of the present application;

6 is a schematic diagram of functional modules of a mobile terminal application security detection system according to a second embodiment of the present application;

7 is a schematic diagram of functional modules of a mobile terminal application security detection system according to a third embodiment of the present application;

8 is a schematic structural diagram of a terminal according to an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a storage medium according to an embodiment of the present application.

Embodiments of the present invention

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

The terms "first", "second" and "third" in this application are only used for descriptive purposes, and should not be construed as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature defined as "first", "second", "third" may expressly or implicitly include at least one of that feature. In the description of the present application, "a plurality of" means at least two, such as two, three, etc., unless otherwise expressly and specifically defined. All directional indications (such as up, down, left, right, front, rear...) in the embodiments of the present application are only used to explain the relative positional relationship between the various components under a certain posture (as shown in the accompanying drawings). , motion situation, etc., if the specific posture changes, the directional indication also changes accordingly. Furthermore, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optionally also includes For other steps or units inherent to these processes, methods, products or devices.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor a separate or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

FIG. 1 is a schematic flowchart of a mobile terminal application security detection method according to a first embodiment of the present application. It should be noted that, if there is substantially the same result, the method of the present application is not limited to the sequence of the processes shown in FIG. 1 . As shown in Figure 1, the method includes the steps:

Step S101: When the target application is started, it is determined by using a preset condition whether to generate an instruction for detecting the target application. If yes, step S102 is executed.

Specifically, the preset condition is preset. In this embodiment, by setting the preset conditions, the number of times of detecting the target application is controlled, so as to avoid detection every time the target application is started, thereby achieving the purpose of reducing the amount of data processing. If the instruction for detecting the target application is not generated, the target application does not need to be detected, and the target application is directly started.

Further, in some embodiments, the preset condition may be to periodically detect the target application to control the detection frequency of the target application. Therefore, step S101 specifically includes:

1. When the target application starts, obtain the time interval between the last detection time of the target application and the current time.

2. When the time interval exceeds the preset threshold, generate an instruction to detect the target application.

It should be noted that the preset threshold is preset, for example, it can be set to 1 day.

Among them, after each detection of the target application, start timing, and when the target application is started again, obtain the time interval between the current time and the last detection of the target application, and then determine the size relationship between the time interval and the preset threshold, When the time interval exceeds the preset threshold, it means that the target application has not been detected for a long time, and an instruction for detecting the target application is generated. In this embodiment, the time interval is used to limit the detection frequency of the target application, thereby reducing the detection times of the target application. In addition, by taking whether the target application is started or not as a precondition for confirming whether the target application needs to be detected, the target application that the user will not start does not need to consume resources to perform the detection.

In addition, it can also be set to generate an instruction for detecting the target application when the target application is started for the first time every day. If the target application is not started for the first time on that day, the target application does not need to be detected.

Further, in some embodiments, the preset condition may be determined in a random manner to determine whether the target application needs to be detected. Therefore, step S101 specifically includes:

1. When the target application is started, a preset random program is executed to obtain a random result, and the random result includes detecting the target application and not detecting the target application.

2. If the random result is the detection target application, an instruction for detecting the target application is generated.

Among them, in order to reduce the detection frequency of the target application, a random program is set for the target application. The random result includes detecting the target application and not detecting the target application. When the target application is started, if the randomly selected result is the target application detection , an instruction for verifying the target application is generated, and if the extracted result is that the target application is not detected, no operation is performed. Through this random sampling method, the detection frequency of the target application is reduced. In addition, the random program will only be executed when the target application is started, which makes the detection of the target application highly probabilistic, making it difficult for the virus program to confirm which time the target application will be detected when the target application is started, which further improves the security protection performance of the target application.

Further, considering that the startup times of different applications are quite different, in order to perform application security detection more reasonably, the occurrence probability of detecting the target application and not detecting the target application in the random result can be preset. For example, for a class of applications that are started frequently, the probability of occurrence of the detected target application in the corresponding random result is set to be low, and the probability of occurrence of the target application not to be detected is set to be high. For a class of applications that are not started frequently, set the probability of occurrence of the detected target application in the corresponding random result to be high, and set the probability of occurrence of the target application not to be detected to be low. Therefore, by setting the probability of occurrence of random results, the number of times of detecting the target application can be controlled, so as to avoid frequent detection and cause excessive resource occupation. For example: WeChat, users start WeChat very frequently every day. At this time, in order to avoid frequent detection of WeChat, the probability of occurrence of the detected target application in the random results corresponding to WeChat can be set to be low, and the target application will not be detected. The probability of occurrence is set to be high, so as to control the frequency of WeChat detection.

It should be understood that the preset conditions of the target application can also be specified by the user, by placing both the periodic detection method and the random detection method into the mobile terminal, and then specified by the user. For example, the user specifies that the target application A uses periodic detection. , the user specifies that the B target application adopts the random detection method, so as to meet the different needs of the user.

Step S102: Extract first target feature information from the target application, where the first target feature information includes feature information for identifying and distinguishing target applications.

Specifically, the first target feature information includes a package name and a signature. Among them, the package name is the unique identifier for judging an app in the Android system. Different apps can have the same name, but their package names cannot be the same. For example, we can compile and generate an app called "WeChat", but its package name cannot be com.tencent.mm (WeChat's package name). If the package names of two apps are the same, the mobile terminal only allows these two apps to be installed. One of the apps. In order for the mobile terminal to identify which App is the required App, it needs to be identified by the App signature. The significance of the App signature is to ensure the legal ID of each application developer and prevent some developers from using the same To obfuscate and replace the installed program, the released APK file needs to be uniquely signed to ensure the consistency of each released version.

Step S103: Obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information form the comparison information.

It should be noted that, after developing the target application, the developer extracts all package names and signatures, then truncates the package names and signatures, and stores part of the package name and part of the signature as the first comparison information in the so library , the other part of the package name and the other part of the signature are stored in the cloud server as the second comparison information. When the package name and the signature need to be used for comparison, the first comparison information needs to be obtained from the so library, from The second comparison information is obtained in the cloud server, and the first comparison information and the second comparison information are combined into comparison information, and then the comparison with the first target feature information can be performed.

Further, in some embodiments, in order to improve the accuracy of the final detection result, when the first comparison information and the second comparison information are formed into the comparison information, the first comparison information and the second comparison information also need to be compared. Verification is performed, therefore, step S103 specifically includes:

1. Detect whether the verification information reserved in the first comparison information matches the verification information reserved in the second comparison information.

Specifically, when developers truncate the package name and signature to obtain the first comparison information and the second comparison information, they also need to reserve verification information on the first comparison information and the second comparison information respectively. When the first comparison information and the second comparison information are matched, the verification information reserved on the first comparison information and the second comparison information is matched, so as to determine whether there is any in the first comparison information and the second comparison information. tampered to ensure the accuracy of the final comparison information. For example, by setting a flag bit in both the first comparison information and the second comparison information, when combining, it is verified whether the flag bits on the first comparison information and the second comparison information match.

2. If there is a match, the combination will obtain the comparison information.

3. If there is no match, output a message that the comparison information has been tampered with.

In this embodiment, by performing matching verification between the first comparison information and the second comparison information, it is confirmed whether the first comparison information and the second comparison information have been tampered with, thereby ensuring that the finally obtained comparison information is accurate. If the comparison information is tampered, it means that the target application has also been tampered with, and there is no need to perform the comparison between the first target feature information and the comparison information.

Step S104: Comparing the first target feature information with the comparison information to obtain a first comparison result, and outputting and displaying the first comparison result and feeding it back to the cloud server at the same time.

Further, in order to further ensure the interests of the user and prevent the user's information from being stolen, in this embodiment, after step S104, it also includes: when it is confirmed that the program of the target application has been tampered with according to the first comparison result, terminating the target application, Then use the pre-set prohibition program to prohibit the target application from starting, and at the same time send out an alarm message to remind the user.

The mobile terminal application security detection method according to the first embodiment of the present application divides the comparison information used to verify the first target feature information into two sections, one section is stored in the so library, and the other section is stored in the cloud server. In the way of segment storage comparison information, even if it is attacked by a virus program, only part of the comparison information will be tampered with, and the complete comparison information cannot be tampered with. The first comparison information is obtained from the so library, the second comparison information is obtained from the cloud server, and the comparison information composed of the first comparison information and the second comparison information is used to compare the first target feature information to Confirm whether the first target feature information has been tampered with, which makes the final verification result accurate. In addition, the setting of the preset conditions makes it possible to control the number of detection target applications, reduce the amount of data processing, and avoid frequent resource occupation.

FIG. 2 is a schematic flowchart of a mobile terminal application security detection method according to a second embodiment of the present application. It should be noted that, if there is substantially the same result, the method of the present application is not limited to the sequence of the processes shown in FIG. 2 . As shown in Figure 2, the method includes the steps:

Step S201 : when the target application is started, it is determined by using a preset condition whether to generate an instruction for detecting the target application. If yes, step S202 is executed.

In this embodiment, step S201 in FIG. 2 is similar to step S101 in FIG. 1 , and for the sake of brevity, details are not repeated here.

Step S202: Extract the first target feature information from the target application.

In this embodiment, step S202 in FIG. 2 is similar to step S102 in FIG. 1 , and for the sake of brevity, details are not repeated here.

Step S203: Obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information form the comparison information.

In this embodiment, step S203 in FIG. 2 is similar to step S103 in FIG. 1 , and for the sake of brevity, details are not repeated here.

Step S204: Comparing the first target feature information with the comparison information to obtain a first comparison result, and outputting and displaying the first comparison result and feeding it back to the cloud server at the same time.

In this embodiment, step S204 in FIG. 2 is similar to step S104 in FIG. 1 , and for the sake of brevity, details are not repeated here.

Step S205: when the target application interacts with the external terminal, the first key segment is obtained from the so library, and the second key segment is obtained from the cloud server at the same time. The first key segment and the second key segment form a secret key segment. key.

Specifically, after developing the target application, the developer divides the key of the target application into two segments, the first key segment is stored in the so library, and the second key segment is stored in the cloud server, so that the virus program cannot be directly obtained. to the complete key, reducing the possibility of key leakage.

It should be noted that verification information is preset on the first key segment and the second key segment, and the verification message of the first key segment matches the verification message of the second key segment. When the first key segment and the second key segment are combined, the verification information of the first key segment is matched with the verification information of the second key segment. The key segment constitutes the key, and if the match fails, a message that the key has been tampered with is output.

Step S206: Encrypt the information to be sent with the key and/or decrypt the received information with the key.

Step S207: when the target application is terminated, delete the key generated by the combination.

Specifically, when the target application is terminated, that is, the user no longer needs to use the target application to interact with the external terminal, the previously generated key can be deleted to prevent it from being stolen by the virus program.

On the basis of the first embodiment, the mobile terminal application security detection method according to the second embodiment of the present application stores the key in segments, making it difficult for the key to be completely acquired by the virus program, thereby ensuring the connection between the target application and the external terminal. The security of data communication, and when the target application is terminated, the key generated by the combination is deleted in time to prevent it from being stolen by the virus program and then decompiled to crack the target application, which improves the protection performance of the target application.

FIG. 3 is a schematic flowchart of a mobile terminal application security detection method according to a third embodiment of the present application. It should be noted that, if there is substantially the same result, the method of the present application is not limited to the sequence of the processes shown in FIG. 3 . As shown in Figure 3, the method includes the steps:

Step S301 : when the target application is started, it is determined by using a preset condition whether to generate an instruction for detecting the target application. If yes, step S302 is executed.

In this embodiment, step S301 in FIG. 3 is similar to step S101 in FIG. 1 , and for the sake of brevity, details are not repeated here.

Step S302: Extract second target feature information from the target application, where the second target feature information includes the fixed name and picture information existing in the target application.

Specifically, the second target feature information includes a fixed name and picture information existing in the target application, wherein the name information can be a fixed name such as the name of the target application, the name of a module in the target application, etc., and the picture information It can be the logo of the target application, the picture on the page of the target application, etc. It should be noted that, considering the large amount of data of resource names and pictures in the target application, this embodiment adopts a random extraction method to randomly extract the second target feature information without acquiring all the second target features. information.

Step S303: Send the second target feature information to the cloud server, and use the cloud server to perform big data comparison analysis on the second target feature information and obtain a second comparison result.

Specifically, the third comparison result is obtained by uploading the second target feature information to the cloud server, and using the cloud server to perform big data comparison and analysis on the second target feature information. Wherein, when the cloud server compares and analyzes the second target feature information, it mainly uses the resource names and pictures of each version of the target application to compare with the second target feature information. The current version number of the target application of the mobile terminal, and then the resource name and picture corresponding to the version number are obtained, and then compared with the second target feature information.

Step S304: Receive the second comparison result fed back by the cloud server.

Specifically, after the second comparison result is obtained, the cloud server saves the second comparison result, and in addition, the second comparison result needs to be synchronized to the mobile terminal to inform the user of the comparison situation.

In the mobile terminal application security detection method according to the third embodiment of the present application, a portion of the second target feature information is randomly extracted and uploaded to the cloud server, and the cloud server is used to perform big data analysis and comparison on the second target feature information, and then obtain and compare the result. The second comparison result, which does not need to complete the process of data analysis and comparison in the mobile terminal itself, reduces the occupation of resources, and at the same time, the data in the cloud server is difficult to be tampered with. Therefore, the method of cloud server comparison is adopted. , the comparison result is more accurate.

FIG. 4 is a schematic flowchart of a mobile terminal application security detection method according to a fourth embodiment of the present application. It should be noted that, if there is substantially the same result, the method of the present application is not limited to the sequence of the processes shown in FIG. 4 . As shown in Figure 4, the method includes the steps:

Step S401: Receive the core code program issued by the cloud server.

Specifically, the core code program refers to a very important code program in the target application. In this embodiment, detection can also be performed through the core code program in the target application, for example, a code that implements a "payment function". The existing virus program is mainly aimed at tampering with the core program of the target application, so as to achieve the purpose of profit. For example, by tampering with the core program corresponding to the "payment function" of the target application, the user's payment information on the target application is If it is stolen, the interests of the user will be lost. Therefore, this embodiment can also detect the core program of the target application. Among them, the frequency of the core code program issued by the cloud server is set by the developer, and can be issued once at a preset time interval.

Step S402: Extract third target feature information from the target application, where the third target feature information includes the code program to be detected corresponding to the core code program in the target application.

Specifically, the third target feature information specifically refers to a piece of code program to be detected corresponding to the core code program in the target application.

Step S403: Compare the core code program with the third target feature information to obtain a third comparison result, and output and display the third comparison result and feed it back to the cloud server at the same time.

The mobile terminal application security detection method according to the fourth embodiment of the present application confirms the third target feature information corresponding to the core code program issued by the cloud server from the target application, where the third target feature information is the code program to be detected, and then Compare the third target feature information with the core code program to obtain a third comparison result, and confirm whether the target application has been tampered with according to the third comparison result. detection method, so as to achieve the purpose of improving the accuracy of the final detection result.

Further, in some embodiments, after obtaining the first comparison result or the second comparison result or the third comparison result, it also includes: comparing the first comparison result or the second comparison result or the third comparison result The results are uploaded to the blockchain.

Specifically, the corresponding summary information is obtained based on the first comparison result or the second comparison result or the third comparison result. Specifically, the summary information is obtained from the first comparison result or the second comparison result or the third comparison result. The result is obtained by hashing, for example, using the sha256s algorithm. Uploading summary information to the blockchain ensures its security and fairness and transparency to users. The user equipment can download the summary information from the blockchain, so as to verify whether the first comparison result, the second comparison result, and the third comparison result have been tampered with. The blockchain referred to in this example is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

FIG. 5 is a schematic diagram of functional modules of a mobile terminal application security detection system according to an embodiment of the present application. As shown in FIG. 5 , the mobile terminal application security detection system 50 includes a first judgment module 51 , a first extraction module 52 , an acquisition module 53 and a first comparison module 54 .

The first judgment module 51 is configured to use a preset condition to judge whether to generate an instruction for detecting the target application when the target application is started.

The first extraction module 52 is configured to extract first target feature information from the target application when an instruction for detecting a target application is generated, where the first target feature information includes feature information for identifying and distinguishing the target application.

The obtaining module 53 is configured to obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information constitute the comparison information.

The first comparison module 54 is configured to compare the first target feature information with the comparison information to obtain a first comparison result, output and display the first comparison result and feed it back to the cloud server at the same time.

Optionally, when the target application is started, the first judging module 51 uses a preset condition to determine whether to generate an instruction to detect the target application. The operation may also be: when the target application is started, obtain the difference between the last detection time of the target application and the current time. Time interval; when the time interval exceeds a preset threshold, an instruction to detect the target application is generated.

Optionally, when the target application is started, the first judgment module 51 uses a preset condition to judge whether to generate an instruction to detect the target application. The operation may also be: when the target application is started, execute a preset random program to obtain a random result, The random result includes detecting the target application and not detecting the target application; if the random result is detecting the target application, an instruction for detecting the target application is generated.

Optionally, the operation of the acquisition module 53 to form the comparison information from the first comparison information and the second comparison information may also be: detecting the verification information reserved on the first comparison information and the reserved verification information on the second comparison information. Whether the verification information matches; if it matches, the comparison information is obtained by combining; if it does not match, the message that the comparison information has been tampered with is output.

Optionally, after the first comparison module 54 obtains the first comparison result, it is also used to obtain the first key segment from the so library and the first key segment from the cloud server when the target application interacts with the external terminal. Two key segments, the first key segment and the second key segment form a key; use the key to encrypt the information to be sent and/or use the key to decrypt the received information; when the target application is terminated, the combined generated Key deletion.

FIG. 6 is a schematic diagram of functional modules of a mobile terminal application security detection system according to an embodiment of the present application. As shown in FIG. 6 , the mobile terminal application security detection system 60 includes a second judgment module 61 , a second extraction module 62 , a sending module 63 and a first receiving module 64 .

The second judgment module 61 is configured to use a preset condition to judge whether to generate an instruction for detecting the target application when the target application is started.

The second extraction module 62 is configured to extract second target feature information from the target application when generating the instruction for detecting the target application, where the second target feature information includes the fixed name and picture information existing in the target application.

The sending module 63 is configured to send the second target feature information to the cloud server, and use the cloud server to perform big data comparison analysis on the second target feature information and obtain a second comparison result.

The first receiving module 64 is configured to receive the second comparison result fed back by the cloud server.

FIG. 7 is a schematic diagram of functional modules of a mobile terminal application security detection system according to an embodiment of the present application. As shown in FIG. 7 , the mobile terminal application security detection system 70 includes a second receiving module 71 , a third extracting module 72 and a second comparing module 73 .

The second receiving module 71 is configured to receive the core code program issued by the cloud server.

The third extraction module 72 is configured to extract third target feature information from the target application, where the third target feature information includes the code program to be detected corresponding to the core code program in the target application.

The second comparison module 73 is configured to compare the core code program with the third target feature information to obtain a third comparison result, output and display the third comparison result and feed it back to the cloud server at the same time.

For other details of the technical solutions implemented by the modules in the mobile terminal application security detection system in the above embodiment, reference may be made to the description in the mobile terminal application security detection method in the above embodiment, which will not be repeated here.

It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same and similar parts among the various embodiments, refer to each other Can. As for the system-type embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the partial description of the method embodiment.

Please refer to FIG. 8 , which is a schematic structural diagram of a terminal according to an embodiment of the present application. As shown in FIG. 8 , the terminal 80 includes a processor 81 and a memory 82 coupled to the processor 81 .

The memory 82 stores program instructions for implementing the mobile terminal application security detection method described in any of the foregoing embodiments.

The processor 81 is configured to execute the program instructions stored in the memory 82 to perform security detection on the mobile terminal application program.

The processor 81 may also be referred to as a CPU (Central Processing Unit, central processing unit). The processor 81 may be an integrated circuit chip with signal processing capability. The processor 81 may also be a general purpose processor, digital signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components . A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

Referring to FIG. 9 , FIG. 9 is a schematic structural diagram of a storage medium according to an embodiment of the present application. The storage medium of this embodiment of the present application stores a program file 91 capable of implementing all the above-mentioned methods, wherein the program file 91 may be stored in the above-mentioned storage medium in the form of a software product, and includes several instructions to enable a computer device (which can be A personal computer, a server, or a network device, etc.) or a processor (processor) executes all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory). Various media that can store program codes, such as Memory), disks, or CDs, or terminal devices such as computers, servers, mobile phones, and tablets. The storage medium may be non-volatile or volatile.

In the several embodiments provided in this application, it should be understood that the disclosed system, terminal and method may be implemented in other manners. For example, the system embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units. The above are only the embodiments of the present application, and are not intended to limit the scope of the patent of the present application. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present application, or directly or indirectly applied in other related technical fields, All are similarly included in the scope of patent protection of the present application.

Claims

1. A mobile terminal application security detection method, comprising:

When the target application is started, use a preset condition to determine whether to generate an instruction to detect the target application;

If so, extract first target feature information from the target application, where the first target feature information includes feature information for identifying and distinguishing the target application;

Obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information form the comparison information;

The first target feature information is compared with the comparison information to obtain a first comparison result, and the first comparison result is output and displayed and fed back to the cloud server at the same time.

2. The mobile terminal application security detection method according to claim 1, wherein, when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

When the target application is started, obtain the time interval between the last detection time of the target application and the current time;

When the time interval exceeds a preset threshold, an instruction to detect the target application is generated.

3. The mobile terminal application security detection method according to claim 1, wherein when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

When the target application is started, a random result is obtained by executing a preset random program, and the random result includes detecting the target application and not detecting the target application;

If the random result is the detection of the target application, an instruction to detect the target application is generated.

4. The mobile terminal application security detection method according to claim 1, wherein the first comparison information and the second comparison information constitute comparison information, comprising:

Detecting whether the verification information reserved on the first comparison information matches the verification information reserved on the second comparison information;

If there is a match, combining to obtain the alignment information;

If there is no match, output a message that the comparison information has been tampered with.

5. The mobile terminal application security detection method according to claim 1, wherein after obtaining the first comparison result, the method further comprises:

When data interaction occurs between the target application and the external terminal, the first key segment is obtained from the so library, and the second key segment is obtained from the cloud server at the same time. The first key segment and the The second key segment forms a key;

Use the key to encrypt the information to be sent and/or use the key to decrypt the received information;

When the target application is terminated, the key generated in combination is deleted.

6. A mobile terminal application security detection method, comprising:

If so, extract second target feature information from the target application, where the second target feature information includes the fixed name and picture information existing in the target application;

Sending the second target feature information to the cloud server, and using the cloud server to perform big data comparison analysis on the second target feature information and obtain a second comparison result;

A second comparison result fed back by the cloud server is received.

7. A mobile terminal application security detection method, comprising:

receiving the core code program issued by the cloud server;

Extracting third target feature information from the target application, where the third target feature information includes a code program to be detected corresponding to the core code program in the target application;

The core code program is compared with the third target feature information to obtain a third comparison result, and the third comparison result is output and displayed and fed back to the cloud server at the same time.

8. A mobile terminal application security detection system, comprising:

a first judgment module, configured to use a preset condition to judge whether to generate an instruction to detect the target application when the target application is started;

a first extraction module, configured to extract first target feature information from the target application when an instruction for detecting the target application is generated;

The acquisition module is used to obtain the first comparison information from the local so library, and simultaneously obtain the second comparison information from the cloud server, and the first comparison information and the second comparison information form the comparison information;

a first comparison module, configured to compare the first target feature information with the comparison information to obtain a first comparison result, output and display the first comparison result and feed it back to the Cloud Server.

9. A terminal, wherein the terminal comprises a processor and a memory coupled to the processor, the memory stores a program file executable on the processor, wherein the processor executes the program file when implementing the following steps:

10. The terminal according to claim 9, wherein, when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

11. The terminal according to claim 9, wherein, when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

12. The terminal according to claim 9, wherein after obtaining the first comparison result, the method further comprises:

13. A terminal, wherein the terminal comprises a processor and a memory coupled to the processor, the memory stores a program file that can run on the processor, wherein the processor executes the program file when implementing the following steps:

A second comparison result fed back by the cloud server is received.

14. A terminal, wherein the terminal comprises a processor and a memory coupled to the processor, the memory stores a program file executable on the processor, wherein the processor executes the program file when implementing the following steps:

receiving the core code program issued by the cloud server;

15. A storage medium, wherein a program file capable of implementing a mobile terminal application security detection method is stored, and when the program file is executed by a processor, the following steps are implemented:

16. The storage medium according to claim 15, wherein, when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

17. The storage medium according to claim 15, wherein, when the target application is started, using a preset condition to determine whether to generate an instruction for detecting the target application comprises:

18. The storage medium according to claim 15, wherein after obtaining the first comparison result, the method further comprises:

19. A storage medium, wherein a program file capable of implementing a mobile terminal application security detection method is stored, and when the program file is executed by a processor, the following steps are implemented:

A second comparison result fed back by the cloud server is received.

20. A storage medium, wherein a program file capable of implementing a mobile terminal application security detection method is stored, and when the program file is executed by a processor, the following steps are implemented:

receiving the core code program issued by the cloud server;