WO2022143126A1 - 应用的安全性分析方法、装置、设备及存储介质 - Google Patents

应用的安全性分析方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2022143126A1
WO2022143126A1 PCT/CN2021/137524 CN2021137524W WO2022143126A1 WO 2022143126 A1 WO2022143126 A1 WO 2022143126A1 CN 2021137524 W CN2021137524 W CN 2021137524W WO 2022143126 A1 WO2022143126 A1 WO 2022143126A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
interface
monitoring
module
event
Prior art date
Application number
PCT/CN2021/137524
Other languages
English (en)
French (fr)
Inventor
董泽勇
张毅
Original Assignee
花瓣云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 花瓣云科技有限公司 filed Critical 花瓣云科技有限公司
Publication of WO2022143126A1 publication Critical patent/WO2022143126A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3051—Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3604—Software analysis for verifying properties of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4843—Task transfer initiation or dispatching by program, e.g. task dispatcher, supervisor, operating system
    • G06F9/4881—Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues

Definitions

  • the present application relates to the field of terminal technologies, and in particular, to an application security analysis method, apparatus, device, and storage medium.
  • a technician can insert monitoring codes into an application package of an application according to actual requirements, so as to obtain an application package with monitoring functions.
  • the behavior of the application can be monitored through the inserted monitoring code.
  • the present application provides an application security analysis method, device, device and storage medium, which solves the problem that in the prior art, the application may fail to run or some functions are unavailable due to the modification of the application package of the application, thereby affecting the stability of the system The problem.
  • an application security analysis method is provided, which is applied to an electronic device, wherein an application program framework layer of the electronic device includes an application monitoring module, and the application monitoring module is used to monitor the first part of the electronic device.
  • An interface invocation event of an application to an interface includes: loading the application monitoring module for the first application in response to the initial running of the first application.
  • the application monitoring module acquires the interface invocation event of the interface by the first application, and reports the interface invocation event to the second application through the communication channel between the first application and the second application.
  • the second application analyzes the security of the first application according to the interface invocation event. When the second application determines that the first application has a potential safety hazard, an early warning prompt is performed.
  • the first application is controlled to load the application monitoring module.
  • the application monitoring module is loaded by the first application, when it is detected that the first application invokes the interface, it acquires the interface invocation event of the interface by the first application, and then reports the acquired interface invocation event to the second application.
  • the second application can analyze whether the behavior of the first application has potential security risks according to the interface invocation event, and when there are security risks, a warning prompt is provided in time, so as to facilitate the user to discover in time.
  • behavior monitoring can be performed without modifying the application package, avoiding the situation that the application cannot run or some functions are unavailable due to modifying the application package, thereby ensuring the stability of the system.
  • the application monitoring module is loaded into the process of the first application by the first application and becomes a runtime module of the first application, it actively interacts with the second application.
  • the behavior monitoring of the first application no longer involves the application framework layer, and can The interface call event reporting mechanism is decoupled from the system platform.
  • implanting the application monitoring module in the application framework layer will not interfere with the normal operation of the entire Android platform, and the changes and upgrades of the Android platform will not affect the interface monitoring.
  • the application monitoring module acquiring the interface invocation event of the interface by the first application includes: the application monitoring module invokes a hook method to acquire the interface invocation event, and the hook method is used for The interface invocation event of the first application to the interface is acquired during the process of the first application executing the interface invocation.
  • the hook method since the hook method is equivalent to the API method of the backup interface, and a monitoring function is added before and after the backup API method. That is, when the application monitoring module calls the hook method, it copies the API method address of the interface in the hook method, which is equivalent to backing up the API method of the interface. Therefore, by calling the hook method, not only the invocation of the interface can be realized, but also the interface invocation event of the interface can be obtained in the process of invoking the interface, thereby realizing the purpose of monitoring the invocation of the interface.
  • the method when the application monitoring module calls the hook method, the method includes: the application monitoring module replaces the address of the API method of the application program interface to be called with the hook method address of the hook method.
  • the application monitoring module invokes the hook method based on the hook method address.
  • an interface corresponds to an API method, and the API method can be invoked based on the API method address, thereby realizing the invocation of the interface.
  • the API method address to be called can be replaced by the hook method address through the application monitoring module, so that the application monitoring module Go to the calling hook method, the application monitoring module can obtain the interface calling event of the interface by executing the hook method, and can call back the API method corresponding to the interface through the hook method, and monitor the interface calling situation in the process of calling the interface.
  • behavior monitoring can be performed without modifying the application package, and the situation in which the application cannot run or some functions are unavailable due to the modification of the application package can be avoided, thereby ensuring the stability of the system.
  • the method before the application monitoring module acquires the interface invocation event of the interface by the first application, the method further includes: the application monitoring module sends a monitoring service registration request to the second application, and the monitoring service The registration request is used to request the second application to determine whether to monitor the interface invocation event of the first application.
  • the second application determining to monitor the interface invocation event of the first application according to the monitoring service registration request, update an application monitoring list to obtain a first monitoring list, where the first monitoring list includes the first application application information.
  • the second application updates the application information of the first application in the application monitoring list to obtain the first monitoring list, and the first monitoring list includes Application to be monitored.
  • the applications to be monitored are recorded through the first monitoring list, so that the applications in the first monitoring list can be monitored in batches subsequently.
  • the method further includes: when the second application determines to monitor the interface invocation event of the interface by the first application, sending a monitoring start notification to the application monitoring module, and the monitoring The start notification is used to trigger the application monitoring module to acquire the interface invocation event of the interface by the first application.
  • a monitoring start notification is sent to the application monitoring module in the second application, so as to facilitate the application monitoring module After receiving the monitoring start notification, the interface invocation situation of the first application is monitored, thereby realizing the purpose of monitoring.
  • the method further includes: updating the first monitoring list.
  • the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.
  • the application security analysis method by updating the first monitoring list, since the updated first monitoring list does not include applications that have undergone security analysis, or, the updated first monitoring list The status of the application that has undergone security analysis is marked as analyzed, so that when subsequent batch monitoring is performed based on the updated first monitoring list again, repeated monitoring of the application that has undergone security analysis can be avoided.
  • the operating power consumption of electronic equipment can be saved.
  • the obtaining, by the application monitoring module, the interface invocation event of the interface by the first application includes: when the application monitoring module monitors the target interface of the first application invocation, The invocation event of the target interface by the first application is determined as the interface invocation event, and the target interface is an interface in an interface monitoring list, and the interface monitoring list is used to record interface information of the interface to be monitored.
  • the application monitoring module may not acquire the calling event of the interface by the first application, and when the application monitoring module monitors the first application
  • the invocation event of the target interface is obtained as an interface invocation event, wherein the target interface is an interface in the interface monitoring list. That is, it is possible to monitor the interfaces in the interface monitoring list.
  • the interfaces in the interface monitoring list may be interfaces that involve user privacy, while other interfaces that do not belong to the interface monitoring list may not be monitored.
  • the private interface can be unmonitored. In this way, the invocation event of the target interface can be selectively monitored, and the monitoring can be targeted to a certain extent, thereby saving the running power consumption of the electronic device.
  • the method further includes: the application monitoring module sends an Android interface definition language AIDL binding request to a target module, where the target module is a connection of the second application or the application framework layer and an establishment module, the connection establishment module is configured to establish a communication channel between the first application and the second application after the first application is initialized and run.
  • the target module receives the AIDL binding request.
  • the target module sends an AIDL binding object to the application monitoring module based on the AIDL binding request, where the AIDL binding object includes object data for establishing the communication channel.
  • the application monitoring module receives the AIDL binding object.
  • the realization principle of AIDL is to realize communication through code.
  • the second application establishes a communication channel with the first application through AIDL.
  • the second application may define an AIDL binding object, and the AIDL binding object includes object data for establishing a communication channel.
  • the AIDL binding object includes at least one execution method, and each execution method corresponds to a piece of code, or it can be understood that each execution method corresponds to an instance.
  • the application monitoring module can communicate with the second application by invoking the execution method in the AIDL binding object.
  • the application monitoring module uses the target module to obtain the AIDL binding object from the second application, and establishes a communication channel with the second application based on the AIDL binding object.
  • the established communication channel monitors the first application, thereby preventing the first application from filtering out indication messages related to monitoring, thereby ensuring the reliability and stability of monitoring the first application.
  • the method in response to the target module being the connection establishment module, the method further includes: the connection establishment module obtains the AIDL binding object from the second application.
  • the connection establishment module requests the AIDL binding object from the monitoring service management module in advance, so that the subsequent first application can be AIDL bound with the application market through the connection establishment module.
  • the AIDL binding of multiple first applications and the application market can reduce the operation burden of the application market to a certain extent.
  • the second application includes a monitoring service management module and a behavior analysis module, and the second application analyzes the security of the first application according to the interface invocation event, including: the monitoring service management
  • the module receives the interface invocation event of the first application to each interface transmitted by the application monitoring module.
  • the behavior analysis module acquires, from the monitoring service management module, the interface invocation events of the respective interfaces by the first application.
  • the behavior analysis module analyzes the security of the first application according to the interface invocation events of the various interfaces.
  • the behavior analysis module obtains the interface invocation events of the first application to each interface from the monitoring service management module, thereby realizing a comprehensive analysis that can be combined with the interface invocation events of each interface. , which can improve the accuracy and validity of security analysis.
  • the second application includes a monitoring service management module and a behavior analysis module, and the second application analyzes the security of the first application according to the interface invocation event, including: the monitoring service management
  • the module receives the interface invocation event transmitted by the application monitoring module.
  • the monitoring service management module reports the interface invocation event to the behavior analysis module based on the request of the behavior analysis module.
  • the behavior analysis module analyzes the security of the first application according to the interface invocation event.
  • the behavior analysis module can actively request the monitoring service management module to obtain the interface invocation event according to its own working state, so as to realize the full and effective operation of the behavior analysis module. The effect of conducting a safety analysis.
  • an application security analysis device configured in an electronic device, wherein an application framework layer of the electronic device includes an application monitoring module, and the application monitoring module is used to monitor the first part of the electronic device.
  • An interface invocation event of an application to an interface the apparatus includes a target management module, the application monitoring module and a second application: the target management module is configured to initialize and run in response to the first application, and is used for the first application.
  • the application loads the application monitoring module.
  • the application monitoring module is configured to acquire the interface invocation event of the interface by the first application, and report the interface invocation to the second application through the communication channel between the first application and the second application event.
  • the second application is configured to analyze the security of the first application according to the interface invocation event.
  • the second application is configured to provide an early warning prompt when it is determined that the first application has a potential safety hazard.
  • the application monitoring module is configured to: call a hook method to acquire the interface invocation event, and the hook method is configured to acquire the first application in the process of executing the interface invocation by the first application The application invokes the event on the interface of the interface.
  • the application monitoring module is configured to: replace the API method address of the application program interface to be called with the hook method address of the hook method.
  • the hook method is invoked based on the hook method address.
  • the second application includes a monitoring service management module.
  • the application monitoring module is configured to send a monitoring service registration request to the second application, where the monitoring service registration request is used to request the second application to determine whether to monitor an interface invocation event of the first application.
  • the monitoring service management module is configured to, in response to the second application determining an interface call event for monitoring the first application according to the monitoring service registration request, update the application monitoring list to obtain a first monitoring list, and the first monitoring list is obtained.
  • the monitoring list includes application information of the first application.
  • the second application includes a monitoring service management module
  • the monitoring service management module is configured to: when the second application determines to monitor the interface invocation event of the interface by the first application, Sending a monitoring enabling notification to the application monitoring module, where the monitoring enabling notification is used to trigger the application monitoring module to acquire an interface invocation event of the first application to the interface.
  • the monitoring service management module is further configured to: update the first monitoring list.
  • the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.
  • the application monitoring module is configured to: in the case of monitoring the invocation of the target interface by the first application, determine the invocation event of the target interface by the first application as the interface invocation event, the target interface is an interface in the interface monitoring list, and the interface monitoring list is used to record the interface information of the interface to be monitored.
  • the apparatus includes a target module, where the target module is a connection establishment module of the second application or the application framework layer, and the connection establishment module is used to initialize the first application After running, a communication channel between the first application and the second application is established.
  • the application monitoring module is configured to send an Android interface definition language AIDL binding request to the target module.
  • the target module is configured to receive the AIDL binding request.
  • the target module is configured to send an AIDL binding object to the application monitoring module based on the AIDL binding request, where the AIDL binding object includes object data for establishing the communication channel.
  • the application monitoring module is configured to receive the AIDL binding object.
  • the connection establishment module in response to the target module being the connection establishment module, is configured to: obtain the AIDL binding object from the second application.
  • the second application includes a monitoring service management module and a behavior analysis module.
  • the monitoring service management module is configured to receive the interface invocation event of each interface by the first application transmitted by the application monitoring module.
  • the behavior analysis module is configured to acquire, from the monitoring service management module, the interface invocation events of the respective interfaces by the first application.
  • the behavior analysis module is configured to analyze the security of the first application according to the interface invocation events of the various interfaces.
  • the second application includes a monitoring service management module and a behavior analysis module.
  • the monitoring service management module is configured to receive the interface invocation event transmitted by the application monitoring module.
  • the monitoring service management module is configured to report the interface invocation event to the behavior analysis module based on the request of the behavior analysis module.
  • the behavior analysis module is configured to analyze the security of the first application according to the interface invocation event.
  • an electronic device in a third aspect, includes a processor and a memory, and the memory is used to store a program that supports the electronic device to perform any of the methods described in the first aspect, and to store a program for Data involved in implementing any of the methods described in the first aspect above.
  • the processor is configured to execute programs stored in the memory.
  • the electronic device may also include a communication bus for establishing a connection between the processor and the memory.
  • a computer-readable storage medium where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium is run on a computer, the computer executes the method described in any one of the above-mentioned first aspect.
  • a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the first aspect above.
  • the application framework layer of the electronic device stores the application monitoring module, and after the first application is initialized, the electronic device controls the first application to load the application monitoring module.
  • the application monitoring module is loaded into the process of the first application by the first application and becomes a runtime module of the first application and then actively interacts with the second application. That is, the application monitoring module obtains the interface invocation event of the first application to the interface, and reports the interface invocation event to the second application through the communication channel between the first application and the second application.
  • the behavior of an application is analyzed to determine whether there is a security risk in the first application, and an early warning prompt is provided when there is a security risk.
  • the behavior of the first application can be monitored without inserting a monitoring code into the application package of the first application, so as to avoid the situation that the application cannot run or some functions are unavailable due to modification of the application package, so that the system can be guaranteed stability.
  • FIG. 1 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • FIG. 2 is a block diagram of a software structure of an electronic device provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • connection establishment module and an application monitoring module provided by an embodiment of the present application
  • FIG. 5 is a schematic diagram of a function introduction of an application market provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of an application security analysis method provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a code implementation relationship provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another applied security analysis method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another applied security analysis method provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an application security analysis device provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a second application provided by an embodiment of the present application.
  • the application security analysis method provided by the embodiment of the present application may be applied to an electronic device capable of installing and running an application.
  • the electronic device may be a device such as a wearable device, a vehicle equipment, and a terminal device.
  • terminal devices may include but are not limited to mobile phones, tablet computers, augmented reality (AR)/virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs) ), netbooks, personal digital assistants (PDAs).
  • the electronic device has an Android system, that is, the method can be applied to the Android platform.
  • FIG. 1 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charge management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2 , mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, buttons 190, motor 191, indicator 192, camera 193, display screen 194, and Subscriber identification module (subscriber identification module, SIM) card interface 195 and so on.
  • SIM Subscriber identification module
  • the sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, and ambient light. Sensor 180L, bone conduction sensor 180M, etc.
  • the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 100 .
  • the electronic device 100 may include more or less components than shown, or combine some components, or separate some components, or arrange different components.
  • the illustrated components may be implemented in hardware, software, or a combination of software and hardware.
  • the processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, memory, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (NPU) Wait. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
  • application processor application processor, AP
  • modem processor graphics processor
  • graphics processor graphics processor
  • ISP image signal processor
  • controller memory
  • video codec digital signal processor
  • DSP digital signal processor
  • NPU neural-network processing unit
  • the controller may be the nerve center and command center of the electronic device 100 .
  • the controller can generate an operation control signal according to the instruction operation code and timing signal, and complete the control of fetching and executing instructions.
  • a memory may also be provided in the processor 110 for storing instructions and data.
  • the memory in processor 110 is cache memory. This memory may hold instructions or data that have just been used or recycled by the processor 110 . If the processor 110 needs to use the instruction or data again, it can be called directly from the memory. Repeated accesses are avoided and the latency of the processor 110 is reduced, thereby increasing the efficiency of the system.
  • the processor 110 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transceiver (universal asynchronous transmitter) receiver/transmitter, UART) interface, mobile industry processor interface (MIPI), general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and / or Universal Serial Bus (universal serial bus, USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM pulse code modulation
  • UART universal asynchronous transceiver
  • MIPI mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB Universal Serial Bus
  • the I2C interface is a bidirectional synchronous serial bus that includes a serial data line (SDA) and a serial clock line (SCL).
  • the processor 110 may contain multiple sets of I2C buses.
  • the processor 110 can be respectively coupled to the touch sensor 180K, the charger, etc. through different I2C bus interfaces.
  • the processor 110 may couple the touch sensor 180K through the I2C interface, so that the processor 110 and the touch sensor 180K communicate with each other through the I2C bus interface, so as to realize the touch function of the electronic device 100 .
  • the MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193 .
  • MIPI interfaces include camera serial interface (CSI), display serial interface (DSI), etc.
  • the processor 110 and the display screen 194 communicate through a DSI interface to implement the display function of the electronic device 100 .
  • the USB interface 130 is an interface that conforms to the USB standard specification, and may specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, and the like.
  • the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration, and does not constitute a structural limitation of the electronic device 100 .
  • the electronic device 100 may also adopt different interface connection manners in the foregoing embodiments, or a combination of multiple interface connection manners.
  • the power management module 141 is used for connecting the battery 142 , the charging management module 140 and the processor 110 .
  • the power management module 141 receives input from the battery 142 and/or the charging management module 140 and supplies power to the processor 110 , the internal memory 121 , the external memory, the display screen 194 , the camera 193 , and the wireless communication module 160 .
  • the wireless communication function of the electronic device 100 may be implemented by the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modulation and demodulation processor, the baseband processor, and the like.
  • the mobile communication module 150 may provide wireless communication solutions including 2G/3G/4G/5G etc. applied on the electronic device 100 .
  • the mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA) and the like.
  • the wireless communication module 160 can provide applications on the electronic device 100 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellites Wireless communication solutions such as global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared technology (IR).
  • WLAN wireless local area networks
  • BT Bluetooth
  • GNSS global navigation satellite system
  • FM frequency modulation
  • NFC near field communication
  • IR infrared technology
  • the antenna 1 of the electronic device 100 is coupled with the mobile communication module 150, and the antenna 2 is coupled with the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology.
  • the wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), broadband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC , FM, and/or IR technology, etc.
  • the GNSS may include global positioning system (global positioning system, GPS), global navigation satellite system (global navigation satellite system, GLONASS), Beidou navigation satellite system (beidou navigation satellite system, BDS), quasi-zenith satellite system (quasi -zenith satellite system, QZSS) and/or satellite based augmentation systems (SBAS).
  • global positioning system global positioning system, GPS
  • global navigation satellite system global navigation satellite system, GLONASS
  • Beidou navigation satellite system beidou navigation satellite system, BDS
  • quasi-zenith satellite system quadsi -zenith satellite system, QZSS
  • SBAS satellite based augmentation systems
  • the electronic device 100 implements a display function through a GPU, a display screen 194, an application processor, and the like.
  • the GPU is a microprocessor for image processing, and is connected to the display screen 194 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations for graphics rendering.
  • Processor 110 may include one or more GPUs that execute program instructions to generate or alter display information.
  • Touch sensor 180K also called “touch panel”.
  • the touch sensor 180K may be disposed on the display screen 194 , and the touch sensor 180K and the display screen 194 form a touch screen, also called a “touch screen”.
  • the touch sensor 180K is used to detect a touch operation on or near it.
  • the touch sensor can pass the detected touch operation to the application processor to determine the type of touch event.
  • Visual output related to touch operations may be provided through display screen 194 .
  • the touch sensor 180K may also be disposed on the surface of the electronic device 100 , which is different from the location where the display screen 194 is located.
  • the indicator 192 can be an indicator light, which can be used to indicate the charging state, the change of the power, and can also be used to indicate a message, a missed call, a notification, and the like.
  • the software system of the electronic device 100 may adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture.
  • the embodiment of the present invention takes an Android system with a layered architecture as an example to illustrate the software structure of the electronic device 100 as an example.
  • FIG. 2 is a block diagram of the software structure of the electronic device 100 according to the embodiment of the present application.
  • the layered architecture divides the software into several layers, and each layer has a clear role and division of labor. Layers communicate with each other through software interfaces.
  • the Android system is divided into four layers, which are, from top to bottom, an application layer, an application framework layer, an Android runtime (Android runtime) and a system library, and a kernel layer.
  • the application layer can include a series of application packages.
  • the application package may include applications such as gallery, camera, navigation, contacts, and application market.
  • An app market is a management app that can be used to manage other apps.
  • the user can trigger the electronic device to download the application from the application market.
  • the user can trigger the electronic device to update the version of the installed application in the application market.
  • the application market can selectively monitor and analyze the behavior of some applications, so as to determine whether these applications have security risks.
  • the application framework layer provides an application programming interface (API) and a programming framework for applications in the application layer.
  • API application programming interface
  • the application framework layer includes some predefined functions.
  • the application framework layer may include a connection establishment module and an application monitoring module.
  • connection establishment module may be used to establish a communication channel between the first application and the application market, where the communication channel mainly establishes a basis for the application market to perform security analysis on the first application.
  • the first application may refer to an application other than the application market among all the applications installed in the electronic device.
  • the application monitoring module can be loaded by the first application as a runtime module of the first application, so when the first application calls the interface, the application monitoring module can obtain the interface invocation event of the first application to the interface, and pass the interface invocation event through the above communication.
  • the channel is reported to the application market for security analysis.
  • the runtime module refers to a module that can be run whenever it wants to be used.
  • the application framework layer may further include: a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.
  • a window manager is used to manage window programs.
  • the window manager can get the size of the display screen, determine whether there is a status bar, lock the screen, take screenshots, etc.
  • Content providers are used to store and retrieve data and make these data accessible to applications.
  • the data may include video, images, audio, calls made and received, browsing history and bookmarks, phone book, etc.
  • the view system includes visual controls, such as controls for displaying text, controls for displaying pictures, and so on. View systems can be used to build applications.
  • a display interface can consist of one or more views.
  • the display interface including the short message notification icon may include a view for displaying text and a view for displaying pictures.
  • the phone manager is used to provide the communication function of the electronic device 100 .
  • the management of call status including connecting, hanging up, etc.).
  • the resource manager provides various resources for the application, such as localization strings, icons, pictures, layout files, video files and so on.
  • the notification manager enables applications to display notification information in the status bar, which can be used to convey notification-type messages, and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc.
  • the notification manager can also display notifications in the status bar at the top of the system in the form of graphs or scroll bar text, such as notifications of applications running in the background, and notifications on the screen in the form of dialog windows. For example, text information is prompted in the status bar, a prompt sound is issued, the electronic device vibrates, and the indicator light flashes.
  • Android Runtime includes core libraries and a virtual machine. Android runtime is responsible for scheduling and management of the Android system.
  • the core library consists of two parts: one is the function functions that the java language needs to call, and the other is the core library of Android.
  • the application layer and the application framework layer run in virtual machines.
  • the virtual machine executes the java files of the application layer and the application framework layer as binary files.
  • the virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, safety and exception management, and garbage collection.
  • a system library can include multiple functional modules. For example: surface manager (surface manager), media library (Media Libraries), 3D graphics processing library (eg: OpenGL ES), 2D graphics engine (eg: SGL), etc.
  • surface manager surface manager
  • media library Media Libraries
  • 3D graphics processing library eg: OpenGL ES
  • 2D graphics engine eg: SGL
  • the Surface Manager is used to manage the display subsystem and provides a fusion of 2D and 3D layers for multiple applications.
  • the media library supports playback and recording of a variety of commonly used audio and video formats, as well as still image files.
  • the media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.
  • the 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.
  • 2D graphics engine is a drawing engine for 2D drawing.
  • the kernel layer is the layer between hardware and software.
  • the kernel layer contains at least display drivers, camera drivers, audio drivers, and sensor drivers.
  • a corresponding hardware interrupt is sent to the kernel layer.
  • the kernel layer processes touch operations into raw input events (including touch coordinates, timestamps of touch operations, etc.). Raw input events are stored at the kernel layer.
  • the application framework layer obtains the original input event from the kernel layer, and identifies the control corresponding to the input event. Taking the touch operation as a touch click operation, and the control corresponding to the click operation is the control of the camera application icon, for example, the camera application calls the interface of the application framework layer to start the camera application, and then starts the camera driver by calling the kernel layer.
  • the camera 193 captures still images or video.
  • FIG. 3 shows an application scenario according to an exemplary embodiment. Schematic, in implementation:
  • the user triggers the electronic device to obtain an application package (application package, APK) of APP1.
  • APK application package
  • the application package of APP1 may be downloaded by the electronic device from a pop-up webpage.
  • the pop-up web page may be a web page recommended by a running application in the electronic device, that is, APP1 may not be listed on the application market, and has not undergone the security detection required before the application market is listed.
  • the user triggers the electronic device to install APP1 based on the downloaded application package, and after the electronic device completes the installation, the electronic device can run APP1 to start APP1.
  • the behavior of APP1 after startup is to call the interface behavior.
  • APP1 if APP1 needs to turn on Bluetooth, APP1 will call the interface for turning on Bluetooth, if APP1 needs to connect to the network, APP1 will call the interface for connecting to the network, and if APP1 needs to obtain contact information, APP1 will call to obtain contact information.
  • APP1 needs to obtain the media access control (media access control, MAC) address, APP1 will call the interface for obtaining the MAC, and if APP1 needs to start the camera, APP1 will call the interface for starting the camera, etc.
  • the behavior of APP1 may have potential security risks, and there may be some illegal behaviors in the behavior of the interface call, such as obtaining the user's private information from the electronic device without authorization.
  • the application market in the electronic device can monitor the behavior of APP1 to determine whether the behavior of APP1 has potential security risks, such as judging whether APP1 has malicious behavior, whether there is privacy compliance, whether there is a permission violation, etc. .
  • the monitoring result can be fed back to the user, so as to give a corresponding prompt to the user.
  • the electronic device may prompt the user through a pop-up window.
  • the pop-up window may display the warning text “APP1 is malware, it is recommended to uninstall it”.
  • the electronic device may also feed back the specific content of the malicious behavior of APP1 to the user in the pop-up window, for example, the specific content is "trying to turn on the camera without authorization”.
  • the pop-up window may also include an “uninstall” option 31 .
  • the user can click option 31 to trigger the electronic device to perform the process of uninstalling APP1.
  • the electronic device closes APP1 after detecting the user's triggering operation on option 31, and then the electronic device uninstalls APP1. In this way, it is convenient to quickly uninstall APP1, which improves the convenience of operation.
  • the electronic device may also display to the user a confirmation prompt message whether to agree to uninstall.
  • the electronic device closes APP1 and executes the process of uninstalling APP1. In this way, the uninstallation operation is performed under the condition of user authorization, which improves the user experience effect.
  • the pop-up window may also include a “close window” option 32 .
  • the user does not need to uninstall APP1, he can click option 32.
  • the electronic device closes the pop-up window.
  • the above description is given by taking the electronic device prompting the user through a pop-up window as an example.
  • the user may also be prompted in any other perceptible manner to the user.
  • the user may be prompted by means of vibration, a prompt sound, a splash screen, etc. Not limited.
  • the application package of APP1 is downloaded from a pop-up webpage.
  • the application package of APP1 may also be obtained through other download methods.
  • the application package of APP1 may be downloaded by the electronic device from a cloud disk or a network disk, or may be downloaded from an application market.
  • the embodiment of this application does not specifically limit the download method of the application package of APP1. , that is, the electronic device can monitor the behavior of all installed applications.
  • connection establishment module and the application monitoring module in the application framework layer are introduced.
  • the main function of the connection establishment module is to establish a communication channel between the first application and the application market.
  • the communication channel is used for data interaction between the application market and the first application, so that the application market can determine whether to monitor the first application.
  • Interface calling behavior of an application and monitoring the interface calling behavior of the first application under the condition of determining to monitor the interface calling behavior of the first application. That is, the communication channel establishes a foundation for monitoring the first application in the application market.
  • the application monitoring module may be loaded by the first application as a runtime module of the first application. As an example, if the first application invokes the interface, the application monitoring module can acquire the interface invocation event of the invoked interface by replacing the interface method address, and send the acquired interface invocation event to the application market through the above-mentioned communication channel, In order to facilitate the application market to analyze the security of the first application, the specific implementation may refer to the embodiment shown in FIG. 6 below.
  • connection establishment module and the application monitoring module may be shared by multiple first applications.
  • multiple first applications may load the application monitoring module.
  • the loading process of multiple first applications may be parallel.
  • the process of behavior monitoring is serial, that is, after the security of one first application is determined, the monitoring of the next first application is continued.
  • the application market involved in the embodiments of the present application is introduced next.
  • the application market integrates a monitoring service management module and a behavior analysis module.
  • the monitoring service management module may maintain an application monitoring list, and the application monitoring list may be used to store application information of the first application to be monitored. When the preset dynamic monitoring conditions are met, the monitoring service management module notifies the first application to be monitored in the application monitoring list to enable behavior monitoring, where the preset dynamic monitoring conditions may be preset.
  • the monitoring service management module may also be configured to receive a monitoring service registration request of the first application, the monitoring service registration request may carry application information of the first application, and according to the monitoring service registration request, it may be determined whether to perform the registration request for the first application. Behavior monitoring. In one example, in a case where it is determined to perform behavior monitoring on the first application requesting registration, application information of the first application requesting registration may be added to the application monitoring list.
  • the monitoring service management module may also be configured to receive the interface invocation event reported by the above-mentioned application monitoring module.
  • the behavior analysis module may be configured to analyze the security of the first application based on the interface invocation event received by the monitoring service management module.
  • the behavior analysis module may include multiple plug-ins, and each plug-in has different logical analysis functions.
  • the functions of multiple plug-ins may include, but are not limited to, analyzing whether the privacy policy statement exists, analyzing whether there is unauthorized user authorization
  • the privacy policy statement refers to the application that declares what permissions it wants to obtain and what operations it will do.
  • the embodiment of the present application does not need to insert monitoring code into the application package, but implants an application monitoring module related to monitoring in the application framework layer, and installs an integrated monitoring service management module and behavior analysis.
  • the application market of the module can avoid the situation that the application cannot run or some functions are unavailable, and can ensure the stability of the application.
  • the operation of the application market and the operation of other applications are independent of each other and do not affect each other, the stability of the system can be guaranteed.
  • FIG. 6 is a schematic flowchart of an application security analysis method according to an exemplary embodiment, which may specifically include some or all of the following contents.
  • the connection establishment module requests the Android interface definition language (AIDL) binding object from the monitoring service management module.
  • AID Android interface definition language
  • AIDL is an implementation of process communication in the Android system, which can be used to establish a communication connection between different processes, so that one application can access the services of another application.
  • the implementation principle of AIDL is to realize communication through code.
  • the application market can define an AIDL binding object, and the AIDL binding object includes a Object data for establishing a communication channel.
  • the AIDL binding object includes at least one execution method, and each execution method corresponds to a piece of code, or it can be understood that each execution method corresponds to an instance. In this way, if the first application obtains the AIDL binding object, it can communicate with the application market by invoking the execution method in the AIDL binding object.
  • the connection establishment module in the electronic device may request the AIDL binding object from the monitoring service management module in the application market in advance.
  • the monitoring service management module creates an AIDL binding object.
  • the AIDL binding object includes at least one execution method.
  • the AIDL binding object created by the monitoring service management module may include a registration method, an event reporting method, and a notification sending method.
  • the registration method may be used for the first application to register with the application market.
  • the event reporting method may be used for the first application to send an interface invocation event to the application market, and the notification sending method may be used for the application market to send a notification message to the first application.
  • the first application obtains the AIDL binding object, when the registration method is called by the first application, the first application can initiate a monitoring service registration request to the application market, thereby realizing the registration between the first application and the application market.
  • the first application can send an interface calling event to the application market, thereby realizing the reporting communication between the first application and the application market; for another example, if the notification sending method After being called by the application market, the application market can send a monitoring activation notification to the first application for instructing the first application to activate behavior monitoring.
  • the monitoring service management module creates the AIDL binding object after the connection establishment module requests the AIDL binding object.
  • the monitoring service management module may further create an AIDL binding object in advance, for example, create an AIDL binding object before the connection establishment module requests the AIDL binding object.
  • the monitoring service management module sends the created AIDL binding object to the connection establishment module.
  • connection establishment module may temporarily store the AIDL binding object, so as to facilitate subsequent AIDL binding of the first application and the application market based on the AIDL binding object.
  • connection establishment module requests the AIDL binding object from the monitoring service management module in advance, so that the subsequent first application can be AIDL bound with the application market through the connection establishment module, so that if there are multiple first applications and application markets When AIDL binding is performed, compared with multiple first applications directly requesting AIDL binding from the application market, the operation burden of the application market can be reduced to a certain extent.
  • steps 601 to 603 may be executed before the first application is initialized and run, and the specific execution time is not specifically limited. Exemplarily, steps 601 to 603 may be executed after the application market is started.
  • connection establishment module requests the AIDL binding object from the monitoring service management module
  • monitoring process of the first application is introduced next.
  • the first application is initialized and run.
  • the first application may be a newly installed application in the electronic device.
  • the first application may be an application whose version is updated in the electronic device.
  • the initial running of the first application may refer to the first running of the first application after being installed in the electronic device.
  • the first application may be installed in the electronic device for the first time, that is, the first application has not been installed in the electronic device before.
  • the first application may also be installed in the electronic device not for the first time, for example, in the electronic device The first app was installed before, but was uninstalled without running it.
  • the initial running of the first application may also refer to the first running of the first application in the electronic device after the version is updated. It is not difficult to understand that after the version of the first application is updated, the first application can execute The operation of the first application may change, and in this case, there may be potential security risks, so the initial running of the first application after the version update of the first application can also be determined as the initial running of the first application.
  • the first application is APP1
  • APP1 is downloaded and installed from a pop-up advertisement promotion page.
  • the first application loads the application monitoring module.
  • the application framework layer includes multiple management modules, one of which is used to manage installation and uninstallation of applications.
  • the embodiment of the present application refers to a management module for managing installation and uninstallation of applications as a target management module.
  • the target management module may be the pms manager module.
  • a function may be added to the target management module, and the function may be used to control the first application to actively load the application monitoring module of the application framework layer after initialized running. That is, in response to the initial operation of the first application, the application monitoring module is loaded for the first application. For example, after the initial operation of APP1, the target management module loads the application monitoring module of the application framework layer for APP1.
  • the application monitoring module sends an AIDL binding request to the connection establishment module.
  • the AIDL binding request is used to request the connection establishment module to perform AIDL binding between the first application and the application market.
  • the application monitoring module actively sends an AIDL binding request to the connection establishment module to request an AIDL binding object.
  • connection establishment module sends the AIDL binding object to the application monitoring module.
  • the connection establishment module can send the stored AIDL binding object after receiving the AIDL binding request from the application monitoring module.
  • the application monitoring module can then perform data interaction with the application market by calling the execution method in the AIDL binding object. That is to say, after the first application obtains the AIDL binding object created by the monitoring service management module in the application market, it means that the AIDL binding between the first application and the application market is realized, that is, the first application is established.
  • the communication channel between the application and the application market is to send the stored AIDL binding object after receiving the AIDL binding request from the application monitoring module.
  • the application monitoring module in this way, the application monitoring module can then perform data interaction with the application market by calling the execution method in the AIDL binding object. That is to say, after the first application obtains the AIDL binding object created by the monitoring service management module in the application market, it means that the AIDL binding between the first application and the application market is realized, that is, the first application is established.
  • the communication channel between the application and the application market is to send the stored AIDL binding object after receiving
  • the application monitoring module sends a monitoring service registration request to the monitoring service management module.
  • the monitoring service registration request may carry application information of the first application.
  • the application information can be used to uniquely identify the first application.
  • the application information may be an application identifier of the first application.
  • the application identification is an application ID (identity).
  • the first application may be a known application or an unknown application.
  • the known application here generally refers to an application known to have no security risks, and the known application is generally downloaded from a known and reliable way downloaded, and unknown apps are usually apps that may pose a security risk.
  • an application downloaded from an application market can generally be regarded as a known application, and an application downloaded from an unknown website can generally be regarded as an unknown application. Therefore, in implementation, if the first application is a known application, its behavior may not be monitored, but if the first application is an unknown application, it is determined to monitor the behavior of the first application.
  • the application monitoring module may send a monitoring service registration request to the application market, and send the application information of the first application to the application market, so that the application market can determine whether the first application is a known application or an unknown application, thereby determining whether the first application is a known application or an unknown application. Whether to monitor the behavior of the first application.
  • the application monitoring module acquires the AIDL binding object created by the monitoring service management module during the AIDL binding process, and the AIDL binding object includes a registration method
  • the application monitoring module can call the AIDL binding object in the AIDL binding object.
  • the registration method At this time, the registration method in the application market is triggered by the AIDL mechanism.
  • the application monitoring module can send the monitoring service registration request to the monitoring service management module through the registration method.
  • the monitoring service management module receives the monitoring service registration request through the registration method, that is, the registration method can be used for the first application and the application market to negotiate how to send or receive the monitoring service registration request, so as to realize the relationship between the first application and the application market. registered communications.
  • the monitoring service management module determines, according to the monitoring service registration request, whether to monitor the interface invocation event of the first application to the interface.
  • the monitoring service management module may obtain a whitelist, and the whitelist includes application information of known applications. It is not difficult to understand that the application indicated by the application information in the whitelist is an application that does not have potential security risks. known applications.
  • the monitoring and management service module can determine whether the first application belongs to the white list. If the first application does not belong to the whitelist, it is determined to monitor the interface invocation event of the first application to the interface, that is, it is determined that the first application is an application to be detected. If the first application belongs to the white list, it is determined not to monitor the interface invocation event of the first application to the interface, that is, it is determined that the first application does not have any potential security risks.
  • the application market can check whether the application ID of APP1 belongs to the whitelist. If the application ID of APP1 belongs to the whitelist, it means that APP1 is a known application. At this time, it can be determined not to monitor the interface call event of APP1 to the interface. Otherwise, if APP1 If the application ID of APP1 does not belong to the whitelist, it means that APP1 is an unknown application. At this time, it can be determined to monitor the interface call events of APP1 to the interface.
  • the following steps 610-614 may be entered. If the monitoring service management module determines not to monitor the interface invocation event of the first application to the interface, the following step 615 is performed.
  • the monitoring service management module updates the application monitoring list to obtain a first monitoring list.
  • the first monitoring list includes application information of the first application.
  • the specific implementation of updating the application monitoring list by the monitoring service management module may include: the monitoring service management module adds the application information of the first application to the application monitoring list to update the application monitoring list.
  • the monitoring service management module may also use other methods to record the first application to be monitored.
  • the monitoring service management module may also use a collection method to record.
  • the specific implementation of updating the application monitoring list by the monitoring service management module may further include: the monitoring service management module adds the application information of the first application to the application monitoring list, and marks the state of the first application as a state to be monitored .
  • the first monitoring list is obtained by updating the application monitoring list, and the applications to be monitored are recorded through the first monitoring list, so that the applications in the first monitoring list can be monitored in batches subsequently.
  • the first monitoring list may be updated.
  • the updated first monitoring list does not include applications that have undergone security analysis, that is, the application information of the first application can be deleted from the first monitoring list, so that repetition of the first application can be avoided. monitor.
  • the status of the application that has undergone security analysis in the updated first monitoring list is marked as analyzed.
  • the first application in the first monitoring list corresponds to an indicator, and the indicator may be used to indicate whether the first application has performed security analysis. For example, when the indicator is "1", it means that the first application has performed security analysis, and when the indicator is "0", it means that the first application has not performed security analysis.
  • the monitoring service management module updates the indicator corresponding to the first application, so that the updated indicator indicates that the first application is an application that has undergone security analysis.
  • the indicator of the first application is updated from "0" to "1", that is, after the monitoring service management module determines the security of the first application, it may not update the application information of the first application from the first monitoring service. delete from the list.
  • the monitoring service management module determines whether a preset dynamic monitoring condition is currently satisfied.
  • Preset dynamic monitoring conditions can be set in advance.
  • the preset dynamic monitoring condition may refer to every preset time period. For example, 5 minutes or 30 minutes.
  • the preset duration may be set by the user according to actual needs, or the preset duration may also be set by default by the electronic device, which is not limited in this embodiment of the present application.
  • the preset dynamic monitoring condition may refer to that the number of applications to be monitored recorded in the first monitoring list reaches a preset value.
  • the preset value may be set by a user according to actual needs, or the preset value may also be set by default by an electronic device, which is not limited in this embodiment of the present application.
  • the preset value is 1, it means that the monitoring service management module is monitoring a single application.
  • the preset value is greater than 1, it indicates that the monitoring service management module can monitor the security of applications in batches.
  • the monitoring service management module determines that the number of applications to be monitored included in the first monitoring list is 2, it can be determined that the preset dynamic monitoring condition is currently satisfied.
  • step 612 determines that the preset dynamic monitoring conditions are currently met. If the monitoring service management module determines that the preset dynamic monitoring conditions are currently met, the following step 612 is entered; otherwise, if the preset dynamic monitoring conditions are not currently met, the following step 615 is entered.
  • the monitoring service management module sends a monitoring start notification to the application monitoring module.
  • the monitoring service management module can call the AIDL binding object in the AIDL binding object.
  • the notification sending method in the first application can be triggered by the AIDL mechanism.
  • the monitoring service management module can send the monitoring start notification to the first application through the notification sending method.
  • the application monitoring module receives the monitoring start notification through the notification sending method, that is, the notification sending method can be used for the application market and the first application to negotiate how to send or receive the notification, thereby realizing communication.
  • the monitoring service management module may respectively deliver a monitoring start notification to the plurality of applications to be monitored.
  • the monitoring service management module can query the indicator of each application in the plurality of applications to be monitored in the first monitoring list, and then report to the plurality of applications to be monitored according to the indicator of each application.
  • the application that has not undergone security analysis in the system sends a notification to enable monitoring.
  • the target refers to an interface belonging to the interface monitoring list, and the interface monitoring list can be preset.
  • the interface monitoring list includes interface information of the interface to be monitored, and the interface information can be used to uniquely identify an interface.
  • the interface information is an interface ID.
  • the application monitoring module After the application monitoring module receives the monitoring enable notification, in the process of calling the interface, it can detect whether the interface called by the first application belongs to the interface monitoring list, and if the called interface belongs to the interface monitoring list, it is determined that the called interface is the target interface ; otherwise, if the called interface does not belong to the interface monitoring list, it is determined that the called interface is not the target interface.
  • the application monitoring module acquires the interface invocation event of the first application to the target interface.
  • the interface call can be implemented by calling the API method. Therefore, under normal circumstances, the first application calling the target interface will execute the API corresponding to the target interface. method.
  • the application monitoring module since it is necessary to monitor the invocation of the target interface, the application monitoring module does not call the API method of the target interface, but instead calls the hook method set in the application monitoring module. By executing the hook method, the interface invocation event of the target interface can be obtained, and the API method corresponding to the target interface can be called back through the hook method, so as to monitor the interface invocation in the process of invoking the target interface.
  • each API method in Android will be represented by a structure object in the Art virtual machine.
  • the structure object is the artMethod structure object .
  • the method ⁇ in FIG. 7 can be used to define the structure object.
  • the specified member variable is the API method address of the API method.
  • the location pointed to by the API method address represents the execution entry of the API method, and the API method can be called through the execution entry. Therefore, the application monitoring module can replace the API method address of the API method of the target interface to be called with the hook method address of the hook method, so as to call the hook method based on the hook method address to obtain the interface call event of the target interface.
  • the hook method can be understood as backing up the API method of the target interface, and adding monitoring functions before and after the backed up API method.
  • the API method address of the target interface can be copied in the hook method, which is equivalent to backing up the API method of the target interface. Therefore, calling the hook method can not only realize the invocation of the target interface, but also obtain the interface invocation event of the target interface in the process of invoking the target interface, so as to achieve the purpose of monitoring the invocation of the target interface.
  • the application monitoring module directly calls the API method of the interface.
  • the method of method address replacement is used in the embodiment of the present application, so there is no need to add monitoring code of the calling event at the actual calling place of the target interface, and the monitoring of the increase or decrease of the target interface only performs corresponding actions on the application monitoring module. Just modify it, so that the monitoring management of the target interface does not have strong coupling with the bottom layer of the Android system, thus ensuring the stability of the system.
  • the application monitoring module when the first application calls the target interface, the application monitoring module obtains the interface call event of the target interface as an example for description.
  • the application monitoring module may obtain the interface invocation event of the invoked interface, that is, as long as the first application executes the interface invocation operation, regardless of whether the invoked interface is the target or not Both the interface and the application monitoring module perform the operation of obtaining the interface call event.
  • the interface invocation event may include an interface identifier, for example, the interface identifier is an interface ID.
  • the interface invocation event may further include an interface invocation start time and/or an interface invocation end time.
  • the interface call start time refers to the time when the interface is started to be called, and the interface call end time refers to the time when the interface is terminated.
  • the interface invocation event may be an event log: Interface A was invoked at 15:05:15.
  • the API call event includes the API call start time and/or the API call end time, in some scenarios, the accuracy of the application market analysis of whether the first application has potential security risks can be improved.
  • the application monitoring module reports the interface invocation event of the first application to the monitoring service management module.
  • the application monitoring module can call the event in the AIDL binding object The reporting method.
  • the event reporting method in the application market is triggered by the AIDL mechanism.
  • the application monitoring module can report the interface invocation event to the application market through the event reporting method.
  • the application market receives the interface invocation event through the event reporting method, that is, the event reporting and sending method can be used for the first application and the application market to negotiate how to send or receive the interface invocation event, so as to realize the communication between the first application and the application market. reporting communications.
  • the application monitoring module reports the interface invocation event through the communication channel between the first application and the application market, so as to facilitate the subsequent security analysis of the application market.
  • the interface invocation event may include the interface identification of the target interface and the start time of the interface invocation.
  • APP1 calls the user address information acquisition interface 000001, it is determined whether the interface 000001 belongs to the interface monitoring list, and if the interface 000001 belongs to the interface monitoring list, it is determined that the interface called by APP1 is the target interface.
  • APP1 uses the hook method address to replace the API method address of interface 000001 through the application monitoring module, so that APP1 executes the hook method.
  • report to the application market the interface invocation event corresponding to APP1 starting to invoke interface 000001, for example, the interface invocation event includes the interface ID.
  • the end time of the interface call of the interface 000001 may be continuously reported to the application market.
  • APP1 invokes the interface 000002 for which the user agrees to the privacy statement
  • the interface 000002 belongs to the interface monitoring list
  • APP1 reports the interface invocation event of the interface 000002 to the application market according to the above method.
  • the first application can easily filter out the monitoring-related instruction messages sent by the application market, and the first application can choose independently. Whether to report the behavior of calling the interface, so that the first application can escape the monitoring of the application market.
  • the application monitoring module is implanted in the application framework layer in the embodiment of the present application, after the first application is initialized and run, the first application loads the application monitoring module into a runtime module of the first application, and the application monitoring module is configured to load the application monitoring module into a runtime module of the first application.
  • a communication channel dedicated to monitoring is established between the first application and the application market, and the application monitoring module monitors the first application and reports the behavior of the first application based on the communication channel, so as to ensure the reliability and effectiveness of monitoring the first application .
  • the embodiment of the present application performs analysis based on the interface invocation event reported by the application monitoring module, and does not involve the user's private data, so there is no threat of leaking the user's data privacy.
  • the monitoring management service module waits for the next monitoring service registration request.
  • the monitoring service management module determines not to monitor the behavior of the first application, it may continue to wait for the next monitoring service registration request of the first application.
  • the electronic device stores the application monitoring module in the application framework layer, and after the first application is initialized, the electronic device controls the first application to load the application monitoring module.
  • the application monitoring module is loaded into the process of the first application by the first application and becomes a runtime module of the first application, it actively interacts with the application market, that is, the application market can monitor the behavior of the first application through the application monitoring module. It can be seen that the behavior monitoring of the first application no longer involves the application framework layer, so that the interface call event reporting mechanism can be decoupled from the system platform.
  • the Android platform implanting the application monitoring module in the application framework layer will not interfere with the normal operation of the entire Android platform, and the changes and upgrades of the Android platform will not affect the interface monitoring.
  • the security analysis of the application by the application market is used as an example for description.
  • the security analysis of the application may also be performed by another management application integrated with the monitoring service management module and the behavior analysis module.
  • the management application may be referred to as the second application.
  • a designated application integrated with a monitoring service management module and a behavior analysis module may be installed in the electronic device, and the designated application is dedicated to analyzing the security of the application in the electronic device, that is, the second application may be the designated application .
  • a communication channel may be established between the first application and the specified application through the connection establishment module of the application framework layer, so that the specified application can monitor and analyze the behavior of the first application through the communication channel.
  • some or all of the modules in the monitoring service management module and the behavior analysis module may also be deployed in the cloud, so as to perform security analysis on the first application through interaction between the electronic device and the cloud.
  • the monitoring service management module may be deployed in a known management application in the electronic device, and the behavior analysis module may be deployed in the cloud. In this way, after receiving the interface calling event, the monitoring service management module can send the received interface calling event to the cloud, and the behavior analysis module of the cloud analyzes the security of the first application based on the received interface calling event.
  • the methods provided by the embodiments of the present application may also be applied to a server.
  • the server may be installed with a second application. After the first application is downloaded and installed in the server, the first application is initially run in During the process, the security of the first application may be monitored and analyzed by the second application in the server, which is not limited in this embodiment of the present application.
  • FIG. 8 is a schematic diagram of an application security analysis method provided according to another exemplary embodiment. The method may be applied to the above electronic device, and may specifically include some or all of the following contents:
  • 801 to 802 are the same as the descriptions at 604 to 605 above, and are not repeated here.
  • the application monitoring module sends an AIDL binding request to the monitoring service management module.
  • a communication channel may be established between the first application and the second application based on the AIDL mechanism, and the communication channel is dedicated for the second application to monitor the first application.
  • An application performs behavior monitoring. For this, AIDL binding between the first application and the second application is required, so after the first application loads the application monitoring module, the application monitoring module can directly send an AIDL binding request to the monitoring service management module, and the AIDL binding request is used to indicate The monitoring service management module returns the AIDL binding object.
  • the AIDL binding object includes at least one execution method.
  • the AIDL binding object created by the monitoring service management module may include a registration method, an event reporting method, and a notification sending method, where the registration method can be used for Registering with the second application, the event reporting method may be used for sending an interface invocation event to the second application, and the notification sending method is used for the second application to send a notification message to the first application.
  • the first application obtains the AIDL binding object
  • the registration method is called by the first application
  • the first application can initiate a monitoring service registration request to the second application, thereby realizing the relationship between the first application and the second application.
  • the first application can send an interface calling event to the second application, thereby realizing the reporting communication between the first application and the second application;
  • the notification sending method is invoked by the second application, the second application may send a monitoring enable notification to the first application for instructing the first application to enable behavior monitoring.
  • the monitoring service management module sends the AIDL binding object to the application monitoring module.
  • the time when the monitoring service management module creates the AIDL binding object is not specifically limited.
  • the monitoring service management module may create the AIDL binding object before the first application is installed, for example, in the first application. 2. Create an AIDL binding object after the application runs.
  • the monitoring service management module may also create an AIDL binding object after receiving the AIDL binding request of the first application for the first time.
  • the application monitoring module sends a monitoring service registration request to the monitoring service management module.
  • the monitoring service management module determines whether to monitor the interface invocation event of the first application to the interface.
  • the monitoring service management module determines whether a preset dynamic monitoring condition is currently satisfied.
  • the monitoring service management module determines that the preset dynamic monitoring conditions are currently met, send a monitoring start notification to the application monitoring module.
  • the application monitoring module reports the interface invocation event of the first application.
  • the monitoring management service module waits for the next monitoring service registration request.
  • the application monitoring module can directly request the second application for AIDL binding, which can avoid the need to implant connections in the application framework layer. Build modules to reduce changes to the Android system.
  • FIG. 9 the execution process of the security analysis of the first application by the second application is introduced.
  • the interaction between the monitoring service management module and the behavior analysis module is taken as an example to illustrate:
  • the behavior analysis module requests an interface invocation event of the first application from the monitoring service management module.
  • the monitoring service management module may store the interface invocation event corresponding to the application information of the first application.
  • the interface invocation event may be stored in a message queue corresponding to the first application information, and in implementation, the received interface invocation events may be stored in the order of reception time of the interface invocation events. In this way, the behavior analysis module can read the interface invocation events from the message queue.
  • the behavior analysis module may request an interface invocation event from the monitoring service management module under the condition that event acquisition conditions are satisfied, where the event acquisition conditions may be preset according to actual requirements.
  • the behavior analysis module may request the monitoring service management module for an interface invocation event every preset time period.
  • the preset duration may be set by the user according to actual needs, or may also be set by default by the electronic device, which is not limited in this embodiment of the present application.
  • the monitoring service management module stores application information and interface call events in a message queue manner.
  • other methods may also be used to store application information and interface call events.
  • corresponding storage may also be used to store application information and interface call events.
  • the monitoring service management module may also perform corresponding storage in the form of a list.
  • the interface invocation event includes an interface identifier, an interface invocation start time, and an interface invocation end time, and the monitoring service management module may store the interface invocation event corresponding to the application information of the first application in the manner of Table 1.
  • the monitoring service management module sends an interface invocation event of the first application to the behavior analysis module.
  • the monitoring service management module sends, to the behavior analysis module, an interface invocation event of each interface by the first application. That is, the first application may call multiple interfaces, and the application monitoring module may report the interface calling events of the first application to each interface. In this way, the monitoring service module sends the behavior analysis module the information of each interface obtained from the application monitoring module. Interface call event.
  • the behavior analysis module requesting the monitoring service management module for an interface invocation event of the first application as an example.
  • the monitoring service management module may also actively report the interface invocation event of the first application to the behavior analysis module.
  • the behavior analysis module analyzes the security of the first application based on the interface call event.
  • the behavior analysis module determines whether there is a security risk in the first application according to the interface invocation event.
  • the behavior analysis module performs security analysis on the first application based on the interface invocation event of the first application to each interface .
  • each behavior analysis will have a corresponding plug-in, and each plug-in may have its own analysis logic.
  • the plug-in can analyze whether the corresponding behavior meets the preset conditions, so as to determine whether the first application exists. Security risks, in which the preset conditions can be set according to actual needs, and different plug-ins can correspond to different preset conditions.
  • a certain plug-in A is a plug-in for the existence of a privacy statement. Plug-in A can be used to analyze whether the privacy policy statement exists.
  • the analysis process is to analyze whether the privacy policy statement interface is called.
  • a plug-in B is a plug-in that collects data without the user's consent.
  • Plug-in B can be used to analyze the problem of applying for permissions without the user's consent.
  • the analysis process is to analyze whether the order of the privacy policy statement and the user's consent to apply for permissions meets the requirements.
  • the preset condition corresponding to the plug-in B may be: the time when the privacy policy statement occurs is earlier than the time when the user agrees to apply for permission.
  • the behavior analysis module determines that the first application has potential security risks, for example, if it is determined that the target interface called by the first application is not within the callable range of the first application, it is determined that the first application has potential security risks.
  • An early warning prompt can be given below to give feedback to the user.
  • a pop-up window can be used to prompt the user that some behaviors of the first application have potential security risks during the running process.
  • the second application may use a message queue to receive the interface call event returned by APP1, and the plug-in in the behavior analysis module analyzes the interface call event in the message queue. If the interface 000001 and the interface 000002 are selected, and the time of calling the interface 000001 is earlier than the time of calling the interface 000002, it can be considered that APP1 has a malicious behavior of collecting user address information without the user's consent. , remind users of the malicious behavior of APP1, and recommend that users uninstall APP1 to avoid leakage of private data.
  • the embodiments of the present application can prevent malicious software from invading the user's electronic device, allowing the user to perceive malicious behavior of installed applications in real time, thereby ensuring the security of the user's private data.
  • FIG. 10 is a structural block diagram of an application security analysis device provided by an embodiment of the present application. relevant part.
  • the security analysis device is configured in an electronic device, an application framework layer of the electronic device includes an application monitoring module, and the application monitoring module is used to monitor the interface invocation event of the interface by the first application in the electronic device, Referring to FIG. 10 , the apparatus includes a target management module 1010 , the application monitoring module 1020 and a second application 1030 :
  • a target management module 1010 configured to load an application monitoring module for the first application in response to the initial operation of the first application
  • the application monitoring module 1020 is configured to acquire the interface invocation event of the first application to the interface, and report the interface invocation event to the second application through the communication channel between the first application and the second application.
  • the second application 1030 is configured to analyze the security of the first application according to the interface invocation event.
  • the second application 1030 is configured to provide an early warning prompt when it is determined that the first application has a potential safety hazard.
  • the application monitoring module 1020 is used to:
  • the hook method is called to acquire the interface invocation event, and the hook method is used to acquire the interface invocation event of the interface by the first application in the process of the first application performing the interface invocation.
  • the application monitoring module 1020 is used to:
  • the second application 1030 includes a monitoring service management module.
  • the application monitoring module 1020 is configured to send a monitoring service registration request to the second application, where the monitoring service registration request is used to request the second application to determine whether to monitor the interface invocation event of the first application.
  • the monitoring service management module is configured to update the application monitoring list to obtain the first monitoring list in response to the second application determining the interface invocation event of monitoring the first application according to the monitoring service registration request, and the first monitoring list includes application information of the first application .
  • the second application 1030 includes a monitoring service management module 10301, and the monitoring service management module 10301 is configured to: when the second application determines to monitor the interface invocation event of the interface by the first application, A monitoring enable notification is sent to the application monitoring module, where the monitoring enable notification is used to trigger the application monitoring module to obtain an interface invocation event of the first application to the interface.
  • the monitoring service management module 10301 is further configured to: update the first monitoring list.
  • the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.
  • the application monitoring module 1020 is configured to: in the case of monitoring that the first application invokes the target interface, determine the invocation event of the first application to the target interface as the interface invocation event, and the target interface is in the interface monitoring list
  • the interface monitoring list is used to record the interface information of the interface to be monitored.
  • the apparatus includes a target module, where the target module is a second application or a connection establishment module of an application framework layer, and the connection establishment module is used to establish a connection between the first application and the second application after the first application is initialized and run. communication channel.
  • the target module is a second application or a connection establishment module of an application framework layer
  • the connection establishment module is used to establish a connection between the first application and the second application after the first application is initialized and run. communication channel.
  • the application monitoring module is used to send the Android interface definition language AIDL binding request to the target module.
  • the target module for receiving AIDL binding requests The target module for receiving AIDL binding requests.
  • the target module is configured to send an AIDL binding object to the application monitoring module based on the AIDL binding request, where the AIDL binding object includes object data for establishing a communication channel.
  • the application monitoring module 1020 is configured to receive the AIDL binding object.
  • the connection establishment module in response to the target module being the connection establishment module, is configured to: obtain the AIDL binding object from the second application.
  • the second application 1030 includes a monitoring service management module 10301 and a behavior analysis module 10302 .
  • the monitoring service management module 10301 is configured to receive the interface invocation event of each interface by the first application transmitted by the application monitoring module.
  • the behavior analysis module 10302 is configured to acquire, from the monitoring service management module, the interface invocation events of the first application to each interface.
  • the behavior analysis module 10302 is configured to analyze the security of the first application according to the interface invocation event of each interface.
  • the second application includes 1030 a monitoring service management module 10301 and a behavior analysis module 10302 .
  • the monitoring service management module 10301 is configured to receive the interface invocation event transmitted by the application monitoring module.
  • the monitoring service management module 10301 is configured to report the interface invocation event to the behavior analysis module based on the request of the behavior analysis module.
  • the behavior analysis module 10302 is configured to analyze the security of the first application according to the interface invocation event.
  • the application framework layer of the electronic device stores the application monitoring module, and after the first application is initialized, the electronic device controls the first application to load the application monitoring module.
  • the application monitoring module is loaded into the process of the first application by the first application and becomes a runtime module of the first application and then actively interacts with the second application. That is, the application monitoring module obtains the interface invocation event of the first application to the interface, and reports the interface invocation event to the second application through the communication channel between the first application and the second application.
  • the behavior of an application is analyzed to determine whether there is a security risk in the first application.
  • the behavior of the first application can be monitored without inserting a monitoring code into the application package of the first application, so as to avoid the situation that the application cannot run or some functions are unavailable due to modification of the application package, so that the system can be guaranteed stability.
  • the disclosed apparatus and method may be implemented in other manners.
  • the system embodiments described above are only illustrative.
  • the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be Incorporation may either be integrated into another system, or some features may be omitted, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the present application realizes all or part of the processes in the methods of the above embodiments, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium.
  • the computer program includes computer program code
  • the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like.
  • the computer-readable medium may include at least: any entity or device capable of carrying computer program codes to an electronic device, a recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunication signals, and software distribution media.
  • ROM read-only memory
  • RAM random access memory
  • electrical carrier signals telecommunication signals
  • software distribution media For example, U disk, mobile hard disk, disk or CD, etc.
  • computer readable media may not be electrical carrier signals and telecommunications signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Stored Programmes (AREA)
  • Telephone Function (AREA)

Abstract

一种应用的安全性分析方法、装置、设备及存储介质，涉及终端技术领域。该方法应用于电子设备中，电子设备的应用程序框架层包括应用监控模块，在第一应用初始化运行后，电子设备控制第一应用加载应用监控模块。应用监控模块被第一应用加载后，当检测到第一应用调用接口时，获取第一应用对接口的接口调用事件，然后通过第一应用与第二应用之间具有的通信通道向第二应用上报所获取的接口调用事件。如此，第二应用就可以根据接口调用事件分析第一应用的行为是否具有安全隐患，当确定第一应用存在安全隐患时进行预警提示。可以在无需修改应用程序包的情况下进行行为监控，可以保证系统的稳定性。

Description

应用的安全性分析方法、装置、设备及存储介质
本申请要求于2020年12月29日提交国家知识产权局、申请号为202011608063.7、申请名称为“应用的安全性分析方法、装置、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及终端技术领域，尤其涉及一种应用的安全性分析方法、装置、设备及存储介质。
背景技术
随着终端技术的快速发展，终端中可以安装各种应用。然而，一些应用可能是行为存在安全隐患的恶意软件。譬如，在没有授权的情况下，获取用户数据等。为此，通常需要对应用的行为进行监控，以对应用的安全性进行分析。
在相关技术中，可以由技术人员根据实际需求在应用的应用程序包中插入监控代码，以得到具有监控功能的应用程序包。如此，在基于具有监控功能的应用程序包安装并运行应用后，就可以通过插入的监控代码对应用的行为进行监控。
然而，上述实现方式由于修改了应用的应用程序包，因此，可能会导致应用无法运行或者部分功能不可用，从而影响系统的稳定性。
发明内容
本申请提供一种应用的安全性分析方法、装置、设备及存储介质，解决了现有技术中由于修改了应用的应用程序包导致应用可能无法运行或者部分功能不可用，从而影响系统的稳定性的问题。
为达到上述目的，本申请采用如下技术方案：
第一方面，提供一种应用的安全性分析方法，应用于电子设备中，所述电子设备的应用程序框架层中包括应用监控模块，所述应用监控模块用于监控所述电子设备中的第一应用对接口的接口调用事件，所述方法包括：响应于所述第一应用初始化运行，为所述第一应用加载所述应用监控模块。所述应用监控模块获取所述第一应用对接口的接口调用事件，通过所述第一应用和第二应用之间具有的通信通道向所述第二应用上报所述接口调用事件。所述第二应用根据所述接口调用事件分析所述第一应用的安全性。当第二应用确定所述第一应用存在安全隐患时，进行预警提示。
本申请实施例提供的应用的安全性分析方法，通过在第一应用初始化运行后，控制第一应用加载应用监控模块。应用监控模块被第一应用加载后，当检测到第一应用调用接口时，获取第一应用对接口的接口调用事件，然后向第二应用上报所获取的接口调用事件。如此，第二应用就可以根据接口调用事件分析第一应用的行为是否具有安全隐患，当存在安全隐患时及时进行预警提示，以便于用户及时发现。从而实现了可以在无需修改应用程序包的情况下进行行为监控，避免由于修改应用程序包导致应用无法运行或者部分功能不 可用的情况，进而可以保证系统的稳定性。
另外，应用监控模块被第一应用加载到第一应用的进程中成为第一应用的一个运行时模块后主动与第二应用进行交互，第一应用的行为监控不再涉及应用程序框架层，可以使得接口调用事件上报机制与系统平台解耦。以Android平台来说，在应用程序框架层植入应用监控模块对整个Android平台的正常运行不会造成干扰，Android平台的改动和升级也不会影响接口监控。并且后续也可以只需修改应用程序框架层的应用监控模块，就可以实现监控点的增加和/或删除，而不涉及Android原生代码的改动，如此不会造成性能上的损耗，可以保证系统性能的稳定性和可维护性。
作为本申请的一个示例，所述应用监控模块获取所述第一应用对接口的接口调用事件，包括：所述应用监控模块调用钩子方法，以获取所述接口调用事件，所述钩子方法用于在所述第一应用执行接口调用的过程中获取所述第一应用对接口的接口调用事件。
本申请实施例提供的应用的安全性分析方法，通过调用钩子方法，由于钩子方法相当于备份了接口的API方法，并在备份的API方法前后增加了监控功能。也即是，应用监控模块调用钩子方法时，在钩子方法中复制接口的API方法地址，如此相当于是备份了接口的API方法。所以通过调用钩子方法不仅可以实现接口的调用，而且在调用接口的过程中还获取到接口的接口调用事件，从而实现了对接口的调用情况进行监控的目的。
作为本申请的一个示例，所述应用监控模块调用钩子方法，包括：所述应用监控模块将待调用的应用程序接口API方法地址替换为所述钩子方法的钩子方法地址。所述应用监控模块基于所述钩子方法地址调用所述钩子方法。
在常规情况下，接口均对应一个API方法，基于API方法地址即可调用该API方法，从而实现接口的调用。然而，由于需要对接口的调用情况进行监控，所以，本申请实施例提供的应用的安全性分析方法，通过应用监控模块可以将待调用的API方法地址替换为钩子方法地址，如此使得应用监控模块转去调用钩子方法，应用监控模块通过执行钩子方法可以获取接口的接口调用事件，并且通过钩子方法可以回调接口对应的API方法，在对接口调用的过程中实现对接口调用情况进行监控。从而实现了在无需修改应用程序包的情况下进行行为监控，避免由于修改应用程序包导致应用无法运行或者部分功能不可用的情况，从而可以保证系统的稳定性。
作为本申请的一个示例，所述应用监控模块获取所述第一应用对接口的接口调用事件之前，还包括：所述应用监控模块向所述第二应用发送监控服务注册请求，所述监控服务注册请求用于请求所述第二应用确定是否监控所述第一应用的接口调用事件。响应于所述第二应用根据所述监控服务注册请求确定监控所述第一应用的接口调用事件，更新应用监控列表，得到第一监控列表，所述第一监控列表中包括所述第一应用的应用信息。
本申请实施例提供的应用的安全性分析方法，通过在确定监控第一应用时，第二应用在应用监控列表中更新第一应用的应用信息，得到第一监控列表，第一监控列表中包括待监控的应用。从而实现了通过第一监控列表记录待监控的应用，以便于后续可以批量对第一监控列表中的应用进行监控。
作为本申请的一个示例，所述方法还包括：在所述第二应用确定监控所述第一应用对接口的接口调用事件的情况下，向所述应用监控模块发送监控开启通知，所述监控开启通知用于触发所述应用监控模块获取所述第一应用对接口的接口调用事件。
本申请实施例提供的应用的安全性分析方法，通过在第二应用确定监控第一应用对接口的接口调用事件时，向第二应用中的应用监控模块发送监控开启通知，以便于应用监控模块接收到监控开启通知后对第一应用的接口调用情况进行监控，从而实现了监控的目的。
作为本申请的一个示例，所述方法还包括：更新所述第一监控列表。其中，更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。
本申请实施例提供的应用的安全性分析方法，通过对第一监控列表进行更新，由于更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析，从而实现了当后续再次基于更新后的第一监控列表进行批量监控时，可以避免对已进行安全性分析的应用再次重复监控，如此可以节省电子设备的运行功耗。
作为本申请的一个示例，所述应用监控模块获取所述第一应用对接口的接口调用事件，包括：在所述应用监控模块监控到所述第一应用调用目标接口的情况下，将所述第一应用对所述目标接口的调用事件确定为所述接口调用事件，所述目标接口为接口监控列表中的接口，所述接口监控列表用于记录待监控的接口的接口信息。
本申请实施例提供的应用的安全性分析方法，通过当第一应用调用的接口不是目标接口时，应用监控模块可以不获取第一应用对接口的调用事件，当应用监控模块监控到第一应用调用目标接口时，将目标接口的调用事件获取为接口调用事件，其中，目标接口为接口监控列表中的接口。也即，可以针对接口监控列表中的接口进行监控，譬如接口监控列表中的接口可能为涉及用户隐私的接口，而对于其他不属于接口监控列表的接口可以不进行监控，譬如对一些不涉及用户隐私的接口可以不监控。从而实现了选择性地对目标接口的调用事件进行监控，可以使得监控具有一定的针对性，从而可以节省电子设备的运行功耗。
作为本申请的一个示例，所述方法还包括：所述应用监控模块向目标模块发送安卓接口定义语言AIDL绑定请求，所述目标模块为所述第二应用或所述应用程序框架层的连接建立模块，所述连接建立模块用于在所述第一应用初始化运行后建立所述第一应用和所述第二应用之间的通信通道。所述目标模块接收所述AIDL绑定请求。所述目标模块基于所述AIDL绑定请求向所述应用监控模块发送AIDL绑定对象，所述AIDL绑定对象包括用于建立所述通信通道的对象数据。所述应用监控模块接收所述AIDL绑定对象。
AIDL的实现原理是通过代码实现通信。作为本申请的一个示例，第二应用与第一应用通过AIDL建立通信通道，在实施中，第二应用可以定义AIDL绑定对象，AIDL绑定对象包括用于建立通信通道的对象数据。示例性地，AIDL绑定对象包括至少一个执行方法，每个执行方法对应一段代码，或者可以理解为每个执行方法对应一个实例。如此，应用监控模块获取到第二应用定义的AIDL绑定对象后，可以通过调用AIDL绑定对象中的执行方法与第二应用实现通信。
若第一应用与第二应用之间采用已有的通信方式进行通信，则第一应用很容易筛选掉第二应用发送的与监控相关的指示消息，导致第一应用可以逃避第二应用的监控。本申请实施例提供的应用的安全性分析方法，通过应用监控模块利用目标模块从第二应用中获取AIDL绑定对象，并基于AIDL绑定对象与第二应用建立通信通道，应用监控模块基于所 建立的通信通道对第一应用进行监控，从而实现了可以避免第一应用过滤掉与监控相关的指示消息，进而可以保证对第一应用进行监控的可靠性和稳定性。
作为本申请的一个示例，响应于所述目标模块为所述连接建立模块，所述方法还包括：所述连接建立模块从所述第二应用处获取所述AIDL绑定对象。
本申请实施例提供的应用的安全性分析方法，通过连接建立模块预先向监控服务管理模块请求AIDL绑定对象，可以使得后续第一应用通过连接建立模块与应用市场进行AIDL绑定，如此若存在多个第一应用与应用市场进行AIDL绑定，则与多个第一应用直接向应用市场请求AIDL绑定相比，从而实现了在一定程度上可以减小应用市场的运行负担。
作为本申请的一个示例，所述第二应用包括监控服务管理模块和行为分析模块，所述第二应用根据所述接口调用事件分析所述第一应用的安全性，包括：所述监控服务管理模块接收所述应用监控模块传输的所述第一应用对各个接口的接口调用事件。所述行为分析模块从所述监控服务管理模块处获取所述第一应用对各个接口的接口调用事件。所述行为分析模块根据所述各个接口的接口调用事件分析所述第一应用的安全性。
一些接口的调用可能存在一定的关系，譬如，通常在调用用户同意申请权限的接口之前，需要调用隐私政策声明的接口，即这两个接口是有先后调用顺序的，在该种情况下，如果对单个接口的调用事件进行分析可能使得分析结果不准确。本申请实施例提供的应用的安全性分析方法，通过行为分析模块从监控服务管理模块中获取第一应用对各个接口的接口调用事件，从而实现了可以结合各个接口的接口调用事件进行综合性分析，从而可以提高安全性分析的准确性和有效性。
作为本申请的一个示例，所述第二应用包括监控服务管理模块和行为分析模块，所述第二应用根据所述接口调用事件分析所述第一应用的安全性，包括：所述监控服务管理模块接收所述应用监控模块传输的所述接口调用事件。所述监控服务管理模块基于所述行为分析模块的请求，向所述行为分析模块上报所述接口调用事件。所述行为分析模块根据所述接口调用事件分析所述第一应用的安全性。
在一些实施例中，行为分析模块的分析任务可能较多，或者行为分析模块的分析任务还没有完成，若在该种情况下，监控服务管理模块向行为分析模块主动发送接口调用事件，可能使得行为分析模块当前无法及时处理。所以，本申请实施例提供的应用的安全性分析方法，通过行为分析模块可以根据自身的工作状态，主动向监控服务管理模块请求获取接口调用事件，从而实现了使得行为分析模块能够充分、有效地进行安全性分析的效果。
第二方面，提供一种应用的安全性分析装置，配置于电子设备中，所述电子设备的应用程序框架层中包括应用监控模块，所述应用监控模块用于监控所述电子设备中的第一应用对接口的接口调用事件，所述装置包括目标管理模块、所述应用监控模块和第二应用：所述目标管理模块，用于响应于所述第一应用初始化运行，为所述第一应用加载所述应用监控模块。所述应用监控模块，用于获取所述第一应用对接口的接口调用事件，通过所述第一应用和所述第二应用之间具有的通信通道向所述第二应用上报所述接口调用事件。所述第二应用，用于根据所述接口调用事件分析所述第一应用的安全性。第二应用，用于当确定所述第一应用存在安全隐患时，进行预警提示。
作为本申请的一个示例，所述应用监控模块用于：调用钩子方法，以获取所述接口调用事件，所述钩子方法用于在所述第一应用执行接口调用的过程中获取所述第一应用对接 口的接口调用事件。
作为本申请的一个示例，所述应用监控模块用于：将待调用的应用程序接口API方法地址替换为所述钩子方法的钩子方法地址。基于所述钩子方法地址调用所述钩子方法。
作为本申请的一个示例，所述第二应用包括监控服务管理模块。所述应用监控模块，用于向所述第二应用发送监控服务注册请求，所述监控服务注册请求用于请求所述第二应用确定是否监控所述第一应用的接口调用事件。所述监控服务管理模块，用于响应于所述第二应用根据所述监控服务注册请求确定监控所述第一应用的接口调用事件，更新应用监控列表，得到第一监控列表，所述第一监控列表中包括所述第一应用的应用信息。
作为本申请的一个示例，所述第二应用包括监控服务管理模块，所述监控服务管理模块用于：在所述第二应用确定监控所述第一应用对接口的接口调用事件的情况下，向所述应用监控模块发送监控开启通知，所述监控开启通知用于触发所述应用监控模块获取所述第一应用对接口的接口调用事件。
作为本申请的一个示例，所述监控服务管理模块还用于：更新所述第一监控列表。其中，更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。
作为本申请的一个示例，所述应用监控模块用于：在监控到所述第一应用调用目标接口的情况下，将所述第一应用对所述目标接口的调用事件确定为所述接口调用事件，所述目标接口为接口监控列表中的接口，所述接口监控列表用于记录待监控的接口的接口信息。
作为本申请的一个示例，所述装置包括目标模块，所述目标模块为所述第二应用或所述应用程序框架层的连接建立模块，所述连接建立模块用于在所述第一应用初始化运行后建立所述第一应用和所述第二应用之间的通信通道。所述应用监控模块，用于向所述目标模块发送安卓接口定义语言AIDL绑定请求。所述目标模块，用于接收所述AIDL绑定请求。所述目标模块，用于基于所述AIDL绑定请求向所述应用监控模块发送AIDL绑定对象，所述AIDL绑定对象包括用于建立所述通信通道的对象数据。所述应用监控模块，用于接收所述AIDL绑定对象。
作为本申请的一个示例，响应于所述目标模块为所述连接建立模块，所述连接建立模块用于：从所述第二应用处获取所述AIDL绑定对象。
作为本申请的一个示例，所述所述第二应用包括监控服务管理模块和行为分析模块。所述监控服务管理模块，用于接收所述应用监控模块传输的所述第一应用对各个接口的接口调用事件。所述行为分析模块，用于从所述监控服务管理模块处获取所述第一应用对各个接口的接口调用事件。所述行为分析模块，用于根据所述各个接口的接口调用事件分析所述第一应用的安全性。
作为本申请的一个示例，所述第二应用包括监控服务管理模块和行为分析模块。所述监控服务管理模块，用于接收所述应用监控模块传输的所述接口调用事件。所述监控服务管理模块，用于基于所述行为分析模块的请求，向所述行为分析模块上报所述接口调用事件。所述行为分析模块，用于根据所述接口调用事件分析所述第一应用的安全性。
第三方面，提供一种电子设备，所述电子设备的结构中包括处理器和存储器，所述存储器用于存储支持电子设备执行上述第一方面任一所述的方法的程序，以及存储用于实现上述第一方面任一所述的方法所涉及的数据。所述处理器被配置为用于执行所述存储器中 存储的程序。所述电子设备还可以包括通信总线，所述通信总线用于在所述处理器与所述存储器之间建立连接。
第四方面，提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行如上述第一方面任意一项所述的方法。
第五方面，提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
上述第二方面、第三方面、第四方面和第五方面所获得的技术效果与上述第一方面中对应的技术手段获得的技术效果近似，在这里不再赘述。
本申请提供的技术方案至少可以带来以下有益效果：
电子设备的应用程序框架层存放应用监控模块，第一应用初始化后电子设备控制第一应用加载应用监控模块。应用监控模块被第一应用加载到第一应用的进程中成为第一应用的一个运行时模块后主动与第二应用进行交互。也即应用监控模块获取第一应用对接口的接口调用事件，通过第一应用与第二应用之间具有的通信通道向第二应用上报接口调用事件，如此，第二应用根据接口调用事件对第一应用的行为进行分析，以确定第一应用是否存在安全隐患，当存在安全隐患时进行预警提示。本申请实施例无需在第一应用的应用程序包中插入监控代码即可对第一应用的行为进行监控，避免由于修改应用程序包导致应用无法运行或者部分功能不可用的情况，从而可以保证系统的稳定性。
附图说明
图1为本申请实施例提供的一种电子设备的结构示意图；
图2为本申请实施例提供的一种电子设备的软件结构框图；
图3为本申请实施例提供的一种应用场景的示意图；
图4为本申请实施例提供的一种连接建立模块和应用监控模块的功能介绍示意图；
图5为本申请实施例提供的一种应用市场的功能介绍示意图；
图6为本申请实施例提供的一种应用的安全性分析方法的流程示意图；
图7为本申请实施例提供的一种代码实现关系示意图；
图8为本申请实施例提供的另一种应用的安全性分析方法的流程示意图；
图9为本申请实施例提供的另一种应用的安全性分析方法的流程示意图；
图10为本申请实施例提供的一种应用的安全性分析装置的结构示意图；
图11为本申请实施例提供的一种第二应用的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
应当理解的是，本申请提及的“多个”是指两个或两个以上。在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B；本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，为了便于清楚描述本申请的技术方案，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
作为一种示例，本申请实施例提供的应用的安全性分析方法可以应用于能够安装和运行应用的电子设备中。该电子设备可以为诸如可穿戴设备、车机设备、终端设备之类的设备。示例性地，终端设备可以包括但不限于手机、平板电脑、增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本、个人数字助理(personal digital assistant，PDA)。在一个实施例中，该电子设备具有安卓(Android)系统，也即该方法可以应用于Android平台上。
请参阅图1，图1是本申请实施例提供的一种电子设备的结构示意图。
电子设备100可以包括处理器110，外部存储器接口120，内部存储器121，通用串行总线(universal serial bus，USB)接口130，充电管理模块140，电源管理模块141，电池142，天线1，天线2，移动通信模块150，无线通信模块160，音频模块170，扬声器170A，受话器170B，麦克风170C，耳机接口170D，传感器模块180，按键190，马达191，指示器192，摄像头193，显示屏194，以及用户标识模块(subscriber identification module，SIM)卡接口195等。其中传感器模块180可以包括压力传感器180A，陀螺仪传感器180B，气压传感器180C，磁传感器180D，加速度传感器180E，距离传感器180F，接近光传感器180G，指纹传感器180H，温度传感器180J，触摸传感器180K，环境光传感器180L，骨传导传感器180M等。
可以理解的是，本发明实施例示意的结构并不构成对电子设备100的具体限定。在本申请另一些实施例中，电子设备100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
处理器110可以包括一个或多个处理单元，例如：处理器110可以包括应用处理器(application processor，AP)，调制解调处理器，图形处理器(graphics processing unit，GPU)，图像信号处理器(image signal processor，ISP)，控制器，存储器，视频编解码器，数字信号处理器(digital signal processor，DSP)，基带处理器，和/或神经网络处理器(neural-network processing unit，NPU)等。其中，不同的处理单元可以是独立的器件，也可以集成在一个或多个处理器中。
其中，控制器可以是电子设备100的神经中枢和指挥中心。控制器可以根据指令操作码和时序信号，产生操作控制信号，完成取指令和执行指令的控制。
处理器110中还可以设置存储器，用于存储指令和数据。在一些实施例中，处理器110中的存储器为高速缓冲存储器。该存储器可以保存处理器110刚用过或循环使用的指令或数据。如果处理器110需要再次使用该指令或数据，可从所述存储器中直接调用。避免了重复存取，减少了处理器110的等待时间，因而提高了系统的效率。
在一些实施例中，处理器110可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit，I2C)接口，集成电路内置音频(inter-integrated circuit sound，I2S)接口，脉冲编码调制(pulse code modulation，PCM)接口，通用异步收发传输器(universal asynchronous receiver/transmitter，UART)接口，移动产业处理器接口(mobile industry processor interface，MIPI)，通用输入输出(general-purpose input/output，GPIO)接口，用户标识模块(subscriber identity module，SIM)接口，和/或通用串行总线(universal serial  bus，USB)接口等。
I2C接口是一种双向同步串行总线，包括一根串行数据线(serial data line，SDA)和一根串行时钟线(derail clock line，SCL)。在一些实施例中，处理器110可以包含多组I2C总线。处理器110可以通过不同的I2C总线接口分别耦合触摸传感器180K，充电器等。例如：处理器110可以通过I2C接口耦合触摸传感器180K，使处理器110与触摸传感器180K通过I2C总线接口通信，实现电子设备100的触摸功能。
MIPI接口可以被用于连接处理器110与显示屏194，摄像头193等外围器件。MIPI接口包括摄像头串行接口(camera serial interface，CSI)，显示屏串行接口(display serial interface，DSI)等。在一些实施例中，处理器110和显示屏194通过DSI接口通信，实现电子设备100的显示功能。
USB接口130是符合USB标准规范的接口，具体可以是Mini USB接口，Micro USB接口，USB Type C接口等。
可以理解的是，本发明实施例示意的各模块间的接口连接关系，只是示意性说明，并不构成对电子设备100的结构限定。在本申请另一些实施例中，电子设备100也可以采用上述实施例中不同的接口连接方式，或多种接口连接方式的组合。
电源管理模块141用于连接电池142，充电管理模块140与处理器110。电源管理模块141接收电池142和/或充电管理模块140的输入，为处理器110，内部存储器121，外部存储器，显示屏194，摄像头193，和无线通信模块160等供电。
电子设备100的无线通信功能可以通过天线1，天线2，移动通信模块150，无线通信模块160，调制解调处理器以及基带处理器等实现。
移动通信模块150可以提供应用在电子设备100上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块150可以包括至少一个滤波器，开关，功率放大器，低噪声放大器(low noise amplifier，LNA)等。
无线通信模块160可以提供应用在电子设备100上的包括无线局域网(wireless local area networks，WLAN)(如无线保真(wireless fidelity，Wi-Fi)网络)，蓝牙(bluetooth，BT)，全球导航卫星系统(global navigation satellite system，GNSS)，调频(frequency modulation，FM)，近距离无线通信技术(near field communication，NFC)，红外技术(infrared，IR)等无线通信的解决方案。
在一些实施例中，电子设备100的天线1和移动通信模块150耦合，天线2和无线通信模块160耦合，使得电子设备100可以通过无线通信技术与网络以及其他设备通信。所述无线通信技术可以包括全球移动通讯系统(global system for mobile communications，GSM)，通用分组无线服务(general packet radio service，GPRS)，码分多址接入(code division multiple access，CDMA)，宽带码分多址(wideband code division multiple access，WCDMA)，时分码分多址(time-division code division multiple access，TD-SCDMA)，长期演进(long term evolution，LTE)，BT，GNSS，WLAN，NFC，FM，和/或IR技术等。所述GNSS可以包括全球卫星定位系统(global positioning system，GPS)，全球导航卫星系统(global navigation satellite system，GLONASS)，北斗卫星导航系统(beidou navigation satellite system，BDS)，准天顶卫星系统(quasi-zenith satellite system，QZSS)和/或星基增强系统(satellite based augmentation systems，SBAS)。
电子设备100通过GPU，显示屏194，以及应用处理器等实现显示功能。GPU为图像处理的微处理器，连接显示屏194和应用处理器。GPU用于执行数学和几何计算，用于图形渲染。处理器110可包括一个或多个GPU，其执行程序指令以生成或改变显示信息。
触摸传感器180K，也称“触控面板”。触摸传感器180K可以设置于显示屏194，由触摸传感器180K与显示屏194组成触摸屏，也称“触控屏”。触摸传感器180K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器，以确定触摸事件类型。可以通过显示屏194提供与触摸操作相关的视觉输出。在另一些实施例中，触摸传感器180K也可以设置于电子设备100的表面，与显示屏194所处的位置不同。
指示器192可以是指示灯，可以用于指示充电状态，电量变化，也可以用于指示消息，未接来电，通知等。
电子设备100的软件系统可以采用分层架构，事件驱动架构，微核架构，微服务架构，或云架构。本发明实施例以分层架构的Android系统为例，示例性说明电子设备100的软件结构。
图2是本申请实施例的电子设备100的软件结构框图。
分层架构将软件分成若干个层，每一层都有清晰的角色和分工。层与层之间通过软件接口通信。在一些实施例中，将Android系统分为四层，从上至下分别为应用程序层，应用程序框架层，安卓运行时(Android runtime)和系统库，以及内核层。
应用程序层可以包括一系列应用程序包。
如图2所示，应用程序包可以包括图库，相机，导航，联系人、应用市场等应用。
应用市场是一种管理类应用，可以用于管理其他应用。譬如，用户可以触发电子设备从应用市场中下载应用。再如，用户可以触发电子设备在应用市场中更新已安装的应用的版本。又如，在本申请实施例中，该应用市场可以选择性地对一些应用的行为进行监控和分析，从而确定这些应用是否存在安全隐患。
应用程序框架层为应用程序层的应用提供应用编程接口(application programming interface，API)和编程框架。应用程序框架层包括一些预先定义的函数。
如图2所示，应用程序框架层可以包括连接建立模块，应用监控模块。
作为一种示例，连接建立模块可以用于为第一应用与应用市场建立通信通道，该通信通道主要是为应用市场对第一应用进行安全性分析建立基础。作为一种示例，第一应用可以是指电子设备中安装的所有应用中除应用市场之外的应用。
应用监控模块可以被第一应用加载成为第一应用的运行时模块，如此当第一应用调用接口时，应用监控模块可以获取第一应用对接口的接口调用事件，并将接口调用事件通过上述通信通道上报给应用市场，供应用市场进行安全性分析。其中，运行时模块是指想何时使用就能够何时运行的模块。
在一种可能的实现方式中，应用程序框架层还可以包括：窗口管理器，内容提供器，视图系统，电话管理器，资源管理器，通知管理器等。
窗口管理器用于管理窗口程序。窗口管理器可以获取显示屏大小，判断是否有状态栏，锁定屏幕，截取屏幕等。
内容提供器用来存放和获取数据，并使这些数据可以被应用访问。所述数据可以包括视频，图像，音频，拨打和接听的电话，浏览历史和书签，电话簿等。
视图系统包括可视控件，例如显示文字的控件，显示图片的控件等。视图系统可用于构建应用。显示界面可以由一个或多个视图组成的。例如，包括短信通知图标的显示界面，可以包括显示文字的视图以及显示图片的视图。
电话管理器用于提供电子设备100的通信功能。例如通话状态的管理(包括接通，挂断等)。
资源管理器为应用程序提供各种资源，比如本地化字符串，图标，图片，布局文件，视频文件等等。
通知管理器使应用可以在状态栏中显示通知信息，可以用于传达告知类型的消息，可以短暂停留后自动消失，无需用户交互。比如通知管理器被用于告知下载完成，消息提醒等。通知管理器还可以是以图表或者滚动条文本形式出现在系统顶部状态栏的通知，例如后台运行的应用的通知，还可以是以对话窗口形式出现在屏幕上的通知。例如在状态栏提示文本信息，发出提示音，电子设备振动，指示灯闪烁等。
Android Runtime包括核心库和虚拟机。Android runtime负责安卓系统的调度和管理。
核心库包含两部分：一部分是java语言需要调用的功能函数，另一部分是安卓的核心库。
应用程序层和应用程序框架层运行在虚拟机中。虚拟机将应用程序层和应用程序框架层的java文件执行为二进制文件。虚拟机用于执行对象生命周期的管理，堆栈管理，线程管理，安全和异常的管理，以及垃圾回收等功能。
系统库可以包括多个功能模块。例如：表面管理器(surface manager)，媒体库(Media Libraries)，三维图形处理库(例如：OpenGL ES)，2D图形引擎(例如：SGL)等。
表面管理器用于对显示子系统进行管理，并且为多个应用程序提供了2D和3D图层的融合。
媒体库支持多种常用的音频，视频格式回放和录制，以及静态图像文件等。媒体库可以支持多种音视频编码格式，例如:MPEG4，H.264，MP3，AAC，AMR，JPG，PNG等。
三维图形处理库用于实现三维图形绘图，图像渲染，合成，和图层处理等。
2D图形引擎是2D绘图的绘图引擎。
内核层是硬件和软件之间的层。内核层至少包含显示驱动，摄像头驱动，音频驱动，传感器驱动。
下面结合捕获拍照场景，示例性说明电子设备100软件以及硬件的工作流程。
当触摸传感器180K接收到触摸操作，相应的硬件中断被发给内核层。内核层将触摸操作加工成原始输入事件(包括触摸坐标，触摸操作的时间戳等信息)。原始输入事件被存储在内核层。应用程序框架层从内核层获取原始输入事件，识别该输入事件所对应的控件。以该触摸操作是触摸单击操作，该单击操作所对应的控件为相机应用图标的控件为例，相机应用调用应用框架层的接口，启动相机应用，进而通过调用内核层启动摄像头驱动，通过摄像头193捕获静态图像或视频。
基于图1和图2所示实施例提供的电子设备100，接下来对本申请实施例涉及的应用场景进行介绍，请参阅图3，图3是根据一示例性实施例示出的一种应用场景的示意图，在实施中：
用户触发电子设备获取APP1的应用程序包(application package，APK)。
作为一种示例，如图3中的(a)图所示，APP1的应用程序包可以是电子设备从弹出的某网页中下载的。示例性地，弹出的网页可以是电子设备中某个正在运行的应用推荐的网页，也即APP1可能未在应用市场上架，未经过在应用市场上架前所需的安全检测。
用户触发电子设备基于所下载的应用程序包安装APP1，在电子设备完成安装后电子设备可以运行APP1，以启动APP1。
通常情况下，APP1启动后的行为是调用接口行为。示例性地，如果APP1需要打开蓝牙，则APP1会调用打开蓝牙的接口，如果APP1需要连接网络，则APP1会调用连接网络的接口，如果APP1需要获取联系人信息，则APP1会调用获取联系人信息的接口，如果APP1需要获取媒体访问控制(media access control，MAC)地址，则APP1会调用获取MAC的接口，如果APP1需要启动摄像头，则APP1会调用启动摄像头的接口等。在一种可能的实现方式中，APP1的行为可能存在安全隐患，在接口调用的行为中可能存在一些违规行为，譬如在没有授权的情况下从电子设备中获取用户的隐私信息等。
在一实施例中，可以由电子设备中的应用市场对APP1进行行为监控以判断APP1的行为是否存在安全隐患，譬如判断APP1是否存在恶意行为、是否存在隐私合规以及是否存在权限违规行为等问题。作为一种示例，当应用市场监控到APP1的行为存在安全隐患时可以向用户反馈监控结果，以对用户进行相应的提示。
在一种可能的实现方式中，电子设备可以通过弹窗的方式向用户进行提示。譬如如图3中的(b)图所示，该弹窗中可以显示有告警文字“APP1为恶意软件，建议卸载”。作为本申请的一个示例，电子设备还可以在该弹窗中为用户反馈APP1的恶意行为的具体内容，示例性地，具体内容为“在未授权的情况下试图开启摄像头”。
作为本申请的一个示例，请继续参阅图3中的(b)图，该弹窗中还可以包括“卸载”选项31。如此，当用户需要卸载APP1时，可以点击选项31以触发电子设备执行卸载APP1的过程。比如电子设备检测到用户对选项31的触发操作后关闭APP1，然后电子设备卸载APP1。如此可以便于快速卸载APP1，提高了操作的便捷性。
作为本申请的一个示例，电子设备检测到用户对选项31的触发操作后，在关闭APP1之前还可以向用户展示是否同意卸载的确认提示消息。当基于确认提示消息检测到用户同意卸载的触发操作时，电子设备关闭APP1，并执行卸载APP1的过程。如此在用户授权的情况下再执行卸载操作，提高了用户体验效果。
作为本申请的一个示例，请继续参阅图3中的(b)图，该弹窗中还可以包括“关闭窗口”选项32。如此，当用户不需要卸载APP1时，可以点击选项32。响应于用户点击选项32的操作，电子设备关闭该弹窗。
当然，上述以电子设备通过弹窗的方式向用户进行提示为例进行说明。在另一实施例中，还可以通过其他任意的用户可感知的方式向用户进行提示，示例性地，还可以采用振动、提示音、闪屏等方式向用户进行提示，本申请实施例对此不作限定。
需要说明的是，上述是以APP1的应用程序包是从弹出的某网页中下载为例。在另一实施例中，APP1的应用程序包也可以是通过其他下载途径获取得到的。示例性地，APP1的应用程序包可以是电子设备从云盘或者网盘中下载的，或者，可以是从应用市场中下载的，本申请实施例对APP1的应用程序包的下载途径不作具体限定，也即电子设备可以对安装的所有应用都进行行为监控。
接下来对应用程序框架层中的连接建立模块和应用监控模块的功能进行介绍。
请参阅图4，连接建立模块主要的功能是建立第一应用与应用市场之间的通信通道，该通信通道用于应用市场与第一应用之间进行数据交互，以便于应用市场确定是否监控第一应用的接口调用行为，以及在确定监控第一应用的接口调用行为的情况下对第一应用的接口调用行为进行监控。也即该通信通道为应用市场监控第一应用建立基础。
应用监控模块可以被第一应用加载成为第一应用的一个运行时模块。作为一种示例，如果第一应用调用接口，则应用监控模块可以通过接口方法地址替换来获取所调用的接口的接口调用事件，并将所获取的接口调用事件通过上述通信通道发送给应用市场，以便于应用市场分析第一应用的安全性，具体实现可以参见如下图6所示实施例。
需要说明的是，连接建立模块和应用监控模块可以被多个第一应用共用。示例性地，多个第一应用均可以加载应用监控模块，作为一种示例，多个第一应用的加载过程可以是并行的。当然，行为监控的过程是串行的，即在确定一个第一应用的安全性后再继续监控下一个第一应用。
请参阅图5，接下来对本申请实施例中涉及的应用市场进行介绍，作为一种示例，应用市场中集成有监控服务管理模块和行为分析模块。
作为一种示例，监控服务管理模块可以维护应用监控列表，应用监控列表可以用于存储待监控的第一应用的应用信息。在满足预设动态监控条件的情况下，监控服务管理模块通知应用监控列表中待监控的第一应用开启行为监控，其中，预设动态监控条件可以是预先设定的。另外，监控服务管理模块还可以用于接收第一应用的监控服务注册请求，监控服务注册请求中可以携带第一应用的应用信息，根据监控服务注册请求可以确定是否对请求注册的第一应用进行行为监控。在一个示例中，在确定对请求注册的第一应用进行行为监控的情况下，可以将请求注册的第一应用的应用信息添加至应用监控列表中。此外，监控服务管理模块还可以用于接收上述应用监控模块上报的接口调用事件。
行为分析模块可以用于基于监控服务管理模块接收的接口调用事件分析第一应用的安全性。在一些实施例中，行为分析模块可以包括多种插件，每种插件具有不同逻辑分析功能，譬如，多种插件的功能可以包括但不限于分析隐私政策声明是否存在、分析是否存在未经用户授权的情况下收集用户数据的情况，其中隐私政策声明是指应用声明要获取什么权限以及会做哪些操作。
值得一提的是，本申请实施例不需要在应用程序包中插入监控代码，而是在应用程序框架层中植入与监控相关的应用监控模块，以及安装一个集成监控服务管理模块和行为分析模块的应用市场，可以避免导致应用无法运行或者部分功能不可用的情况，可以保证应用的稳定性。另外，由于应用市场的运行与其他应用的运行是相互独立的，互不影响，所以可以保证系统的稳定性。
接下来以本申请实施例提供的应用的安全性分析方法应用于电子设备中为例，对该方法的具体实现过程进行介绍。请参阅图6，图6是根据一示例性实施例示出的一种应用的安全性分析方法的示意性流程图，具体可以包括如下部分或者全部内容。
601：连接建立模块向监控服务管理模块请求安卓接口定义语言(android interface definition language，AIDL)绑定对象。
其中，AIDL是Android系统中进程通信的一种实现方式，可以用于在不同进程之间建立通信连接，以使得一个应用可以访问另一个应用的服务。AIDL的实现原理是通过代码实现通信，在本申请的一个示例中，假设以应用市场与第一应用通过AIDL建立通信通道为例，应用市场可以定义AIDL绑定对象，AIDL绑定对象包括用于建立通信通道的对象数据。示例性地，AIDL绑定对象包括至少一个执行方法，每个执行方法对应一段代码，或者可以理解为每个执行方法对应一个实例。如此，若第一应用获取到AIDL绑定对象，则可以通过调用AIDL绑定对象中的执行方法与应用市场实现通信。
在本申请实施例中，为了便于第一应用能够与应用市场建立通信，可以由电子设备中的连接建立模块预先向应用市场中的监控服务管理模块请求AIDL绑定对象。
602：监控服务管理模块创建AIDL绑定对象。
如前文所述，AIDL绑定对象包括至少一个执行方法，作为一种示例，监控服务管理模块创建的AIDL绑定对象可以包括注册方法、事件上报方法和通知发送方法。其中，注册方法可以用于第一应用向应用市场进行注册。事件上报方法可以用于第一应用向应用市场发送接口调用事件，通知发送方法用于应用市场向第一应用发送通知消息。譬如，如果第一应用获取到AIDL绑定对象，则当注册方法被第一应用调用时，第一应用就可以向应用市场发起监控服务注册请求，从而实现第一应用与应用市场之间的注册通信；再如，若事件上报方法被第一应用调用，则第一应用就可以向应用市场发送接口调用事件，从而实现第一应用与应用市场之间的上报通信；又如，若通知发送方法被应用市场调用，则应用市场就可以向第一应用发送用于指示第一应用开启行为监控的监控开启通知。
需要说明的是，这里是以监控服务管理模块在连接建立模块请求AIDL绑定对象后创建AIDL绑定对象为例进行说明。在另一实施例中，监控服务管理模块还可以预先创建AIDL绑定对象，譬如在连接建立模块请求AIDL绑定对象之前创建AIDL绑定对象。
603：监控服务管理模块将创建的AIDL绑定对象发送给连接建立模块。
连接建立模块接收到AIDL绑定对象后可以暂存AIDL绑定对象，以便于后续基于AIDL绑定对象将第一应用与应用市场进行AIDL绑定。
值得一提的是，连接建立模块预先向监控服务管理模块请求AIDL绑定对象，可以使得后续第一应用通过连接建立模块与应用市场进行AIDL绑定，如此若存在多个第一应用与应用市场进行AIDL绑定，则与多个第一应用直接向应用市场请求AIDL绑定相比，这里在一定程度上可以减小应用市场的运行负担。
需要说明的是，上述步骤601至步骤603在第一应用初始化运行之前执行即可，具体执行时间不做具体限定，示例性地，步骤601至步骤603可以在应用市场启动后执行。
在介绍了连接建立模块从监控服务管理模块请求AIDL绑定对象之后，接下来对第一应用的监控过程进行介绍。
604：第一应用初始化运行。
作为一种示例，第一应用可以是电子设备中新安装的应用。作为另一种示例，第一应用可以是电子设备中进行版本更新后的应用。
在一种可能的实现方式中，第一应用初始化运行可以是指第一应用在电子设备中安装后初次运行。通常情况下，第一应用可以是在电子设备中首次安装，也即是电子设备中之前没有安装过第一应用，当然，第一应用也可以是在电子设备中不是首次安装，譬如电子 设备中之前安装过第一应用，但没有运行过就被卸载了。
在另一种可能的实现方式中，第一应用初始化运行也可以是指第一应用在电子设备中版本更新后初次运行，不难理解，当第一应用的版本更新后，第一应用能够执行的操作可能会发生变化，在该种情况下可能会存在安全隐患，所以这里也可以将第一应用的版本更新后初次运行确定为第一应用初始化运行。
示例性地，第一应用为APP1，APP1是从弹出的广告推广页面中下载后安装的。
605：第一应用加载应用监控模块。
作为一种示例，应用程序框架层中包括多个管理模块，其中的一个管理模块是用于对应用的安装、卸载进行管理。为了便于描述，本申请实施例将用于对应用的安装、卸载进行管理的管理模块称为目标管理模块。示例性地，目标管理模块可以是pms manager模块。在本申请实施例中，可以在目标管理模块中增加一种功能，该功能可以用于控制第一应用在初始化运行后主动加载应用程序框架层的应用监控模块。也即响应于第一应用初始化运行，为第一应用加载应用监控模块，譬如在APP1初始化运行后，目标管理模块为APP1加载应用程序框架层的应用监控模块。
606：应用监控模块向连接建立模块发送AIDL绑定请求。
AIDL绑定请求用于请求连接建立模块将第一应用与应用市场之间进行AIDL绑定。作为一种示例，应用监控模块被第一应用加载后主动向连接建立模块发送AIDL绑定请求，以请求AIDL绑定对象。
607：连接建立模块向应用监控模块发送AIDL绑定对象。
如前文所述，由于连接建立模块预先已经存储了应用市场创建的AIDL绑定对象，所以，连接建立模块在接收到应用监控模块的AIDL绑定请求后，就可以将存储的AIDL绑定对象发送给应用监控模块，如此，应用监控模块后续就可以通过调用AIDL绑定对象中的执行方法与应用市场之间进行数据交互。也就是说，第一应用在获取到应用市场中的监控服务管理模块创建的AIDL绑定对象后，就意味着第一应用与应用市场之间实现了AIDL绑定，也即建立起了第一应用与应用市场之间的通信通道。
608：应用监控模块向监控服务管理模块发送监控服务注册请求。
作为一种示例，监控服务注册请求中可以携带第一应用的应用信息。该应用信息可以用于唯一地标识第一应用。示例性地，该应用信息可以为第一应用的应用标识。例如，应用标识为应用ID(identity，身份)。
在一些实施例中，第一应用可能是已知应用或未知应用，这里所述的已知应用通常是指已知不具有安全隐患的应用，已知应用一般是从已知且可靠的下载途径下载的，而未知应用通常是指可能存在安全隐患的应用。示例性地，从应用市场中下载的应用通常可以认为是已知应用，而从未知网站下载的应用通常可以认为是未知应用。因此在实施中，若第一应用是已知应用可以不对其行为进行监控，但若第一应用为未知应用确定对第一应用进行行为监控。在本申请实施例中，应用监控模块可以向应用市场发送监控服务注册请求，将第一应用的应用信息发送给应用市场，以便于应用市场确定第一应用是已知应用还是未知应用，从而确定是否对第一应用进行行为监控。
作为一种示例，由于在AIDL绑定过程中应用监控模块获取了监控服务管理模块创建的AIDL绑定对象，AIDL绑定对象中包括注册方法，所以，应用监控模块可以调用AIDL 绑定对象中的注册方法，此时应用市场中的注册方法被AIDL机制触发，如此，应用监控模块就可以通过注册方法向监控服务管理模块发送监控服务注册请求。相应的，监控服务管理模块通过注册方法接收监控服务注册请求，也即是，注册方法可以用于第一应用和应用市场协商如何发送或接收监控服务注册请求，从而实现第一应用与应用市场之间的注册通信。
609：监控服务管理模块根据监控服务注册请求判断是否监控第一应用对接口的接口调用事件。
在一种可能的实现方式中，监控服务管理模块可以获取白名单，白名单中包括已知应用的应用信息，不难理解，白名单中的应用信息指示的应用为不存在安全隐患的应用，即为已知应用。监控管理服务模块可以判断第一应用是否属于白名单。如果第一应用不属于白名单，则确定监控第一应用对接口的接口调用事件，也即确定第一应用为待检测应用。如果第一应用属于白名单，则确定不监控第一应用对接口的接口调用事件，也即确定第一应用不存在安全隐患。
譬如，应用市场可以查看APP1的应用标识是否属于白名单，如果APP1的应用标识属于白名单，则说明APP1为已知应用，此时可以确定不监控APP1对接口的接口调用事件，否则，如果APP1的应用标识不属于白名单，则说明APP1是未知应用，此时可以确定监控APP1对接口的接口调用事件。
响应于监控服务管理模块根据监控服务注册请求确定监控第一应用对接口的接口调用事件，则可以进入如下步骤610-步骤614。若监控服务管理模块确定不监控第一应用对接口的接口调用事件，则执行如下步骤615。
610：监控服务管理模块更新应用监控列表，得到第一监控列表。
其中，第一监控列表中包括第一应用的应用信息。
作为一种示例，监控服务管理模块更新应用监控列表的具体实现可以包括：监控服务管理模块将第一应用的应用信息添加至应用监控列表中，以对应用监控列表进行更新。
需要说明的是，这里仅是以监控服务管理模块采用应用监控列表对待监控的第一应用进行记录为例进行说明。在另一实施例中，监控服务管理模块还可以采用其他方式对待监控的第一应用进行记录，示例性地，监控服务管理模块还可以采用集合的方式进行记录。
作为另一种示例，监控服务管理模块更新应用监控列表的具体实现还可以包括：监控服务管理模块将第一应用的应用信息添加至应用监控列表中，并标记第一应用的状态为待监控状态。
如此，通过更新应用监控列表得到第一监控列表，并通过第一监控列表记录待监控的应用，以便于后续可以批量对第一监控列表中的应用进行监控。
作为一种示例，监控服务管理模块后续确定了第一应用的安全性之后，可以更新第一监控列表。作为一种示例，更新后的第一监控列表中不包括已进行安全性分析的应用，也即可以将第一应用的应用信息从第一监控列表中删除，如此可以避免对第一应用进行重复监控。
作为另一种示例，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。示例性地，第一监控列表中的第一应用对应有指示符，指示符可以用于指示第一应用是否已进行安全性分析。譬如，当指示符为“1”时表示第一应用已进行安全性分析，当 指示符为“0”时表示第一应用未进行安全性分析。在该种情况下，监控服务管理模块在确定了第一应用的安全性后，更新第一应用对应的指示符，以使得更新后的指示符指示第一应用为已进行安全性分析的应用。譬如，将第一应用的指示符从“0”更新为“1”，也即监控服务管理模块在确定了第一应用的安全性后，也可以不将第一应用的应用信息从第一监控列表中删除。
611：监控服务管理模块确定当前是否满足预设动态监控条件。
预设动态监控条件可以预先进行设置。
作为一种示例，预设动态监控条件可以是指每隔预设时长。比如，5分钟或者30分钟。
其中，预设时长可以由用户根据实际需求进行设置，或者，预设时长也可以由电子设备默认设置，本申请实施例对此不作限定。
作为另一种示例，预设动态监控条件可以是指第一监控列表中记录的待监控的应用个数达到预设数值。
其中，预设数值可以由用户根据实际需求进行设置，或者，预设数值也可以由电子设备默认设置，本申请实施例对此不作限定。
当预设数值为1时，说明监控服务管理模块是对单个应用进行监控。当预设数值大于1时，表明监控服务管理模块可以批量监控应用的安全性。
示例性地，以预设数值为2为例，则当监控服务管理模块确定第一监控列表中包括的待监控的应用个数为2时，可以确定当前满足预设动态监控条件。
若监控服务管理模块确定当前满足预设动态监控条件，则进入如下步骤612；反之，若当前不满足预设动态监控条件，则进入如下步骤615。
612：监控服务管理模块向应用监控模块发送监控开启通知。
在实施中，由于在AIDL绑定过程中应用监控模块获取了监控服务管理模块创建的AIDL绑定对象，AIDL绑定对象中包括通知发送方法，所以，监控服务管理模块可以调用AIDL绑定对象中的通知发送方法，此时第一应用中的通知发送方法就可以被AIDL机制触发，如此，监控服务管理模块就可以通过通知发送方法向第一应用发送监控开启通知。相应的，应用监控模块通过通知发送方法接收监控开启通知，也即是，通知发送方法可以用于应用市场和第一应用协商如何发送或接收通知，从而实现通信。
需要说明的是，若第一监控列表中包括多个待监控的应用的应用信息，则监控服务管理模块可以向多个待监控的应用分别下发监控开启通知。
在本申请一个实施例中，在第一应用对应有指示符的情况下，按照前文所述，第一监控列表记录的多个待监控的应用中可能存在某个或某些应用已进行了安全性分析，所以为了避免重复监控，监控服务管理模块可以查询第一监控列表中的多个待监控的应用中每个应用的指示符，之后根据每个应用的指示符向多个待监控的应用中未进行安全性分析的应用下发监控开启通知。
613：若第一应用调用目标接口，则应用监控模块执行方法地址替换。
其中，目标是指属于接口监控列表中的接口，接口监控列表可以预先设置。示例性地，接口监控列表中包括待监控的接口的接口信息，接口信息可以用于唯一地标识一个接口，示例性地，接口信息为接口ID。
应用监控模块接收监控开启通知后，在调用接口的过程中，可以检测被第一应用调用 的接口是否属于接口监控列表，如果被调用的接口属于接口监控列表，则确定被调用的接口为目标接口；否则，如果被调用的接口不属于接口监控列表，则确定被调用的接口不是目标接口。
作为一种示例，如果第一应用调用目标接口，则应用监控模块获取第一应用对目标接口的接口调用事件。在实施中，由于每个接口对应一个应用程序接口(application programming interface，API)方法，通过调用API方法可以实现接口调用，所以在常规情况下，第一应用调用目标接口会执行目标接口对应的API方法。然而在本申请实施例中，由于需要对目标接口的调用情况进行监控，所以此时应用监控模块不调用目标接口的API方法，而是转去调用应用监控模块中设置的钩子方法，应用监控模块通过执行钩子方法可以获取目标接口的接口调用事件，并且通过钩子方法可以回调目标接口对应的API方法，从而在对目标接口调用的过程中实现对接口调用情况进行监控。
具体地，在Android5.0以后，Android系统使用Art虚拟机作为底层的实现，Android中的每个API方法在Art虚拟机中都会由一个结构对象来表示，示例性地，结构对象为artMethod结构对象。在实施中，可以采用图7中的Method{}方式来定义结构对象。结构对象中存在至少一个成员变量，至少一个成员变量包括一个指定成员变量，示例性地，指定成员变量为entry_point_from_quick_compiled_code。指定成员变量为API方法的API方法地址，API方法地址指向的位置表征API方法的执行入口，通过执行入口可以调用起API方法。因此，应用监控模块可以将待调用的目标接口的API方法的API方法地址替换为钩子方法的钩子方法地址，从而基于钩子方法地址调用钩子方法，以获取目标接口的接口调用事件。
钩子方法可以理解为是备份了目标接口的API方法，并在备份的API方法前后增加了监控功能。在实施中，可以在钩子方法中复制目标接口的API方法地址，如此相当于是备份了目标接口的API方法。所以调用钩子方法不仅可以实现目标接口的调用，而且在调用目标接口的过程中还获取到目标接口的接口调用事件，达到了对目标接口的调用情况进行监控的目的。
作为一种示例，如果要调用的接口不是目标接口，则应用监控模块直接调用接口的API方法。
值得一提的是，本申请实施例中使用的是方法地址替换的方法，因此无需在目标接口的实际调用处增加调用事件的监控代码，增减目标接口的监控只对应用监控模块进行相应的修改即可，使得目标接口的监控管理与Android系统底层不具有强耦合性，从而保证了系统的稳定性。
需要说明的是，本申请实施例是以在第一应用调用目标接口的情况下，应用监控模块获取目标接口的接口调用事件为例进行说明。在另一实施例中，还可以在第一应用调用接口的情况下，应用监控模块获取所调用的接口的接口调用事件，也即只要第一应用执行接口调用操作，无论调用的接口是否为目标接口，应用监控模块都执行获取接口调用事件的操作。
作为一种示例，接口调用事件可以包括接口标识，譬如接口标识为接口ID。作为本申请的一个示例，接口调用事件还可以包括接口调用开始时间和/或接口调用结束时间。其中，接口调用开始时间是指开始调用接口的时间，接口调用结束时间是指结束调用接口的时间。 示例性地，接口调用事件可以为一条事件日志：在15:05:15调用了接口A。
值得一提的是，若接口调用事件中包括接口调用开始时间和/或接口调用结束时间，则在一些场景下，可以提高应用市场分析第一应用是否存在安全隐患的准确性。
614：应用监控模块向监控服务管理模块上报第一应用的接口调用事件。
具体地，由于在AIDL绑定过程中应用监控模块获取了监控服务管理模块创建的AIDL绑定对象，AIDL绑定对象中包括事件上报方法，所以，应用监控模块可以调用AIDL绑定对象中的事件上报方法，此时应用市场中的事件上报方法被AIDL机制触发，如此，应用监控模块就可以通过事件上报方法向应用市场上报接口调用事件。相应的，应用市场通过事件上报方法接收接口调用事件，也即是，事件上报发送方法可以用于第一应用和应用市场协商如何发送或接收接口调用事件，从而实现第一应用与应用市场之间的上报通信。也即应用监控模块通过第一应用与应用市场之间具有的通信通道上报接口调用事件，以便于应用市场后续进行安全性分析。示例性地，接口调用事件可以包括目标接口的接口标识和接口调用开始时间。
示例性地，在行为监控过程中，若APP1调用用户地址信息的获取接口000001，判断接口000001是否属于接口监控列表，如果接口000001属于接口监控列表，确定APP1调用的接口为目标接口。此时，APP1通过应用监控模块使用钩子方法地址来替换接口000001的API方法地址，如此，APP1去执行钩子方法。在钩子方法中向应用市场上报关于APP1开始调用接口000001所对应的接口调用事件，譬如，接口调用事件包括接口ID。然后回调接口000001对应的API方法。作为本申请的一个示例，在接口000001对应的API方法执行结束后，还可以继续上报接口000001的接口调用结束时间给应用市场。
在一个实施例中，若APP1调用用户同意隐私声明的接口000002，当接口000002属于接口监控列表时，APP1按照上述方式上报接口000002的接口调用事件给应用市场。
值得一提的是，若第一应用与应用市场之间采用已有的通信方式进行通信，则第一应用很容易筛选掉应用市场发送的与监控相关的指示消息，并且第一应用可以自主选择是否要上报自己调用接口的行为，导致第一应用可以逃避应用市场的监控。然而，由于本申请实施例在应用程序框架层植入应用监控模块，在第一应用初始化运行后，使得第一应用将应用监控模块加载成为第一应用的一个运行时模块，由应用监控模块在第一应用与应用市场之间建立专用于监控的通信通道，并且由应用监控模块基于通信通道监控第一应用及上报第一应用的行为，如此可以保证对第一应用监控的可靠性和有效性。
另外，本申请实施例是基于应用监控模块上报的接口调用事件进行分析，不涉及用户的隐私数据，因此不会存在泄漏用户数据隐私的威胁。
615：监控管理服务模块等待下一个监控服务注册请求。
不难理解，如果监控服务管理模块确定不对第一应用进行行为监控，则可以继续等待下一个第一应用的监控服务注册请求。
本申请实施例中，电子设备在应用程序框架层存放应用监控模块，第一应用初始化后电子设备控制第一应用加载应用监控模块。应用监控模块被第一应用加载到第一应用的进程中成为第一应用的一个运行时模块后主动与应用市场进行交互，也即应用市场可以通过应用监控模块对第一应用进行行为监控，由此可见，第一应用的行为监控不再涉及应用程序框架层，可以使得接口调用事件上报机制与系统平台解耦。以Android平台来说，在应 用程序框架层植入应用监控模块对整个Android平台的正常运行不会造成干扰，Android平台的改动和升级也不会影响接口监控。并且后续也可以只需修改应用程序框架层的应用监控模块，就可以实现监控点的增加和/或删除，而不涉及Android原生代码的改动，如此不会造成性能上的损耗，可以保证系统性能的稳定性和可维护性。
需要说明的是，本申请实施例中仅是以由应用市场对应用进行安全性分析为例进行说明。在另一实施例中，还可以由其他集成有监控服务管理模块和行为分析模块的管理类应用对应用进行安全性分析，在一些实施例中可以称该管理类应用为第二应用。作为一种示例，电子设备中可以安装有集成了监控服务管理模块和行为分析模块的指定应用，指定应用专用于对电子设备中的应用的安全性进行分析，也即第二应用可以为指定应用。在该种情况下，可以通过应用程序框架层的连接建立模块在第一应用与指定应用之间建立通信通道，以使得指定应用通过该通信通道能够对第一应用进行行为监控和分析。再或者，监控服务管理模块和行为分析模块中的部分模块或者全部模块也可以部署在云端，以通过电子设备与云端之间交互对第一应用进行安全性分析。示例性地，监控服务管理模块可以部署在电子设备中的某已知的管理类应用中，行为分析模块可以部署在云端。如此，监控服务管理模块接收接口调用事件后，可以将所接收的接口调用事件发送给云端，由云端的行为分析模块基于所接收的接口调用事件对第一应用的安全性进行分析。
上述是以本申请实施例提供的方法应用于电子设备中为例进行说明。在另一实施例中，本申请实施例提供的方法还可以应用于服务器中，示例性地，服务器可以安装有第二应用，服务器中下载和安装第一应用后，在第一应用初始化运行的过程中，可以由服务器中的第二应用对第一应用的安全性进行监控和分析，本申请实施例对此不作限定。
请参阅图8，图8是根据另一示例性实施例提供的一种应用的安全性分析方法的示意图，该方法可以应用于上述电子设备中，具体可以包括如下部分或者全部内容：
801～802，同上述604～605处的描述，此处不再赘述。
803：应用监控模块向监控服务管理模块发送AIDL绑定请求。
在本申请实施例中，为了保证对第一应用进行监控的可靠性和稳定性，可以基于AIDL机制在第一应用与第二应用之间建立通信通道，该通信通道专用于第二应用对第一应用进行行为监控。为此，需要第一应用与第二应用进行AIDL绑定，所以第一应用加载应用监控模块后，可以直接由应用监控模块向监控服务管理模块发送AIDL绑定请求，AIDL绑定请求用于指示监控服务管理模块返回AIDL绑定对象。
如前文所述，AIDL绑定对象包括至少一个执行方法，作为一种示例，监控服务管理模块创建的AIDL绑定对象可以包括注册方法、事件上报方法和通知发送方法，其中，注册方法可以用于向第二应用进行注册，事件上报方法可以用于向第二应用发送接口调用事件，通知发送方法用于第二应用向第一应用发送通知消息。譬如，如果第一应用获取到AIDL绑定对象，则当注册方法被第一应用调用时，则第一应用就可以向第二应用发起监控服务注册请求，从而实现第一应用与第二应用之间的注册通信；再如，若事件上报方法被第一应用调用，则第一应用就可以向第二应用发送接口调用事件，从而实现第一应用与第二应用之间的上报通信；又如，若通知发送方法被第二应用调用，则第二应用就可以向第一应用发送用于指示第一应用开启行为监控的监控开启通知。
804：监控服务管理模块向应用监控模块发送AIDL绑定对象。
需要说明的是，这里对监控服务管理模块创建AIDL绑定对象的时间不做具体限定，作为一种示例，监控服务管理模块可以在第一应用安装之前就已经创建AIDL绑定对象，譬如在第二应用运行后创建AIDL绑定对象。作为又一种示例，监控服务管理模块还可以在第一次接收到第一应用的AIDL绑定请求后创建AIDL绑定对象。
805：应用监控模块向监控服务管理模块发送监控服务注册请求。
806：监控服务管理模块判断是否监控第一应用对接口的接口调用事件。
807：若监控服务管理模块确定监控第一应用对接口的接口调用事件，则更新应用监控列表。
808：监控服务管理模块确定当前是否满足预设动态监控条件。
809：若监控服务管理模块确定当前满足预设动态监控条件，则向应用监控模块发送监控开启通知。
810：若第一应用调用目标接口，则应用监控模块执行方法地址替换。
811：应用监控模块上报第一应用的接口调用事件。
812：监控管理服务模块等待下一个监控服务注册请求。
上述步骤805至步骤812的具体实现过程可以参见上述步骤608至步骤615的具体实现过程，这里不再重复赘述。
值得一提的是，在本申请实施例中，第一应用加载应用监控模块后，可以由应用监控模块直接向第二应用请求进行AIDL绑定，如此可以避免需要在应用程序框架层植入连接建立模块，从而可以减少对Android系统改动。
请参阅图9，接下来介绍第二应用对第一应用的安全性分析的执行过程，这里以监控服务管理模块与行为分析模块之间的交互为例进行说明：
901：行为分析模块向监控服务管理模块请求第一应用的接口调用事件。
作为一种示例，监控服务管理模块在接收第一应用的接口调用事件后，可以将接口调用事件与第一应用的应用信息对应存储。在一种可能的实现方式中，可以将接口调用事件存储至第一应用信息对应的消息队列中，在实施中，可以按照接口调用事件的接收时间先后顺序对所接收的接口调用事件进行存储。如此，行为分析模块可以从消息队列中读取接口调用事件。
作为一种示例，行为分析模块可以在满足事件获取条件的情况下向监控服务管理模块请求接口调用事件，其中，事件获取条件可以根据实际需求预先进行设置。示例性地，事件获取条件为每隔预设时长，则行为分析模块可以每隔预设时长，向监控服务管理模块请求接口调用事件。
其中，预设时长可以由用户根据实际需求进行设置，或者，也可以由电子设备默认设置，本申请实施例对此不作限定。
需要说明的是，这里仅是以监控服务管理模块以消息队列方式将应用信息与接口调用事件对应存储为例进行说明，在另一实施例中，还可以采用其他方式将应用信息与接口调用事件对应存储。比如在一些实施例中，监控服务管理模块还可以采用列表的方式进行对应存储。示例性地，接口调用事件包括接口标识、接口调用开始时间和接口调用结束时间， 则监控服务管理模块可以采用表1的方式将接口调用事件与第一应用的应用信息对应存储。
表1
Figure PCTCN2021137524-appb-000001
902：监控服务管理模块向行为分析模块发送第一应用的接口调用事件。
作为一种示例，监控服务管理模块向行为分析模块发送第一应用对各个接口的接口调用事件。也即是，第一应用可能对多个接口进行调用，应用监控模块可以上报第一应用对各个接口的接口调用事件，如此，监控服务模块向行为分析模块发送从应用监控模块获取的各个接口的接口调用事件。
另外需要说明的是，上述是以行为分析模块向监控服务管理模块请求第一应用的接口调用事件为例进行说明。在另一实施例中，监控服务管理模块还可以主动向行为分析模块上报第一应用的接口调用事件。
903：行为分析模块基于接口调用事件分析第一应用的安全性。
行为分析模块根据接口调用事件确定第一应用是否存在安全隐患。
作为一种示例，当监控服务管理模块向行为分析模块发送第一应用对各个接口的接口调用事件时，行为分析模块基于第一应用对各个接口的接口调用事件，对第一应用进行安全性分析。
作为一种示例，每个行为的分析都会存在一个与之对应的插件，每个插件可以具有自己的分析逻辑，可以通过插件来分析对应的行为是否符合预设条件，从而确定第一应用是否存在安全隐患，其中预设条件可以根据实际需求进行设置，且不同插件可以对应不同的预设条件。示例性地，某插件A为隐私声明存在插件，插件A可以用于分析隐私政策声明存在与否，其分析过程就是分析隐私政策声明接口是否被调用，示例性地，插件A对应的预设条件可以为：隐私政策声明接口被调用。再如，某插件B为未经用户同意收集数据插件，插件B可以用于分析未经用户同意申请权限的问题，其分析过程就是分析隐私政策声明与用户同意申请权限发生的顺序是否符合要求，示例性地，插件B对应的预设条件可以为：隐私政策声明发生的时间早于用户同意申请权限发生的时间。
作为一种示例，若行为分析模块确定第一应用存在安全隐患，譬如若确定第一应用调用的目标接口不在第一应用的可调用范围内，则确定第一应用存在安全隐患，在这种情况下可以进行预警提示，以向用户进行反馈，譬如可以通过弹窗的方式提示用户第一应用在运行过程中一些行为存在安全隐患，具体实现方式可以参见上述应用场景部分，这里不再重复赘述。
作为一种示例，第二应用可以使用一个消息队列接收APP1传递回来的接口调用事件，行为分析模块中的插件分析消息队列中的接口调用事件，示例性地，若发现APP1在一个时间段内调用了接口000001和接口000002，且调用接口000001的时间早于调用接口000002的时间，则可以认为APP1存在未经用户同意就收集用户地址信息的恶意行为，此 时可以通过弹窗或者信息提示等方式，提醒用户APP1的恶意行为，建议用户卸载APP1，以避免隐私数据的泄露。
值得一提的是，本申请实施例可以避免恶意软件入侵用户的电子设备，让用户可以实时感知已安装应用的恶意行为，从而保证用户的隐私数据的安全。
应理解，上述实施例中各步骤的序号并不完全意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
对应于上文实施例所述的应用的安全性分析方法，图10是本申请实施例提供的一种应用的安全性分析装置的结构框图，为了便于说明，仅示出了与本申请实施例相关的部分。
该安全性分析装置配置于电子设备中，所述电子设备的应用程序框架层中包括应用监控模块，所述应用监控模块用于监控所述电子设备中的第一应用对接口的接口调用事件，请参照图10，所述装置包括目标管理模块1010、所述应用监控模块1020和第二应用1030：
目标管理模块1010，用于响应于第一应用初始化运行，为第一应用加载应用监控模块；
应用监控模块1020，用于获取第一应用对接口的接口调用事件，通过第一应用和第二应用之间具有的通信通道向第二应用上报接口调用事件。
第二应用1030，用于根据接口调用事件分析第一应用的安全性。
第二应用1030，用于当确定所述第一应用存在安全隐患时，进行预警提示。
作为本申请的一个示例，应用监控模块1020用于：
调用钩子方法，以获取接口调用事件，钩子方法用于在第一应用执行接口调用的过程中获取第一应用对接口的接口调用事件。
作为本申请的一个示例，应用监控模块1020用于：
将待调用的应用程序接口API方法地址替换为钩子方法的钩子方法地址。
基于钩子方法地址调用钩子方法。
作为本申请的一个示例，第二应用1030包括监控服务管理模块。
应用监控模块1020，用于向第二应用发送监控服务注册请求，监控服务注册请求用于请求第二应用确定是否监控第一应用的接口调用事件。
监控服务管理模块，用于响应于第二应用根据监控服务注册请求确定监控第一应用的接口调用事件，更新应用监控列表，得到第一监控列表，第一监控列表中包括第一应用的应用信息。
作为本申请的一个示例，请参考图11，第二应用1030包括监控服务管理模块10301，监控服务管理模块10301用于：在第二应用确定监控第一应用对接口的接口调用事件的情况下，向应用监控模块发送监控开启通知，监控开启通知用于触发应用监控模块获取第一应用对接口的接口调用事件。
作为本申请的一个示例，监控服务管理模块10301还用于：更新第一监控列表。其中，更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。
作为本申请的一个示例，应用监控模块1020用于：在监控到第一应用调用目标接口的情况下，将第一应用对目标接口的调用事件确定为接口调用事件，目标接口为接口监控列表中的接口，接口监控列表用于记录待监控的接口的接口信息。
作为本申请的一个示例，装置包括目标模块，目标模块为第二应用或应用程序框架层的连接建立模块，连接建立模块用于在第一应用初始化运行后建立第一应用和第二应用之间的通信通道。
应用监控模块，用于向目标模块发送安卓接口定义语言AIDL绑定请求。
目标模块，用于接收AIDL绑定请求。
目标模块，用于基于AIDL绑定请求向应用监控模块发送AIDL绑定对象，AIDL绑定对象包括用于建立通信通道的对象数据。
应用监控模块1020，用于接收AIDL绑定对象。
作为本申请的一个示例，响应于目标模块为连接建立模块，连接建立模块用于：从第二应用处获取AIDL绑定对象。
作为本申请的一个示例，请参考图11，第二应用1030包括监控服务管理模块10301和行为分析模块10302。
监控服务管理模块10301，用于接收应用监控模块传输的第一应用对各个接口的接口调用事件。
行为分析模块10302，用于从监控服务管理模块处获取第一应用对各个接口的接口调用事件。
行为分析模块10302，用于根据各个接口的接口调用事件分析第一应用的安全性。
作为本申请的一个示例，请参考图11，第二应用包括1030监控服务管理模块10301和行为分析模块10302。
监控服务管理模块10301，用于接收应用监控模块传输的接口调用事件。
监控服务管理模块10301，用于基于行为分析模块的请求，向行为分析模块上报接口调用事件。
行为分析模块10302，用于根据接口调用事件分析第一应用的安全性。
在本申请实施例中，电子设备的应用程序框架层存放应用监控模块，第一应用初始化后电子设备控制第一应用加载应用监控模块。应用监控模块被第一应用加载到第一应用的进程中成为第一应用的一个运行时模块后主动与第二应用进行交互。也即应用监控模块获取第一应用对接口的接口调用事件，通过第一应用与第二应用之间具有的通信通道向第二应用上报接口调用事件，如此，第二应用根据接口调用事件对第一应用的行为进行分析，以确定第一应用是否存在安全隐患。本申请实施例无需在第一应用的应用程序包中插入监控代码即可对第一应用的行为进行监控，避免由于修改应用程序包导致应用无法运行或者部分功能不可用的情况，从而可以保证系统的稳定性。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述 系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的系统实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口，装置或单元的间接耦合或通讯连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质至少可以包括：能够将计算机程序代码携带到电子设备的任何实体或装置、记录介质、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、电载波信号、电信信号以及软件分发介质。例如U盘、移动硬盘、磁碟或者光盘等。在某些司法管辖区，根据立法和专利实践，计算机可读介质不可以是电载波信号和电信信号。
最后应说明的是：以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (20)

  1. 一种应用的安全性分析方法，其特征在于，应用于电子设备中，所述电子设备的应用程序框架层中包括应用监控模块，所述应用监控模块用于监控所述电子设备中的第一应用对接口的接口调用事件，所述方法包括：
    响应于所述第一应用初始化运行，为所述第一应用加载所述应用监控模块；
    所述应用监控模块获取所述第一应用对接口的接口调用事件，通过所述第一应用和第二应用之间具有的通信通道向所述第二应用上报所述接口调用事件；
    所述第二应用根据所述接口调用事件分析所述第一应用的安全性；
    当所述第二应用确定所述第一应用存在安全隐患时，进行预警提示。
  2. 如权利要求1所述的方法，其特征在于，所述应用监控模块获取所述第一应用对接口的接口调用事件，包括：
    所述应用监控模块调用钩子方法，以获取所述接口调用事件，所述钩子方法用于在所述第一应用执行接口调用的过程中获取所述第一应用对接口的接口调用事件。
  3. 如权利要求2所述的方法，其特征在于，所述应用监控模块调用钩子方法，包括：
    所述应用监控模块将待调用的应用程序接口API方法地址替换为所述钩子方法的钩子方法地址；
    所述应用监控模块基于所述钩子方法地址调用所述钩子方法。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，所述方法还包括：
    所述应用监控模块向目标模块发送安卓接口定义语言AIDL绑定请求，所述目标模块为所述第二应用或所述应用程序框架层的连接建立模块，所述连接建立模块用于在所述第一应用初始化运行后建立所述第一应用和所述第二应用之间的通信通道；
    所述目标模块接收所述AIDL绑定请求；
    所述目标模块基于所述AIDL绑定请求向所述应用监控模块发送AIDL绑定对象，所述AIDL绑定对象包括用于建立所述通信通道的对象数据；
    所述应用监控模块接收所述AIDL绑定对象。
  5. 如权利要求4所述的方法，其特征在于，响应于所述目标模块为所述连接建立模块，所述方法还包括：
    所述连接建立模块从所述第二应用处获取所述AIDL绑定对象。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，所述应用监控模块获取所述第一应用对接口的接口调用事件之前，还包括：
    所述应用监控模块向所述第二应用发送监控服务注册请求，所述监控服务注册请求用于请求所述第二应用确定是否监控所述第一应用的接口调用事件；
    响应于所述第二应用根据所述监控服务注册请求确定监控所述第一应用的接口调用事件，更新应用监控列表，得到第一监控列表，所述第一监控列表中包括所述第一应用的应用信息。
  7. 如权利要求1-6中任一项所述的方法，其特征在于，所述方法还包括：
    在所述第二应用确定监控所述第一应用对接口的接口调用事件的情况下，向所述应用监控模块发送监控开启通知，所述监控开启通知用于触发所述应用监控模块获取所述第一应用对接口的接口调用事件。
  8. 如权利要求6所述的方法，其特征在于，所述方法还包括：
    更新所述第一监控列表；
    其中，更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。
  9. 如权利要求1-8中任一项所述的方法，其特征在于，所述应用监控模块获取所述第一应用对接口的接口调用事件，包括：
    在所述应用监控模块监控到所述第一应用调用目标接口的情况下，将所述第一应用对所述目标接口的调用事件确定为所述接口调用事件，所述目标接口为接口监控列表中的接口，所述接口监控列表用于记录待监控的接口的接口信息。
  10. 如权利要求1所述的方法，其特征在于，所述第二应用包括监控服务管理模块和行为分析模块，所述第二应用根据所述接口调用事件分析所述第一应用的安全性，包括：
    所述监控服务管理模块接收所述应用监控模块传输的所述第一应用对各个接口的接口调用事件；
    所述行为分析模块从所述监控服务管理模块处获取所述第一应用对各个接口的接口调用事件；
    所述行为分析模块根据所述各个接口的接口调用事件分析所述第一应用的安全性。
  11. 如权利要求1所述的方法，其特征在于，所述第二应用包括监控服务管理模块和行为分析模块，所述第二应用根据所述接口调用事件分析所述第一应用的安全性，包括：
    所述监控服务管理模块接收所述应用监控模块传输的所述接口调用事件；
    所述监控服务管理模块基于所述行为分析模块的请求，向所述行为分析模块上报所述接口调用事件；
    所述行为分析模块根据所述接口调用事件分析所述第一应用的安全性。
  12. 一种应用的安全性分析装置，其特征在于，配置于电子设备中，所述电子设备的应用程序框架层中包括应用监控模块，所述应用监控模块用于监控所述电子设备中的第一应用对接口的接口调用事件，所述装置包括目标管理模块、所述应用监控模块和第二应用：
    所述目标管理模块，用于响应于所述第一应用初始化运行，为所述第一应用加载所述应用监控模块；
    所述应用监控模块，用于获取所述第一应用对接口的接口调用事件，通过所述第一应用和所述第二应用之间具有的通信通道向所述第二应用上报所述接口调用事件；
    所述第二应用，用于根据所述接口调用事件分析所述第一应用的安全性；
    所述第二应用，用于当确定所述第一应用存在安全隐患时，进行预警提示。
  13. 如权利要求12所述的装置，其特征在于，所述应用监控模块用于：
    调用钩子方法，以获取所述接口调用事件，所述钩子方法用于在所述第一应用执行接口调用的过程中获取所述第一应用对接口的接口调用事件。
  14. 如权利要求12或13所述的装置，其特征在于，所述装置包括目标模块，所述目标模块为所述第二应用或所述应用程序框架层的连接建立模块，所述连接建立模块用于在所述第一应用初始化运行后建立所述第一应用和所述第二应用之间的通信通道；
    所述应用监控模块，用于向所述目标模块发送安卓接口定义语言AIDL绑定请求；
    所述目标模块，用于接收所述AIDL绑定请求；
    所述目标模块，用于基于所述AIDL绑定请求向所述应用监控模块发送AIDL绑定对象，所述AIDL绑定对象包括用于建立所述通信通道的对象数据；
    所述应用监控模块，用于接收所述AIDL绑定对象。
  15. 如权利要求12-14中任一项所述的装置，其特征在于，所述第二应用包括监控服务管理模块；
    所述应用监控模块，用于向所述第二应用发送监控服务注册请求，所述监控服务注册请求用于请求所述第二应用确定是否监控所述第一应用的接口调用事件；
    所述监控服务管理模块，用于响应于所述第二应用根据所述监控服务注册请求确定监控所述第一应用的接口调用事件，更新应用监控列表，得到第一监控列表，所述第一监控列表中包括所述第一应用的应用信息。
  16. 如权利要求12-15中任一项所述的装置，其特征在于，所述第二应用包括监控服务管理模块，所述监控服务管理模块用于：
    在所述第二应用确定监控所述第一应用对接口的接口调用事件的情况下，向所述应用监控模块发送监控开启通知，所述监控开启通知用于触发所述应用监控模块获取所述第一应用对接口的接口调用事件。
  17. 如权利要求15所述的装置，其特征在于，所述监控服务管理模块还用于：
    更新所述第一监控列表；
    其中，更新后的第一监控列表中不包括已进行安全性分析的应用，或者，更新后的第一监控列表中已进行安全性分析的应用的状态被标记为已分析。
  18. 如权利要求12所述的装置，其特征在于，所述所述第二应用包括监控服务管理模块和行为分析模块；
    所述监控服务管理模块，用于接收所述应用监控模块传输的所述第一应用对各个接口的接口调用事件；
    所述行为分析模块，用于从所述监控服务管理模块处获取所述第一应用对各个接口的接口调用事件；
    所述行为分析模块，用于根据所述各个接口的接口调用事件分析所述第一应用的安全性。
  19. 一种电子设备，所述电子设备包括处理器和存储器，所述存储器用于存储支持电子设备执行权利要求1-11任一所述的方法的程序，以及存储用于实现权利要求1-11任一所述的方法所涉及的数据；所述处理器被配置为用于执行所述存储器中存储的程序。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行如权利要求1-11任一项所述的方法。
PCT/CN2021/137524 2020-12-29 2021-12-13 应用的安全性分析方法、装置、设备及存储介质 WO2022143126A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011608063.7A CN114692137A (zh) 2020-12-29 2020-12-29 应用的安全性分析方法、装置、设备及存储介质
CN202011608063.7 2020-12-29

Publications (1)

Publication Number Publication Date
WO2022143126A1 true WO2022143126A1 (zh) 2022-07-07

Family

ID=82132863

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/137524 WO2022143126A1 (zh) 2020-12-29 2021-12-13 应用的安全性分析方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN114692137A (zh)
WO (1) WO2022143126A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117806971A (zh) * 2024-01-03 2024-04-02 北京北大软件工程股份有限公司 一种自适应分析配置方法和系统

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117633774A (zh) * 2022-08-12 2024-03-01 荣耀终端有限公司 一种应用图标的可视化方法和设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103198255A (zh) * 2013-04-03 2013-07-10 武汉大学 一种Android软件敏感行为监控与拦截方法及系统
WO2015070653A1 (zh) * 2013-11-15 2015-05-21 北京奇虎科技有限公司 病毒防御方法和装置
CN105550595A (zh) * 2015-12-22 2016-05-04 北京奇虎科技有限公司 用于智能通信设备的隐私数据访问方法及系统
CN111858224A (zh) * 2019-04-25 2020-10-30 珠海格力电器股份有限公司 一种安卓系统中的进程监听方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103198255A (zh) * 2013-04-03 2013-07-10 武汉大学 一种Android软件敏感行为监控与拦截方法及系统
WO2015070653A1 (zh) * 2013-11-15 2015-05-21 北京奇虎科技有限公司 病毒防御方法和装置
CN105550595A (zh) * 2015-12-22 2016-05-04 北京奇虎科技有限公司 用于智能通信设备的隐私数据访问方法及系统
CN111858224A (zh) * 2019-04-25 2020-10-30 珠海格力电器股份有限公司 一种安卓系统中的进程监听方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117806971A (zh) * 2024-01-03 2024-04-02 北京北大软件工程股份有限公司 一种自适应分析配置方法和系统

Also Published As

Publication number Publication date
CN114692137A (zh) 2022-07-01

Similar Documents

Publication Publication Date Title
EP4002108B1 (en) Application start method and electronic device
CN109101352B (zh) 图像处理算法架构、算法调用方法、装置、存储介质及移动终端
EP3893118A1 (en) Recovery from application anomaly
EP4145286A1 (en) Memory management method and electronic device
US11853820B2 (en) Cross-process communication method, apparatus, and device
WO2021027630A1 (zh) 补丁方法、相关装置及系统
WO2022143126A1 (zh) 应用的安全性分析方法、装置、设备及存储介质
WO2021052167A1 (zh) 一种实现应用插件化的方法及电子设备
CN115309431B (zh) 一种参数更新方法、可读介质和电子设备
WO2022052766A1 (zh) 主题包适配方法及装置
CN115185652B (zh) 应用优化方法、装置以及电子设备
US20230350738A1 (en) Method for Reusing Shared Library and Electronic Device
WO2021238376A1 (zh) 功能包的加载方法、装置、服务器和电子设备
CN115562732A (zh) 一种开机方法、电子设备及计算机存储介质
CN112181406A (zh) 一种渲染引擎的共享方法和装置
CN113392120A (zh) 获取SQLite的执行信息的方法及装置
WO2024083114A1 (zh) 一种软件分发方法、电子设备及系统
CN117707753B (zh) 资源更新控制方法、电子设备及芯片系统
CN116737258B (zh) 卸载应用的方法及相关装置
CN117743445B (zh) 一种数据访问方法及电子设备
CN117707562B (zh) 参数更新方法和终端设备
CN116662101B (zh) 电子设备的故障修复方法和电子设备
WO2023202406A1 (zh) 显示方法及电子设备
WO2024088053A1 (zh) 代码调试方法、电子设备及计算机可读存储介质
CN118277120A (zh) 一种管理系统服务的方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913867

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 06.11.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21913867

Country of ref document: EP

Kind code of ref document: A1