WO2023024928A1 - Procédé et appareil de détection pour un programme d'application, et dispositif - Google Patents

Procédé et appareil de détection pour un programme d'application, et dispositif Download PDF

Info

Publication number
WO2023024928A1
WO2023024928A1 PCT/CN2022/111956 CN2022111956W WO2023024928A1 WO 2023024928 A1 WO2023024928 A1 WO 2023024928A1 CN 2022111956 W CN2022111956 W CN 2022111956W WO 2023024928 A1 WO2023024928 A1 WO 2023024928A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
application program
program
identification result
service interface
Prior art date
Application number
PCT/CN2022/111956
Other languages
English (en)
Chinese (zh)
Inventor
张述
孙靓
朱小龙
Original Assignee
花瓣云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 花瓣云科技有限公司 filed Critical 花瓣云科技有限公司
Publication of WO2023024928A1 publication Critical patent/WO2023024928A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/52—Network services specially adapted for the location of the user terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the technical field of information security, and in particular to a detection method, device and equipment of an application program.
  • a method for detecting the application program is needed to detect whether the application program transmits user information across borders.
  • the detection may be implemented by parsing the installation package of the application program. Specifically, the installation package of the application program is reversely analyzed (for example, decompiled) to obtain the source code. Through static analysis of the source code, determine whether the application will transfer user data across borders.
  • Embodiments of the present application provide an application program detection method, device, and equipment, so as to improve the accuracy of application program detection results.
  • the embodiment of the present application provides a method for detecting an application program.
  • the method for detecting an application program may be executed by a terminal device, a processor in a terminal device, a chip, etc., or may be performed by a server, a processor in a server, or a Chips, etc. can also be executed interactively by terminal devices and servers.
  • the following takes the execution subject as a server as an example for illustration.
  • the first application program to be detected runs in the terminal device.
  • the server acquires M messages sent by the terminal device through the first application program, where M is an integer greater than or equal to 1; wherein, each message may correspond to the first A network request sent by an application program to its corresponding application server.
  • Each message indicates the target data to be transmitted by the first application program, and the target network address to which the target data is to be transmitted.
  • the server determines the identification result of each message, and the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message; Generate a program detection result corresponding to the first application program according to the identification results of the M messages.
  • the geographical area is an area corresponding to a country.
  • the identification results of M messages may have the following situations:
  • Case 1 The identification result of each message in the M messages indicates that the sending location and the receiving location of the message are located in the same geographical area, and there is no user information in the message. That is to say, none of the M messages transmits user information across geographic regions. In this case, it may be determined that the program detection result corresponding to the first application program is normal.
  • Case 2 The identification result of the first message among the M messages indicates that the sending location and the receiving location of the message are not located in the same geographical area. That is to say, among the M messages, there are messages transmitted across geographic regions. In this case, it may be determined that the program detection result of the first application program is abnormal.
  • Case 3 The identification result that the first message exists in the M messages indicates that the user information exists in the message. That is to say, there is a message transmitting user information among the M messages. In this case, it may be determined that the program detection result of the first application program is abnormal.
  • the program detection result may include an abnormal level.
  • the abnormal levels corresponding to the above-mentioned cases 2 and 3 are slight.
  • the exception level corresponding to the above case 4 is the severity level.
  • the program detection result may include the cause of the abnormality.
  • the abnormal cause corresponding to the above case 2 is "cross-geographical region transmission”
  • the above-mentioned case 3 corresponds to "transmission of user information”
  • the above-mentioned case 4 corresponds to "transmission of user information across geographical regions”.
  • the reason for the above abnormality may be represented by text or an identification code.
  • the program detection result of the application program is obtained by analyzing the message actually sent by the application program during the running process, the accuracy of the program detection result is guaranteed.
  • the application detection method when the application detection method is applied to a server; the first application includes service interfaces corresponding to K geographical areas, and the server is provided with an agent corresponding to each service interface interface, the K is an integer greater than or equal to 1; the server can obtain M messages in the following manner: for each service interface, through the proxy interface corresponding to the service interface, obtain the The at least one message sent.
  • terminal devices when terminal devices are located in different countries, they send messages through different service interfaces. Therefore, when detecting the first application program, if it is necessary to detect service interfaces corresponding to multiple countries, it is necessary to obtain messages sent through multiple service interfaces.
  • terminal devices located in different countries can be used for detection.
  • the second way you can use a terminal device to change the location of the terminal device by piling and burying the terminal device, and simulate the scene where the terminal device is located in different countries, so as to complete the multiple service interfaces. detection process.
  • one terminal device is used, and the detection of all service interfaces of the first application program can be completed without the country where the mobile terminal device is located, which ensures that the detection process covers the service country comprehensively, and The detection efficiency is improved.
  • the way the terminal device sends the message through the first application program may be that the user operates the first application program to trigger the first application program to send a message, or the first application program may be controlled by an automatic test script The program sends the message, which is not limited in this embodiment.
  • the service interface of each geographical area can be detected separately.
  • the comprehensiveness of the detection results is guaranteed; The detection efficiency is improved.
  • the server may generate the program detection result of the first application program in the following manner: for each service interface, according to the identification result of the at least one message sent through the service interface, determine the The interface detection result corresponding to the service interface; according to the interface detection results corresponding to the K service interfaces, the program detection result corresponding to the first application program is generated, and the program detection result corresponding to the first application program includes the K The interface detection result corresponding to the service interface.
  • the interface detection result corresponding to the service interface is determined, and the interface detection result corresponding to each service interface is included in the application program detection result, so that the detection result is more refined, so that the user according to The results of the program detection can intuitively know which service interface is abnormal.
  • the server may determine the interface detection result corresponding to the service interface in the following manner: if the identification result of each message in the at least one message indicates the sending location and receiving location of the message Located in the same geographical area, and there is no user information in the message, then determine that the interface detection result indicates that there is no abnormality in the service interface; if the identification result of the first message in the at least one message indicates that the If the sending location and the receiving location of the message are not located in the same geographical area, and/or, user information exists in the message, then it is determined that the interface detection result indicates that the service interface is abnormal.
  • the interface detection result corresponding to the service interface may include: an exception level.
  • the interface detection result corresponding to the service interface may include: the cause of the exception. In this way, the program detection result is more refined.
  • the identification result of each message includes a first identification result, and the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area; for the M
  • the first identification result of the message may be determined in the following manner: determine the geographical area to which the sending location of the message belongs, and the geographical area to which the receiving location of the message belongs; if The geographic area to which the sending location belongs is the same as the geographic area to which the receiving location belongs, then it is determined that the first identification result of the message indicates that the sending location and the receiving location of the message are located in the same geographic area; if the sending location belongs to If the geographic area is different from the geographic area to which the receiving location belongs, it is determined that the first identification result of the message indicates that the sending location and the receiving location of the message are not located in the same geographic area.
  • the first application program includes service interfaces corresponding to K geographical areas, where K is an integer greater than or equal to 1; determine the geographical area to which the sending location of the message belongs, and the The geographical area to which the receiving location of the message belongs includes: determining the first service interface for sending the message from among the K service interfaces; using the geographical area corresponding to the first service interface as the address of the message The geographic area to which the sending location belongs; parsing and processing the message to obtain the geographic area to which the receiving location of the message belongs.
  • parsing and processing the message to obtain the geographical area to which the receiving location of the message belongs includes: obtaining the Internet connection corresponding to the receiving location of the message by parsing the message. Protocol IP address; obtain a preset correspondence relationship, the preset correspondence relationship indicates the correspondence relationship between different IP addresses and different geographical regions; determine the geographical region corresponding to the IP address in the preset correspondence relationship as The geographical area to which the receiving location of the message belongs.
  • the geographical area where the sending location of the message belongs is determined according to the service interface of the sending message, and the geographical area where the receiving location of the message belongs is determined by analyzing the IP address in the message, and then according to Whether the geographical area of the sending location and the receiving location are the same, the first identification result of the message is obtained, which ensures the accuracy of the first identification result, that is, the message transmitted across geographical areas can be accurately and comprehensively identified.
  • the identification result of each message includes a second identification result, and the second identification result is used to indicate whether user information exists in the message; for any of the M messages
  • the second identification result of the message may be determined in the following manner: the target data to be transmitted is obtained by parsing the message; the target data is decrypted to obtain decrypted data; the decrypted The data is matched with the user information corresponding to the first application program to obtain a second identification result of the message.
  • the user information corresponding to the first application program includes at least one information item; the decrypted data is matched with the user information corresponding to the first application program to obtain the information of the message.
  • the second identification result includes: respectively matching each information item with the decrypted data to obtain a matching result of each information item; if the matching result of the information item in the at least one information item is successful, then determine The second identification result of the message indicates that user information exists in the message; if the matching result of no information item in the at least one information item is successful, it is determined that the second identification result of the message indicates that the There is no user information in the above message.
  • the target data to be transmitted is obtained by parsing the message, and the target data is decrypted to obtain the decrypted data, and then according to the matching result of the decrypted data and the user information of the first application program, the message is determined.
  • the second identification result ensures the accuracy of the second identification result, that is, the message transmitting the user information can be accurately and comprehensively identified.
  • the server before the server obtains the M messages sent by the terminal device through the first application, the server further includes: the server sends a control instruction to the terminal device, and the control instruction is used to control the first application The program starts running.
  • the server may send a control instruction to the terminal device in the following manner: receive target information sent by the terminal device, where the target information includes resource information required for starting and running the first application program ; Sending the control instruction to the terminal device according to the target information.
  • the server sends a startup control instruction to the terminal device, and the startup control instruction is used to simulate the user manually clicking the icon of the first application program on the terminal device, so as to trigger the first application program to start running.
  • the start control instruction By sending the start control instruction to the terminal device, the first application program can be run to perform the subsequent detection process, thereby improving the automation degree of application program detection.
  • the method further includes: displaying the program detection result; or sending the program detection result result. In this way, it is convenient for relevant testing personnel to know the testing results of the program in time.
  • the embodiment of the present application provides an application detection device, the application detection device includes:
  • An acquisition unit configured to acquire M messages sent by the terminal device through the first application program during the running of the first application program to be detected, where M is an integer greater than or equal to 1;
  • a determining unit configured to determine an identification result of each message, where the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and/or, whether User information exists;
  • a generating unit configured to generate a program detection result corresponding to the first application program according to the identification results of the M messages.
  • the detection device of the application program is applied to a server, the first application program includes service interfaces corresponding to K geographical areas, and the server is provided with a proxy interface corresponding to each service interface , the K is an integer greater than or equal to 1;
  • the acquisition unit includes: a traffic proxy module, configured to obtain, for each service interface, the traffic sent by the terminal device through the service interface through the proxy interface corresponding to the service interface The at least one message.
  • the generation unit includes: a detection result generation module, configured to, for each service interface, determine the corresponding Interface detection results; according to the interface detection results corresponding to the K service interfaces, the program detection results corresponding to the first application program are generated, and the program detection results corresponding to the first application program include the program detection results corresponding to the K service interfaces. Interface detection result.
  • the detection result generation module is specifically configured to: if the identification result of each message in the at least one message indicates that the sending location and the receiving location of the message are located in the same geographical area, and If there is no user information in the message, it is determined that the interface detection result indicates that there is no abnormality in the service interface; or,
  • the identification result of the first message in the at least one message indicates that the sending location and the receiving location of the message are not located in the same geographical area, and/or, there is user information in the message, then determine the The interface detection result indicates that the service interface is abnormal.
  • the identification result of each message includes a first identification result, and the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area;
  • the determining unit includes: Location analysis module.
  • a location analysis module configured to determine the geographical area to which the sending location of the message belongs, and the geographical area to which the receiving location of the message belongs; if the geographical area to which the sending location belongs is the same as the geographical area to which the receiving location belongs, then determine The first identification result of the message indicates that the sending location and the receiving location of the message are located in the same geographical area; if the geographical area to which the sending location belongs is different from the geographical area to which the receiving location belongs, then determine the location of the message The first identification result indicates that the sending location and the receiving location of the message are not located in the same geographical area.
  • the first application program includes service interfaces corresponding to K geographical areas, where K is an integer greater than or equal to 1; the location analysis module is configured to select from the K service interfaces, determining the first service interface for sending the message; using the geographical area corresponding to the first service interface as the geographical area to which the sending location of the message belongs; parsing and processing the message to obtain the The geographic area to which the receiving location belongs.
  • the determining unit further includes: an IP parsing module, configured to parse the message to obtain an Internet Protocol IP address corresponding to a receiving location of the message.
  • the location analysis module is used to obtain a preset corresponding relationship, the preset corresponding relationship indicates the corresponding relationship between different IP addresses and different geographical areas; determine the geographical area corresponding to the IP address in the preset corresponding relationship is the geographical area to which the receiving location of the message belongs.
  • the identification result of each message includes a second identification result, and the second identification result is used to indicate whether user information exists in the message; for any of the M messages
  • the determination unit includes: an encrypted traffic cracking module and a user information matching module.
  • the encrypted traffic cracking module is used to analyze the target data to be transmitted from the message, and decrypt the target data to obtain decrypted data;
  • the user information matching module is used to match the decrypted data with the first application The user information corresponding to the program is matched, and the second recognition result of the message is obtained.
  • the user information corresponding to the first application program includes at least one information item;
  • the user information matching module is specifically configured to: respectively match each information item with the decrypted data to obtain each The matching result of the information item; if the matching result of the information item in the at least one information item is successful, it is determined that the second identification result of the message indicates that there is user information in the message; if the at least one information item If the matching result of no information item in the item is successful, then it is determined that the second identification result of the message indicates that there is no user information in the message.
  • the apparatus for detecting an application program further includes: a dynamic running module, configured to send a control instruction to the terminal device, and the control instruction is used to control the first application program to start running.
  • the dynamic running module is configured to receive target information sent by the terminal device, where the target information includes resource information required for starting and running the first application program; The terminal device sends the control instruction.
  • the detection result generating module is further configured to display the program detection result, or send the program detection result.
  • the geographical area is an area corresponding to a country.
  • the embodiment of the present application provides an electronic device, where the electronic device is a terminal device or a server.
  • the electronic device includes: a processor and a memory.
  • the processor is configured to be coupled with the memory, read and execute instructions in the memory, so as to implement the first aspect or the method described in various possible implementation manners of the first aspect.
  • the embodiment of the present application provides an apparatus for detecting an application program, including a unit, module, or circuit for performing the method provided in the above first aspect or each possible implementation manner of the first aspect.
  • the data processing apparatus may be a terminal device or a server, or a module applied to a terminal device or a server.
  • the embodiments of the present application provide a computer-readable storage medium, the computer-readable storage medium stores computer instructions, and when the computer instructions are executed, the first aspect or various possibilities of the first aspect are realized.
  • an embodiment of the present application provides a computer program product, the computer program product includes a computer program, and when the computer program is executed, implements the first aspect or the various possible implementations of the first aspect. method.
  • the application program detection method, device and equipment provided in the embodiment of the present application includes: during the running process of the first application program to be detected, obtain M messages sent by the terminal device through the first application program, and determine The identification result of each message, the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message, according to the The identification results of the M messages are generated to generate a program detection result corresponding to the first application program.
  • the program detection result of the application program is obtained by analyzing the message actually sent by the application program during the running process, which improves the accuracy of the program detection result.
  • FIG. 1 is a schematic diagram of a process of detecting an application program
  • FIG. 2 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of an application detection method provided in an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another application detection method provided by the embodiment of the present application.
  • FIG. 5 is a schematic diagram of a message identification process provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another process for identifying a message provided in an embodiment of the present application.
  • FIG. 7A is a schematic diagram of a display interface corresponding to a program detection result provided in an embodiment of the present application.
  • FIG. 7B is a schematic diagram of a display interface corresponding to another program detection result provided in the embodiment of the present application.
  • FIG. 8A is a schematic diagram of another system architecture provided by the embodiment of the present application.
  • FIG. 8B is a schematic diagram of an interaction flow of a detection method for an application program corresponding to the system architecture shown in FIG. 8A;
  • FIG. 9A is a schematic diagram of another system architecture provided by the embodiment of the present application.
  • FIG. 9B is a schematic diagram of an interaction process of a detection method for an application program corresponding to the system architecture shown in FIG. 9A;
  • FIG. 10 is a schematic diagram of interface changes of a terminal device provided in an embodiment of the present application.
  • FIG. 11 is a schematic diagram of the application detection process provided by the embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • Application refers to a computer program designed to accomplish one or more specific tasks.
  • Applications in this application include, but are not limited to: mobile applications, portals, applets, etc.
  • User information In a broad sense, it refers to all kinds of information recorded electronically or in other ways that can identify a specific natural person or reflect the activities of a specific natural person, including but not limited to the name, date of birth, and ID number of a natural person , personal biometric information, address, phone number, email address, health information, whereabouts information, etc.
  • Cross-border transfer of user information refers to the transfer of user information from one country to another.
  • FIG. 1 is a schematic diagram of a process of detecting an application program.
  • the detection can be realized by parsing the installation package of the application program. Specifically, as shown in FIG. 1 , reverse analysis (for example, decompilation) is performed on the installation package of the application program to obtain the source code.
  • the source code is matched with preset keywords to detect the user information and the domain name to which the user information is sent. Furthermore, the domain name is analyzed to determine the target address to which the user information is sent, so as to determine whether the user information is transmitted across borders, and obtain the program detection result.
  • the source code of the application is obtained after reverse analysis is performed on the installation package of the application. Use the preset keywords "name”, “identification”, “birthday”, etc. to match the source code, and search for user information from the source code.
  • the domain name to which the user information is sent is searched out from the source code, and the domain name is analyzed to obtain the target network address. If the target network address is an overseas network address, it means that the application program has carried out cross-border transmission of user information.
  • the above-mentioned technology adopts the method of performing static analysis on the installation package.
  • the "static” here means that the application program does not need to be run, and only the installation package of the application program needs to be analyzed.
  • the detection results of the above methods depend on the coding style of the source code, and the coding styles of different developers are usually different. Taking the variable corresponding to "user name" in the source code as an example, some developers may name it “name”, while some developers may Named "Nm”, and some developers may name it "Nm01", “Nm_01”, etc. In this way, the user information is identified from the source code by using the preset keyword, so that there is a problem of misdetection or missed detection of the user information.
  • the above method needs to search the domain name from the source code, but in actual application, the domain name may be dynamically generated during the running of the application, so the domain name obtained by the above method is not comprehensive. Based on the above analysis, it can be seen that the accuracy of the program detection results obtained by the above method is not high.
  • the embodiment of the present application provides a detection method of an application program, which is different from the static analysis method adopted in the above-mentioned related art, and the embodiment of the present application adopts a dynamic analysis method.
  • multiple messages that is, dynamic traffic data
  • each message can be obtained in real time, and by identifying and processing the multiple messages, each message can be obtained
  • the identification result of each message, the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message, and then, according to the multiple messages
  • the identification result determines the program detection result corresponding to the application program.
  • the program detection result of the application program is determined by analyzing the message actually sent by the application program during the running process, the accuracy of the program detection result is guaranteed.
  • FIG. 2 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • the system architecture includes an application detection client (hereinafter referred to as “detection client”) and an application detection server (hereinafter referred to as “detection server”). Detect applications that are installed on the client to be detected.
  • the detection server provides the function of detecting the application program.
  • the detection client refers to a terminal device that installs an application program to be detected, including but not limited to smart phones, smart wearable devices, smart home devices, personal computers (personal computers, PCs), wireless Handheld devices, computing devices, vehicle-mounted devices or wearable devices with communication functions, virtual reality (virtual reality, VR) terminal devices, augmented reality (augmented reality, AR) terminal devices, wireless terminals in industrial control (industrial control), wireless Wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety, smart city Wireless terminals in smart homes, wireless terminals in smart homes, etc.
  • VR virtual reality
  • AR augmented reality
  • wireless terminals in industrial control industrial control
  • wireless Wireless terminals in self driving
  • wireless terminals in remote medical wireless terminals in smart grid
  • wireless terminals in transportation safety smart city Wireless terminals in smart homes, wireless terminals in smart homes, etc.
  • the personal computer may be, for example, a tablet computer, a notebook computer, a desktop computer, a super mobile personal computer, a personal digital assistant, and the like.
  • the detection server may be, for example, a router, a switch, or a server, and the server may be, for example, an enterprise server, an operator server, or a service provider server. In some possible scenarios, the server may be a cloud server.
  • the detection client and the detection server may be deployed in different electronic devices, for example, the detection client is a terminal device, and the detection server is a server. In other scenarios, the detection client and the detection server may also be deployed in the same electronic device, for example, both are deployed in the electronic device where the application program to be detected is installed.
  • the detection client is taken as a terminal device, and the detection server is used as an example for description.
  • the detection of the application program can be realized.
  • the application program to be detected runs in the terminal device.
  • the server can obtain the message (that is, flow data) sent by the terminal device through the application program in real time, and detect and process the message to obtain the program detection result.
  • the server shown in FIG. 2 refers to a server for providing a detection function for an application program, which is different from a server for providing a service for an application program.
  • the server used to provide services to the application program is called the application server
  • the server used to provide the detection function of the application program is called the detection server.
  • the terminal device sends a message to the application server through the application program.
  • the detection server may obtain the message sent by the terminal device to the application server through a certain technology (for example, through a traffic proxy technology, a message interception technology, etc.). Furthermore, the detection server detects and processes the obtained message to obtain a program detection result.
  • the server may send the program detection result to the terminal device.
  • the server may display program detection results.
  • the detection process of the application program can be automatically executed by the terminal device and the server, so that the detection efficiency is high.
  • the application detection method provided in the embodiment of the present application can be applied in various application scenarios. Several possible scenarios are taken as examples for illustration below.
  • the supervision department may use the method of the embodiment of the present application to detect the application program during security detection, and obtain the program detection result. If the program detection result indicates that the application program is abnormal, the application program is required to make rectification according to the program detection result. Since the program detection result of the application program is obtained by analyzing the message actually sent by the application program during the running process, the accuracy of the program detection result is guaranteed.
  • an application distribution platform (such as an application market, an application store, and a mobile phone manager) is responsible for providing download/installation portals for various types of applications.
  • the application program Before an application program is released on the application distribution platform, or after the application program is updated, the application program may be detected by using the method of the embodiment of the present application to obtain the program detection result. If the program detection results indicate that the application is abnormal, the application is required to be rectified before being put on the shelves.
  • the application distribution platform needs to put a large number of application programs on the shelves, and the method of the embodiment of the present application can automatically complete the detection of the application programs to ensure the detection efficiency.
  • the application program may be tested by using the method of the embodiment of the present application, and a program test result may be obtained. If the program detection result indicates that the application program is abnormal, it shall be corrected in time during the subsequent development process, so as to avoid the rectification workload required for rectification after the application program is released.
  • the embodiment of the present application does not limit the application scenarios of the application checking method, and the application checking method may also be used by third-party testing. It should be noted that when a user uses a website or other system programs, the transmission of user information across geographical regions may also be involved. Therefore, the embodiments of the present application may also be applicable to detecting websites or other system programs.
  • the application needs to provide a privacy statement to the user.
  • the privacy statement the use of user information by the terminal device during the use of the application by the user is explained.
  • the program detection result can be compared with the privacy statement of the application program to determine whether the application program transmits user information according to the terms of the privacy statement.
  • FIG. 3 is a schematic flowchart of a method for detecting an application provided by an embodiment of the present application. As shown in Figure 3, the method of this embodiment includes:
  • S301 Acquire M packets sent by the terminal device through the first application program during running of the first application program to be detected, where M is an integer greater than or equal to 1.
  • the first application program to be detected runs on the terminal device.
  • the execution subject of this embodiment acquires M messages sent by the terminal device through the first application program.
  • M is an integer greater than or equal to 1.
  • each message may correspond to a network request sent by the first application program to its corresponding application server.
  • Each message indicates the target data to be transmitted by the first application program, and the target network address to which the target data is to be transmitted.
  • the execution subject of this embodiment may be a terminal device or a server. It can be understood that when the execution subject of this embodiment is a terminal device, the terminal device can obtain the M messages sent by the first application program by monitoring its own sending interface. When the execution subject of this embodiment is a server, the server may obtain M messages sent by the terminal device through the first application program through message interception technology, traffic proxy technology, and the like.
  • S302 Determine the identification result of each message, the identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message .
  • the identification result of each message can be obtained by performing identification processing on each message.
  • the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area. That is, the implementation can identify whether a message is transmitted across geographic regions.
  • the sending location of the message is usually the location of the terminal equipment, or the location of the user of the terminal equipment.
  • the receiving location of the message refers to the location of the application server of the first application program.
  • the geographical area may be a geographical area divided according to the coverage of the country.
  • the area covered by a country is called a geographic area.
  • another expression of “the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area” is "the first identification result is used to indicate that the message Whether the sending location and the receiving location are located in the same country", or "the first identification result is used to indicate whether the message is transmitted across countries (cross-borders)".
  • At least one of the sending location and the receiving location is carried in the message in the form of an Internet Protocol (Internet Protocol, IP) address. Therefore, the identification result can be obtained by parsing and processing the IP address in the message.
  • IP Internet Protocol
  • the identification result of each packet is used to indicate whether there is user information in the packet. That is to say, this implementation can identify whether the packet transmits user information.
  • the target data to be transmitted in the message may be parsed to determine whether there is user information in the target data, thereby obtaining the recognition result.
  • the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and whether there is user information in the message. That is to say, this implementation method can not only identify whether the message is transmitted across geographical regions, but also identify whether the message transmits user information.
  • S303 Generate a program detection result corresponding to the first application program according to the identification results of the M packets.
  • the identification results of M messages may have the following situations:
  • Case 1 The identification result of each of the M messages indicates that the sending location and the receiving location of the message are located in the same geographical area, and there is no user information in the message. That is to say, none of the M messages transmits user information across geographic regions. In this case, it may be determined that the program detection result corresponding to the first application program is normal.
  • Case 2 The identification result of the first message among the M messages indicates that the sending location and the receiving location of the message are not located in the same geographical area. That is to say, among the M messages, there are messages transmitted across geographic regions. In this case, it may be determined that the program detection result of the first application program is abnormal.
  • Case 3 The identification result that the first message exists in the M messages indicates that the user information exists in the message. That is to say, there is a message transmitting user information among the M messages. In this case, it may be determined that the program detection result of the first application program is abnormal.
  • the program detection result may include an abnormal level.
  • the abnormal levels corresponding to the above-mentioned cases 2 and 3 are slight.
  • the exception level corresponding to the above case 4 is the severity level.
  • the program detection result may include the cause of the abnormality.
  • the abnormal cause corresponding to the above case 2 is "cross-geographical region transmission”
  • the above-mentioned case 3 corresponds to "transmission of user information”
  • the above-mentioned case 4 corresponds to "transmission of user information across geographical regions”.
  • the reason for the above abnormality may be represented by text or an identification code.
  • the terminal device may display the program detection result after generating the program detection result corresponding to the first application program, so that relevant personnel can know the program detection result in time.
  • the execution subject of this embodiment is a server
  • the server after the server generates the program detection result corresponding to the first application program, it can display the program detection result, or send the program detection result to the terminal device, so that relevant personnel can know the program detection result in time. result.
  • the application detection method provided in this embodiment includes: during the running of the first application to be detected, acquiring M messages sent by the terminal device through the first application, and determining the recognition result of each message , the identification result of each message is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message, according to the identification of the M messages As a result, a program detection result corresponding to the first application program is generated.
  • the program detection result of the application program is obtained by analyzing the message actually sent by the application program during the running process, which improves the accuracy of the program detection result.
  • FIG. 4 is a schematic flowchart of another detection method for an application provided by an embodiment of the present application. As shown in Figure 4, the method of this embodiment includes:
  • S401 Send a startup control instruction to the terminal device, where the startup control instruction is used to control the startup and operation of the first application program to be detected.
  • the method in this embodiment can be executed by a server.
  • the server sends the start control instruction to the terminal device, and the start control instruction is used to simulate the user manually clicking the icon of the first application program on the terminal device, so as to trigger the first application program to start and run.
  • the start control instruction By sending the start control instruction to the terminal device, the first application program can be run to perform the subsequent detection process, thereby improving the automation degree of application program detection.
  • the server may receive target information sent by the terminal device, where the target information includes resource information required for starting and running the first application program.
  • the target information includes resource information required for starting and running the first application program.
  • resource information may be included: routing configuration information, application programming interface (Application Programming Interface, API) information of the terminal device, software package information to be loaded, and the like.
  • the server can send an activation control instruction to the terminal device according to the target information.
  • the target information further includes user information corresponding to the first application.
  • the user information corresponding to the first application program may be used in S403 to identify and process the message, so as to identify whether there is user information in the message.
  • the user information corresponding to the first application includes but is not limited to at least one of the following: name, date of birth, ID number, personal biometric information, address, phone number, email, health information, whereabouts information, etc.
  • S402 During the running of the first application program, for the service interface corresponding to each geographical area of the first application program, obtain at least one message sent by the terminal device through the service interface through the proxy interface corresponding to the service interface.
  • the first application program includes service interfaces corresponding to each of the K geographical areas.
  • K is an integer greater than or equal to 1.
  • the first application program includes service interfaces corresponding to four countries, namely: service interface A corresponding to country A, service interface B corresponding to country B, service interface C corresponding to country C, and service interface corresponding to country D Interface D.
  • the terminal device sends messages via service interface A in country A, via service interface B in country B, via service interface C in country C, and via service interface D in country D.
  • the server is provided with a proxy interface corresponding to each service interface, for example: proxy interface A corresponding to service interface A, proxy interface B corresponding to service interface B, proxy interface C corresponding to service interface C, corresponding to service interface D
  • the proxy interface D Each proxy interface is used to realize the traffic proxy function. That is to say, proxy interface A can proxy to receive packets sent through service interface A, proxy interface B can proxy to receive packets sent through service interface B, proxy interface C can proxy to receive packets sent through service interface C, and proxy Interface D can act as a proxy to receive packets sent through service interface D.
  • the server can obtain at least one message sent by the terminal device through the service interface A through the proxy interface A, obtain at least one message sent by the terminal device through the service interface B through the proxy interface B, and obtain at least one message sent by the terminal device through the service interface B through the proxy interface C.
  • the at least one message sent by C obtains at least one message sent by the terminal device through the service interface D through the proxy interface D.
  • S403 Determine the identification result of each message, the identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and/or, whether there is user information in the message .
  • the identification result of each packet includes the first identification result and/or the second identification result.
  • the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area.
  • the second identification result is used to indicate whether there is user information in the packet.
  • the following possible manners may be used to determine the first identification result of each message.
  • the first application program includes service interfaces corresponding to K geographical areas, where K is an integer greater than or equal to 1.
  • the terminal device sends the message through the first application program, it sends the message through the service interface corresponding to the geographical area to which the current location of the terminal device belongs. For example, if the current location of the terminal device is in country A, then the message will be sent through service interface A; if the current location of the terminal device is in country B, then the message will be sent through service interface B. Therefore, for each message, the geographical area corresponding to the service interface that sends the message may be used as the geographical area to which the sending location of the message belongs.
  • FIG. 5 is a schematic diagram of a packet identification process provided by an embodiment of the present application.
  • the K service interfaces determine the first service interface that sends the message, and use the geographical area corresponding to the first service interface as the message The geographical area to which the text is sent. Further, the message is parsed to obtain the geographical area to which the receiving location of the message belongs.
  • the geographical area to which the receiving location of the message belongs may be obtained in the following manner: as shown in FIG. 5 , the IP address corresponding to the receiving location of the message is obtained by parsing the message.
  • the IP address refers to the destination network address to which the packet is to be sent.
  • the IP address is carried in the message explicitly or implicitly, and the IP address can be obtained by parsing the message according to the protocol format adopted by the message.
  • a preset corresponding relationship is acquired, and the preset corresponding relationship indicates a corresponding relationship between different IP addresses and different geographic regions. Determining the geographical area corresponding to the IP address in the preset correspondence relationship as the geographical area to which the receiving location of the message belongs. That is to say, by using the IP address to query the preset correspondence relationship, the geographical area to which the receiving location of the message belongs can be obtained.
  • the first identification result of the message indicates that the sending location and the receiving location are not located in the same geographical area. If the geographical area of the sending location of a certain message is country C, and the geographical area of the receiving location is country C, then the first identification result of the message indicates that the sending location and the receiving location are located in the same geographic area.
  • the first identification result of the message is obtained, which ensures the accuracy of the first identification result, that is, the message transmitted across geographical areas can be accurately and comprehensively identified.
  • FIG. 6 is a schematic diagram of another packet identification process provided by the embodiment of the present application. As shown in Figure 6,
  • the target data to be transmitted can be obtained by parsing the message according to the protocol format adopted by the message.
  • the sender encrypts the target data in the message before sending the message. That is to say, the target data analyzed in the above step (1) is encrypted data. Therefore, the encryption and decryption algorithm corresponding to the first application program may be used to decrypt the target data, or the target data may be decrypted to obtain decrypted data.
  • the user information corresponding to the first application program includes at least one information item.
  • the second recognition result of the message may be determined in the following manner:
  • Each information item is matched with the decrypted data respectively to obtain a matching result of each information item, and the matching result of each information item is success or failure. If the matching result of the existence of the information item in the at least one information item is successful, it is determined that the second identification result of the message indicates that the user information exists in the message. If the matching result of no information item in the at least one information item is successful, it is determined that the second identification result of the message indicates that there is no user information in the message.
  • the user information corresponding to the first application program includes the following two information items: "56215467812" and "AAAaaa”. Among them, “56215467812” indicates the user location, and “AAAaaa” indicates the device ID. If at least one of “56215467812” and “AAAaaa” exists in the decrypted data corresponding to a certain message, it means that the second identification result of the message indicates that the message contains user information. If neither "56215467812" nor "AAAaaa” exists in the decrypted data of a certain message, it means that the second identification result of the message indicates that there is no user information in the message.
  • the target data to be transmitted is obtained by parsing the message, and the target data is decrypted to obtain the decrypted data, and then according to the matching result of the decrypted data and the user information of the first application program, the information of the message is determined.
  • the second identification result ensures the accuracy of the second identification result, that is, the message transmitting the user information can be accurately and comprehensively identified.
  • each message in the at least one message indicates that the sending location and the receiving location of the message are located in the same geographical area, and there is no user information in the message, then determine The interface detection result indicates that there is no abnormality in the service interface.
  • the identification result of the first message in the at least one message indicates that the sending location and the receiving location of the message are not located in the same geographical area, and/or, there is user information in the message, then determine the The interface detection result indicates that the service interface is abnormal.
  • the identification result of each message indicates that the sending location and the receiving location of the message are located in the same geographical area, and there is no user in the message. That is to say, none of the N1 messages transmit user information across geographic regions, which means that there is no abnormality in service interface A.
  • the identification result of a certain message indicates that there is user information in the message, that is, there is a message transmitting user information in the N3 messages, then it means There is an exception in service interface C.
  • the interface detection result corresponding to the service interface may include: an exception level.
  • the abnormality levels of the above-mentioned service interface B and service interface C are minor level, and the abnormality level of service interface D is severe level.
  • the interface detection result corresponding to the service interface may include: the cause of the exception.
  • the abnormal reason corresponding to the above-mentioned service interface B is "Transfer across geographic regions”
  • the corresponding abnormal reason of the above-mentioned service interface C is “Transfer user information”
  • the abnormal reason corresponding to the above-mentioned service interface D is "Transfer user information across geographic regions” .
  • the reason for the above abnormality may be represented by text or an identification code.
  • S405 Generate a program detection result corresponding to the first application program according to the interface detection result corresponding to each service interface, where the program detection result corresponding to the first application program includes the interface detection result corresponding to each service interface.
  • the program detection results of the first application program can be shown in Table 1:
  • FIG. 7A is a schematic diagram of a display interface corresponding to a program detection result provided in an embodiment of the present application. As shown in FIG. 7A , in the display interface, whether the service interface A, the service interface B, the service interface C, and the service interface D are normal is displayed respectively. When a certain service interface is abnormal, it also displays the corresponding exception level of the service interface.
  • FIG. 7B is a schematic diagram of a display interface corresponding to another program detection result provided in the embodiment of the present application. As shown in FIG. 7B , in the display interface, whether the service interface A, service interface B, service interface C, and service interface D are normal is displayed respectively. When a certain service interface is abnormal, the abnormal cause corresponding to the service interface is also specifically displayed.
  • terminal devices when terminal devices are located in different countries, they send messages through different service interfaces. Therefore, when detecting the first application program, if it is necessary to detect service interfaces corresponding to multiple countries, it is necessary to obtain messages sent through multiple service interfaces.
  • terminal devices located in different countries may be used for detection.
  • the server obtains the message sent by the terminal device A (located in country A) through the service interface A of the first application program, and obtains the interface detection result of the service interface A by analyzing the message.
  • the server obtains the message sent by the terminal device B (located in country B) through the service interface B of the first application program, and obtains the interface detection result of the service interface B by analyzing the message.
  • the server acquires the message sent by the terminal device C (located in country C) through the service interface C of the first application program, and obtains the interface detection result of the service interface C by analyzing the message.
  • the server obtains the message sent by the terminal device D (located in the country D) through the service interface D of the first application program, and obtains the interface detection result of the service interface D by analyzing the message. Furthermore, the interface detection results of the above service interfaces are integrated to obtain the program detection result of the first application program.
  • one terminal device may be used to complete the detection process for multiple service interfaces. For example, by piling and burying the terminal equipment, changing the location of the terminal equipment, respectively simulating the following scenarios: (1) The terminal equipment is located in country A, and the terminal equipment is sent through the service interface A of the first application program. message; (2) the terminal device is located in country B, and sends the message through the service interface B of the first application program; (3) the terminal device is located in country C, and sends the message through the service interface C of the first application program; (4) The terminal device is located in country D, and sends the message through the service interface D of the first application program.
  • the server obtains the message sent by the terminal device through the first application program, and analyzes the message to obtain the interface detection result corresponding to each service interface. Furthermore, the interface detection results of the above service interfaces are integrated to obtain the program detection result of the first application program. In this implementation mode, the detection of all service interfaces of the first application program can be completed by using one terminal device without the country where the mobile terminal device is located, which ensures the comprehensiveness of the detection process for the service country and improves the detection efficiency.
  • the way the terminal device sends the message through the first application program may be that the user operates the first application program to trigger the first application program to send a message, or the first application program may be controlled by an automatic test script.
  • the application program sends the message, which is not limited in this embodiment.
  • the program detection result of the application program is obtained by analyzing the message actually sent by the first application program during the running process, the accuracy of the program detection result is guaranteed. Further, when there are multiple geographical areas that the first application program can serve, the service interface of each geographical area can be detected separately, on the one hand, the comprehensiveness of the detection results is guaranteed, on the other hand, it also improves the detection efficiency.
  • FIG. 8A is a schematic diagram of another system architecture provided by the embodiment of the present application.
  • the system architecture includes: a terminal device and a server.
  • the server includes: a runtime system, a position analysis system, an interface positioning system, a data analysis system, and a detection result generation system.
  • a first application program to be detected is installed in the terminal device.
  • FIG. 8B is a schematic diagram of an interaction flow of a detection method for an application program corresponding to the system architecture shown in FIG. 8A .
  • the detection method of the application program in this embodiment includes:
  • S801 The runtime system controls the first application program to be detected to start running.
  • S802 The runtime system acquires the message sent by the terminal device through the first application program.
  • the runtime system provides a traffic proxy function to proxy the traffic data of the first application program in various service geographical regions in the world in real time, so as to ensure the detection of traffic in all service geographical regions and improve the comprehensiveness of detection.
  • the location analysis system performs identification processing on the message to obtain a first identification result of the message, and the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area.
  • S805 The location analysis system sends the first identification result of the message to the detection result generation system.
  • the interface positioning system determines the service interface corresponding to the packet.
  • the interface locating system performs interface-level locating for each message, so that subsequent interface-level detection results can be obtained for each service interface.
  • the interface locating system sends the service interface corresponding to the message to the detection result generating module.
  • the interface positioning system parses the message to obtain the target data to be transmitted, and decrypts the target data to obtain the decrypted data.
  • the interface positioning system sends the decrypted data to the data analysis system.
  • the data analysis system matches the decrypted data with the user information corresponding to the first application program to obtain a second identification result of the message.
  • the second identification result is used to indicate whether there is user information in the packet.
  • S811 The data analysis system sends the second identification result of the packet to the detection result generation system.
  • the detection result generating system generates a program detection result corresponding to the first application program according to the service interface corresponding to the message and the first identification result and/or the second identification result of the message.
  • S802 to S811 may be executed in a loop multiple times.
  • S804-S805, S806-S809, and S810-S811 can be executed at the same time, and there is no distinction between the three.
  • FIG. 9A is a schematic diagram of another system architecture provided by the embodiment of the present application.
  • the terminal device includes: a static analysis module, a runtime plug-in module and a display module.
  • the runtime system in the server includes: a dynamic operation module and a traffic proxy module;
  • the location analysis system includes: an IP resolution module and a location analysis module;
  • the interface location system includes: an encrypted traffic cracking module.
  • the data analysis system includes: a user information matching module;
  • the detection result generation system includes: a detection result generation module.
  • FIG. 9B is a schematic diagram of an interaction flow of a detection method for an application program corresponding to the system architecture shown in FIG. 9A .
  • the application detection method of this embodiment includes:
  • the static parsing module performs reverse parsing processing on the installation package of the first application program to be detected to obtain target information, where the target information includes resource information required for starting and running the first application program.
  • S902 The static analysis module sends the target information to the dynamic operation module.
  • the target information further includes: user information corresponding to the first application program.
  • the static analysis module can also send the user information corresponding to the first application program to the runtime system, so that the static analysis module can provide the data analysis system with the user information corresponding to the first application program.
  • Information, used for matching processing of user information can be used for matching processing of user information.
  • the dynamic running module interacts with the runtime plug-in module according to the target information, and controls the first application program to start running.
  • the dynamic running module sends control instructions to the runtime plug-in module, and the runtime plug-in module sends event information to the dynamic running module.
  • the runtime plug-in module ensures that the first application runs dynamically.
  • the traffic proxy module obtains the message sent by the terminal device through the first application program.
  • the traffic proxy module sends the packet to the IP analysis module and the encrypted traffic cracking module.
  • the IP parsing module parses the message to obtain the IP address corresponding to the receiving location of the message.
  • the location analysis module determines the geographical area corresponding to the IP address in the preset correspondence relationship as the geographical area to which the receiving location of the message belongs.
  • the location analysis module determines the geographical area corresponding to the first service interface that sends the message as the geographical area to which the sending location of the message belongs.
  • the location analysis module determines the first identification result of the message according to the geographical area to which the sending location and the receiving location of the message belong, and the first identification result is used to indicate whether the sending location and the receiving location of the message are located in the same geographical area .
  • the location analysis module sends the first identification result of the packet to the detection result generation module.
  • the encrypted traffic cracking module determines the service interface corresponding to the message.
  • the encrypted traffic cracking module sends the service interface corresponding to the message to the detection result generating module.
  • the encrypted traffic cracking module parses the message to obtain the target data to be transmitted, and decrypts the target data to obtain the decrypted data.
  • the encrypted traffic cracking module sends decrypted data to the user information matching module.
  • the user information matching module matches the decrypted data with the user information corresponding to the first application program, and obtains a second identification result of the message, and the second identification result is used to indicate whether there is user information in the message.
  • the user information matching module sends the second identification result of the message to the detection result generating module.
  • the above S904 to S916 are executed repeatedly multiple times, that is, to detect and analyze multiple messages sent by the terminal device through the first application program.
  • the detection result generation module sends a stop operation instruction to the dynamic operation module.
  • the detection result generation module generates a program detection result corresponding to the first application program according to the service interface corresponding to the message and the first identification result and/or the second identification result of the message.
  • the detection result generating module sends the program detection result to the display module.
  • the display module displays the program detection results.
  • S906-S910, S911-S914, and S915-S916 can be executed at the same time, and the order of the three is not distinguished.
  • the installation package of the application program to be detected can be downloaded to the terminal device, and then the interaction process between the terminal device and the server is triggered, so as to realize the detection method of the application program in any of the above embodiments.
  • FIG. 10 is a schematic diagram of interface changes of a terminal device provided by an embodiment of the present application.
  • the identifier of the application to be detected may be displayed on the interface 1001 .
  • the application to be detected is application X
  • the identifier of the application to be detected may be the icon or name of the application X.
  • the interface 1001 may also display a "detection" control, and the inspector may click on the "detection" control to trigger the execution of the application detection method in the above-mentioned embodiment.
  • the terminal device receives the program detection result of the application program X from the server, the interface 1001 may jump to the interface 1002, and the interface 1002 may be similar to the interface in FIG. 7A or FIG.
  • the above interface 1001 may jump to interface 1003 first, and then jump to interface 1002.
  • the interface 1003 may display a text reminder message of "application detection in progress".
  • FIG. 11 is a schematic diagram of an application detection process provided by an embodiment of the present application.
  • the application program X to be tested provides services in country A, country B, country C and country D.
  • the detection process for application X is as follows:
  • the terminal device performs reverse analysis processing on the installation package of the application program X through the static analysis module, and obtains the resource information required for the application program X to start and run.
  • the resource information obtained through parsing may include:
  • Device API interface device information interface (getImei) ⁇ location information interface (getLocation)
  • the server interacts with the terminal device to control the application program X to start and run.
  • the interaction between the dynamic running module in the server and the running plug-in module in the terminal device is as follows:
  • the interactive instructions corresponding to the dynamic running module in the server are as follows:
  • the interaction instructions corresponding to the runtime plug-in module in the terminal device are as follows:
  • the application program X starts to run, and, as shown in 1113 in FIG. 11 , the user information matching module of the server obtains the user information corresponding to the application program X including:
  • the server obtains the message sent by the terminal device through the first application program.
  • the application program X includes a service interface corresponding to each service geographic area.
  • the server proxies the traffic of each service interface through the traffic proxy module.
  • the service interface corresponding to each service geographic area is as follows:
  • the IP parsing module in the server parses the message to obtain the IP address corresponding to the receiving location of the message.
  • the IP addresses obtained through analysis in the four packets are as follows:
  • the location analysis module in the server maps the IP address to a geographical area according to the preset corresponding relationship, and obtains the geographical area to which the receiving location of the message belongs.
  • the geographical areas to which the receiving locations of the above four messages belong are as follows:
  • the location analysis module in the server determines the geographical area to which the sending location of the message belongs according to the service interface of the sending message. Assume that the geographical areas where the sending locations of the above four messages belong are as follows:
  • the location analysis module in the server determines the first identification result of the message according to the geographical area of the sending location and the receiving location of the message, namely: whether the message is transmitted across borders.
  • the first identification results of the above four messages are as follows:
  • the encrypted traffic cracking module in the server determines the service interface corresponding to the message. As an example, as shown in 1108 in FIG. 11 , it is assumed that the geographical areas where the sending locations of the above four messages belong are as follows:
  • the encrypted traffic cracking module in the server parses the message to obtain the target data to be transmitted.
  • the target data obtained by parsing the above four messages is as follows:
  • the encrypted traffic cracking module in the server decrypts the target data to obtain the decrypted data.
  • the decrypted data corresponding to the above four messages are as follows:
  • the user information matching module in the server matches the decrypted data with the user information corresponding to the first application program, and determines the first identification result of the message, that is, whether there is user information in the message.
  • the second identification results corresponding to the above four messages are as follows:
  • Packet 3 AAAaaa has user information
  • Packet 4: AAAaaa has user information
  • the detection result generating module in the server integrates the service interface corresponding to each message, the first identification result and the second identification result, as shown in 1112 in Figure 11, obtains:
  • Service interface D is not cross-border and has user information
  • the detection result generation module in the server generates a program detection result corresponding to the application program X according to the above integration result.
  • the program detection results are as follows:
  • Service interface A is abnormal (serious)
  • program detection results are as follows:
  • Service interface D is abnormal (user information exists)
  • the program detection result of the application program X is obtained, and the program detection result can be displayed on the terminal device.
  • FIG. 12 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the electronic device may be the terminal device and the server in the foregoing embodiments.
  • the electronic device 1200 may include: a processor 1201 (such as a CPU), a memory 1202 and a transceiver 1203 .
  • the memory 1202 and the transceiver 1203 may be coupled to the processor 1201, and the processor 1201 controls the transceiver 1203 to perform the above-mentioned transceiving actions of the terminal device or the server, so as to realize the interaction between the terminal device and the server.
  • the memory 1202 may include a high-speed random-access memory (random-access memory, RAM), and may also include a non-volatile memory (non-volatile memory, NVM), such as at least one disk memory, and various instructions may be stored in the memory 1202, It is used to complete various processing functions and realize the method steps of the present application.
  • the transceiver 1203 may be integrated into the transceiver of the electronic device, or may be a transceiver antenna independently set on the electronic device.
  • the above-mentioned memory 1202 is used to store computer-executable program codes, and the program codes include instructions; when the processor 1201 executes the instructions, the instructions cause the processor 1201 of the electronic device to perform the actions in the above-mentioned method embodiments, which The implementation principles and technical effects are similar and will not be repeated here.
  • the electronic device 1200 involved in this application may further include: a power supply 1204 , a communication bus 1205 and a communication port 1206 .
  • the communication bus 1205 is used to realize the communication connection between the components.
  • the above-mentioned communication port 1206 is used to realize connection and communication between the electronic device and other peripheral devices.
  • a computer program product includes one or more computer instructions.
  • Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g. Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to another website site, computer, server or data center.
  • DSL digital subscriber line
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server, a data center, etc. integrated with one or more available media.
  • Available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Telephonic Communication Services (AREA)

Abstract

Les modes de réalisation de la présente demande concernent un procédé et un appareil de détection pour un programme d'application, et un dispositif. Le procédé consiste à : pendant le processus d'exécution d'un premier programme d'application à soumettre à une détection, acquérir M messages qui sont envoyés par un équipement terminal au moyen du premier programme d'application ; déterminer un résultat d'identification de chaque message, le résultat d'identification de chaque message étant utilisé pour indiquer si l'emplacement d'envoi et l'emplacement de réception du message se situent dans la même zone géographique, et/ou s'il existe des informations d'utilisateur dans le message ; et, en fonction des résultats d'identification des M messages, générer un résultat de détection de programme correspondant au premier programme d'application. Pendant le processus, un résultat de détection de programme d'un programme d'application est obtenu par analyse de messages qui sont réellement envoyés par le programme d'application pendant un processus d'exécution et, par conséquent, la précision du résultat de détection de programme est améliorée.
PCT/CN2022/111956 2021-08-24 2022-08-12 Procédé et appareil de détection pour un programme d'application, et dispositif WO2023024928A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110977670.9A CN115720144A (zh) 2021-08-24 2021-08-24 应用程序的检测方法、装置及设备
CN202110977670.9 2021-08-24

Publications (1)

Publication Number Publication Date
WO2023024928A1 true WO2023024928A1 (fr) 2023-03-02

Family

ID=85253491

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/111956 WO2023024928A1 (fr) 2021-08-24 2022-08-12 Procédé et appareil de détection pour un programme d'application, et dispositif

Country Status (2)

Country Link
CN (1) CN115720144A (fr)
WO (1) WO2023024928A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110535865A (zh) * 2019-08-30 2019-12-03 北京小米移动软件有限公司 信息处理方法、装置、测试终端、测试平台及存储介质
CN110633112A (zh) * 2019-08-30 2019-12-31 北京小米移动软件有限公司 信息处理方法及装置、设备、存储介质
US20200202316A1 (en) * 2018-12-20 2020-06-25 Mastercard International Incorporated Methods and systems for reducing cross-border traffic over a network
CN112101954A (zh) * 2020-09-29 2020-12-18 支付宝(杭州)信息技术有限公司 基于隐私数据、基于设备信息的跨境业务处理方法和装置
CN112423297A (zh) * 2020-11-16 2021-02-26 重庆满集网络科技有限公司 一种跨境电商与移动终端的交互方法、系统及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200202316A1 (en) * 2018-12-20 2020-06-25 Mastercard International Incorporated Methods and systems for reducing cross-border traffic over a network
CN110535865A (zh) * 2019-08-30 2019-12-03 北京小米移动软件有限公司 信息处理方法、装置、测试终端、测试平台及存储介质
CN110633112A (zh) * 2019-08-30 2019-12-31 北京小米移动软件有限公司 信息处理方法及装置、设备、存储介质
CN112101954A (zh) * 2020-09-29 2020-12-18 支付宝(杭州)信息技术有限公司 基于隐私数据、基于设备信息的跨境业务处理方法和装置
CN112423297A (zh) * 2020-11-16 2021-02-26 重庆满集网络科技有限公司 一种跨境电商与移动终端的交互方法、系统及存储介质

Also Published As

Publication number Publication date
CN115720144A (zh) 2023-02-28

Similar Documents

Publication Publication Date Title
CN106936793B (zh) 一种信息拦截处理方法及终端
US20210157938A1 (en) Methods, media, apparatuses and computing devices of user data authorization based on blockchain
Jung et al. Privacy oracle: a system for finding application leaks with black box differential testing
US9268946B2 (en) Quantifying the risks of applications for mobile devices
US11244074B2 (en) Security systems and methods for social networking
US20160036849A1 (en) Method, Apparatus and System for Detecting and Disabling Computer Disruptive Technologies
US9280665B2 (en) Fast and accurate identification of message-based API calls in application binaries
KR102504075B1 (ko) 사용자 디바이스 이벤트의 매칭 및 속성
US11677774B2 (en) Interactive web application scanning
US20160078221A1 (en) Automated vulnerability and error scanner for mobile applications
GB2507960A (en) Wireless access point login dependent upon supply of stored (key/personal) information and/or viewing a message (advertisement)
US10754717B2 (en) Fast and accurate identification of message-based API calls in application binaries
CN109635581A (zh) 一种数据处理方法、设备、系统及存储介质
US10242200B1 (en) Static analysis of vulnerabilities in application packages
WO2013074245A1 (fr) Systèmes et procédés de sécurité de codage et de décodage de contenu numérique
US20220207636A1 (en) Methods and apparatus for managing and online transactions involving personal data
US20190050910A1 (en) System, devices and methods for identifying mobile devices and other computer devices
WO2023024928A1 (fr) Procédé et appareil de détection pour un programme d'application, et dispositif
WO2022247226A1 (fr) Procédé et dispositif de surveillance d'applets
Pourali et al. Hidden in plain sight: exploring encrypted channels in android apps
US10178512B2 (en) Information broadcast
CN111181831B (zh) 通信数据处理方法和装置、存储介质及电子装置
CN108055286B (zh) 一种用于生成用户身份信息的方法、客户端、计算机可读存储介质及计算机设备
CN117240618B (zh) 家庭云盒子访问方法、装置、设备及存储介质
US20230124545A1 (en) Verifying content and interactions within webviews

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22860274

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE