Mobile intelligent terminal information security detection method

Abstract

The invention belongs to the technical field of information security, and particularly relates to a mobile intelligent terminal information security detection method which comprises the following steps: S1, static feature deep analysis, S2, dynamic detection enhancement, S3, multi-dimensional correlation analysis, S4, cross-platform detection standardization and S5, intelligent detection and authentication. Malicious logic in obfuscated codes is effectively identified by analyzing intermediate language codes, extracting key features such as an API calling sequence, an authority application mode and a sensitive data access path and combining a rule engine and a machine learning model, so that the false alarm rate is reduced; an application runs in a sandbox environment with multiple operating system versions and hardware configuration, a detection strategy is dynamically adjusted in combination with reinforcement learning, and zero-day attacks and APT behaviors are captured in real time, so that the real-time performance and accuracy of detection are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and specifically relates to a mobile intelligent terminal information security detection method. BACKGROUND

[0002] With the rapid development of mobile Internet, mobile intelligent terminals have become an indispensable part of people's daily life and work. However, security problems of mobile applications have become increasingly prominent, and security threats such as malicious software, data leakage, and abuse of permissions have emerged continuously. Traditional mobile terminal information security detection methods mainly rely on static analysis and dynamic monitoring, but these methods often have low detection efficiency, high false positive rate, and cannot effectively identify multi-application collaborative attacks when facing complex malicious attacks and zero-day vulnerabilities.

[0003] Specifically, the prior art has the following deficiencies: Traditional static analysis methods mainly analyze source code or binary code, which is difficult to identify malicious logic in obfuscated code and cannot capture runtime behavior. Secondly, although dynamic monitoring methods can capture runtime behavior, in the environment of multiple operating system versions and hardware configurations, the detection strategy is difficult to dynamically adjust, and cannot effectively capture zero-day attacks and APT behavior. In addition, existing detection methods lack analysis of cross-application permission requests, data transmission, and shared component call behavior, making it difficult to detect malicious attack chains of multi-application collaboration. Moreover, the security detection framework and rule library of different platforms differ, resulting in low cross-platform detection efficiency and inability to standardize vulnerability scanning. In addition, traditional detection methods have low automation degree, and the detection efficiency is difficult to meet the detection needs of a large number of terminals, and lack effective caching mechanisms and load balancing technologies.

[0004] Therefore, the present application provides a mobile intelligent terminal information security detection method. SUMMARY

[0005] In order to make up for the deficiencies of the prior art and solve at least one technical problem raised in the background art.

[0006] The technical solution adopted by the present application to solve its technical problems is: the mobile intelligent terminal information security detection method of the present application comprises the following steps: S1, static feature depth analysis: analyzing the intermediate language code in the APK file, extracting API call sequence, permission application mode and sensitive data access path as key features, and identifying malicious logic in obfuscated code through a combination of rule engine and machine learning model. ​S2, Dynamic Detection Enhancement: Run the application in a sandbox environment with multiple operating system versions and hardware configurations, monitor system call behavior in real time, and dynamically adjust the detection strategy by combining reinforcement learning to capture zero-day attacks and APT behavior; S3. Multi-dimensional correlation analysis: Construct application correlation graphs, analyze cross-application permission requests, data transmission and shared component call behavior, and detect malicious attack chains in multi-application collaboration; S4. Cross-platform detection standardization: Based on a unified security detection framework, the intermediate code generated by the cross-platform framework is parsed, and common security features are extracted for vulnerability scanning. S5 Intelligent Detection and Authentication: Integrates an AI real-time threat detection module and a blockchain evidence storage system. It achieves automated detection through automated test scripts and continuous integration processes, and improves the detection efficiency of massive terminals by utilizing parallel processing and load balancing technologies.

[0007] A further improvement of the present invention is that, in the static feature depth analysis step: Code analysis includes decompiling the core executable file in the APK file and extracting the method call stack, field access, and exception handling logic; The rule engine uses regular expressions to match known malicious patterns, and the machine learning model is based on... Architecture training, input features include opcode sequences, constant pool references, and call graph structures; Obfuscated code identification is achieved by comparing the original Java class name with... Class name differences, combined with control flow flattening detection algorithm.

[0008] A further improvement of the present invention is that, in the dynamic detection enhancement step: Sandbox environment simulation includes different API versions Different system versions and Hongmeng Hardware abstraction layer configuration; The LSTM model takes system call sequences, network connection quintuples, and memory snapshots as input data and outputs a probability value of malicious behavior. Real-time analysis combined Frames, tags and Attack tactics; The reinforcement learning algorithm adjusts the detection strategy based on real-time feedback from the application's runtime in the sandbox environment; For zero-day attacks, identification is achieved by real-time monitoring of system call behavior and combining it with pre-defined zero-day attack characteristic patterns.

[0009] A further improvement of the present invention is that, in the multi-dimensional correlation analysis step: Application association graph construction includes the following methods: monitoring cross-application messaging via broadcast receivers and analysis. Data sharing path, detection Sensitive data transmission in communications; Malicious attack chain detection rules include: multiple applications on the same device requesting the same sensitive permissions without any reasonable business logic connection, or through sharing. Collaborate to execute covert operations.

[0010] A further improvement of the present invention is that, in the cross-platform unified detection step: The unified detection framework supports parsing. , and Intermediate code; Common security features include: unverified input processing, hard-coded keys, and insecure encryption algorithms; Vulnerability scanning rule base coverage Risks, and dynamically updated. data.

[0011] A further improvement of the present invention is that the vulnerability scanning rule base should cover a variety of security risks, including code injection vulnerabilities, access control vulnerabilities, data security vulnerabilities, component security vulnerabilities, and network communication vulnerabilities.

[0012] A further improvement of the present invention is that, in the intelligent detection and authentication step: The AI ​​real-time threat detection module includes: Behavioral Analysis Submodule: Monitors application process tree changes, file system operations, and registry modifications; Traffic Analysis Submodule: Parsing Certificate chains in traffic and Handshake parameters; Threat Intelligence Submodule: Integration , Platform data is updated in real time to determine detection rules. Blockchain-based evidence storage system adopts The architecture stores the hash value of the inspection report, audit logs, and signature certificates to ensure immutability.

[0013] A further improvement of the present invention is that, in the automated testing and continuous integration steps: The automated test scripts cover the following scenarios: privilege abuse testing, data breach testing, and reverse engineering testing; Continuous Integration Process Integration The pipeline triggers static checks during the code commit phase, performs dynamic checks during the build phase, and generates a security compliance report before deployment. Test results were fed back to or The issue tracking system automatically links to the code repository commit history; The integration pipeline in the continuous integration process consists of multiple tools and components, including code repository management tools, continuous integration servers, static analysis tools, dynamic analysis tools, and report generation tools.

[0014] A further improvement of the present invention is that, in the parallel processing and load balancing steps: Detection task allocation adopts Cluster management dynamically allocates nodes based on APK file size, complexity, and historical detection time; The load balancing algorithm combines weighted round-robin with the least number of connections, prioritizing scheduling to nodes with CPU utilization ≤70%; Inter-node communication adopts Protocol, transmitting compressed data Code features and dynamic detection logs reduce network overhead.

[0015] A further improvement of the present invention is that the improvement in detection efficiency also includes: Incremental detection mode: Compare APK version differences, and only re-analyze the modified versions. Classes and methods; Caching mechanism: Stores the hash value and results of detected applications, and directly returns a cache report for applications that are submitted repeatedly; The distributed cache uses a Redis cluster and supports millisecond-level query response.

[0016] The beneficial effects of this invention are as follows: This invention analyzes Intermediate language code is used to extract key features such as API call sequences, permission request patterns, and sensitive data access paths. Combined with a rule engine and machine learning model, this effectively identifies malicious logic in obfuscated code, thereby reducing false positive rates. Applications are run in sandbox environments with multiple operating system versions and hardware configurations. Reinforcement learning is used to dynamically adjust detection strategies, capturing zero-day attacks and APT behavior in real time, thus improving the real-time performance and accuracy of detection. By constructing application association graphs, cross-application permission requests, data transmission, and shared component call behavior are analyzed to detect malicious attack chains involving multi-application collaboration, effectively preventing complex attacks. Based on a unified security detection framework, intermediate code generated by cross-platform frameworks is parsed to extract common security features for vulnerability scanning, ensuring consistency of detection results across different platforms and improving detection efficiency. An AI real-time threat detection module and a blockchain evidence storage system are integrated, automating detection through automated test scripts and continuous integration processes. Parallel processing and load balancing technologies are used to improve the detection efficiency of massive terminals. Only modified APK versions are re-analyzed when comparing APK version differences. The class and methods store the hash values ​​and results of the detected applications. For applications that are submitted repeatedly, a cached report is returned directly, reducing repetitive work and improving detection efficiency. Attached Figure Description

[0017] The invention will now be further described with reference to the accompanying drawings.

[0018] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figure 1 , This embodiment provides a method for detecting information security of mobile smart terminals, including the following steps: S1. Static Feature Deep Analysis: Analyzing the static features in the APK file. Intermediate language code is used to extract API call sequences, permission request patterns, and sensitive data access paths as key features. By combining a rule engine with a machine learning model, malicious logic in the obfuscated code can be identified. To obtain more comprehensive and in-depth code information and thus more accurately identify malicious logic, a further improvement of this invention lies in the following step of static feature deep analysis: Code analysis includes decompiling the core executable file in the APK file and extracting the method call stack, field access, and exception handling logic; The rule engine uses regular expressions to match known malicious patterns, and the machine learning model is based on... Architecture training, input features include opcode sequences, constant pool references, and call graph structures; Obfuscated code identification is achieved by comparing the original Java class name with... Class name differences, combined with control flow flattening detection algorithm.

[0021] S2, Dynamic Detection Enhancement: Run the application in a sandbox environment with multiple operating system versions and hardware configurations, monitor system call behavior in real time, and dynamically adjust the detection strategy by combining reinforcement learning to capture zero-day attacks and APT behavior; To simulate a more realistic operating environment, ensure that detection can cover various situations, improve the comprehensiveness and accuracy of detection, and more accurately determine whether malicious behavior exists, while enabling the detection system to flexibly adjust according to actual conditions and promptly identify newly emerging zero-day attacks, a further improvement of this invention lies in the dynamic detection enhancement step: Sandbox environment simulation includes different API versions Different system versions and Hongmeng Hardware abstraction layer configuration; The LSTM model takes system call sequences, network connection quintuples, and memory snapshots as input data and outputs a probability value of malicious behavior. Real-time analysis combined Frames, tags and Attack tactics; It should be noted that reinforcement learning dynamically adjusts the detection strategy, meaning that the reinforcement learning algorithm adjusts the detection strategy based on real-time feedback from the application's runtime in the sandbox environment, such as whether system calls trigger anomalies or network connections are abnormal. For example, if a system call is found to frequently trigger suspected malicious behavior flags over a period of time, the reinforcement learning model will increase the detection weight of that system call and its related call sequences, and more strictly examine the application behavior involved in that call. Conversely, if some system calls do not trigger anomalies for a long time, the detection frequency will be appropriately reduced to improve the overall detection efficiency.

[0022] Capturing zero-day attacks and APT behavior involves identifying zero-day attacks by real-time monitoring of system call behavior and combining this with pre-defined zero-day attack characteristic patterns, such as abnormal system call combinations and unusual memory access patterns. Once behavior matching these zero-day attack characteristics is detected, an alert is immediately triggered. For APT behavior, due to its long-term latency and multi-stage attack characteristics, a behavioral sequence model is constructed by continuously monitoring application system calls and network connections at different stages. When an application's behavioral sequence highly matches a known APT attack behavioral sequence model, it is identified as APT behavior and captured. S3. Multi-dimensional correlation analysis: Construct application correlation graphs, analyze cross-application permission requests, data transmission and shared component call behavior, and detect malicious attack chains in multi-application collaboration; To more accurately construct the relationships between applications and thus better analyze cross-application behavior, a further improvement of this invention lies in the multi-dimensional relationship analysis step: Application association graph construction includes the following methods: monitoring cross-application messaging via broadcast receivers and analysis. Data sharing path, detection Sensitive data transmission in communications; It should be noted that in the Android system, broadcast receivers allow applications to send and receive broadcast messages from the system or other applications. Malicious applications may use the broadcast mechanism to conduct cross-application communication, transmit malicious instructions or data. By monitoring the registration, sending and receiving of broadcast receivers, the message passing behavior between applications can be captured. Specifically, the detection system records the broadcast receiver information registered by each application, including the broadcast actions received and permission requests. For example, a malicious application may register a receiver to receive the system startup completion broadcast in order to perform malicious operations when the device starts up. When a broadcast message is sent, the detection system tracks the sender and receiver of the message and records the content of the message. For example, if an application sends a custom broadcast message and another application receives and processes the message, the detection system can record this process. Secondly, the detection system will analyze each The definition includes its provided URI, permission requirements, etc.; it also tracks the application's... This records access information, including the applications accessed, the data types accessed, and the types of operations performed, such as querying, inserting, updating, and deleting. For example, an application might not have declared permission to access contact data, but could still do so through... Querying contact information may pose a risk of data breach.

[0023] This provides specific criteria for detecting malicious attack chains involving multiple applications, improving the accuracy and targeting of detection. The publicly disclosed malicious attack chain detection rules include: multiple applications on the same device requesting the same sensitive permissions without any reasonable business logic connection, or through sharing... Collaborate to execute covert operations.

[0024] It's important to note that under normal circumstances, the permissions requested by an application should be related to the business functions it provides. If multiple applications on the same device request the same sensitive permissions, but there is no clear business logic connection between these applications, then a malicious attack chain may exist. For example, if a game application and a weather application both request permission to read SMS messages, but the functions of these two applications are not directly related to reading SMS messages, there is a risk that malicious applications may obtain sensitive user information by sharing permissions.

[0025] Detection method: The detection system collects permission information requested by each application and compares the permissions of applications on the same device. When multiple applications are found to have requested the same sensitive permissions, the system will further analyze the business logic relationship between these applications. If a reasonable business logic relationship cannot be found, it will be marked as a possible malicious attack chain. In addition to sharing UIDs, applications may also collaborate in other ways, such as sharing processes or sharing memory. The detection system will monitor and analyze these sharing and collaboration methods to check for malicious behavior. For example, if two applications exchange data through shared memory, and one application writes malicious code into the shared memory, and the other application reads and executes the code, this constitutes a malicious attack chain. Analyzing cross-application permission requests involves collecting permission request information from various applications on the same device and constructing a permission request relationship graph. This allows for the analysis of which applications request the same permissions and whether there is permission transfer or sharing among these applications. For example, if application A requests permission to read SMS messages, and application B does not directly request this permission but indirectly obtains the ability to read SMS messages through some interaction with application A, such as a shared component call, analyzing such cross-application permission request relationships can uncover potential risks of permission abuse.

[0026] Analyze data transmission: Monitor data transmission behavior between applications, including the data types transmitted (such as text, images, audio, etc.), the transmission protocols (such as HTTP, Socket, etc.), and the source and target applications. By analyzing the frequency, volume, and timing of data transmission, determine if there are any abnormal data transmission behaviors. For example, if an application transmits a large amount of sensitive user data to multiple unknown remote servers in a short period of time, there may be a risk of data leakage.

[0027] Analyze the behavior of shared components: Identify components shared between applications, such as... , Analyze the usage of these shared components. Examine which applications are calling the shared components, and whether the frequency and manner of these calls conform to normal business logic. For example, if one application frequently calls another application's... The purpose of acquiring large amounts of user data without a reasonable business need may be malicious data acquisition behavior. S4. Cross-platform detection standardization: Based on a unified security detection framework, the intermediate code generated by the cross-platform framework is parsed, and common security features are extracted for vulnerability scanning. To ensure coverage of common cross-platform development frameworks, improve the universality of detection, unify detection standards, discover common security vulnerabilities in cross-platform applications, and improve the accuracy and timeliness of vulnerability scanning, a further improvement of this invention lies in the following cross-platform unified detection steps: The unified detection framework supports parsing. , and Intermediate code; Common security features include: unverified input processing, hard-coded keys, and insecure encryption algorithms; Vulnerability scanning rule base coverage Risks, and dynamically updated. data.

[0028] It should be noted that the unified detection framework should support parsing intermediate code generated by multiple cross-platform frameworks, such as... generated bytecode generated Intermediate code, etc.; by parsing this intermediate code, security-related information can be extracted for subsequent security testing. The vulnerability scanning rule base should cover a variety of security risks, including but not limited to code injection vulnerabilities such as SQL injection and cross-site scripting (XSS) attacks; access control vulnerabilities such as excessive privilege requests and privilege escalation; data security vulnerabilities such as data leakage and improper data encryption; component security vulnerabilities such as security configuration issues of shared components and component exposure; and network communication vulnerabilities such as insecure use of network protocols and man-in-the-middle attack risks. The rule base should be dynamically updated to promptly incorporate newly discovered security risks and vulnerability characteristics.

[0029] S5 Intelligent Detection and Authentication: Integrates an AI real-time threat detection module and a blockchain evidence storage system. It achieves automated detection through automated test scripts and continuous integration processes, and improves the detection efficiency of massive terminals by utilizing parallel processing and load balancing technologies.

[0030] To enable the detection system to comprehensively and in real-time monitor application behavior and network traffic, promptly detect potential security threats, and to clarify the architecture adopted by the blockchain evidence storage system, storing the hash value of the detection report, audit logs, and signature certificates to ensure immutability, a further improvement of this invention lies in the intelligent detection and authentication steps: The AI ​​real-time threat detection module includes: Behavioral Analysis Submodule: Monitors application process tree changes, file system operations, and registry modifications; Traffic Analysis Submodule: Parsing Certificate chains in traffic and Handshake parameters; Threat Intelligence Submodule: Integration , The platform data is updated in real time with detection rules. The threat intelligence submodule should integrate data from multiple authoritative security threat intelligence platforms, such as the CVE platform, which provides detailed information on known vulnerabilities; and the threat intelligence platform of the National Computer Network Emergency Response Technical Team / Coordination Center of China (CNCERT / CC), which provides information on domestic cyberattacks and malware samples. Blockchain-based evidence storage system adopts The architecture stores the hash value of the inspection report, audit logs, and signature certificates to ensure immutability.

[0031] To comprehensively test the security of applications across various aspects, ensuring compliance with security requirements under diverse circumstances, and to automate and standardize testing, thereby improving efficiency and timeliness, while also facilitating developers' timely understanding and handling of security issues, as well as their tracking and management, a further improvement of this invention lies in the automated testing and continuous integration steps: The automated test scripts cover the following scenarios: privilege abuse testing, data breach testing, and reverse engineering testing; Continuous Integration Process Integration The pipeline triggers static checks during the code commit phase, performs dynamic checks during the build phase, and generates a security compliance report before deployment. Test results were fed back to or The issue tracking system automatically links to the code repository commit history; The integration pipeline in a continuous integration process typically consists of multiple tools and components, including code repository management tools such as... Continuous integration server, such as Static testing tools such as , This includes dynamic detection tools such as those in the sandbox environment and report generation tools. During the code submission phase, when developers submit code to the code repository, the continuous integration server automatically triggers static analysis tools to perform static analysis on the submitted code, checking for security vulnerabilities and coding style issues. During the build phase, the continuous integration server builds the code into an executable application and runs it in the sandbox environment, performing dynamic detection and monitoring the application's runtime behavior. Before deployment, the report generation tool generates a detailed security compliance report based on the results of static and dynamic detection. The report includes information such as detected security vulnerabilities, their severity, and remediation recommendations for developers and security managers.

[0032] To more rationally allocate detection tasks, improve the utilization efficiency of detection resources, better balance the load of each node, avoid overloading any node and affecting the overall detection efficiency, reduce network overhead, and improve communication efficiency, a further improvement of this invention lies in the parallel processing and load balancing steps: Detection task allocation adopts Cluster management dynamically allocates nodes based on APK file size, complexity, and historical detection time; The load balancing algorithm combines weighted round-robin with the least number of connections, prioritizing scheduling to nodes with CPU utilization ≤70%; Inter-node communication adopts Protocol, transmitting compressed data Code signature and dynamic detection logs reduce network overhead; Based on the HTTP / 2 protocol, it features high performance, low latency, and supports multiple programming languages; it uses As a data serialization format, it can effectively compress code features and dynamic detection logs, reducing network overhead; through The protocol enables reliable communication between detection nodes, transmitting compressed data and improving the efficiency of parallel processing and load balancing.

[0033] To avoid repeatedly detecting unmodified parts, reduce unnecessary detection work, and allow the caching mechanism to function better, thereby improving detection efficiency, a further improvement of this invention is that the efficiency enhancement also includes: Incremental detection mode: Compare APK version differences, and only re-analyze the modified versions. Classes and methods; Caching mechanism: Stores the hash value and results of detected applications, and directly returns a cache report for applications that are submitted repeatedly; The distributed cache uses a Redis cluster and supports millisecond-level query response.

[0034] The terms "front," "back," "left," "right," "top," and "bottom" all refer to the figures in the accompanying drawings. Figure 1 Based on the perspective of the observer, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0035] In the description of this invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting the scope of protection of this invention.

[0036] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting information security in mobile intelligent terminals, characterized in that, Includes the following steps: S1. Static Feature Deep Analysis: Analyzing the static features in the APK file. Intermediate language code is used to extract API call sequences, permission request patterns, and sensitive data access paths as key features. By combining a rule engine with a machine learning model, malicious logic in the obfuscated code can be identified. S2, Dynamic Detection Enhancement: Run the application in a sandbox environment with multiple operating system versions and hardware configurations, monitor system call behavior in real time, and dynamically adjust the detection strategy by combining reinforcement learning to capture zero-day attacks and APT behavior; S3. Multi-dimensional correlation analysis: Construct application correlation graphs, analyze cross-application permission requests, data transmission and shared component call behavior, and detect malicious attack chains in multi-application collaboration; S4. Cross-platform detection standardization: Based on a unified security detection framework, the intermediate code generated by the cross-platform framework is parsed, and common security features are extracted for vulnerability scanning. S5 Intelligent Detection and Authentication: Integrates an AI real-time threat detection module and a blockchain evidence storage system. It achieves automated detection through automated test scripts and continuous integration processes, and improves the detection efficiency of massive terminals by utilizing parallel processing and load balancing technologies.

2. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the static feature depth analysis step: Code analysis includes decompiling the core executable file in the APK file and extracting the method call stack, field access, and exception handling logic; The rule engine uses regular expressions to match known malicious patterns, and the machine learning model is based on... Architecture training, input features include opcode sequences, constant pool references, and call graph structures; Obfuscated code identification is achieved by comparing the original Java class name with... Class name differences, combined with control flow flattening detection algorithm.

3. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the dynamic detection enhancement step: Sandbox environment simulation includes different API versions Different system versions and Hongmeng Hardware abstraction layer configuration; The LSTM model takes system call sequences, network connection quintuples, and memory snapshots as input data and outputs a probability value of malicious behavior. Real-time analysis combined Frames, tags and Attack tactics; The reinforcement learning algorithm adjusts the detection strategy based on real-time feedback from the application running in the sandbox environment; For zero-day attacks, identification is achieved by real-time monitoring of system call behavior combined with pre-defined zero-day attack characteristic patterns.

4. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the multi-dimensional correlation analysis step: Application association graph construction includes the following methods: monitoring cross-application messaging via broadcast receivers and analysis. Data sharing path, detection Sensitive data transmission in communications; Malicious attack chain detection rules include: multiple applications on the same device requesting the same sensitive permissions without any reasonable business logic connection, or through sharing. Collaborate to execute covert operations.

5. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the cross-platform unified detection steps: The unified detection framework supports parsing. , and Intermediate code; Common security features include: unverified input processing, hard-coded keys, and insecure encryption algorithms; Vulnerability scanning rule base coverage Risks, and dynamically updated. data.

6. The mobile intelligent terminal information security detection method according to claim 5, characterized in that: The vulnerability scanning rule base should cover a variety of security risks, including code injection vulnerabilities, access control vulnerabilities, data security vulnerabilities, component security vulnerabilities, and network communication vulnerabilities.

7. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the intelligent detection and authentication steps: The AI ​​real-time threat detection module includes: Behavioral Analysis Submodule: Monitors application process tree changes, file system operations, and registry modifications; Traffic Analysis Submodule: Parsing Certificate chains in traffic and Handshake parameters; Threat Intelligence Submodule: Integration , Platform data is updated in real time to determine detection rules. Blockchain-based evidence storage system adopts The architecture stores the hash value of the inspection report, audit logs, and signature certificates to ensure immutability.

8. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the automated testing and continuous integration steps: The automated test scripts cover the following scenarios: privilege abuse testing, data breach testing, and reverse engineering testing; Continuous Integration Process Integration The pipeline triggers static checks during the code commit phase, performs dynamic checks during the build phase, and generates a security compliance report before deployment. Test results were fed back to or The issue tracking system automatically links to the code repository commit history; The integration pipeline in the continuous integration process consists of multiple tools and components, including code repository management tools, continuous integration servers, static analysis tools, dynamic analysis tools, and report generation tools.

9. The mobile intelligent terminal information security detection method according to claim 1, characterized in that: In the parallel processing and load balancing steps: Detection task allocation adopts Cluster management dynamically allocates nodes based on APK file size, complexity, and historical detection time; The load balancing algorithm combines weighted round-robin with the least number of connections, prioritizing scheduling to nodes with CPU utilization ≤70%; Inter-node communication adopts Protocol, transmission of compressed data Code features and dynamic detection logs reduce network overhead.

10. A method for detecting information security of a mobile intelligent terminal according to claim 1, characterized in that: The improvement in detection efficiency also includes: Incremental detection mode: Compare APK version differences, and only re-analyze the modified versions. Classes and methods; Caching mechanism: Stores the hash value and results of detected applications, and directly returns a cache report for applications that are submitted repeatedly; The distributed cache uses a Redis cluster and supports millisecond-level query response.

Images