Sensitive Permission Detection Method, Device and Storage Medium

Abstract

The present application discloses a sensitive permission detection method, device and storage medium, belonging to the field of Internet technology. In the embodiments of the present application, the application code of the application to be detected is obtained by decompiling the first executable file in the first application installation package, and then the detection result of each sensitive permission applied for by the application to be detected is determined according to the application code and the first information description file. The whole process does not require manual participation and does not depend on the source code of the application, saving time and effort and better ensuring the accuracy of the detection result.

Description

Technical Field

[0001] This application relates to the field of Internet technologies, and particularly to a method, apparatus, and storage medium for detecting sensitive permissions. Background Art

[0002] Currently, various applications can be installed on a terminal. When an application runs, it may obtain information related to user privacy in the terminal, or call some functions related to user privacy and personal information in the terminal. In this case, the application needs to apply to the user for permission to obtain information or call functions. For example, the application may read the address book, and at this time, it needs to apply to the user for permission to read the address book. Among them, the above permissions related to user privacy and personal information can be referred to as sensitive permissions. To avoid the abuse of sensitive permissions by applications, before an application is launched, it can be detected whether the application's application for sensitive permissions is reasonable.

[0003] In related technologies, before an application is launched, the developer of the application can determine the sensitive permissions to be applied for according to the source code of the application. After that, the developer can search for the system API (Application Programming Interface) corresponding to each sensitive permission in the source code. If the API corresponding to the sensitive permission is found in the source code, it is considered that the application for the sensitive permission is reasonable.

[0004] It can be seen that in related technologies, it is necessary to rely on the source code of the application, and it is time-consuming and laborious for developers to manually screen whether the application for sensitive permissions is reasonable, and it is difficult to ensure the accuracy. Summary of the Invention

[0005] Embodiments of this application provide a method, apparatus, and storage medium for detecting sensitive permissions, which can more time-saving and labor-saving detect whether the application for sensitive permissions is reasonable, and can ensure the accuracy of the detection. The technical solution is as follows:

[0006] On the one hand, a method for detecting sensitive permissions is provided. The method includes:

[0007] Obtain a first application installation package of the application to be detected. The first application installation package is the installation package of the application to be detected corresponding to a first operating system, and the first application installation package includes a first executable file and a first information description file;

[0008] Decompile the first executable file to obtain the application code of the application to be detected;

[0009] According to the application code of the application to be detected and the first information description file, determine the detection result of each sensitive permission applied for by the application to be detected. The detection result is used to indicate whether the application for the sensitive permission is reasonable.

[0010] On the other hand, a sensitive permission detection device is provided, and the device includes:

[0011] An acquisition module, configured to acquire a first application installation package of an application to be detected, where the first application installation package is an installation package of the application to be detected corresponding to a first operating system, and the first application installation package includes a first executable file and a first information description file;

[0012] A decompilation module, configured to decompile the first executable file to obtain application code of the application to be detected;

[0013] A determination module, configured to determine a detection result of each sensitive permission applied for by the application to be detected according to the application code of the application to be detected and the first information description file, where the detection result is used to indicate whether the application for the sensitive permission is reasonable.

[0014] On the other hand, a sensitive permission detection device is provided, and the device includes a processor, a communication interface, a memory, and a communication bus;

[0015] Wherein, the processor, the communication interface, and the memory complete mutual communication through the communication bus;

[0016] The memory is used to store a computer program;

[0017] The processor is configured to execute the program stored on the memory to implement the steps of the foregoing sensitive permission detection method.

[0018] On the other hand, a computer-readable storage medium is provided, where at least one instruction, at least one segment of program, a code set, or an instruction set is stored in the storage medium, and the at least one instruction, the at least one segment of program, the code set, or the instruction set is loaded and executed by a processor to implement the foregoing sensitive permission detection method.

[0019] The beneficial effects brought by the technical solution provided in the embodiments of the present application at least include:

[0020] In the embodiments of the present application, the application code of the application to be detected is obtained by decompiling the first executable file in the first application installation package, and then the detection result of each sensitive permission applied for by the application to be detected is determined according to the application code and the first information description file. The whole process does not require manual participation and does not depend on the source code of the application, which saves time and effort and can better ensure the accuracy of the detection result. Description of the Drawings

[0021] To more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0022] Figure 1 is the system architecture diagram of a network system provided by an embodiment of the present application;

[0023] Figure 2 is the flowchart of a sensitive permission detection method provided by an embodiment of the present application;

[0024] Figure 3 is the flowchart of another sensitive permission detection method provided by an embodiment of the present application;

[0025] Figure 4 is the flowchart of another sensitive permission detection method provided by an embodiment of the present application;

[0026] Figure 5 is the structural schematic diagram of a sensitive permission detection device provided by an embodiment of the present application;

[0027] Figure 6 is the structural schematic diagram of a server for sensitive permission detection provided by an embodiment of the present application. Detailed implementation manners

[0028] To make the purpose, technical solutions, and advantages of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0029] Before explaining the embodiments of the present application in detail, the application scenarios involved in the embodiments of the present application will be introduced first.

[0030] Currently, various applications can be installed in a terminal. When an application runs, it may obtain information related to the user's privacy in the terminal, or call some functions related to the user's privacy and personal information in the terminal. In this case, the application can apply to the user for permission to obtain information or call functions. For example, the application may need to read the address book, and at this time, it needs to apply to the user for permission to read the address book. Or, the application may need to read text messages, and at this time, it needs to apply to the user for permission to read text messages. Again, for example, the application may need to call the camera, and at this time, it can apply to the user for permission to call the camera.

[0031] However, currently, in order to prevent applications from over-collecting user information and misusing user information, before an application goes online, the server will detect whether the permissions applied for by the application are reasonable to meet the principle of minimum necessary information collection. The sensitive permission detection method provided in the embodiments of the present application can be used in the above scenario to detect whether the application's application for sensitive permissions is reasonable.

[0032] Next, the system structure involved in the embodiments of the present application will be introduced.

[0033] Figure 1 It is a schematic diagram of a network system provided by the embodiments of the present application. As Figure 1 shown, the network system may include a network service module 101, a script service module 102, and a user device 103. Among them, the user device 103 can communicate with the network service module 101, and the network service module 101 can communicate with the script service module 102.

[0034] Among them, the user device 103 can upload the application installation package to the network service module 101. After receiving the application installation package, the network service module 101 can send the application installation package to the script service module 102 for parsing, and the script service module 102 can decompile the executable file in the application installation package to obtain the application code.

[0035] After that, the script service module 102 can send the obtained application code to the network service module 101. After that, the network service module 101 can use the method provided in the embodiments of the present application to detect whether the sensitive permissions applied for by the application are reasonable according to the application code.

[0036] It should be noted that the network service module 101 and the script service module 102 can both be separate servers. Or, the network service module 101 and the script service module 102 can be two functional modules in a server. Or, the network service module 101 and the script service module 102 are each a server cluster, and the embodiments of the present application do not make any limitations in this regard.

[0037] Next, the sensitive permission detection method provided in the embodiments of the present application will be introduced.

[0038] Figure 2 It is a sensitive permission detection method provided by the embodiments of the present application. This method can be applied to a server, which can refer to a server integrating the above network service module and script service module. As Figure 2 shown, this method includes the following steps:

[0039] Step 201: Obtain a first application installation package of the application to be detected, where the first application installation package includes a first executable file and a first information description file.

[0040] In an embodiment of the present application, a user device may upload an installation package of an application to be detected to a server. Among them, different operating systems correspond to different installation packages. The server may receive the application installation packages of the application to be detected under each operating system uploaded by the user device. After that, for each application installation package, the server may adopt the method provided in the embodiment of the present application to detect whether the sensitive permissions applied for by the application to be detected under the corresponding operating system are reasonable.

[0041] Next, an embodiment of the present application takes the server obtaining a first application installation package to detect whether the sensitive permissions applied for by the application to be detected under the first operating system are reasonable as an example to explain the method provided in the embodiment of the present application. Among them, the first application installation package refers to the installation package of the application to be detected corresponding to the first operating system. The first operating system may be an Android operating system or an IOS operating system. The embodiment of the present application does not limit this.

[0042] It should be noted that the server may parse the first application installation package to obtain a first executable file and a first information description file included in the first application installation package. Among them, the first executable file is a file containing the source code of the application, and the terminal device can install the application by running this executable file. Exemplarily, under the Android operating system, the first executable file may be a dex file.

[0043] In addition, the first information description file is a file containing the description information of the application program. Among them, the first information description file declares the sensitive permissions required for the application program to access restricted APIs and other parameters of the application. Exemplarily, under the Android operating system, the first information description file may be an AndroidManifest.xml file, and under the IOS operating system, the first information description file may be an Info.plist file.

[0044] Step 202: Decompile the first executable file to obtain the application code of the application to be detected.

[0045] After parsing the first application installation package to obtain the first executable file, the server may decompile the first executable file to obtain the application code of the application to be detected.

[0046] Since the first executable file contains the source code of the application, through decompilation, the application code of the application to be detected can be obtained. Among them, this application code is different from the source code and contains less information than the source code. However, this application code contains information about the application calling system APIs.

[0047] Step 203: Determine the detection results of each sensitive permission applied for by the application to be detected according to the application code of the application to be detected and the first information description file.

[0048] After obtaining the application code of the application to be detected, the server can determine the detection results of each sensitive permission applied for by the application to be detected according to the application code of the application to be detected and the first information description file.

[0049] Among them, the server can first obtain the reference permission list under the first operating system, and the reference permission list includes multiple reference sensitive permissions; determine multiple first sensitive permissions applied for by the application to be detected under the first operating system according to the reference permission list of the first operating system and the first information description file; find the system API corresponding to each first sensitive permission from the application code of the application to be detected, and different sensitive permissions correspond to different system APIs; determine the detection results of each first sensitive permission according to the search results.

[0050] It should be noted that the reference permission list under the first operating system may include all sensitive permissions under the first operating system. Exemplarily, currently, for the Android operating system, the reference permission list may include 26 sensitive permissions, and for the iOS operating system, the reference permission list may include 16 sensitive permissions.

[0051] After obtaining the reference permission list under the first operating system, the server can parse the first information description file. Then, for each sensitive permission in the reference permission list, the server can detect whether there is a keyword in the first information description file that matches the sensitive permission. If so, it means that the first information description file declares the sensitive permission, that is, it means that the application applies for the sensitive permission. If there is no keyword in the first information description file that matches the sensitive permission, it means that the first information description file does not declare the sensitive permission, that is, it can be determined that the application does not apply for the sensitive permission.

[0052] By comparing the sensitive permissions in the reference permission list with the first information description file one by one, all the sensitive permissions applied for by the application can be determined.

[0053] After determining all the sensitive permissions applied for by the application to be detected under the first operating system, the server can detect whether the application of each sensitive permission is reasonable according to the application code obtained by decompiling the first executable file.

[0054] Among them, the server may store the correspondence between sensitive permissions and APIs. In this correspondence, each sensitive permission corresponds to a different system API. During the running of the application to be detected, if it needs to use a sensitive permission, it can use the sensitive permission by calling the system API corresponding to the sensitive permission. That is to say, the system API corresponding to each sensitive permission is actually an interface for using the function of the corresponding sensitive permission.

[0055] Based on this, in the embodiment of the present application, the server can obtain the system API corresponding to each sensitive permission applied by the application to be detected from the stored correspondence between sensitive permissions and APIs. Then, for each sensitive permission applied by the application to be detected, the server can search in the decompiled application code to find whether there is the system API corresponding to the sensitive permission according to the obtained system API of the sensitive permission, and then determine whether the application of the sensitive permission is reasonable according to the search result.

[0056] Exemplarily, in a possible implementation manner, if the server finds the same system API in the decompiled application code according to the obtained system API of the sensitive permission, it can indicate that the application to be detected uses the sensitive permission by calling the system API. That is to say, the application of the sensitive permission is reasonable. At this time, the server can determine the detection result of the sensitive permission as the second detection result. The second detection result is used to indicate that the application of the sensitive permission is reasonable.

[0057] Optionally, if the server fails to find the same system API in the decompiled application code according to the obtained system API of the sensitive permission, it can indicate that although the application to be detected applies for the sensitive permission, it does not use it. That is to say, the application of the sensitive permission is not reasonable. At this time, the server can determine the detection result of the sensitive permission as the first detection result. The first detection result is used to indicate that the application of the sensitive permission is not reasonable.

[0058] It should be noted that for each sensitive permission applied by the application to be detected, the server can use the above method to detect whether the system API of the corresponding sensitive permission exists in the application code, and then determine whether the application of the corresponding sensitive permission is reasonable based on this.

[0059] Optionally, in another possible implementation manner, after obtaining the search result of finding the system API corresponding to each sensitive permission applied by the application to be detected from the application code, for the sensitive permission for which the corresponding system API is found, the server can further detect whether the application to be detected also applies for the corresponding sensitive permission in the installation packages of other operating systems, so as to judge whether the application of this part of the sensitive permission is reasonable.

[0060] Exemplarily, the server may obtain a second application installation package of the application to be detected. The second application installation package is the application installation package of the application to be detected corresponding to the second operating system, and the second operating system is different from the first operating system. The second application installation package includes a second information description file. Determine multiple second sensitive permissions applied by the application to be detected under the second operating system according to the second information description file. For the first target sensitive permission for which the corresponding system API is found, if there is no corresponding second sensitive permission in the multiple second sensitive permissions, determine that the detection result of the first target sensitive permission is the first detection result, and the first detection result is used to indicate that the application for the corresponding sensitive permission is unreasonable.

[0061] It should be noted that the second operating system is different from the first operating system. For example, the first operating system may be the Android operating system, and the second operating system may be the IOS operating system. Or, if the first operating system is the IOS operating system, the second operating system may be the Android operating system. The second application installation package also includes an executable file and an information description file.

[0062] In the embodiment of the present application, the server may obtain a reference permission list under the second operating system. Then, referring to the method of determining the sensitive permissions applied by the application to be detected under the first operating system according to the reference permission list under the first operating system, determine multiple second sensitive permissions applied by the application to be detected under the second operating system according to the reference permission list under the second operating system and the second information description file.

[0063] It should be noted that the server may store the corresponding relationships of sensitive permissions for implementing the same function under different operating systems. Exemplarily, referring to Table 1, for example, for calling the camera, in the Android operating system, the keyword used to represent this sensitive permission may be "CAMERA", while in the IOS operating system, the keyword used to represent this sensitive permission may be "NSCameraUsageDescription". For reading the calendar, in the Android operating system, the keyword used to represent this sensitive permission may be "READ_CALENDAR", while in the IOS operating system, it may be "NSCalendarsUsageDescription". It should be noted that only several corresponding relationships of sensitive permissions are exemplarily given in Table 1, which does not constitute a limitation to the present application.

[0064] Table 1 Corresponding relationship table of sensitive permissions under different operating systems

[0065] Android operating system IOS operating system CAMERA NSCameraUsageDescription READ_CALENDAR NSCalendarsUsageDescription RECORD_AUDIO Microphon ······ ······

[0066] Based on this, for each first target sensitive permission applied for and used by the to-be-detected application detected above under the first operating system, the server can first obtain the keyword corresponding to the first target sensitive permission under the second operating system from the corresponding relationship shown in Table 1. After that, the server can search in the second information description file to check whether it contains the keyword corresponding to the obtained keyword of the first target sensitive permission. If the second information description file does not contain the keyword corresponding to the keyword of the first target sensitive permission, it indicates that under the second operating system, the to-be-detected application has not applied for this sensitive permission. Since for an application, the sensitive permissions usually required under different operating systems are often the same. Therefore, for the to-be-detected application, if a first target sensitive permission is applied for under one operating system but not applied for under another operating system, it means that this first target sensitive permission is not necessary for the to-be-detected application. At this time, it can be determined that the application of this first target sensitive permission is unreasonable. That is, it is determined that the detection result of this first target sensitive permission is the first detection result.

[0067] Optionally, if the second information description file contains the keyword corresponding to the keyword of the first target sensitive permission, it indicates that under the second operating system, the to-be-detected application has also applied for this sensitive permission. At this time, the server can determine that the application of this first target sensitive permission is reasonable. That is, it can be determined that the detection result of this first target sensitive permission is the second detection result.

[0068] It should be noted that in some possible implementation manners, after the server determines the multiple first sensitive permissions applied for by the to-be-detected application under the first operating system, it can directly search in the multiple second sensitive permissions to check whether there are second sensitive permissions corresponding to each first sensitive permission. After that, the first sensitive permissions for which the corresponding second sensitive permissions are found are determined as the sensitive permissions with reasonable applications, and the first sensitive permissions for which the corresponding second sensitive permissions are not found are determined as the sensitive permissions with unreasonable applications. That is, in the embodiments of the present application, it can be directly determined whether the application of the sensitive permission is reasonable by comparing whether the sensitive permissions applied for in the two application installation packages are the same.

[0069] Optionally, in a possible implementation, since there may be uncontrollable permission management or other security vulnerabilities when the API level of the application is too low, in the embodiments of the present application, before performing step 203, the server may first parse the first information description file of the application to be detected, so as to obtain the API level from the first information description file. Then, the server may detect whether the API level of the application to be detected is less than the reference level. If it is not less than the reference level, the server may perform this step. Otherwise, it may directly determine that the API level of the application to be detected does not meet the requirements, and return a prompt message to the user device to prompt that the application to be detected cannot be launched.

[0070] Among them, for the Android operating system, the server may obtain the parameter value corresponding to the keyword targetSDKversion from the first information description file, and this parameter value is the API level. At this time, the reference level may be 26.

[0071] In the embodiments of the present application, the server may decompile the first executable file in the first application installation package to obtain the application code of the application to be detected, and then determine whether each sensitive permission applied for by the application to be detected is used according to the application code and the first information description file, so as to determine whether the application for each sensitive permission is reasonable. The whole process does not require manual participation, saves time and effort, and can better ensure the accuracy of the detection result. And since the detection in the present application is performed on the application code obtained by decompiling the executable file, it is not necessary to rely on the source code of the application, which solves the problem that it is difficult to obtain the source code of the application and simplifies the detection process.

[0072] Next, the above sensitive permission detection method will be described by taking the Android operating system as an example.

[0073] See Figure 3, the method may include the following steps: 301. The server may receive an Android Application Package (APK) uploaded by a user device. 302. The server may decompile the executable file (i.e., the dex file) in the Android application package to obtain the application code. 303. The server may parse the information description file (i.e., the AndroidManifest.xml file) in the Android application package. 304. Obtain the parameter value corresponding to the targetSDKversion in the AndroidManifest.xml file, that is, the API level. 305. Determine whether the parameter value corresponding to the targetSDKversion is greater than or equal to 26. 306. If it is greater than or equal to 26, the server may obtain the list of sensitive permissions under the first operating system. 307. Traverse whether each sensitive permission in the sensitive permission list is a sensitive permission applied for by the application to be detected. 308. If so, continue to determine whether there is a system API corresponding to the sensitive permission in the application code. 309. If it exists, determine that the application for the sensitive permission is reasonable. 310. If there is no corresponding system API in the application code, it indicates that the application for the sensitive permission is unreasonable.

[0074] Figure 4 It is a flowchart of another method provided by an embodiment of the present application for detecting whether a sensitive permission is reasonable. Refer to Figure 4 , the method may include the following steps: 401. The server may simultaneously obtain the Android application package of the application to be detected under the Android operating system and the Apple application package (i.e., the ipa installation package) under the IOS operating system. 402. The server may parse the two installation packages respectively. 403. Parse the information description files under the two installation packages, that is, parse the AndroidManifest.xml file and the Info.plist file respectively. 404. Obtain multiple first sensitive permissions applied for by the application to be detected under the first operating system and multiple second sensitive permissions applied for under the second operating system. 405. The server may compare the first sensitive permission with the multiple second sensitive permissions one by one. 406. If there is a second sensitive permission that is the same as the first sensitive permission, determine that the application for the first sensitive permission is reasonable. 407. Otherwise, consider that the application for the first sensitive permission is unreasonable.

[0075] Next, the sensitive permission detection device provided by the embodiment of the present application will be introduced.

[0076] Refer to Figure 5 , an embodiment of the present application provides a sensitive permission detection device 500, and the device 500 includes:

[0077] An obtaining module 501, configured to obtain a first application installation package of an application to be detected, where the first application installation package is an installation package of the application to be detected corresponding to a first operating system, and the first application installation package includes a first executable file and a first information description file;

[0078] A decompiling module 502, configured to decompile the first executable file to obtain application code of the application to be detected;

[0079] A determining module 503, configured to determine a detection result of each sensitive permission applied for by the application to be detected according to the application code of the application to be detected and the first information description file, where the detection result is used to indicate whether the application for the sensitive permission is reasonable.

[0080] Optionally, the apparatus 500 is further configured to:

[0081] Obtain an application programming interface (API) level of the application to be detected from the first information description file;

[0082] If the API level of the application to be detected is not less than a reference level, trigger the determining module to determine a detection result of each sensitive permission applied for by the application to be detected according to the application code of the application to be detected and the first information description file.

[0083] Optionally, the determining module 503 includes:

[0084] An obtaining sub-module, configured to obtain a reference permission list of the first operating system, where the reference permission list includes multiple reference sensitive permissions;

[0085] A first determining sub-module, configured to determine multiple first sensitive permissions applied for by the application to be detected under the first operating system according to the reference permission list of the first operating system and the first information description file;

[0086] A searching sub-module, configured to search for a system API corresponding to each first sensitive permission from the application code of the application to be detected, where different sensitive permissions correspond to different system APIs;

[0087] A second determining sub-module, configured to determine a detection result of each first sensitive permission according to the search result.

[0088] Optionally, the second determining sub-module is specifically configured to:

[0089] Determine a detection result of a first sensitive permission for which no corresponding system API is found as a first detection result, where the first detection result is used to indicate that the application for the corresponding sensitive permission is unreasonable.

[0090] Optionally, the second determining sub-module is specifically configured to:

[0091] Determine the detection result of the first sensitive permission that finds the corresponding system API as the second detection result, where the second detection result is used to indicate that the application for the corresponding sensitive permission is reasonable.

[0092] Optionally, the second determination sub-module is specifically configured to:

[0093] Obtain the second application installation package of the application to be detected, where the second application installation package is the application installation package of the application to be detected corresponding to the second operating system, the second operating system is different from the first operating system, and the second application installation package includes a second information description file;

[0094] Determine multiple second sensitive permissions applied by the application to be detected under the second operating system according to the second information description file;

[0095] For the first target sensitive permission that finds the corresponding system API, if there is no second sensitive permission corresponding to the first target sensitive permission among the multiple second sensitive permissions, determine the detection result of the first target sensitive permission as the first detection result, where the first detection result is used to indicate that the application for the corresponding sensitive permission is unreasonable.

[0096] Optionally, the second determination sub-module is specifically configured to:

[0097] If there is a second sensitive permission corresponding to the first target sensitive permission among the multiple second sensitive permissions, determine the detection result of the first target sensitive permission as the second detection result, where the second detection result is used to indicate that the application for the corresponding sensitive permission is reasonable.

[0098] In summary, in the embodiments of the present application, the server can decompile the first executable file in the first application installation package to obtain the application code of the application to be detected, and then determine whether each sensitive permission applied by the application to be detected is used according to the application code and the first information description file, so as to determine whether the application for each sensitive permission is reasonable. The whole process does not require manual participation, saves time and effort, and can better ensure the accuracy of the detection result. And because the present application performs the detection through the application code obtained by decompiling the executable file, it does not have to rely on the source code of the application, solves the problem that it is difficult to obtain the source code of the application, and simplifies the detection process.

[0099] It should be noted that when the sensitive permission detection device provided in the above embodiments detects whether a sensitive permission is reasonable, only the division of the above function modules is used for illustration. In practical applications, the above functions can be allocated to different function modules according to needs, that is, the internal structure of the device is divided into different function modules to complete all or part of the functions described above. In addition, the sensitive permission detection device provided in the above embodiments and the embodiments of the sensitive permission detection method belong to the same concept. For the specific implementation process, please refer to the method embodiments and will not be elaborated here.

[0100] Figure 6 is a schematic structural diagram of a server 600 for detecting sensitive permissions shown according to an exemplary embodiment. The above Figures 2 - 4 functions of the server in the shown embodiments can be implemented by Figure 6 the server shown in. The server can be a server in a background server cluster. Specifically:

[0101] The server 600 includes a CPU (Central Processing Unit) 601, a system memory 604 including a RAM (Random Access Memory) 602 and a ROM (Read-Only Memory) 603, and a system bus 605 connecting the system memory 604 and the central processing unit 601. The server 600 also includes an I / O (Input / Output) system 606 for transferring information between various devices in the computer, and a mass storage device 607 for storing an operating system 613, application programs 614, and other program modules 615.

[0102] The basic input / output system 606 includes a display 608 for displaying information and input devices 609 such as a mouse and a keyboard for user input. The display 608 and the input devices 609 are both connected to the central processing unit 601 through an input / output controller 610 connected to the system bus 605. The basic input / output system 606 may further include an input / output controller 610 for receiving and processing inputs from multiple other devices such as a keyboard, a mouse, or an electronic stylus. Similarly, the input / output controller 610 also provides outputs to a display screen, a printer, or other types of output devices.

[0103] The mass storage device 607 is connected to the central processing unit 601 through a mass storage controller (not shown) connected to the system bus 605. The mass storage device 607 and its associated computer-readable medium provide non-volatile storage for the server 600. That is, the mass storage device 607 may include a computer-readable medium (not shown) such as a hard disk or a CD-ROM (Compact Disc Read-Only Memory) drive.

[0104] Without loss of generality, computer-readable media may include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes RAM, ROM, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other solid-state storage technologies, CD-ROM, DVD (Digital Video Disc), or other optical storage, magnetic tape cartridges, tapes, disk storage, or other magnetic storage devices. Of course, those skilled in the art will appreciate that computer storage media is not limited to the above several. The above system memory 604 and mass storage device 607 may be collectively referred to as memory.

[0105] According to various embodiments of the present application, the server 600 may also be run by connecting to a remote computer on the network through a network such as the Internet. That is, the server 600 may be connected to the network 612 through the network interface unit 611 connected to the system bus 605, or rather, the network interface unit 611 may also be used to connect to other types of networks or remote computer systems (not shown).

[0106] The above memory further includes one or more programs, and the one or more programs are stored in the memory and configured to be executed by the CPU. The one or more programs contain instructions for performing the sensitive permission detection method provided by the embodiments of the present application.

[0107] The embodiments of the present application also provide a non-transitory computer-readable storage medium, which, when the instructions in the storage medium are executed by the processor of the server, enables the server to execute the above Figures 2 - 4 sensitive permission detection method provided by the illustrated embodiments.

[0108] An embodiment of the present application also provides a computer program product including instructions, which, when running on a computer, causes the computer to execute the sensitive permission detection method provided by the embodiment shown above. Figures 2 - 4

[0109] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above embodiments can be completed by hardware or by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk, or an optical disc, etc.

[0110] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.​

Claims

1. A sensitive permission detection method, characterized in that The method includes: Obtain a first application installation package of the application to be detected. The first application installation package is the installation package of the application to be detected corresponding to a first operating system, and the first application installation package includes a first executable file and a first information description file; Decompile the first executable file to obtain the application code of the application to be detected; Determine, according to the first information description file, a first sensitive permission applied for by the application to be detected under the first operating system; Obtain a second application installation package of the application to be detected corresponding to a second operating system different from the first operating system and including a second information description file; Determine multiple second sensitive permissions applied for by the application to be detected under the second operating system according to the second information description file; check whether there are corresponding second sensitive permissions for each first sensitive permission among the multiple second sensitive permissions, and determine the first sensitive permissions for which no corresponding second sensitive permissions are found as sensitive permissions with unreasonable applications; or Search for a system application programming interface (API) corresponding to the first sensitive permission from the application code; for a first target sensitive permission for which the corresponding API is found, obtain, from the corresponding relationship of sensitive permissions for implementing the same function under different operating systems, the keyword corresponding to the keyword of the first target sensitive permission under the second operating system; if the second information description file does not contain the keyword corresponding to the keyword of the first target sensitive permission, determine that the application to be detected does not apply for the first target sensitive permission under the second operating system, and the detection result of the first target sensitive permission is a first detection result for indicating that the application of the corresponding sensitive permission is unreasonable.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the application programming interface (API) level of the application to be detected from the first information description file; In response to the application programming interface (API) level of the application to be detected being not less than a reference level, execute the step of determining the detection result of the sensitive permission applied for by the application to be detected.

3. The method according to claim 1 or 2, characterized in that The method further includes: Obtain a reference permission list of the first operating system, where the reference permission list includes reference sensitive permissions; Determine, according to the reference permission list of the first operating system and the first information description file, the first sensitive permissions applied for by the application to be detected under the first operating system; System application programming interfaces (APIs) corresponding to different sensitive permissions are different; Determine the detection result of the first sensitive permission according to the search result.

4. The method according to claim 3, wherein The determining the detection result of the first sensitive permission according to the search result includes: Determine the detection result of the first sensitive permission for which no corresponding system application programming interface (API) is found as the first detection result.

5. The method according to claim 3, wherein The determining the detection result of the first sensitive permission according to the search result includes: Determine the detection result of the first sensitive permission for which a corresponding system application programming interface (API) is found as a second detection result, where the second detection result is used to indicate that the application of the corresponding sensitive permission is reasonable.

6. The method according to claim 1, characterized in that, The method further includes: In response to the existence of a second sensitive permission corresponding to the first target sensitive permission among the multiple second sensitive permissions, determine that the detection result of the first target sensitive permission is a second detection result, where the second detection result is used to indicate that the application for the corresponding sensitive permission is reasonable.

7. A sensitive permission detection device, characterized in that, The device includes: An acquisition module, configured to acquire a first application installation package of a to-be-detected application, where the first application installation package is an installation package of the to-be-detected application corresponding to a first operating system, and the first application installation package includes a first executable file and a first information description file; A decompilation module, configured to decompile the first executable file to obtain application code of the to-be-detected application; A determination module, configured to: Determine, according to the first information description file, a first sensitive permission applied by the to-be-detected application under the first operating system; Acquire a second application installation package of the to-be-detected application corresponding to a second operating system different from the first operating system and including a second information description file; Determine multiple second sensitive permissions applied by the to-be-detected application under the second operating system according to the second information description file; search for whether there is a second sensitive permission corresponding to each first sensitive permission among the multiple second sensitive permissions, and determine the first sensitive permission for which no corresponding second sensitive permission is found as a sensitive permission with an unreasonable application; or, Search for a system application programming interface (API) corresponding to the first sensitive permission from the application code; for a first target sensitive permission for which the corresponding API is found, obtain a keyword corresponding to the first target sensitive permission in the second operating system from the corresponding relationship of sensitive permissions for implementing the same function under different operating systems; if the second information description file does not include a keyword corresponding to the keyword of the first target sensitive permission, determine that the to-be-detected application does not apply for the first target sensitive permission under the second operating system, and the detection result of the first target sensitive permission is a first detection result used to indicate that the application for the corresponding sensitive permission is unreasonable.

8. The device according to claim 7, characterized in that, The device is further configured to: Obtain an API level of the to-be-detected application from the first information description file; In response to the API level of the to-be-detected application being not less than a reference level, trigger the determination module to determine the detection result of the sensitive permissions applied by the to-be-detected application.

9. The device according to claim 7 or 8, characterized in that, The determination module includes: An acquisition sub-module, configured to acquire a reference permission list of the first operating system, where the reference permission list includes reference sensitive permissions; A first determination sub-module, configured to determine, according to the reference permission list of the first operating system and the first information description file, a first sensitive permission applied by the to-be-detected application under the first operating system; System application programming interfaces (APIs) corresponding to different sensitive permissions are different; A second determination sub-module, configured to determine the detection result of the first sensitive permission according to the search result.

10. The device according to claim 9, characterized in that, The second determination sub-module is specifically configured to: Determine the detection result of the first sensitive permission for which the corresponding system application programming interface (API) is not found as the first detection result.

11. The device according to claim 9, characterized in that, The second determination sub-module is specifically configured to: Determine the detection result of the first sensitive permission for which the corresponding system application programming interface (API) is found as the second detection result, where the second detection result is used to indicate that the application for the corresponding sensitive permission is reasonable.

12. The device according to claim 7, characterized in that, The determination module is specifically configured to: In response to the existence of a second sensitive permission corresponding to the first target sensitive permission among the multiple second sensitive permissions, determine the detection result of the first target sensitive permission as the second detection result, where the second detection result is used to indicate that the application for the corresponding sensitive permission is reasonable.

13. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, at least one program, a code set, or an instruction set, and the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the sensitive permission detection method according to any one of claims 1 to 6.

14. A sensitive permission detection device, the device includes a processor, a communication interface, a memory, and a communication bus. The processor, the communication interface, and the memory complete communication with each other through the communication bus. The memory is used to store a computer program, and the processor is used to execute the program stored on the memory to implement the sensitive permission detection method according to any one of claims 1 to 6.

15. A computer program product, characterized in that, When the instructions in the computer program product run on a computer, the computer is enabled to execute the sensitive permission detection method according to any one of claims 1 to 6.

Images