Information monitoring method and device, terminal and storage medium

Abstract

The embodiments of the present invention relate to the field of information processing, and disclose an information monitoring method and device, a terminal and a storage medium. The method includes intercepting an uplink message sent by a target application at the system layer, forwarding the uplink message to the application layer, and detecting the uplink message at the application layer; when the uplink message contains user privacy information, intercepting the uplink message and notifying the user. The present invention monitors the application information uploaded to the network to prevent the user's privacy information from being leaked. At the same time, the monitoring object is limited to the uplink message of the application, so that the impact of monitoring on network performance is minimized, thereby reducing the risk of network delay and improving the user experience.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information processing, and in particular to an information monitoring method and device, a terminal and a storage medium. Background Art

[0002] Currently, smartphones have more and more third-party applications. It is difficult for users to avoid obtaining some personal privacy information while using third-party application services. Once some malicious or security-insensitive applications upload this privacy information to the network environment through unencrypted communication protocols, it may cause the user's privacy information to be leaked. Therefore, it is becoming increasingly important to identify and intercept such unsafe application operations in a timely manner to protect the user's privacy information security. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide an information monitoring method and device, a terminal and a storage medium, which at least solves the problem that the user's privacy information is exposed in an unsafe network environment due to malicious third-party applications or insufficient security awareness, while minimizing the impact of information sent by monitoring applications on network performance.

[0004] To solve at least the above-mentioned technical problems, an embodiment of the present invention provides an information monitoring method and device, a terminal and a storage medium, including: intercepting an uplink message sent by a target application at the system layer, forwarding the uplink message to the application layer, and detecting the uplink message at the application layer; when the uplink message contains user privacy information, intercepting the uplink message and notifying the user.

[0005] An embodiment of the present invention also provides an application information monitoring device, including: an interception unit, used to intercept uplink messages sent by each application at the system layer and forward the uplink messages to the application layer; a detection unit, used to detect the uplink messages at the application layer; and a processing unit, which intercepts the uplink messages and notifies the user when the uplink messages contain user privacy information.

[0006] An embodiment of the present invention also provides a terminal, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned information monitoring method.

[0007] An embodiment of the present invention further provides a computer-readable storage medium for storing a computer program, wherein the computer program is used for computing and executing the above-mentioned information monitoring method.

[0008] Compared with the prior art, the embodiment of the present invention designs an information monitoring method to replace VPN service to monitor user privacy information. If it is determined that the message contains user privacy information, the message is intercepted and the user is notified, so as to prevent the user privacy information from being leaked. At the same time, the monitoring is only for the uplink message of the application, so the monitoring of information is more targeted, so that the impact of monitoring on network performance is minimized, thereby reducing the possibility of network delay and improving the user experience.

[0009] In addition, before forwarding the uplink message to the application layer, it also includes: judging whether the source application of the uplink message exists in the whitelist according to the pre-set whitelist, and sending the uplink message when the source application of the uplink message exists in the whitelist; when the source application of the uplink message does not exist in the whitelist, forwarding the uplink message to the application layer. Uplink messages sent by applications in the whitelist do not need to be monitored, so setting a whitelist can not only increase the system's customizability and flexibility, but also reduce the system's unnecessary computing overhead to increase overall performance.

[0010] In addition, the whitelist is pre-set by one or more of the following methods: the system automatically sets the whitelist and the user-defined whitelist; the system automatically sets the whitelist to include one or more of the following applications: applications without Internet access permissions, system applications, and manufacturer-set applications; the user-defined whitelist is added manually by the user. The system automatically sets the whitelist without the need for manual execution by the user, thus providing the user with a simple user experience and avoiding the system's computing burden being increased by the user's failure to set it. The user-defined whitelist allows the user to add trusted applications on their own, improving the user experience.

[0011] In addition, before the application layer detects the uplink message, it also includes: determining whether the uplink message is encrypted, if the uplink message is encrypted, sending the uplink message, and if the uplink message is not encrypted, detecting the uplink message at the application layer. If the uplink message is encrypted, it means that there is no risk of leaking user privacy information in the uplink message, so the uplink message does not need to be detected, thereby reducing the system calculation burden.

[0012] In addition, the uplink message is detected at the application layer, including: using a pre-trained word embedding dimensionality reduction Bayesian classification algorithm as the main algorithm to detect the uplink message; if the probability that the uplink message detected by the main algorithm contains user privacy information is less than the first preset threshold, the uplink message is determined to contain no user privacy information; if the probability that the uplink message detected by the main algorithm contains user privacy information is greater than the second preset threshold, the uplink message is determined to contain user privacy information; if the probability that the uplink message detected by the main algorithm contains user privacy information is greater than the first preset threshold and less than the second preset threshold, the uplink message is detected by an auxiliary detection algorithm for secondary detection; wherein the first preset threshold is less than the second preset threshold. The use of the word embedding dimensionality reduction Bayesian classification algorithm can greatly reduce the complexity of the data processed by the detection algorithm and significantly improve the efficiency of the detection algorithm. At the same time, in order to ensure the reliability of the detection results while ensuring efficiency, adding an auxiliary detection algorithm for secondary judgment can significantly improve the overall accuracy of the algorithm. Since most cases only need to execute high-speed algorithms, the overall time consumption of the detection process can still be maintained low enough. Therefore, with the help of this two-step process, the detection process can simultaneously ensure high speed and high accuracy.

[0013] In addition, the auxiliary detection algorithm is a one-dimensional convolutional neural network. The one-dimensional convolutional neural network algorithm is deep learning, with high reliability, which can significantly improve the overall accuracy of the algorithm.

[0014] In addition, the detection of the uplink message at the application layer also includes: when the virtual private network VPN service is turned on, when the uplink message does not contain user privacy information, the uplink message is sent through the virtual private network VPN service. When the VPN service is turned on, the uplink message forwarded by the application layer is forwarded to the VPN application after detection is completed, and sent by the VPN, so the VPN and the service of the present invention can be turned on and off independently without interfering with each other. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily described by the pictures in the corresponding drawings, and these exemplary descriptions do not constitute limitations on the embodiments.

[0016] Figure 1 is a flow chart of an information monitoring method according to a first embodiment of the present invention;

[0017] Figure 2 is a schematic diagram of an information monitoring method according to a first embodiment of the present invention;

[0018] Figure 3 is a detection flow chart of two privacy protection detection algorithms according to the first embodiment of the present invention;

[0019] Figure 4 is a main algorithm flow chart according to the first embodiment of the present invention;

[0020] Figure 5 is a flow chart of an auxiliary detection algorithm according to a first embodiment of the present invention;

[0021] Figure 6 is a flow chart of an information monitoring method according to a second embodiment of the present invention;

[0022] Figure 7 is a flow chart of an information monitoring method according to a third embodiment of the present invention;

[0023] Figure 8 is a flow chart of an information monitoring method according to a fourth embodiment of the present invention;

[0024] Fig. 9 is a schematic diagram of an information monitoring method according to a fourth embodiment of the present invention;

[0025] Fig.10 is a schematic diagram of an information monitoring device according to a sixth embodiment of the present invention;

[0026] Fig.11 FIG. 4 is a schematic structural diagram of an electronic device according to a seventh embodiment of the present invention. DETAILED DESCRIPTION

[0027] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0028] The first embodiment of the present invention relates to an information monitoring method, which can be specifically applied to various terminal devices, such as user mobile phones, tablet computers, etc., which are not described in detail here. In this embodiment, the uplink message sent by each application is intercepted at the system layer, and the uplink message is forwarded to the application layer. The uplink message is detected at the application layer to determine whether the uplink message contains user privacy information; if the uplink message contains user privacy information, the uplink message is intercepted and the user is notified, otherwise, the uplink message is sent.

[0029] The implementation details of the information monitoring method of this embodiment are specifically described below. The following content is only provided for the convenience of understanding the implementation details and is not necessary for the implementation of this solution.

[0030] The flowchart of the information monitoring method in this embodiment is as follows Figure 1 As shown, including:

[0031] Step 101: intercept an uplink message sent by a target application at the system layer.

[0032] Specifically, current smartphones have a wealth of third-party applications. When a third-party application sends a network request, the network request may carry and upload various user information, which may contain user privacy information. Figure 2 As shown, in order to monitor the uplink message sent by the target application 11 , a virtual module 21 , such as a virtual network card, can be set at the system layer 20 to intercept the uplink message sent by the target application 11 .

[0033] It can be noted that the messages intercepted here refer specifically to uplink messages. Downlink messages are sent directly to the application according to normal logic, so there is no need to monitor the downlink messages. It can be understood that the information received by the user is unlikely to have the risk of privacy information being leaked. In this way, as little data as possible is monitored, thereby minimizing the impact of monitoring on network performance, thereby reducing the risk of network delays and improving user experience.

[0034] Step 102: forward the uplink message to the application layer.

[0035] Specifically, after the uplink message of the target application 11 is intercepted by the virtual module 21, it is sent to the application layer 10 by the virtual module 21. Specifically, the virtual module 21 sends the intercepted uplink message to the detection module 12 working in the application layer 10.

[0036] Step 103: Detect the uplink message at the application layer.

[0037] Specifically, the intercepted uplink message of the target application is detected at the detection module 12 of the application layer 10, which may be a detection application that uses a specific detection algorithm to detect whether the uplink message of the target application contains user privacy information and outputs the detection result. The specific detection algorithm will be described in detail after the specific implementation steps of this embodiment are described.

[0038] Step 104: When the uplink message contains user privacy information, execute step 105; otherwise, execute step 106.

[0039] Specifically, according to the detection result obtained in step 103, it is determined whether the uplink message contains a privacy message; and subsequent processing is performed according to different determination results.

[0040] Step 105: intercept the uplink message and notify the user.

[0041] Specifically, uplink messages that are judged to contain user privacy will be temporarily intercepted and a warning will be sent to the user. The warning message sent to the user will include the details of the detection. The user can then decide what to do next. The user can choose to ignore the warning and continue sending the message or immediately intercept and delete the uplink message.

[0042] Step 106: Send an uplink message.

[0043] After the detection application passes the detection of the target application's uplink message, the uplink message is released and sent directly from the system layer 20 to the external network 30 .

[0044] To determine whether the uplink message of the target application contains user privacy information, it is necessary to identify the uploaded information on the detection module in real time, which places extremely high requirements on the performance of the detection algorithm. To this end, this implementation proposes a clustering dimensionality reduction technology based on word embedding. This algorithm technology can compress the extremely large word space in the message into a limited number of core semantic categories, and refine the message body with complex content into features composed of some semantic tags, and then use the processed features as the main body for privacy information detection. This solution can greatly reduce the complexity of the data processed by the detection algorithm and significantly improve the efficiency of the detection algorithm, thereby ensuring that this technology has a practical commercial basis.

[0045] In order to ensure the reliability of the test results while ensuring efficiency, this implementation adopts a dimensionality reduction optimization strategy and designs a set of test processes, such as Figure 3 As shown in the figure, the main algorithm and the auxiliary detection algorithm are combined into a detection process, in which the main algorithm is a pre-trained word embedding dimensionality reduction Bayesian classification algorithm, and the auxiliary detection algorithm is a segmented one-dimensional convolutional neural network classification algorithm. When the posterior probability confidence of the main detection algorithm reaches a certain threshold requirement, the auxiliary detection algorithm performs a secondary judgment, thereby controlling the false alarm rate and missed detection rate to the minimum. The detection process specifically includes:

[0046] Step 1101, calculate the posterior probability confidence level of the private information through the main algorithm.

[0047] The pre-trained word embedding dimensionality reduction Bayesian classification algorithm used by the main algorithm is based on the Bayesian formula, which specifically includes word embedding, clustering, and LDA topic model. Based on the above three concepts, the main algorithm is customized for the application scenarios of this implementation. It does not need to pay attention to the subtle semantics and sequential structure of the word to determine whether it contains sensitive information. Therefore, these redundant information is removed through embedding coding and classification dimensionality reduction operations to retain only the core features. While significantly reducing the algorithm's computational complexity and improving the speed, it can still maintain a high accuracy rate. The main algorithm flow chart is as follows Figure 4 As shown, it specifically includes the following steps 1201 to 1205:

[0048] Step 1201, first the text to be detected is segmented and decomposed into a word set.

[0049] Specifically, in the word segmentation algorithm, frequency can be used as probability for calculation. In a given text to be detected, we count the words as units, count the frequency of each word, and count all possible word segmentation results to form a word set.

[0050] In step 1202, these words are then converted into vector encodings using a pre-trained word embedding model. The word embedding model is pre-trained, and this conversion process is very efficient.

[0051] Specifically, word embedding is a word encoding technology developed in the field of natural language processing in recent years. It maps natural words into a high-dimensional vector space through certain rules, represents each word with a vector of the same dimension, and tries to ensure that the vector distance of words with similar semantics is closer. Word embedding is usually used for preprocessing of deep learning for natural language recognition. The algorithm proposed in this embodiment uses this technology for word feature extraction for classification and dimensionality reduction. In practice, the result of word embedding should be a high-dimensional vector, and the vector distance of words with similar semantics after encoding is also closer.

[0052] Step 1203, the converted vector code actually contains semantic features and can be directly used for dimensionality reduction. The dimensionality reduction process is to classify the encoded words into pre-set k semantic classes through the k-nearest neighbor classification algorithm. The centers of these k semantic classes are pre-trained through the k-means clustering algorithm, and the classification process is also very efficient.

[0053] Specifically, clustering is to apply the k-means clustering algorithm to cluster a large number of words in the message body into a limited number of central semantic categories, and give the vector features corresponding to each central semantic and the relationship between it and sensitive information. This step is preprocessing, and the clustering results and relationship parameters are written into the algorithm for direct use after the calculation is completed. This mechanism can significantly reduce the complexity of the data that the algorithm needs to process during formal detection, greatly improve the detection speed and will not reduce the accuracy of detection.

[0054] Step 1204, after classification and dimensionality reduction, the message is converted into a feature vector composed of several semantic classes, and the feature dimension is greatly reduced compared to before dimensionality reduction, which will reduce the amount of computation for subsequent calculations.

[0055] Specifically, clustering is performed on the basis of word embedding coding, and a large number of words are clustered into several semantic classes, the number of which is much smaller than the number of words. When using semantic classes instead of words, dimensionality reduction is achieved.

[0056] In step 1205, the feature vector of the message is fed into the Bayesian formula to calculate the posterior probability that it contains sensitive information, and the detection is completed through the calculation result.

[0057] Specifically, the LDA topic model is a Bayesian model, whose basic assumption is that messages with different topics (including or not containing private information) have different word frequency distribution probabilities, so the topic of a message can be inferred by the distribution of different words in the message. However, this inference process is based on a strict Bayesian formula, so the LDA model has higher reliability than ordinary methods.

[0058] In order to classify the intercepted messages using the LDA model, some model parameters need to be specified. These parameters can be obtained through training. Assume that there is a training set ω={ω1,ω2,...ω M}, where ω is the word in the document, and the model parameters are estimated using the maximum likelihood method:

[0059]

[0060] Among them, α is the parameter of the Dirichlet prior of the topic distribution of each document, that is, the prior weight of the document topic. η is the parameter of the Dirichlet prior of the distribution of each topic word, that is, the prior weight of the word in a topic. It is usually believed that α of all topics and η of all words are equal and sparse, and can be represented by α and η. The parameters α and η can be estimated by the maximum likelihood through the above formula.

[0061] The above parameter training is pre-training. After being pre-trained by the manufacturer and written into the application, it will not affect the speed when the user uses it.

[0062] After the model parameters are determined, it is equivalent to determining the probability distribution of different words in two types of messages: those containing user privacy information and those not containing user privacy information. At this time, the word frequency distribution in the message can be used to calculate the posterior probability of this message for different topics through the Bayesian formula:

[0063]

[0064] In which, assuming θ m represents the topic distribution of the mth document, with θ mk =p(z k |θ m ). β k represents the word distribution of topic k, with β ki =p(ω i |z k ). mnis the topic to which the nth word in the mth document belongs. mn Then, we can estimate θ by the Bayesian formula above. m ,β k ,z mn Parameter value.

[0065] At this time, the detection and judgment can be completed by comparing the posterior probabilities of the current message for the two topics containing private information and not containing private information. This algorithm is fast and accurate, and can efficiently filter messages to minimize the impact of this function on user experience. The core of this algorithm is efficiency-oriented. All time-consuming steps are pre-calculated through preprocessing. The steps performed in the actual detection are both streamlined and efficient, with the aim of minimizing the impact of the detection process on the user experience.

[0066] The above steps obtain the posterior probability confidence through the main algorithm, and the next step 1102 of the detection process of the following two detection algorithms is performed according to the calculation result to judge the result of the posterior probability confidence:

[0067] Step 1102, determine whether the obtained posterior probability confidence is less than a first threshold value. In this embodiment, 0.25 is used, but it is not limited to this value. When the classification confidence is less than the first threshold value, execute step 1104, that is, determine that the detection result does not contain privacy information; otherwise, execute step 1103.

[0068] Specifically, the posterior probability confidence value obtained by the main algorithm determines that when the value is less than the first threshold, it is determined that the uplink message does not contain privacy information. When the value is not less than the first threshold, the next step 1103 is executed for judgment, wherein the first threshold is not limited to 0.25 in this embodiment.

[0069] Step 1103, determine whether the obtained posterior probability confidence is greater than a second threshold value, which is 0.75 in this embodiment, but is not limited to this value. When the classification confidence is greater than the second threshold value, execute step 1105, i.e. determine that the detection result contains privacy information, otherwise, execute step 1106.

[0070] Specifically, through the posterior probability confidence obtained in the first step, when the value is greater than the second threshold, it is determined that the uplink message contains privacy information. When the value is not greater than the second threshold, the next step 1106 is continued to be executed for judgment, wherein the second threshold is not limited to 0.75 in this embodiment.

[0071] Step 1106, perform a secondary judgment using an auxiliary detection algorithm.

[0072] Although the main algorithm can achieve good results, the privacy information detection function requires higher accuracy because in the application scenario of this technology, both missed reports and false reports will seriously affect the user experience. A large number of missed reports will make this interception mechanism meaningless, and a large number of false reports will seriously reduce the user experience. Therefore, this implementation method introduces a more accurate algorithm for secondary judgment when the confidence of the posterior probability calculated by LDA is not high, so as to ensure that this mechanism can reach the required level in terms of overall speed and accuracy.

[0073] The auxiliary detection algorithm is a one-dimensional convolutional neural network. This method has high accuracy and good speed, which meets the requirements of the secondary judgment algorithm. Usually in deep learning, convolutional neural networks are used for image processing, while recurrent neural networks are mostly used in natural language analysis. This is determined by the characteristics of images and natural languages. Images are more concerned about the relationship between a certain feature and surrounding features and require features to be translationally invariant, while natural languages ​​are more concerned about the order in which features appear and their relationship with previous and subsequent sentences.

[0074] Although the privacy information detection in this implementation belongs to semantic recognition, it is very different from the focus of natural language processing. The text faced by privacy recognition is not a complete sentence, and there is no coherent semantics. Therefore, there is no need to pay too much attention to the order of the entire sentence. Trying to recognize the semantics of network data packets will cause problems. At the same time, privacy information may appear at any position in the data packet, requiring feature recognition to be translation invariant, and the features of privacy information usually exist in a fragment. These features show that one-dimensional convolutional neural networks are more in line with the requirements. In addition, the parallel processing of convolutional neural networks has higher performance than recurrent neural networks.

[0075] On this basis, in order to further improve the running speed of the neural network, a segmented one-dimensional convolutional neural network model is proposed without reducing the accuracy of the neural network results. This model reuses the intermediate calculation results of word embedding and classification in the main algorithm, and directly uses the intermediate variables cached in the main algorithm as the input value of the convolutional neural network. The traditional neural network mainly includes an embedding layer, a convolution layer, a pooling layer, a fully connected layer, and the final output is a sigmoid activation function for binary classification. In this way, the embedding layer, a convolution layer and a pooling layer can be removed from the traditional one-dimensional convolutional neural network, reducing the depth and number of variables of the neural network, so as to significantly improve the running speed.

[0076] Based on the above reasons, the auxiliary detection algorithm process proposed in this embodiment Figure 5As shown, step 1301, step 1302 and step 1303 are the first half of the segmented method, which are actually consistent with some operations of the main algorithm. The intermediate calculation results of word embedding and classification in the main algorithm can be directly used. Therefore, in practice, only the second half of the segmented method needs to be executed to speed up the algorithm. The specific process includes:

[0077] Step 1304, input the intermediate calculation results of the main algorithm into the one-dimensional convolutional neural network calculation.

[0078] Step 1305, use the fully connected layer to output the classification result.

[0079] Step 1306, output the binary classification result through the Sigmod activation function.

[0080] Among them, the vast majority of messages can be successfully detected through the main algorithm, and there is no need to perform a secondary judgment. Therefore, in practice, this process will be executed very quickly to ensure overall high efficiency. In a few cases, the main algorithm fails to judge and is supplemented by the secondary detection algorithm. The secondary detection algorithm is deep learning, which has high reliability and can significantly improve the overall accuracy of the algorithm. The detection process proposed in the invention can find a suitable balance between speed and accuracy, so that the overall detection process can maintain both high speed and high accuracy, so that this invention can meet commercial standards.

[0081] The above steps 1301 to 1306 complete the auxiliary detection algorithm. The following step 1107 is the last step of the detection process of the combination of the two detection algorithms, that is, the user privacy message is judged according to the secondary judgment result of the auxiliary detection algorithm:

[0082] Step 1107, if the secondary judgment result contains private information, execute step 1105, that is, determine that the detection result contains private information; otherwise, execute step 1104, that is, determine that the detection result does not contain private information.

[0083] Specifically, this step uses the designed algorithm flow to check whether the uplink message contains user privacy information. If there is no user privacy information in the uplink message, it means that there is no risk of leaking user privacy information in the uplink message, and the detection result is determined to contain no privacy information. If user privacy information is detected in the data packet, it means that the uplink message contains user privacy information and there is a great risk of privacy leakage, and the detection result is determined to contain privacy information.

[0084] This implementation method monitors the application information uploaded to the network to prevent the user's privacy information from being leaked. At the same time, the monitoring object is limited to the uplink message of the application, so that the impact of monitoring on network performance is minimized, thereby reducing the risk of network delay and improving the user experience. In addition, compared with the existing detection technology based on VPN services, because the functional module of this implementation method is completely built into the system, there will be no redundant status bar logo, and there will be no background application resident in the task bar. Therefore, the solution of this implementation method can effectively prevent the user from clearing the process of the detection application while cleaning the background process, causing functional abnormalities, and more importantly, it can give users a simple user experience.

[0085] The second embodiment of the present invention relates to an information monitoring method. The second embodiment is substantially the same as the first embodiment, with the main difference being that in the second embodiment of the present invention, a whitelist is pre-set, and the uplink message of the target application is processed according to the set whitelist, such as Figure 6 As shown, including:

[0086] Step 201: intercepting uplink messages sent by each application at the system layer. This step is similar to step 101 of the first embodiment and will not be described in detail here.

[0087] Step 202: determine whether the source application of the uplink message exists in the whitelist.

[0088] Specifically, in this step, the whitelist is a list of trusted applications, that is, the applications in the whitelist are trusted applications that do not need to be detected, so the uplink messages sent by the applications do not need to be intercepted and detected.

[0089] In addition, the whitelist is pre-set by one or more of the following methods: the system automatically sets the whitelist and the user-defined whitelist; the system automatically sets the whitelist and includes one or more of the following applications: applications without Internet access permission, system applications, and manufacturer-set applications; the user-defined whitelist is manually added by the user. The three applications in the system automatically sets the whitelist are only specific examples, but are not limited to these three. The user-defined whitelist is manually added by the user, and the user can set the whitelist according to his or her own usage needs.

[0090] Uplink messages sent by trusted applications in the whitelist do not need to be intercepted and detected. Therefore, setting a whitelist can not only increase the system's customizability and flexibility, but also reduce the system's unnecessary computing overhead and improve overall performance. In addition, by dividing the whitelist into a system-automatically set whitelist and a user-defined whitelist, the automatic whitelist setting does not require manual execution by the user, thus providing the user with a simple user experience and avoiding the system's computing burden due to the user's failure to set it. The user-set whitelist allows users to add trusted applications on their own, avoiding the possibility of applications that users identify as trusted being detected and intercepted, thereby improving the user experience.

[0091] Step 203: forward the uplink message to the application layer.

[0092] Step 204: Detect the uplink message at the application layer.

[0093] Step 205: When the uplink message contains user privacy information, execute step 206; otherwise, execute step 207.

[0094] Step 206: intercept the uplink message and notify the user.

[0095] Step 207: Send an uplink message.

[0096] Step 201 , step 203 , step 204 , step 205 , step 206 and step 207 of this embodiment are similar to step 101 , step 102 , step 103 , step 104 , step 105 and step 106 of the first embodiment, respectively, and are not described again herein.

[0097] A third embodiment of the present invention relates to an information monitoring method, such as Figure 7 As shown, the third embodiment is substantially the same as the second embodiment, and the main difference is that: in the third embodiment of the present invention, before the application layer detects the uplink message, it also includes: determining whether the uplink message is encrypted, if the uplink message is encrypted, sending the uplink message, if the uplink message is not encrypted, detecting the uplink message at the application layer. Figure 7 As shown, including:

[0098] Step 301: intercepting uplink messages sent by each application at the system layer. This step is similar to step 201 of the second embodiment and will not be described in detail here.

[0099] Step 302, determine whether the source application of the uplink message exists in the whitelist. This step is similar to step 202 of the second implementation mode, and will not be repeated here. In a specific embodiment, this step is optional and is not necessary for implementing this solution.

[0100] Step 303: forward the uplink message to the application layer.

[0101] Step 304, determine whether the uplink message is encrypted.

[0102] Specifically, a preliminary check can be performed on the acquired uplink message to check whether the data information is encrypted, for example, whether the data information is encrypted using the HTTPS protocol. This is just an example, but is not limited to the HTTPS encryption protocol. If the data information is encrypted using the HTTPS protocol, this proves that the uplink message will not be monitored during transmission and can be considered safe. The uplink message can then be sent directly through the test. If the uplink message is an unencrypted HTTPS protocol, it is considered to be a security risk and the next step needs to be continued.

[0103] Step 305: Detect the uplink message at the application layer.

[0104] Step 306: When the uplink message contains user privacy information, execute step 307; otherwise, execute step 308.

[0105] Step 307: intercept the uplink message and notify the user.

[0106] Step 308: Send an uplink message.

[0107] Step 301 , step 302 , step 303 , step 305 , step 306 , step 307 and step 308 of this embodiment are similar to step 201 , step 202 , step 203 , step 204 , step 205 , step 206 and step 207 of the first embodiment, respectively, and are not repeated here.

[0108] This embodiment determines that if the uplink message has been encrypted, it is considered that the uplink message does not have the risk of leaking user privacy information, so the uplink message does not need to be detected, thereby reducing the calculation burden of the system.

[0109] The relevant technical details mentioned in the first embodiment and the second embodiment are still valid in this embodiment, and are not repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the first embodiment.

[0110] The fourth embodiment of the present invention relates to an information monitoring method, which is substantially the same as the third embodiment, with the main difference being that: if the user turns on the VPN service, the request to enter the normal sending process will be forwarded to the application of the VPN service after completing the detection according to the predetermined process, and the subsequent communication will be processed by the VPN service. Turning on the privacy information detection and interception function will not affect the user's use of the VPN service.

[0111] Specifically, if Figure 8 As shown, including:

[0112] Step 401: intercepting uplink messages sent by each application at the system layer.

[0113] Step 402, determine whether the application exists in the whitelist.

[0114] Step 403: forward the uplink message to the application layer.

[0115] Step 404, determine whether the uplink message is encrypted.

[0116] Step 405: Detect the uplink message at the application layer.

[0117] Step 406: When the uplink message contains user privacy information, execute step 408; otherwise, execute step 409.

[0118] Step 401 , step 402 , step 403 , step 404 , step 405 , and step 406 of this embodiment are similar to step 301 , step 302 , step 303 , step 304 , step 305 , and step 306 of the third embodiment, and are not described again here.

[0119] Step 407: Whether the VPN service is enabled.

[0120] The detection module is compatible with the system's VPN service. When the user turns on the VPN service, the entire module architecture is as follows: Fig. 9 As shown, the VPN application 13 and the detection module 12 are in a serial processing mode, the uplink message is first intercepted by the first virtual module 21 and transmitted to the detection module 12 for detection, when the detection process is completed, the uplink message is sent again, and then it is forwarded to the VPN application 13 through the second virtual module 22 according to the normal VPN service, and finally the uplink message is sent through the VPN gateway 40, that is, step 410 is completed. For the VPN service, whether the received information data has been detected will not have an impact, so the detection process in the invention is transparent to the VPN service, and both can be started at the same time.

[0121] Step 408: intercept the uplink message and notify the user.

[0122] Step 409: Send an uplink message.

[0123] Step 408 and step 409 of this embodiment are similar to steps 307 and 308 of the third embodiment, respectively, and are not described again herein.

[0124] Step 410: Send an uplink message via the VPN service.

[0125] This step is as explained in step 407 and will not be repeated here.

[0126] In this mode of the present embodiment, neither the detected application nor the VPN service started by the user will sense the existence of the detection module. In other words, the detection module in this embodiment will not affect the use function of any mobile phone itself, so the VPN and the service of this embodiment can be turned on and off independently without interfering with each other.

[0127] The fifth embodiment of the present invention relates to an information monitoring method. The fifth embodiment is substantially the same as the fourth embodiment, with the main difference being that in the fifth embodiment of the present invention, the privacy detection function at the system layer can be turned off.

[0128] According to the set rules, the system layer detects the status of the privacy information detection function. If the detection function is not turned on, the request enters the normal communication process and is ready to be sent. If the detection function is turned on, the data packet of this network request will be transmitted to the next step for detection. In this implementation, users can choose to turn off privacy detection, thereby improving the user experience.

[0129] The relevant technical details mentioned in the fourth embodiment are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the fourth embodiment.

[0130] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0131] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.

[0132] The sixth embodiment of the present invention relates to an information monitoring device 600, such as Fig.10 As shown, the device may include, but is not limited to, the following units.

[0133] The interception unit 601 is used to intercept the uplink messages sent by each application at the system layer and forward the uplink messages to the application layer;

[0134] The detection unit 602 is used to detect the uplink message at the application layer;

[0135] The processing unit 603 intercepts the uplink message and notifies the user when the uplink message contains user privacy information.

[0136] In a specific embodiment, the interception unit 601 can also determine whether the source application of the uplink message exists in the whitelist based on a pre-set whitelist. If it exists in the whitelist, the uplink message is sent directly. If it does not exist in the whitelist, the uplink message is forwarded to the application layer.

[0137] In a specific embodiment, the whitelist is pre-set by one or more of the following methods: a whitelist automatically set by the system and a user-defined whitelist; wherein the whitelist automatically set by the system includes one or more of the following applications: applications without Internet access permission, system applications, and manufacturer-set applications; and the user-defined whitelist is manually added by the user.

[0138] In a specific embodiment, the detection unit 602 is specifically used to determine whether the uplink message is encrypted before detecting the uplink message at the application layer. If the uplink message is encrypted, the uplink message is sent; if the uplink message is not encrypted, the uplink message is detected at the application layer.

[0139] In a specific embodiment, the detection unit 602 is specifically used to use a pre-trained word embedding dimensionality reduction Bayesian classification algorithm as a main algorithm to detect the uplink message; if the probability that the uplink message detected by the main algorithm contains user privacy information is less than a first preset threshold, it is determined that the uplink message does not contain user privacy information; if the probability that the uplink message detected by the main algorithm contains user privacy information is greater than a second preset threshold, it is determined that the uplink message contains user privacy information; if the probability that the uplink message detected by the main algorithm contains user privacy information is greater than the first preset threshold and less than the second preset threshold, an auxiliary detection algorithm is used to perform secondary detection on the uplink message; wherein the first preset threshold is less than the second preset threshold.

[0140] In a specific embodiment, the auxiliary detection algorithm is a one-dimensional convolutional neural network.

[0141] In a specific embodiment, the processing unit 603 is specifically configured to send an uplink message through the VPN service when the VPN service is enabled.

[0142] Since the first embodiment and the present embodiment correspond to each other, the present embodiment can be implemented in conjunction with the first embodiment. The relevant technical details mentioned in the first embodiment are still valid in the present embodiment, and the technical effects that can be achieved in the first embodiment can also be achieved in the present embodiment. In order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in the present embodiment can also be applied in the first embodiment.

[0143] A seventh embodiment of the present invention relates to a terminal, such as Fig.11 As shown, it includes at least one processor 701; and a memory 702 that is communicatively connected to the at least one processor 701; wherein the memory 702 stores instructions that can be executed by the at least one processor 701, and the instructions are executed by the at least one processor 701 so that the at least one processor 701 can execute the above-mentioned information monitoring method.

[0144] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0145] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0146] The sixth embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0147] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0148] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. An information monitoring method, characterized in that: include: An uplink message sent by a target application is intercepted at the system layer, and the uplink message is forwarded to the application layer, where a pre-trained word embedding dimensionality reduction Bayesian classification algorithm is used as a main algorithm to detect the uplink message; When the probability that the uplink message detected by the main algorithm contains the user privacy information is greater than a second preset threshold, determining that the uplink message contains the user privacy information; In the case that the uplink message contains user privacy information, the uplink message is intercepted and the user is notified.

2. The information monitoring method according to claim 1, characterized in that: Before forwarding the uplink message to the application layer, it also includes: judging whether the source application of the uplink message exists in the whitelist according to a pre-set whitelist, and sending the uplink message when the source application of the uplink message exists in the whitelist; and forwarding the uplink message to the application layer when the source application of the uplink message does not exist in the whitelist.

3. The information monitoring method according to claim 2, characterized in that: The whitelist is pre-set by one or more of the following methods: a system automatically set whitelist and a user-defined whitelist; The system automatically sets the whitelist to include one or more of the following applications: applications without Internet access permission, system applications, and manufacturer settings applications; The user-defined whitelist is manually added by the user.

4. The information monitoring method according to any one of claims 1 to 3, characterized in that: Before the uplink message is detected, it also includes: judging whether the uplink message is encrypted, if the uplink message is encrypted, sending the uplink message, if the uplink message is not encrypted, executing the detection of the uplink message.

5. The information monitoring method according to claim 1, characterized in that: The method further comprises: If the probability that the uplink message detected by the main algorithm contains user privacy information is less than a first preset threshold, determining that the uplink message does not contain user privacy information; If the probability that the uplink message detected by the main algorithm contains user privacy information is greater than the first preset threshold and less than the second preset threshold, a secondary detection algorithm is used to perform secondary detection on the uplink message; The first preset threshold is smaller than the second preset threshold.

6. The information monitoring method according to claim 5, characterized in that: The auxiliary detection algorithm is a one-dimensional convolutional neural network.

7. The information monitoring method according to claim 1, characterized in that: The detecting the uplink message at the application layer further includes: starting a virtual private network VPN service, and when the uplink message does not contain user privacy information, sending the uplink message through the virtual private network VPN service.

8. An application information monitoring device, characterized in that: include: An interception unit, used to intercept uplink messages sent by each application at the system layer, and forward the uplink messages to the application layer; A detection unit, configured to detect the uplink message using a pre-trained word embedding dimension reduction Bayesian classification algorithm as a main algorithm at the application layer; When the probability that the uplink message detected by the main algorithm contains the user privacy information is greater than a second preset threshold, determining that the uplink message contains the user privacy information; The processing unit intercepts the uplink message and notifies the user when the uplink message contains user privacy information.

9. A terminal, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the information monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the information monitoring method according to any one of claims 1 to 7 is implemented.

Images