Method, device and system for detecting operating environment

Abstract

The present invention discloses a method, device and system for detecting an operating environment, and relates to the field of computer technology. A specific implementation of the method includes: obtaining a reference sample, the reference sample includes: sample information of multiple library files; when an application carried by the operating environment is started, determining the information of the target library file loaded by the application; detecting the information of the target library file according to the sample information of the multiple library files; when the detection result is that the information of the target library file does not belong to the reference sample, determining that there is a dynamically injected file in the operating environment. This implementation can detect the dynamically injected files more comprehensively to guide the solution of the security problems caused by the dynamically injected files.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and system for detecting an operating environment. Background Art

[0002] Attackers often use dynamic injection to attack applications. For example, an attacker dynamically injects a plug-in file into a mobile terminal in the form of jailbreaking. During the running of the application in the mobile terminal, the user information can be stolen by calling the plug-in file. For another example, an attacker generates a forged file with the same name as the original library file in the running environment, and overwrites the original library file with the forged file, which can achieve the purpose of forgery. That is, when the application that needs to use the library file is running, the forged file will be loaded, and the attacker can intercept relevant information through the forged file.

[0003] Existing detection methods mainly detect whether there is dynamic injection by matching file names, so as to detect the operating environment.

[0004] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0005] Since file names can be forged, some dynamically injected files that affect applications are difficult to detect, resulting in security issues caused by dynamically injected files still existing in the operating environment. Summary of the invention

[0006] In view of this, the embodiments of the present invention provide a method, device and system for detecting an operating environment, which can detect dynamically injected files in a relatively comprehensive manner to guide the resolution of security issues caused by dynamically injected files.

[0007] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for detecting an operating environment is provided, comprising:

[0008] Acquire a reference sample, wherein the reference sample includes: sample information of a plurality of library files;

[0009] When the application carried by the operating environment is started, determining information of a target library file loaded by the application;

[0010] Detecting information of the target library file according to sample information of the plurality of library files;

[0011] When the detection result is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the operating environment.

[0012] Preferably,

[0013] The sample information includes: a relative path of a library file, at least one instruction set identifier, and a library file feature identifier corresponding to each instruction set identifier;

[0014] The information of detecting the target library file includes:

[0015] Determine a target instruction set identifier corresponding to the operating environment;

[0016] Searching for a relative path of a target library file that matches the information of the target library file in the sample information of the plurality of library files;

[0017] If found, then the target library file feature identifier corresponding to the target instruction set identifier is matched under the target library file relative path;

[0018] Determine whether the target library file feature identifier is consistent with the information of the target library file, and if not, determine that the detection result is that the information of the target library file does not belong to the reference sample;

[0019] If not found, it is determined that the detection result is that the information of the target library file does not belong to the reference sample.

[0020] Preferably, the method for detecting the operating environment further comprises:

[0021] Collect full data corresponding to multiple environment versions;

[0022] Extracting a full sample corresponding to the environment version from the full data corresponding to the environment version, and storing a plurality of full samples corresponding to the environment version, wherein the full sample corresponding to the environment version includes: sample information of all library files corresponding to the environment version;

[0023] The obtaining of the reference sample comprises:

[0024] Determining a target environment version of the operating environment;

[0025] From the full samples corresponding to the multiple stored environment versions, search for the full samples corresponding to the target environment version, and use the full samples corresponding to the target environment version as reference samples.

[0026] Preferably,

[0027] The sample information includes: a first key-value pair consisting of the library file relative path and each of the instruction set identifiers, and a second key-value pair consisting of each of the instruction set identifiers and a library file feature identifier, wherein the second key-value pair is a next-level key-value pair of the first key-value pair;

[0028] The searching for the relative path of the target library file that matches the information of the target library file comprises: searching for a target first key-value pair according to the target instruction set identifier and the target load path in the information of the target library file;

[0029] Under the relative path of the target library file, the target instruction set identifier is matched with the corresponding target library file feature identifier, including: under the target first key-value pair, searching for the target second key-value pair corresponding to the target instruction set identifier, and determining that the library file feature identifier contained in the target second key-value pair is the target library file feature identifier.

[0030] Preferably, in any of the above-mentioned operating environment detection methods, the operating environment is constructed by an iOS operating system.

[0031] Preferably, the sample information comes from a dSYM file.

[0032] In a second aspect, an embodiment of the present invention provides a device for detecting an operating environment, comprising: an acquisition unit, a determination unit, and a detection unit, wherein:

[0033] The acquisition unit is used to acquire reference samples, and the reference samples include: sample information of multiple library files;

[0034] The determining unit is used to determine the information of the target library file loaded by the application when the application carried by the running environment is started;

[0035] The detection unit is used to detect the information of the target library file determined by the determination unit according to the sample information of the multiple library files acquired by the acquisition unit; when the detection result is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the operating environment.

[0036] In a third aspect, an embodiment of the present invention provides a system for detecting an operating environment, comprising: the above-mentioned operating environment detection device and a server, wherein:

[0037] The server is used to store reference samples;

[0038] The operating environment detection device is used to obtain the reference sample from the server.

[0039] One embodiment of the above invention has the following advantages or beneficial effects: generally, the operating environment is constructed for the application by running the library files of the operating system. At present, the library files are often replaced / disguised by dynamically injected files, and user information is stolen / intercepted, etc., that is, once there is a dynamically injected file in the operating environment, and the application carried by the operating environment calls the dynamically injected file, it will pose a threat to the security of the application. Therefore, the detection of the operating environment can be achieved by detecting the target library file loaded by the application. Since the information of the library file of the operating operating system is generally unchanged, by obtaining a reference sample, the reference sample includes: sample information of multiple library files, and the information of the target library file is detected according to the sample information of the multiple library files; when the result of the detection is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the operating environment, and the dynamically injected file can be detected relatively completely to guide the solution of the security problems caused by the dynamically injected file. In addition, after determining that there is a dynamically injected file in the operating environment, a prompt of the existence of security risks can be given.

[0040] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0042] Figure 1 is a schematic diagram of the main process of the method for detecting the operating environment according to an embodiment of the present invention;

[0043] Figure 2 is a schematic diagram of the main process of a method for detecting an operating environment according to another embodiment of the present invention;

[0044] Figure 3 is a schematic diagram of a command line tool calling a submodule code snippet according to an embodiment of the present invention;

[0045] Figure 4 is a schematic diagram of a core code snippet of a Python script according to an embodiment of the present invention;

[0046] Figure 5 is a schematic diagram of a core code snippet of a Python script according to an embodiment of the present invention;

[0047] Figure 6 is a schematic diagram of part of sample information in a dictionary format according to an embodiment of the present invention;

[0048] Figure 7 is a schematic diagram of main units of a device for detecting an operating environment according to an embodiment of the present invention;

[0049] Figure 8 is a schematic diagram of main units of an operating environment detection device according to another embodiment of the present invention;

[0050] Fig. 9 is a schematic diagram of main devices of a system for detecting an operating environment according to an embodiment of the present invention;

[0051] Fig.10 is a schematic diagram of main devices of a system for detecting an operating environment according to another embodiment of the present invention;

[0052] Fig.11 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0053] Fig.12 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0055] Dynamic injection refers to inserting files into the running environment or changing files in the running environment in order to change the original program logic of the application, and executing the inserted files or changed files when the target application is started. Dynamically injected files may intercept the user information of the application, etc., which may pose a security risk to user information.

[0056] The operating environment refers to the library files included in the operating system running on the terminal device, such as the iOS operating system, Android operating system, etc., which provide the operating basis for the application.

[0057] Figure 1 A method for detecting an operating environment according to an embodiment of the present invention is as follows: Figure 1 As shown, the method for detecting the operating environment may include the following steps:

[0058] 101: Obtain reference samples, where the reference samples include: sample information of multiple library files;

[0059] 102: When the application carried by the running environment is started, determine the information of the target library file loaded by the application;

[0060] 103: Detecting information of a target library file according to sample information of multiple library files;

[0061] 104: When the detection result is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the operating environment.

[0062] Generally speaking, the reference sample comes from the original file / original library file of the operating system, and the sample information of the library file comes from part of the information in the original library file of the operating system or part of the information in the original file of the operating system. The above-mentioned reference sample can be obtained by sending a request for obtaining the reference sample to the server, and the request for obtaining the reference sample includes the version information of the operating environment. After receiving the request for obtaining the reference sample, the server sends the reference sample corresponding to the version information of the operating environment to the terminal that executes the detection method of the operating environment; the terminal that executes the detection method of the operating environment can also directly obtain the reference sample from its own storage area or the server according to the version information of the operating environment. The sample information of the multiple library files can be the sample information of all library files related to the application, or it can be the sample information of all library files corresponding to the operating system constituting the operating environment.

[0063] In addition, a specific implementation method for determining the information of the target library file loaded by the application can be obtained through the API (Application Programming Interface) and function provided by the operating system on which the operating environment relies. For example, the current number of library files loaded is obtained through the API interface and the _dyld_image_count function in the iOS system, and then the instruction set information, UUID, and library file loading path corresponding to the library file are obtained through the API interface and _dyld_get_image_header and _dyld_get_image_name. Among them, the application refers to the application program, which can be implemented through the client or through the terminal browser. UUID is a concept proposed by the International Organization for Standardization (ISO). It is a 128-bit value that can be calculated through a certain algorithm. In order to improve efficiency, the commonly used UUID can be shortened to 16 bits. UUID is used to identify the attribute type and is regarded as a unique identifier in all space and time. Generally speaking, it can be guaranteed that this value is truly unique and any UUID generated anywhere will not have the same value. One advantage of using UUID is that new identifiers can be created for library files / new services. For example, for each library file corresponding to an operating environment (such as the environment version of the operating environment / the system version of the operating system where the operating environment is located) and instruction set information (the instruction set information refers to the hardware feature identification information of the terminal where the operating environment is located), a UUID corresponds to each library file.

[0064] Generally, the operating environment is constructed for the application by running the library files of the operating system. At present, the library files are often replaced / disguised by dynamically injected files, and user information is stolen / intercepted, etc. That is, once there is a dynamically injected file in the operating environment, and the application carried by the operating environment calls the dynamically injected file, it will pose a threat to the security of the application. Therefore, the detection of the operating environment can be achieved by detecting the target library file loaded by the application. Since the information of the library file of the operating system is generally unchanged, by obtaining a reference sample, the reference sample includes: sample information of multiple library files, and the information of the target library file is detected according to the sample information of the multiple library files; when the result of the detection is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the operating environment, and the dynamically injected file can be detected relatively completely to guide the solution of the security problems caused by the dynamically injected file. In addition, after determining that there is a dynamically injected file in the operating environment, a prompt that there is a security risk can be given.

[0065] The prompt of the potential security risk may be a pop-up display component to remind the user. The owner of the application can adopt some strategies to protect the privacy or security of the application according to the prompt, such as disabling some functions of the application, or deleting the private data stored by the application, or allowing the application owner to identify risky users.

[0066] In one embodiment of the present invention, the sample information may include: a relative path of a library file, at least one instruction set identifier, and a library file feature identifier corresponding to each instruction set identifier; the relative path of the library file indicates the relative path of the library file storage, the instruction set identifier indicates the feature identifier of the operating system running on the terminal where the application is located, and the library file feature identifier is the above UUID. Since each library file corresponding to an operating system version has a unique library file feature identifier, accordingly, a specific implementation method of detecting the information of the target library file may include: determining the target instruction set identifier corresponding to the operating environment; searching for the target library file relative path that matches the information of the target library file in the sample information of multiple library files; if found, matching the target library file feature identifier corresponding to the target instruction set identifier under the relative path of the target library file; judging whether the target library file feature identifier is consistent with the information of the target library file, if not, determining that the result of the detection is that the information of the target library file does not belong to the reference sample; if not found, determining that the result of the detection is that the information of the target library file does not belong to the reference sample.

[0067] In the above embodiment, when the relative path of the library file, the instruction set identifier and the library file feature identifier completely match the information of the target library file (the relative path of the target library file matching the information of the target library file is found and the target instruction set identifier matches the target library file feature identifier and the target library file feature identifier is consistent with the information of the target library file), it is determined that the library file corresponding to the information of the target library file exists in the operating environment itself. On the contrary, when the relative path of the library file, the instruction set identifier and the library file feature identifier do not completely match the information of the target library file (i.e., in the sample information of multiple library files, the relative path of the target library file matching the information of the target library file is not found or the target instruction set identifier does not match the target library file feature identifier or the target library file feature identifier is inconsistent with the information of the target library file), it is determined that the library file corresponding to the information of the target library file is dynamically injected. Since the dynamically injected file may have the name of the dynamically injected file modified to the name of the library file that already exists in the operating environment, etc., by matching the relative path of the library file, the instruction set identifier and the library file feature identifier, the dynamically injected file can be accurately detected, that is, the solution provided by the embodiment of the present invention makes the detection result more accurate.

[0068] Since the library file path loaded by the application is determined by the application loading mechanism of the operating system layer corresponding to the running environment, the library file path loaded by the application is generally consistent with the library file relative path. The specific implementation method of searching for the target library file relative path that matches the target library file information can be to compare a library file path loaded by the application contained in the target library file information with the library file relative path to confirm.

[0069] In one embodiment of the present invention, the operating environment detected by the above-mentioned operating environment detection method is constructed by the iOS operating system.

[0070] Accordingly, the library file relative path, at least one instruction set identifier, and the library file feature identifier corresponding to each instruction set identifier included in the reference sample can be obtained from the iOS operating system provider platform or from the original dSYM file of the iOS operating system. Among them, dSYM (debugging SYMbols) includes all library files corresponding to a version of the operating system.

[0071] After the same application is installed on different iOS operating system versions or different iOS terminal hardware (currently the terminal CPU is either 32-bit or 64-bit, and the common CPU instruction sets are arm7, armv7, arm64, arm64e, etc.), when the application is started, the library files corresponding to different instruction sets will be loaded according to the different bit numbers of the cpu. At the same time, due to the differences in machine models or cpu, the library files that need to be loaded and the final number are also uncertain. For example, if an application uses the face recognition function (faceID), then on a device with faceID, the library files related to faceID will be loaded when the application is opened, and will not be loaded if the device does not have faceID. Based on this, in one embodiment of the present invention, Figure 2 As shown, the above operating environment detection method may further include the following steps:

[0072] 201: Collect the full data corresponding to multiple environment versions;

[0073] The environment version indicates the system version of the operating system, and the full amount of data is all the library file information required for the operation of the operating system corresponding to the system version. Taking the iOS operating system as an example, the specific implementation method of this step is described in detail. A sample data generation module / collection module is connected to multiple terminals to be collected, wherein the terminal where the sample data generation module / collection module is located is different from the terminal to be collected, and the implementation device of the terminal where the sample data generation module / collection module is located and the detection method of the operating environment can be the same or different. The terminal to be collected is installed with an officially provided iOS system version (either the official version or the test version), that is, the terminal to be collected is a non-jailbroken iOS device (a preferred embodiment, the terminal to be collected is an unused terminal with an iOS operating system). The system versions (environment versions) of the iOS operating system installed on the multiple terminals to be collected are different from each other. Take the iOS 10.3.3 (14G60) system version and the terminal A where the system version is located as an example of the terminal to be collected. After connecting to terminal A, the sample data generation module / collection module builds a storage directory for the iOS 10.3.3 (14G60) system version, and according to the storage directory, copies the dSYM files corresponding to all library files contained in terminal A to the storage directory. Copying the dSYM files to the storage path can be achieved through the Xcode tool.

[0074] In this step, the constructed storage directory may be: / Users / YY / Library / Developer / Xcode / iOSDeviceSupport / 10.3.3(14G60), wherein YY represents the user name of the terminal user; and 10.3.3(14G60) is the operating system version.

[0075] 202: extracting full samples corresponding to the environment version from the full data corresponding to the environment version, and storing a plurality of full samples corresponding to the environment version, wherein the full samples corresponding to the environment version include: sample information of all library files corresponding to the environment version;

[0076] Since the full amount of data collected in the previous step is a dSYM file, the specific implementation method of this step can be implemented by calling the "dwarfdump" command line tool of the Xcode tool, for example, obtaining the sample information of the CoreFoundation library file under the storage directory: " / Users / YY / Library / Developer / Xcode / iOSD eviceSupport / 10.3.3(14G60) / Symbols / System / Library / Frameworks / CoreFo undation.framework / CoreFoundation". The command line tool can be called using Figure 3 The command line tool calls the submodule 301 implementation. The implementation code of the command line tool calls the submodule 300 is as follows Figure 3 As shown. Extract sample information of all library files from the dSYM file, and the extracted results can be shown as follows:

[0077] Extracted results:

[0078] UUID:ACEDAA63-1829-3AFA-8CC2-49F6E92EB254(armv7s) / Users / YY / Library / Developer / Xcode / iOS DeviceSupport / 10.3.3(14G60) / Symbols / System / Library / Frameworks / CoreFoundation.framework / CoreFoundation.

[0079] From the extracted results we can know:

[0080] The relevant path of the library file named CoreFoundation when loaded in the system is: " / System / Library / Frameworks / CoreFoundation.framework / CoreFoundation";

[0081] The instruction set is: "armv7s";

[0082] The UUID is: "ACEDAA63-1829-3AFA-8CC2-49F6E92EB254".

[0083] 203: Determine the target environment version of the operating environment;

[0084] The target environment version refers to the version of the operating system where the running environment is located.

[0085] 204: Search for a full sample corresponding to a target environment version from the full samples corresponding to the stored multiple environment versions, and use the full sample corresponding to the target environment version as a reference sample.

[0086] For example, if the target environment version is 10.3.3 (14G60), the sample information of all library files corresponding to 10.3.3 (14G60) includes the relative path of the library file, the instruction set identifier, and the library file feature identifier UUID.

[0087] When storing full samples corresponding to multiple environment versions, two fields can be stored: one is the environment version number (iOS operating system version number), and the other is the full sample. The reference sample can be queried by the environment version number.

[0088] Through the above process, targeted detection of different operating environments is achieved.

[0089] In one embodiment of the present invention, the collection of full samples of multiple environment versions can be implemented in batches through a python script. The core code snippet of the python script is as follows: Figure 4 and Figure 5 shown.

[0090] In one embodiment of the present invention, a key-value pair can be constructed for the sample information to facilitate searching for the sample information through the key-value pair. The sample information is in json format, and the data structure of the constructed key-value pair is in dictionary format, that is, the sample information includes: a first key-value pair consisting of a relative path of the library file and each instruction set identifier, and a second key-value pair consisting of each instruction set identifier and a library file feature identifier, wherein the second key-value pair belongs to the next level of the first key-value pair; for example, the relative path of the library file is the key value of the first key-value pair, the instruction set identifier UUID is the value value of the first key-value pair, the instruction set identifier UUID is the key of the first key-value pair, and the instruction set uses the corresponding UUID as the value. The constructed partial sample information in dictionary format can be as follows Figure 6 As shown. Figure 6The first key-value pair composed of the relative path of the CoreFoundation library file-uuid (armv7s), and the second key-value pair composed of uuid (armv7s)-library file characteristic identification (ACEDAA63-1829-3AFA-8CC2-49F6E92EB254) under the shown first key-value pair; the first key-value pair composed of the relative path of the CoreMotion library file-uuid (armv7s), and the second key-value pair composed of uuid (armv7s)-library file characteristic identification (8B7FB768C-5149-36FA-BD9E-E46B507F4DE7) under the first key-value pair, etc., are not repeated here.

[0091] Accordingly, a specific implementation method for searching for a target library file relative path that matches the target library file information may include: searching for a target first key-value pair based on a target instruction set identifier and a target loading path in the target library file information; a specific implementation method for matching a target library file characteristic identifier corresponding to the target instruction set identifier under the target library file relative path may include: searching for a target second key-value pair corresponding to the target instruction set identifier under the target first key-value pair, and determining that the library file characteristic identifier contained in the target second key-value pair is the target library file characteristic identifier.

[0092] It can be seen from the above embodiments that the solution provided by the embodiments of the present invention matches the library file path, and then compares the APP runtime sample with the full sample data in combination with the instruction set identifier and the UUID of the similar library file feature identifier, so as to accurately determine whether the dynamic injection scenario occurs. At the same time, it is not affected by factors such as the non-jailbroken or jailbroken operating environment, the number of library files, and the forged library file names, thereby making the detection more accurate.

[0093] like Figure 7 As shown, an embodiment of the present invention provides a detection device 700 for an operating environment, and the detection device 700 for an operating environment includes: an acquisition unit 701, a determination unit 702, and a detection unit 703, wherein:

[0094] The acquisition unit 701 is used to acquire reference samples, where the reference samples include: sample information of multiple library files;

[0095] The determination unit 702 is used to determine the information of the target library file loaded by the application when the application carried by the running environment is started;

[0096] The detection unit 703 is used to detect the information of the target library file determined by the determination unit 702 according to the sample information of the multiple library files obtained by the acquisition unit 701; when the detection result is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the running environment.

[0097] In another embodiment of the present invention, the sample information acquired by the acquisition unit 701 includes: a relative path of a library file, at least one instruction set identifier, and a library file feature identifier corresponding to each instruction set identifier;

[0098] The detection unit 703 is further used to determine the target instruction set identifier corresponding to the operating environment; in the sample information of multiple library files obtained by the acquisition unit 701, search for the target library file relative path that matches the information of the target library file; if found, match the target instruction set identifier with the corresponding target library file feature identifier under the target library file relative path; determine whether the target library file feature identifier is consistent with the information of the target library file, if not, determine that the result of the detection is that the information of the target library file does not belong to the reference sample; if not found, determine that the result of the detection is that the information of the target library file does not belong to the reference sample.

[0099] In one embodiment of the present invention, Figure 8 As shown, the above-mentioned operating environment detection device 700 may further include: a sample data generation unit 801 and a storage unit 802, wherein:

[0100] The sample data generating unit 801 is used to collect full data corresponding to multiple environment versions; and extract full samples corresponding to the environment versions from the full data corresponding to the environment versions;

[0101] The storage unit 802 is used to store the full samples corresponding to the multiple environment versions extracted by the sample data generation unit 801, where the full samples corresponding to the environment version include: sample information of all library files corresponding to the environment version;

[0102] The acquisition unit 701 is further used to determine the target environment version of the operating environment; from the full samples corresponding to multiple environment versions stored in the storage unit 802, the full samples corresponding to the target environment version are searched, and the full samples corresponding to the target environment version are used as reference samples.

[0103] In one embodiment of the present invention, the sample information includes: a first key-value pair consisting of a library file relative path and each instruction set identifier, and a second key-value pair consisting of each instruction set identifier and a library file feature identifier, wherein the second key-value pair is a next-level key-value pair of the first key-value pair;

[0104] The detection unit 703 is used to search for a target second key-value pair corresponding to the target instruction set identifier under the target first key-value pair, and determine that the library file feature identifier included in the target second key-value pair is the target library file feature identifier.

[0105] In one embodiment of the present invention, the above-mentioned operating environment detection device 700 may rely on the iOS operating system.

[0106] It is worth noting that the sample data generating unit 801 and the storage unit 802 may be arranged in different devices from the acquiring unit, the determining unit and the detecting unit, or may be arranged in the same device, which may be a terminal or a server.

[0107] like Fig. 9 As shown, an embodiment of the present invention provides a system 900 for detecting an operating environment, and the system 900 for detecting an operating environment includes: the device 700 for detecting an operating environment provided in any of the above embodiments and a server 901, wherein:

[0108] The server 901 is used to store reference samples;

[0109] The operating environment detection device 700 is used to obtain reference samples from the server.

[0110] In one embodiment of the present invention, Fig.10 As shown, the operating environment detection system 900 further includes: a sample data generating device 1001, wherein:

[0111] The sample data generating device 1001 is used to collect full data corresponding to multiple environment versions; extract full samples corresponding to the environment version from the full data corresponding to the environment version, and the full samples corresponding to the environment version include: sample information of all library files corresponding to the environment version;

[0112] The server 901 is used to store the full samples corresponding to the multiple environment versions extracted by the sample data generating device 1001.

[0113] Fig.11 An exemplary system architecture 1100 is shown to which the method for detecting an operating environment or the apparatus for detecting an operating environment according to the embodiments of the present invention can be applied.

[0114] like Fig.11 As shown, system architecture 1100 may include terminal devices 1101, 1102, 1103, a network 1104, and a server 1105. Network 1104 is used to provide a medium for communication links between terminal devices 1101, 1102, 1103 and server 1105. Network 1104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0115] Users can use terminal devices 1101, 1102, and 1103 to interact with server 1105 through network 1104 to receive or send messages, etc. Various applications can be installed on terminal devices 1101, 1102, and 1103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0116] The terminal devices 1101 , 1102 , and 1103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0117] The server 1105 may be a server that provides various services, such as a background management server (only an example) that supports the terminal devices 1101, 1102, and 1103 in detecting the operating environment of the shopping website being browsed. The background management server may analyze and process the received reference sample acquisition request and other data, and feed back the processing results (such as sample information of multiple library files - only an example) to the terminal device.

[0118] It should be noted that the operating environment detection method provided in the embodiment of the present invention is generally executed by the terminal devices 1101 , 1102 , and 1103 . Accordingly, the operating environment detection device is generally arranged in the terminal devices 1101 , 1102 , and 1103 .

[0119] It should be understood that Fig.11 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0120] Reference below Fig.12 , which shows a schematic diagram of the structure of a computer system 1200 of a terminal device suitable for implementing an embodiment of the present invention. Fig.12 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0121] like Fig.12 As shown, the computer system 1200 includes a central processing unit (CPU) 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1202 or a program loaded from a storage part 1208 into a random access memory (RAM) 1203. In the RAM 1203, various programs and data required for the operation of the system 1200 are also stored. The CPU 1201, the ROM 1202, and the RAM 1203 are connected to each other via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0122] The following components are connected to the I / O interface 1205: an input section 1206 including a keyboard, a mouse, etc.; an output section 1207 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN card, a modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as needed. A removable medium 1211, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1210 as needed, so that a computer program read therefrom is installed into the storage section 1208 as needed.

[0123] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1209, and / or installed from the removable medium 1211. When the computer program is executed by the central processing unit (CPU) 1201, the above-mentioned functions defined in the system of the present invention are executed.

[0124] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0125] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0126] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be provided in a processor, for example, may be described as: a processor includes an acquisition unit, a determination unit, and a detection unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the acquisition unit may also be described as a "unit for acquiring reference samples from a server".

[0127] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining a reference sample, the reference sample includes: sample information of multiple library files; in response to the start of an application carried by the operating environment, determining the information of the target library file loaded by the application; based on the sample information of multiple library files, detecting the information of the target library file; when the result of the detection is that the information of the target library file does not belong to the reference sample, determining that there is a dynamically injected file in the operating environment.

[0128] The computer-readable medium carries one or more programs. When the one or more programs are executed by a device, the device includes: determining a target instruction set identifier corresponding to the operating environment; searching for a target library file relative path that matches the information of the target library file in sample information of multiple library files; if found, matching the target library file feature identifier corresponding to the target instruction set identifier under the target library file relative path; determining whether the target library file feature identifier is consistent with the information of the target library file, if not, determining that the result of the detection is that the information of the target library file does not belong to the reference sample; if not found, determining that the result of the detection is that the information of the target library file does not belong to the reference sample.

[0129] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the device includes: collecting full data corresponding to multiple environment versions; extracting full samples corresponding to the environment version from the full data corresponding to the environment version, and storing the full samples corresponding to the multiple environment versions, the full samples corresponding to the environment version include: sample information of all library files corresponding to the environment version; obtaining reference samples, including: determining the target environment version of the running environment; searching for the full samples corresponding to the target environment version from the full samples corresponding to the multiple stored environment versions, and using the full samples corresponding to the target environment version as reference samples.

[0130] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the device includes: searching for a target first key-value pair according to a target instruction set identifier and a target loading path in information of a target library file; under the target first key-value pair, searching for a target second key-value pair corresponding to the target instruction set identifier, and determining that the library file feature identifier contained in the target second key-value pair is the target library file feature identifier.

[0131] According to the technical solution of the embodiment of the present invention, generally, a running environment is constructed for an application by running the library files of the operating system. At present, dynamically injected files are often used to replace / disguise library files, steal / intercept user information, etc., that is, once there is a dynamically injected file in the running environment, and the application carried by the running environment calls the dynamically injected file, it will pose a threat to the security of the application. Therefore, the detection of the running environment can be achieved by detecting the target library file loaded by the application. Since the information of the library file of the running operating system is generally unchanged, by obtaining a reference sample, the reference sample includes: sample information of multiple library files, and the information of the target library file is detected according to the sample information of the multiple library files; when the result of the detection is that the information of the target library file does not belong to the reference sample, it is determined that there is a dynamically injected file in the running environment, and the dynamically injected file can be detected relatively completely to guide the solution of the security problems caused by the dynamically injected file. In addition, after determining that there is a dynamically injected file in the running environment, a prompt that there is a security risk can be given.

[0132] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting an operating environment, characterized in that: include: Acquire a reference sample, wherein the reference sample includes: sample information of a plurality of library files; When the application carried by the operating environment is started, determining information of a target library file loaded by the application; Detecting information of the target library file according to sample information of the plurality of library files; When the detection result is that the information of the target library file does not belong to the reference sample, determining that there is a dynamically injected file in the operating environment; The sample information includes: a relative path of a library file, at least one instruction set identifier, and a library file feature identifier corresponding to each instruction set identifier; The information of detecting the target library file includes: Determine a target instruction set identifier corresponding to the operating environment; Searching for a relative path of a target library file that matches the information of the target library file in the sample information of the plurality of library files; If found, then under the relative path of the target library file, the target instruction set identifier is matched with the corresponding target library file feature identifier; it is determined whether the target library file feature identifier is consistent with the information of the target library file, and if not, it is determined that the result of the detection is that the information of the target library file does not belong to the reference sample; If not found, it is determined that the detection result is that the information of the target library file does not belong to the reference sample.

2. The method for detecting the operating environment according to claim 1, characterized in that: Further including: Collect full data corresponding to multiple environment versions; Extracting a full sample corresponding to the environment version from the full data corresponding to the environment version, and storing a plurality of full samples corresponding to the environment version, wherein the full sample corresponding to the environment version includes: sample information of all library files corresponding to the environment version; The obtaining of the reference sample comprises: Determining a target environment version of the operating environment; From the full samples corresponding to the multiple stored environment versions, search for the full samples corresponding to the target environment version, and use the full samples corresponding to the target environment version as reference samples.

3. The method for detecting the operating environment according to claim 1, characterized in that: The sample information further includes: a first key-value pair consisting of the library file relative path and each of the instruction set identifiers, and a second key-value pair consisting of each of the instruction set identifiers and the library file feature identifier, wherein the second key-value pair is a next-level key-value pair of the first key-value pair; The searching for the relative path of the target library file that matches the information of the target library file comprises: searching for a target first key-value pair according to the target instruction set identifier and the target load path in the information of the target library file; Under the relative path of the target library file, the target instruction set identifier is matched with the corresponding target library file feature identifier, including: under the target first key-value pair, searching for the target second key-value pair corresponding to the target instruction set identifier, and determining that the library file feature identifier contained in the target second key-value pair is the target library file feature identifier.

4. The method for detecting the operating environment according to any one of claims 1 to 3, characterized in that: The operating environment is constructed by the iOS operating system.

5. The method for detecting the operating environment according to claim 4, characterized in that: The sample information comes from the original dSYM file of the iOS operating system.

6. A device for detecting an operating environment, characterized in that: include: an acquisition unit, a determination unit, and a detection unit, wherein: The acquisition unit is used to acquire reference samples, and the reference samples include: sample information of multiple library files; The determining unit is used to determine the information of the target library file loaded by the application when the application carried by the running environment is started; The detection unit is used to detect the information of the target library file determined by the determination unit according to the sample information of the multiple library files obtained by the acquisition unit; when the detection result is that the information of the target library file does not belong to the reference sample, determine that there is a dynamically injected file in the running environment; The sample information includes: a relative path of a library file, at least one instruction set identifier, and a library file feature identifier corresponding to each instruction set identifier; The detection unit is further used to determine the target instruction set identifier corresponding to the operating environment; search for a target library file relative path that matches the information of the target library file in the sample information of the multiple library files; if found, match the target library file feature identifier corresponding to the target instruction set identifier under the target library file relative path; determine whether the target library file feature identifier is consistent with the information of the target library file, if not, determine that the result of the detection is that the information of the target library file does not belong to the reference sample; if not found, determine that the result of the detection is that the information of the target library file does not belong to the reference sample.

7. A system for detecting an operating environment, characterized in that: include: The operating environment detection device and server as described in claim 6, wherein: The server is used to store reference samples; The operating environment detection device is used to obtain the reference sample from the server.

8. An electronic device for detecting an operating environment, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images