Application data packet capture method, device and computing equipment

Abstract

The present invention discloses a method, device and computing device for capturing application data packets, the method comprising: obtaining a class loader of a target application, and obtaining a specified class through the class loader; when creating a client object of an okhttp network request component, using the specified class to implement an interceptor interface of the okhttp network request component, and loading the interceptor interface into the client object; and obtaining a data packet of a network request of the target application according to the client object loaded with the interceptor interface. It can be seen that the scheme of the present invention utilizes the interceptor characteristics of the okhttp network request component, and obtains the specified class that implements the interceptor through the class loader of the application, thereby being unaffected by traditional anti-capture strategies such as certificate binding, and effectively capturing the data packets of the application.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for capturing application data packets, and a computing device. Background Art

[0002] With the rapid development and popularization of mobile terminals such as mobile phones, the functions of mobile applications are becoming more and more abundant, and the network requests sent by mobile applications are becoming more and more frequent, and the resulting network security issues are becoming more and more serious. At the same time, network packet capture tools, as a network data monitoring program, can obtain the required information in a targeted manner, use this information to conduct network security analysis and network threat response, and play an important role in network security attack and defense.

[0003] In addition, the Android system is currently the most widely used smartphone operating system. Current Android applications mainly use HTTP and HTTPS protocols for data transmission. The HTTP protocol is a plain text protocol and can be captured directly using packet capture tools, while HTTPS is an encrypted protocol and it is not easy to capture data packets using packet capture tools under normal circumstances.

[0004] In the prior art, there are two main ways to capture data packets for Android applications: Method 1: By loading the self-signed certificate of Fiddler / Charles on the mobile phone and then setting the proxy to Fiddler / Charles, the HTTP / HTTPS data packets on the target Android device can be captured, from which the data packets of the Android application that you want to capture can be filtered out. Method 2: By using a local VPN packet capture application similar to Packet Capture to capture and analyze the target application, the content of the HTTP / HTTPS data packet can be obtained.

[0005] However, the inventors found in the process of implementing the embodiments of the present invention that the above existing data packet capture methods can only capture packets for target applications that do not use certificate binding, and once the target application uses certificate binding, the above methods lose their effect. Therefore, it is of great significance and practicality to study and develop a data packet capture tool based on the Android platform. Summary of the invention

[0006] In view of the above problems, embodiments of the present invention are proposed to provide a method, apparatus and computing device for capturing application data packets that overcome the above problems or at least partially solve the above problems.

[0007] According to one aspect of an embodiment of the present invention, a method for capturing an application data packet is provided, comprising:

[0008] Get the class loader of the target application, and get the specified class through the class loader;

[0009] When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component, the interceptor interface is loaded into the client object;

[0010] The data packet of the network request of the target application is obtained according to the client object loaded with the interceptor interface.

[0011] According to another aspect of an embodiment of the present invention, a packet capturing device for an application data packet is provided, comprising:

[0012] An acquisition module, adapted to acquire a class loader of a target application, and acquire a specified class through the class loader;

[0013] An interceptor implementation module, adapted to implement the interceptor interface of the okhttp network request component using the specified class when creating a client object of the okhttp network request component;

[0014] A loading module, adapted to load the interceptor interface into the client object;

[0015] The packet capture module is adapted to obtain the data packet of the network request of the target application according to the client object loaded with the interceptor interface.

[0016] According to another aspect of an embodiment of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0017] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the operation corresponding to the above-mentioned method for capturing the application data packet.

[0018] According to another aspect of an embodiment of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute operations corresponding to the above-mentioned method for capturing application data packets.

[0019] According to the packet capture method, device and computing device of the application data packet of the embodiment of the present invention, the specified class of the interceptor interface implementing the okhttp network communication component is obtained through the class loader of the target application, without being affected by the reinforcement of the target application, avoiding some reinforcement means that lead to the inability to obtain the specified class implementing the interceptor interface, and realizing the accurate acquisition of the specified class; and, when creating a client object, the interceptor interface implemented by the specified class is loaded into the client object, and when the client object is used to process the network request initiated by the target application, the data packet of the network request can be obtained, and due to the legal use of the interceptor characteristics of the okhttp network request component, the packet capture method is not restricted by traditional anti-packet capture strategies such as certificate binding, and then the data packets of all android applications using okhttp communication can be captured. It can be seen that the scheme of the present invention, compared with the packet capture method in the prior art, can expand the scope of application of packet capture and improve the effectiveness of packet capture.

[0020] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation method of the embodiment of the present invention is specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the embodiments of the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0022] Figure 1 A flow chart of a method for capturing application data packets provided by an embodiment of the present invention is shown;

[0023] Figure 2 A flow chart of a method for capturing application data packets provided by another embodiment of the present invention is shown;

[0024] Figure 3 A schematic diagram showing the structure of a packet capture device for application data packets provided by an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0026] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0027] Figure 1 The flowchart of the method for capturing application data packets provided by an embodiment of the present invention is shown. The solution is applied to Android applications to capture network communication data packets initiated by Android applications; and the method can be executed by any computing device with data processing capabilities. Figure 1 As shown, the method comprises the following steps:

[0028] Step S110: Obtain the class loader of the target application, and obtain the specified class through the class loader.

[0029] The specified class refers to the class required to implement the interceptor of the okhttp network communication component.

[0030] Specifically, the classloader of the target application is obtained. The class name and method name in the classloader will not change due to the hardening of the target application. Obtaining the specified class through the classloader is not subject to the restrictions of application hardening.

[0031] Step S120: When creating a client object of the okhttp network request component, use the specified class to implement the interceptor interface of the okhttp network request component, and load the interceptor interface into the client object.

[0032] Among them, the okhttp network request component is a framework for processing network requests in the Android system. It has the following advantages: allowing all requests to connect to the same host address to improve request efficiency; sharing Sockets to reduce the number of requests to the server; reducing request delays through connection pools; caching response data to reduce repeated network requests; reducing data traffic consumption; and automatically processing GZip compression.

[0033] Specifically, when the okhttpclient object (client object) that creates the okhttp network request component is detected, the interceptor interface is implemented using the specified class obtained by the classloader and loaded into the okhttpclient object. Among them, by implementing the interceptor interface and loading it when the OkHttpClient is constructed, the data packets of the network request of the target application are monitored, and this is applicable to both http and https. In addition, by using the interceptor feature of the okhttp network request component, data capture can be unaffected by traditional anti-capture strategies such as certificate binding.

[0034] Step S130: obtaining a data packet of a network request of a target application according to a client object loaded with the interceptor interface.

[0035] The interceptor interface is loaded in the okhttpclient object. When implementing network request processing, the data packets of the network request processed by the created okhttpclient object can be obtained for network security analysis and response.

[0036] According to the packet capture method of the application data packet provided by this embodiment, the specified class of the interceptor interface that implements the okhttp network communication component is obtained through the class loader of the target application, without being affected by the reinforcement of the target application, avoiding some reinforcement means that lead to the inability to obtain the specified class that implements the interceptor interface, and realizing the accurate acquisition of the specified class; and, when creating a client object, the interceptor interface implemented by the specified class is loaded into the client object, and when the client object is used to process the network request initiated by the target application, the data packet of the network request can be obtained. Due to the legal use of the interceptor characteristics of the okhttp network request component, the packet capture method is not restricted by traditional anti-packet capture strategies such as certificate binding, and then the data packets of all Android applications that use okhttp communication can be captured. It can be seen that the scheme of this embodiment can expand the scope of application of packet capture and improve the effectiveness of packet capture compared with the packet capture method in the prior art.

[0037] Figure 2 FIG. 2 is a flow chart showing a method for capturing application data packets provided by another embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0038] Step S210: Obtain the class loader of the target application, and obtain the specified class through the class loader.

[0039] Among them, the specified class is the class required to implement the interceptor of the okhttp network communication component. The specified class is an existing class and may vary depending on different requirements. The specific class name is not listed in this article.

[0040] And, in an embodiment of the present invention, the interceptor feature of the okhttp network request component is used to capture packets, and the okhttp network request component is suitable for Android applications, so the target application is an Android application that uses the okhttp network request component for network communication.

[0041] Specifically, by obtaining the class required to implement the interceptor through the classloader, the specified class can be avoided from being affected by application hardening and failing to accurately obtain the specified class. In addition, in this embodiment, the class loader of the target application is obtained through xpsoed (application modification service), wherein the Xposed Framework is an open source framework service running in Android high-privilege mode, which can affect program operation (modify the system) without modifying the APK file. Using xpsoed, the classloader can be easily obtained without being hindered by permissions.

[0042] Furthermore, the class loader can obtain the specified class through name matching and / or feature matching. The name matching process is as follows: the class loader matches the first name of the to-be-selected class with the second name of the specified class, and determines the to-be-selected class with the consistent name match as the specified class, where the to-be-selected class is each class in the class loader (the same below). Normally, the class name and method name in the classloader are not affected by application hardening, and the specified class can be quickly and accurately matched through name matching.

[0043] And, the feature matching process is as follows: the class loader matches the first feature of the selected class with the second feature of the specified class, and determines the selected class with consistent feature matching as the specified class; wherein the first feature and the second feature are both specific features that are not affected by the name. In practice, class names and method names may be confused, and matching through some specific features that are not affected by the name can avoid the problem of name confusion and improve the accuracy of obtaining the specified class. wherein, the specific features that are not affected by the name include but are not limited to the JAVA public package to which the interface implemented by the class belongs, the return value type of the class, and / or the type of the input parameter of the class.

[0044] When actually acquiring the specified class, either name matching or feature matching can be used for acquisition, or both methods can be used simultaneously. In actual implementation, those skilled in the art can make a choice based on the requirements for acquisition efficiency and / or acquisition accuracy. In some optional embodiments of the present invention, before acquiring the specified class, it can be determined whether the name of the specified class is an easily confused name. If so, it is acquired through feature matching, that is, the class loader matches the first feature of the selected class with the second feature of the specified class; if not, it is acquired through name matching, that is, the class loader matches the first name of the selected class with the second name of the specified class. In this way, both the efficiency and accuracy of acquiring the specified class can be taken into account.

[0045] Step S220: When creating a client object of the okhttp network request component, use the specified class to implement the interceptor interface of the okhttp network request component, and load the interceptor interface into the client object.

[0046] Specifically, when using okhttp to send a network request, you need to use an okhttpclient construction class to create a request. When the okhttpclient object is created, it indicates that a new network request needs to be processed. At this time, if the interceptor implementation is added, packet capture for the network request can be performed.

[0047] Furthermore, a hook function is set on the method of creating the client object through xposed (application modification service) to hook at the exact time of creating the okhttpclient object, which is conducive to timely adding the implementation of the interceptor; and xposed can be used to conveniently hook. Accordingly, when the client object is created, the interceptor interface is implemented using the hook function dynamic proxy, that is, when it is detected that the execution is to create the okhttpclient object, the interceptor interface is implemented using the dynamic proxy and loaded into the newly created okhttpclient object, wherein the dynamic proxy can ensure the efficient implementation of the interceptor interface.

[0048] Step S230: Acquire a data packet of a network request of a target application according to a client object loaded with the interceptor interface.

[0049] The data packet of the network request of the target application includes request data and response data of the network request.

[0050] Specifically, okhttp processes the network requests initiated by the application to the network end through a series of interceptors. When the interceptor implemented by the specified class is loaded into the okhttpclient object, the request data can be obtained before the request, and the response data can be obtained after the network response, thereby completing the packet capture of the network request.

[0051] Step S240: Compare the uniform resource locator included in the request data with the malicious locator in the malicious locator database, and filter out the malicious requests of the target application according to the comparison result.

[0052] After the network request is captured, the request URL (Uniform Resource Locator) contained therein is subjected to malicious detection. If the request URL is a malicious URL, the request URL is filtered out to avoid threats to network security and maintain network security.

[0053] It should be noted here that after obtaining the data packet of the network request, a series of security analyses can be performed on the data packet and corresponding threat response measures can be taken to ensure network security. The URL comparison and filtering indicated in the above step S240 is only an optional analysis and response method. In actual implementation, technical personnel in this field can flexibly set the analysis method and measures to be taken, for example, dynamically modify the data packet while capturing the packet to assist in network security analysis.

[0054] According to the packet capture method of the application data packet provided in this embodiment, the class loader of the target application is obtained through xpsoed, which is not restricted by high permissions; the class loader obtains the specified class through name matching and / or feature matching, which can improve the efficiency and / or accuracy of obtaining the specified class; and, a hook function is set on the method of creating the client object to hook at the exact time of creating the okhttpclient object, which is conducive to the timely addition of the interceptor implementation, and then the okhttpclient object loaded with the interceptor interface can be used to obtain the data packet of the network request of the target application, and network security analysis and threat response are performed based on the data packet. It can be seen that in this embodiment, the packet capture method legally utilizes the interceptor characteristics of the okhttp network request component, and will not be affected by traditional anti-capture strategies such as certificate binding, and obtains the specified class according to feature matching for the class that may be confused, thereby expanding the scope of application to all Android applications that use okhttp communication, and realizing the capture of data packets of Android applications that use okhttp for network communication.

[0055] Figure 3A schematic diagram of the structure of a device for capturing application data packets provided by an embodiment of the present invention is shown.

[0056] like Figure 3 As shown, the device comprises:

[0057] An acquisition module 310 is adapted to acquire a class loader of a target application and acquire a specified class through the class loader;

[0058] The interceptor implementation module 320 is adapted to implement the interceptor interface of the okhttp network request component by using the specified class when creating a client object of the okhttp network request component;

[0059] A loading module 330, adapted to load the interceptor interface into the client object;

[0060] The packet capture module 340 is adapted to obtain the data packet of the network request of the target application according to the client object loaded with the interceptor interface.

[0061] In an optional manner, the acquisition module is further adapted to: acquire a class loader of the target application through an application modification service.

[0062] In an optional manner, the acquisition module is further adapted to: the class loader matches the first name of the to-be-selected class with the second name of the designated class, and determines the to-be-selected class with the matching name as the designated class; and / or,

[0063] The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein both the first feature and the second feature are specific features not affected by the name.

[0064] In an optional manner, the device further comprises: a judgment module, adapted to judge whether the name of the specified class is a confusing name;

[0065] The acquisition module is further adapted to: if the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

[0066] In an optional manner, the specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

[0067] In an optional manner, the device further comprises: a setting module, adapted to set a hook function on the device for creating the client object by applying a modification service;

[0068] The interceptor implementation module is further adapted to: when creating the client object, implement the interceptor interface using a hook function dynamic proxy.

[0069] In an optional manner, the data packet of the network request of the target application includes request data and response data of the network request.

[0070] In an optional manner, the device further includes: a filtering module adapted to: compare the uniform resource locator included in the request data with the malicious locator in the malicious locator database, and filter out malicious requests of the target application according to the comparison result.

[0071] In an optional manner, the target application is an Android application that uses the okhttp network request component to perform network communication.

[0072] An embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the method for capturing application data packets in any of the above method embodiments.

[0073] The executable instructions may be specifically used to cause the processor to perform the following operations:

[0074] Get the class loader of the target application, and get the specified class through the class loader;

[0075] When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component, the interceptor interface is loaded into the client object;

[0076] The data packet of the network request of the target application is obtained according to the client object loaded with the interceptor interface.

[0077] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0078] Get the class loader of the target application through the application modification service.

[0079] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0080] The class loader matches the first name of the candidate class with the second name of the designated class, and determines the candidate class with the matching name as the designated class; and / or,

[0081] The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein both the first feature and the second feature are specific features not affected by the name.

[0082] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0083] Determine whether the name of the specified class is a confusing name;

[0084] If the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

[0085] In an optional manner, the specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

[0086] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0087] Setting a hook function on a method of creating the client object by applying a modification service;

[0088] When the client object is created, the interceptor interface is implemented using a hook function dynamic proxy.

[0089] In an optional manner, the data packet of the network request of the target application includes request data and response data of the network request.

[0090] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0091] The uniform resource locator included in the request data is compared with the malicious locator in the malicious locator database, and the malicious request of the target application is filtered out according to the comparison result.

[0092] In an optional manner, the target application is an Android application that uses the okhttp network request component to perform network communication.

[0093] Figure 4 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0094] like Figure 4 As shown, the computing device may include: a processor (processor) 402 , a communications interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

[0095] The processor 402, the communication interface 404, and the memory 406 communicate with each other via the communication bus 408. The communication interface 404 is used to communicate with other devices such as a client or other server network elements. The processor 402 is used to execute the program 410, which can specifically execute the relevant steps in the above-mentioned embodiment of the method for capturing application data packets of a computing device.

[0096] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0097] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0098] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0099] The program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0100] Get the class loader of the target application, and get the specified class through the class loader;

[0101] When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component, the interceptor interface is loaded into the client object;

[0102] The data packet of the network request of the target application is obtained according to the client object loaded with the interceptor interface.

[0103] In an optional manner, the program 410 enables the processor to perform the following operations:

[0104] Get the class loader of the target application through the application modification service.

[0105] In an optional manner, the program 410 enables the processor to perform the following operations:

[0106] The class loader matches the first name of the candidate class with the second name of the designated class, and determines the candidate class with the matching name as the designated class; and / or,

[0107] The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein both the first feature and the second feature are specific features not affected by the name.

[0108] In an optional manner, the program 410 enables the processor to perform the following operations:

[0109] Determine whether the name of the specified class is a confusing name;

[0110] If the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

[0111] In an optional manner, the specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

[0112] In an optional manner, the program 410 enables the processor to perform the following operations:

[0113] Setting a hook function on a method of creating the client object by applying a modification service;

[0114] When the client object is created, the interceptor interface is implemented using a hook function dynamic proxy.

[0115] In an optional manner, the program 410 enables the processor to perform the following operations:

[0116] The data packet of the network request of the target application includes request data and response data of the network request.

[0117] In an optional manner, the program 410 enables the processor to perform the following operations:

[0118] The uniform resource locator included in the request data is compared with the malicious locator in the malicious locator database, and the malicious request of the target application is filtered out according to the comparison result.

[0119] In an optional manner, the target application is an Android application that uses the okhttp network request component to perform network communication.

[0120] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the embodiment of the present invention described herein, and the description of the above specific language is to disclose the best mode of the embodiment of the present invention.

[0121] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0122] Similarly, it should be understood that in order to streamline the embodiments of the present invention and to aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present invention, the various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, the disclosed method should not be interpreted as reflecting the following intention: that the claimed embodiments of the present invention require more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, the inventive aspects lie in less than all the features of the single embodiment disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present invention.

[0123] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0124] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0125] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The embodiments of the present invention may also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing an embodiment of the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0126] It should be noted that the above embodiments illustrate rather than limit the present invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim listing a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

[0127] The present invention discloses: A1. A method for capturing application data packets, comprising:

[0128] Get the class loader of the target application, and get the specified class through the class loader;

[0129] When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component, the interceptor interface is loaded into the client object;

[0130] The data packet of the network request of the target application is obtained according to the client object loaded with the interceptor interface.

[0131] A2. The method according to A1, wherein obtaining the class loader of the target application further comprises: obtaining the class loader of the target application through an application modification service.

[0132] A3. The method according to A1 or A2, wherein obtaining the specified class through the class loader further comprises:

[0133] The class loader matches the first name of the candidate class with the second name of the designated class, and determines the candidate class with the matching name as the designated class; and / or,

[0134] The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein both the first feature and the second feature are specific features not affected by the name.

[0135] A4. The method according to A3, wherein, before obtaining the specified class through the class loader, the method further comprises: determining whether the name of the specified class is a confusing name;

[0136] The class loader matches the first feature of the selected class with the second feature of the specified class further comprising:

[0137] If the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

[0138] A5. The method according to A3 or A4, wherein the specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

[0139] A6. The method according to any one of A1-A5, wherein the method further comprises: setting a hook function on the method of creating the client object by applying a modification service;

[0140] When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component further includes:

[0141] When the client object is created, the interceptor interface is implemented using a hook function dynamic proxy.

[0142] A7. A method according to any one of A1-A6, wherein the data packet of the network request of the target application includes request data and response data of the network request.

[0143] A8. The method according to A7, wherein, after obtaining the data packet of the network request of the target application, the method further comprises:

[0144] The uniform resource locator included in the request data is compared with the malicious locator in the malicious locator database, and the malicious request of the target application is filtered out according to the comparison result.

[0145] A9. A method according to any one of A1-A8, wherein the target application is an Android application that uses the okhttp network request component for network communication.

[0146] The present invention also discloses: B10. A packet capture device for an application data packet, comprising:

[0147] An acquisition module, adapted to acquire a class loader of a target application, and acquire a specified class through the class loader;

[0148] An interceptor implementation module, adapted to implement the interceptor interface of the okhttp network request component using the specified class when creating a client object of the okhttp network request component;

[0149] A loading module, adapted to load the interceptor interface into the client object;

[0150] The packet capture module is adapted to obtain the data packet of the network request of the target application according to the client object loaded with the interceptor interface.

[0151] B11. The apparatus according to B10, wherein the acquisition module is further adapted to: acquire a class loader of a target application through an application modification service.

[0152] B12. The device according to B10 or B11, wherein the acquisition module is further adapted to: the class loader matches the first name of the to-be-selected class with the second name of the designated class, and determines the to-be-selected class with the consistent name match as the designated class; and / or,

[0153] The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein both the first feature and the second feature are specific features not affected by the name.

[0154] B13. The device according to B12, wherein the device further comprises: a judgment module adapted to judge whether the name of the specified class is a confusing name;

[0155] The acquisition module is further adapted to: if the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

[0156] B14. An apparatus according to B12 or B13, wherein the specific features not affected by the name include: a JAVA public package to which an interface implemented by the class belongs, a return value type of the class and / or a type of an input parameter of the class.

[0157] B15. The device according to any one of B10-B14, wherein the device further comprises: a setting module adapted to set a hook function on the device for creating the client object by applying a modification service;

[0158] The interceptor implementation module is further adapted to: when creating the client object, implement the interceptor interface using a hook function dynamic proxy.

[0159] B16. An apparatus according to any one of B10-B15, wherein the data packet of the network request of the target application includes request data and response data of the network request.

[0160] B17. The device according to B16, wherein the device further comprises: a filtering module adapted to: compare the uniform resource locator contained in the request data with the malicious locator in the malicious locator database, and filter out malicious requests of the target application according to the comparison result.

[0161] B18. An apparatus according to any one of B10-B17, wherein the target application is an Android application that uses an okhttp network request component for network communication.

[0162] The present invention also discloses: C19. A computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0163] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the method for capturing application data packets as described in any one of A1-A9.

[0164] The present invention also discloses: D20. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables the processor to execute operations corresponding to the method for capturing application data packets as described in any one of A1-A9.

Claims

1. A method for capturing an application data packet, comprising: Get the class loader of the target application, and obtain the specified class through the class loader. The specified class is the class required to implement the interceptor of the okhttp network communication component. The target application is an application that uses the okhttp network request component for network communication. When creating a client object of the okhttp network request component, the interceptor interface of the okhttp network request component is implemented using the specified class, and the interceptor interface is loaded into the client object, wherein the interceptor interface is implemented using a hook function dynamic proxy; The data packet of the network request of the target application is obtained according to the client object loaded with the interceptor interface.

2. The method according to claim 1, wherein: The obtaining the class loader of the target application further includes: obtaining the class loader of the target application through an application modification service.

3. The method according to claim 1, wherein: The obtaining of the specified class through the class loader further comprises: The class loader matches the first name of the candidate class with the second name of the designated class, and determines the candidate class with the matching name as the designated class; and / or, The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein the first feature and the second feature are both specific features not affected by the name.

4. The method according to claim 3, wherein: Before obtaining the specified class through the class loader, the method further includes: determining whether the name of the specified class is a confusing name; The class loader matches the first feature of the selected class with the second feature of the specified class further comprising: If the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

5. The method according to claim 3, wherein: The specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

6. The method according to any one of claims 1 to 5, wherein: The method further comprises: setting a hook function on a method for creating the client object by applying a modification service; When creating a client object of the okhttp network request component, using the specified class to implement the interceptor interface of the okhttp network request component further includes: When the client object is created, the interceptor interface is implemented using a hook function dynamic proxy.

7. The method according to any one of claims 1 to 5, wherein: The data packet of the network request of the target application includes request data and response data of the network request.

8. The method according to claim 7, wherein: After obtaining the data packet of the network request of the target application, the method further includes: The uniform resource locator included in the request data is compared with the malicious locator in the malicious locator database, and the malicious request of the target application is filtered out according to the comparison result.

9. The method according to claim 8, wherein: The target application is an Android application that uses the okhttp network request component for network communication.

10. A packet capture device for an application data packet, comprising: An acquisition module is adapted to acquire a class loader of a target application, and acquire a specified class through the class loader, wherein the specified class is a class required for implementing an interceptor of an okhttp network communication component, and the target application is an application that uses the okhttp network request component for network communication; The interceptor implementation module is suitable for implementing the interceptor interface of the okhttp network request component by using the specified class when creating the client object of the okhttp network request component, and the interceptor interface is implemented by using the hook function dynamic proxy; A loading module, adapted to load the interceptor interface into the client object; The packet capture module is adapted to obtain the data packet of the network request of the target application according to the client object loaded with the interceptor interface.

11. The device according to claim 10, wherein: The acquisition module is further adapted to: acquire the class loader of the target application through the application modification service.

12. The device according to claim 10, wherein: The acquisition module is further adapted to: the class loader matches the first name of the to-be-selected class with the second name of the designated class, and determines the to-be-selected class with the matching name as the designated class; and / or, The class loader matches the first feature of the to-be-selected class with the second feature of the designated class, and determines the to-be-selected class with consistent feature matching as the designated class; wherein the first feature and the second feature are both specific features not affected by the name.

13. The device according to claim 12, wherein: The device further comprises: a determination module adapted to determine whether the name of the specified class is a confusing name; The acquisition module is further adapted to: if the name of the designated class is a confusing name, the class loader matches the first feature of the to-be-selected class with the second feature of the designated class.

14. The device according to claim 13, wherein: The specific features not affected by the name include: the JAVA public package to which the interface implemented by the class belongs, the return value type of the class and / or the type of the input parameter of the class.

15. The device according to any one of claims 10 to 14, wherein: The device further comprises: a setting module adapted to set a hook function on the device for creating the client object by applying a modification service; The interceptor implementation module is further adapted to: when creating the client object, implement the interceptor interface using a hook function dynamic proxy.

16. The device according to any one of claims 10 to 14, wherein: The data packet of the network request of the target application includes request data and response data of the network request.

17. The device according to claim 16, wherein: The device further comprises: a filtering module adapted to compare the uniform resource locator contained in the request data with the malicious locator in the malicious locator database, and filter out the malicious request of the target application according to the comparison result.

18. The device according to claim 17, wherein: The target application is an Android application that uses the okhttp network request component for network communication.

19. A computing device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to the method for capturing an application data packet as described in any one of claims 1-9.

20. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute an operation corresponding to the method for capturing an application data packet according to any one of claims 1 to 9.

Images