Information processing method and device

Abstract

The present disclosure provides an information processing method and device. The method is applied to a terminal, and the method includes: detecting whether an application is started, and when the application is started, determining the startup source of the application, detecting the behavior information of the application, and displaying the startup source and behavior information of the application. In the embodiment of the present disclosure, the terminal has the function of displaying the startup source and behavior information of the application. The user can determine whether the application has malicious behavior during the current operation by viewing the information displayed by the terminal, and manage malicious applications in a timely manner to protect the security of user information in the terminal and protect the normal operation of the terminal.

Description

Technical Field

[0001] The present disclosure relates to the field of computer communication technology, and in particular to an information processing method and device. Background Art

[0002] With the development of terminal technology, more and more applications are installed in terminals for use, which enriches the functions of the terminals and satisfies the user experience.

[0003] At present, there are some malicious applications that can steal user data in the terminal, causing leakage of user data. Therefore, how to discover malicious applications and prevent malicious applications from stealing data is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides an information processing method and device.

[0005] According to a first aspect of an embodiment of the present disclosure, there is provided an information processing method, which is applied to a terminal, and the method includes:

[0006] Detect whether the application is started;

[0007] When the application is started, determining a startup source of the application and detecting behavior information of the application;

[0008] Displays the startup source and behavior information of the application.

[0009] Optionally, the detecting whether the application is started includes:

[0010] It is detected whether a component in the application is started, and if it is detected that a component is started, it is determined that the application is started.

[0011] Optionally, determining the startup source of the application includes any of the following:

[0012] Determine the startup source of the application program through the startup interface of the started component, the startup source includes: chain startup or user startup;

[0013] The startup source of the application is determined through the system mechanism of the terminal, and the startup source includes: self-starting.

[0014] Optionally, the behavior information of the detected application program includes:

[0015] The behavior of the application program in acquiring user information is obtained through a standard interface of the system, and the behavior of acquiring user information is recorded through instrumentation.

[0016] Optionally, the displaying of the startup source and behavior information of the application program includes:

[0017] On a predetermined display interface, the startup source and behavior information of the application are recorded in a timeline manner.

[0018] According to a second aspect of an embodiment of the present disclosure, there is provided an information processing device, applied to a terminal, the device comprising:

[0019] A first detection module is configured to detect whether the application is started;

[0020] A determination module, configured to determine a startup source of the application when the application is started;

[0021] A second detection module is configured to detect behavior information of the application program;

[0022] The display module is configured to display the startup source and behavior information of the application.

[0023] Optionally, the first detection module includes:

[0024] A detection submodule, configured to detect whether a component in the application is started;

[0025] The determination submodule is configured to determine that the application is started if it is detected that a component is started.

[0026] Optionally, the determining module includes any one of the following:

[0027] A first determining submodule is configured to determine a startup source of the application program through a startup interface of a started component, wherein the startup source includes: a chain startup or a user startup;

[0028] The second determining submodule is configured to determine a startup source of the application program through a system mechanism of the terminal, wherein the startup source includes: self-starting.

[0029] Optionally, the second detection module is configured to obtain the behavior of the application program obtaining user information through a standard interface of the system, and record the behavior of obtaining user information by means of instrumentation.

[0030] Optionally, the display module is configured to record the startup source and behavior information of the application in a timeline format on a predetermined display interface.

[0031] According to a third aspect of an embodiment of the present disclosure, there is provided a non-temporary computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0032] According to a fourth aspect of an embodiment of the present disclosure, a terminal is provided, including:

[0033] processor;

[0034] a memory for storing processor-executable instructions;

[0035] Wherein, the processor is configured to:

[0036] Detect whether the application is started;

[0037] When the application is started, determining a startup source of the application and detecting behavior information of the application;

[0038] Displays the startup source and behavior information of the application.

[0039] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0040] In the disclosed embodiment, the terminal detects whether the application is started, and when the application is started, determines the starting source of the application, detects the behavior information of the application, and displays the starting source and behavior information of the application. In the disclosed embodiment, the terminal has the function of displaying the starting source and behavior information of the application. The user can check the information displayed by the terminal to determine whether the application has malicious behavior during the current operation, and manage malicious applications in a timely manner to protect the security of user information in the terminal and protect the normal operation of the terminal.

[0041] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flow chart of an information processing method according to an exemplary embodiment;

[0043] Figure 2 is a schematic diagram of a display interface according to an exemplary embodiment;

[0044] Figure 3 is a schematic diagram of another display interface according to an exemplary embodiment;

[0045] Figure 4 yes Figure 3 A schematic diagram of a sub-interface of the display interface shown;

[0046] Figure 5 is a block diagram of an information processing device according to an exemplary embodiment;

[0047] Figure 6 The diagram is a schematic diagram of the structure of a terminal according to an exemplary embodiment. DETAILED DESCRIPTION

[0048] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0049] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0050] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0051] Figure 1 is a flow chart of an information processing method according to an exemplary embodiment. Figure 1 The method shown is applied to a terminal, and the method includes:

[0052] In step 101, it is detected whether the application is started.

[0053] The terminal has an application installed therein, and the terminal detects whether the application is started.

[0054] There are many applicable terminals, such as mobile phones, tablets, notebooks, wearable electronic devices, etc.

[0055] In one embodiment, the application is composed of components, and the terminal can detect whether a component in the application is started. If it is detected that a component is started, it is determined that the application is started.

[0056] For example, an Android application includes an Activity component, a Broadcast component, a Service component, and a ContentProvider component. When any of the above components is started, it is determined that the application is started.

[0057] In step 102, when the application is started, the starting source of the application is determined, and the behavior information of the application is detected.

[0058] In one embodiment, the startup sources are divided into chain startup, self-start and user startup, among which chain startup is a startup method based on calls from other applications; self-start is a startup method based on the system, for example, self-start based on system broadcast, self-start based on system timing, etc.; user startup is a startup method based on user operation, for example, startup from a desktop icon, startup from the notification bar on the desktop, startup from the recent taskbar on the desktop, etc.

[0059] The terminal can determine the launch source of the application in the following ways:

[0060] The first method: after determining that a component in the application is started, determine the start source of the application through the start interface of the started component, wherein the start source includes: chain start or user start.

[0061] For chain startup and user startup, the startup interface of the component controls the startup of the component, and then controls the startup of the application. For the startup interface of the component started in the application, the startup source of the application is determined to be chain startup or user startup based on the party initiating the startup and the party being started. For example, after the startup interface determines that the application is called by a desktop application, it determines that the startup source of the application is desktop startup. For another example, after the startup interface determines that the application is called by an application running in the background, it determines that the startup source of the application is chain startup.

[0062] Based on this, the terminal can obtain the startup source of the application from the startup interface of the component started in the application.

[0063] You can insert a stub at the startup interface of each component, and use the stub to record the startup source of the application for the terminal to obtain and use.

[0064] The second method: determine the startup source of the application through the terminal's system mechanism, and the startup sources include: automatic startup.

[0065] Applications can be activated by system mechanisms, and applications can be started after the system mechanism is executed. You can manage whether an application can be activated by this special system mechanism by setting the auto-start permission. There are many applicable system mechanisms, such as the SyncManager system mechanism, the JobScheduler system mechanism, etc.

[0066] After determining that the application is activated by the system mechanism, the terminal determines that the startup source of the application is self-starting. The behavior of the application being activated by the system mechanism can be recorded by instrumentation.

[0067] In one embodiment, the terminal may obtain the behavior of the application program obtaining the user information through a standard interface of the system, and record the behavior of obtaining the user information through instrumentation.

[0068] The behavior of an application obtaining user information is considered a dangerous behavior, which poses a risk of user information leakage. The terminal will record such behavior.

[0069] In one embodiment, the behavior information of the application includes at least one of the following: the calling object, the time when the behavior occurs, the number of times the behavior occurs, the behavior execution result, and the running state of the application when the behavior occurs. The behavior execution result includes: the application is allowed when running in the foreground or the application is prohibited when running in the background. The running state includes: foreground running state or background running state.

[0070] In step 103, the startup source and behavior information of the application are displayed.

[0071] After obtaining the startup source and behavior information of the application, the terminal displays the startup source and behavior information of the application so that the user can determine whether the application has malicious behavior during the current operation by viewing the information displayed by the terminal, and manage malicious applications in a timely manner, thereby protecting the security of user information in the terminal and protecting the normal operation of the terminal.

[0072] In one embodiment, the terminal may record the startup source and behavior information of the application program in a timeline manner on a predetermined display interface.

[0073] Through the content displayed on the display interface, the user can understand the application's startup source, behavior information, startup time, behavior occurrence time, and the order in which various behaviors occur.

[0074] If an application initiates an action to obtain user information while running in the background, the terminal can reject such action, thereby preventing the application running in the background from secretly obtaining user information and causing user information leakage.

[0075] In order to highlight the behavior information of the application when it is running in the background, the terminal can distinguish and display the behavior information of the application when it is running in the foreground and the behavior information when it is running in the background, so as to facilitate the user to view different types of information.

[0076] In one embodiment, at least one of the following items is provided on the predetermined display interface: a permission management entry, an end process entry, and an uninstall entry. The user adjusts the permissions of the application by using the permission management entry, ends the application by using the end process entry, and uninstalls the application from the terminal by using the uninstall entry.

[0077] For example, Figure 2 is a schematic diagram of a display interface of an application according to an exemplary embodiment. Figure 2 The display interface of the application shown in the figure displays the startup source and behavior information of the application in the form of a timeline. The startup source is startup from the desktop icon; the behavior information of each behavior includes: behavior content, behavior occurrence time, behavior occurrence count and behavior execution result, wherein the behavior occurrence count refers to the number of times the same behavior occurs in the same time, and the same time here refers to the same minute. When the behavior information does not include the behavior occurrence count, it indicates that the behavior has only occurred once in this minute; the behavior execution result includes: the behavior is allowed or the behavior is rejected.

[0078] For example, the behavior information of an action includes: reading the application list, and allowing 11 times at 19:12. From the above information, it can be seen that the application has read the application list 11 times in the minute 19:12.

[0079] For another example, the behavior information of an action includes: obtaining location information in the background, and permitted at 19:13. From the above information, it can be seen that at 19:13, the application requested to obtain location information in the background, and the action was permitted by the terminal.

[0080] The terminal displays the behavior information of the application program when it is running in the foreground and the behavior information of the application program when it is running in the background.

[0081] In the application, the user can set the permissions of the application, for example, setting the terminal to reject the behavior of the application to obtain user information when running in the background. In this case, the behavior information of the behavior of obtaining user information when running in the background may include: the content of the behavior being rejected.

[0082] At this time Figure 2 The behavior information in the message "Get location information in the background, allowed at 19:13" will become "Get location information in the background, rejected at 19:13".

[0083] Figure 2In the application display interface, there are permission management buttons, end process buttons and uninstall buttons. Users can manage the application accordingly by using the above buttons.

[0084] In one embodiment, the terminal may display the startup sources and behavior information of different application programs on a preset display interface, thereby realizing the aggregation and display of information of different application programs.

[0085] For example, on a preset display interface, the startup sources and behavior information of different application programs are recorded in a timeline manner.

[0086] The preset display interface is provided with a behavior screening entry, which includes at least one of the following: all behavior entry, self-start entry, chain start entry, permission use entry, and sensitive behavior entry. The terminal can determine the target behavior based on the usage information of the behavior screening entry, and record and display the behavior information of the target behavior occurring in the application.

[0087] For example, when the user selects the option for setting all behavior entry points, the terminal records the behavior information of various startup sources of the application, the behavior of setting permissions and sensitive behaviors. Sensitive behaviors can be understood as the behavior of obtaining user information; when the user selects the option for setting the chain startup entry point, the terminal only records the startup source of the application started by the chain; when the user sets the option for the sensitive behavior entry point, the terminal only records the behavior information of sensitive behaviors occurring in the application.

[0088] In this embodiment, the terminal provides a behavior screening portal, and the user can set the type of information recorded by the terminal by using the behavior screening portal, thereby enriching the functions of the terminal and improving the user experience.

[0089] For example, Figure 3 is a schematic diagram of another display interface according to an exemplary embodiment. Figure 3 On the display interface shown, the startup sources and behavior information of different application programs are displayed in a timeline manner.

[0090] For example, a startup source is: at 19:10, the application store is automatically started. At the same time, it is also recorded that the behavior of the application store automatically starting is allowed by the terminal. The behavior information of a behavior includes: the system desktop reads the application list and has been allowed at 19:10.

[0091] exist Figure 3 There are function keys on the right side of the display interface shown. When the function keys are triggered, the terminal pops up a sub-interface, such as Figure 4 As shown, there are five options on the sub-interface, and the user can select the corresponding option according to the recording requirements to control the terminal to record the required information.

[0092] Figure 3 In the display interface, "All Behaviors" is displayed. At this time, the terminal records the behavior information of all behaviors of the application, that is, the terminal records the behavior information of various startup sources, permission setting behaviors and sensitive behaviors of the application.

[0093] In the disclosed embodiment, the terminal detects whether the application is started, and when the application is started, determines the starting source of the application, detects the behavior information of the application, and displays the starting source and behavior information of the application. In the disclosed embodiment, the terminal has the function of displaying the starting source and behavior information of the application. The user can check the information displayed by the terminal to determine whether the application has malicious behavior during the current operation, and manage malicious applications in a timely manner to protect the security of user information in the terminal and protect the normal operation of the terminal.

[0094] For the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present disclosure is not limited by the described order of actions, because according to the present disclosure, certain steps can be performed in other orders or simultaneously.

[0095] Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0096] Corresponding to the aforementioned application function implementation method embodiment, the present disclosure also provides an application function implementation device and a corresponding terminal embodiment.

[0097] Figure 5 is a block diagram of an information processing device according to an exemplary embodiment, which is applied to a terminal. The device may include: a detection module 21, a determination module 22, a detection module 23 and a display module 24; wherein,

[0098] The first detection module 21 is configured to detect whether the application is started;

[0099] The determination module 22 is configured to determine a startup source of the application when the application is started;

[0100] The second detection module 23 is configured to detect behavior information of the application;

[0101] The display module 24 is configured to display the startup source and behavior information of the application.

[0102] In an optional embodiment, Figure 5Based on the information processing device shown in the figure, the first detection module 21 may include: a detection submodule and a determination submodule; wherein,

[0103] The detection submodule is configured to detect whether a component in the application program is started;

[0104] The determining submodule is configured to determine that the application is started if it is detected that a component is started.

[0105] In an optional embodiment, the determination module may include any one of the following: a first determination submodule and a second determination submodule; wherein:

[0106] The first determining submodule is configured to determine the startup source of the application through the startup interface of the started component, and the startup source includes: chain startup or user startup;

[0107] The second determining submodule is configured to determine a startup source of the application program through a system mechanism of the terminal, and the startup source includes: self-starting.

[0108] In an optional embodiment, Figure 5 Based on the information processing device shown, the second detection module 23 can be configured to obtain the behavior of the application program obtaining user information through a standard interface of the system, and record the behavior of obtaining user information by means of instrumentation.

[0109] In an optional embodiment, Figure 5 Based on the information processing device shown, the display module 24 can be configured to record the startup source and behavior information of the application in a timeline manner on a predetermined display interface.

[0110] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art may understand and implement it without creative work.

[0111] Accordingly, in one aspect, an embodiment of the present disclosure provides a terminal, including: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to:

[0112] Detect whether the application is started;

[0113] When the application is started, determining a startup source of the application and detecting behavior information of the application;

[0114] Displays the startup source and behavior information of the application.

[0115] Figure 6 1 is a schematic diagram of a structure of a terminal 1600 according to an exemplary embodiment. For example, the device 1600 may be a user device, which may specifically be a mobile phone, a computer, a digital broadcast terminal, a message transceiver device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, a wearable device such as a smart watch, a smart glasses, a smart bracelet, a smart running shoe, etc.

[0116] Reference Figure 6 , the device 1600 may include one or more of the following components: a processing component 1602 , a memory 1604 , a power component 1606 , a multimedia component 1608 , an audio component 1610 , an input / output (I / O) interface 1612 , a sensor component 1614 , and a communication component 1616 .

[0117] The processing component 1602 generally controls the overall operation of the device 1600, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 1602 may include one or more processors 1620 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 1602 may include one or more modules to facilitate the interaction between the processing component 1602 and other components. For example, the processing component 1602 may include a multimedia module to facilitate the interaction between the multimedia component 1608 and the processing component 1602.

[0118] The memory 1604 is configured to store various types of data to support operations on the device 1600. Examples of such data include instructions for any application or method operating on the device 1600, contact data, phone book data, messages, pictures, videos, etc. The memory 1604 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0119] The power supply component 1606 provides power to the various components of the device 1600. The power supply component 1606 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device 1600.

[0120] The multimedia component 1608 includes a screen that provides an output interface between the above-mentioned device 1600 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The above-mentioned touch sensor can not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the above-mentioned touch or slide operation. In some embodiments, the multimedia component 1608 includes a front camera and / or a rear camera. When the device 1600 is in an operating mode, such as an adjustment mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0121] The audio component 1610 is configured to output and / or input audio signals. For example, the audio component 1610 includes a microphone (MIC), and when the device 1600 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 1604 or sent via the communication component 1616. In some embodiments, the audio component 1610 also includes a speaker for outputting audio signals.

[0122] I / O interface 1612 provides an interface between processing component 1602 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0123] The sensor assembly 1614 includes one or more sensors for providing various aspects of the status assessment of the device 1600. For example, the sensor assembly 1614 can detect the open / closed state of the device 1600, the relative positioning of components, such as the display and keypad of the device 1600, the sensor assembly 1614 can also detect the position change of the device 1600 or a component of the device 1600, the presence or absence of user contact with the device 1600, the orientation or acceleration / deceleration of the device 1600, and the temperature change of the device 1600. The sensor assembly 1614 can include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 1614 can also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1614 can also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0124] The communication component 1616 is configured to facilitate wired or wireless communication between the device 1600 and other devices. The device 1600 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 1616 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the above-mentioned communication component 1616 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0125] In an exemplary embodiment, the device 1600 can be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above methods.

[0126] In an exemplary embodiment, a non-temporary computer-readable storage medium is also provided, such as a memory 1604 including instructions. When the instructions in the storage medium are executed by the processor 1620 of the device 1600, the device 1600 is enabled to execute an information processing method, the method comprising: detecting whether an application is started; when the application is started, determining the startup source of the application and detecting the behavior information of the application; and displaying the startup source and behavior information of the application.

[0127] The non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0128] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0129] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An information processing method, characterized in that: Applied to a terminal, the method comprises: Detect whether the application is started; When the application is started, determining the starting source of the application, and detecting the behavior information of the application in acquiring the user information; Display the startup source and behavior information of the application; Wherein, determining the startup source of the application includes any of the following: Determining the startup source of the application through the startup interface of the component started in the application, the startup source includes: chain startup or user startup; The startup source of the application is determined through the terminal's system mechanism, and the startup sources include: automatic startup.

2. The method according to claim 1, characterized in that The step of detecting whether the application is started includes: It is detected whether a component in the application is started, and if it is detected that a component is started, it is determined that the application is started.

3. The method according to claim 1, characterized in that The behavior information of the detected application includes: The behavior of the application program in acquiring user information is obtained through a standard interface of the system, and the behavior of acquiring user information is recorded through instrumentation.

4. The method according to claim 1, characterized in that: The display of the startup source and behavior information of the application program includes: On a predetermined display interface, the startup source and behavior information of the application are recorded in a timeline manner.

5. An information processing device, characterized in that: Applied to a terminal, the device comprises: A first detection module is configured to detect whether the application is started; A determination module, configured to determine a startup source of the application when the application is started; A second detection module is configured to detect behavior information of the application program acquiring user information; A display module, configured to display the startup source and behavior information of the application; Wherein, the determination module includes any one of the following: A first determining submodule is configured to determine a startup source of the application through a startup interface of a component started in the application, wherein the startup source includes: chain startup or user startup; The second determining submodule is configured to determine a startup source of the application program through a system mechanism of the terminal, wherein the startup source includes: self-starting.

6. The device according to claim 5, characterized in that The first detection module includes: A detection submodule, configured to detect whether a component in the application is started; The determination submodule is configured to determine that the application is started if it is detected that a component is started.

7. The device according to claim 5, characterized in that: The second detection module is configured to obtain the behavior of the application program obtaining user information through a standard interface of the system, and record the behavior of obtaining user information through instrumentation.

8. The device according to claim 5, characterized in that: The display module is configured to record the startup source and behavior information of the application program in a timeline manner on a predetermined display interface.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented.

10. A terminal, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to: Detect whether the application is started; When the application is started, determining the starting source of the application, and detecting the behavior information of the application in acquiring the user information; Display the startup source and behavior information of the application; Wherein, determining the startup source of the application includes any of the following: Determining the startup source of the application through the startup interface of the component started in the application, the startup source includes: chain startup or user startup; The startup source of the application is determined through the terminal's system mechanism, and the startup sources include: automatic startup.

Images