A detection method for facial recognition services in mobile applications

Abstract

The present invention relates to the field of information security technology, and specifically to a detection method for a mobile application face recognition service. The method comprises the following steps: unpacking an app file to obtain files and classifying them; traversing a collection of dex files to obtain class names and function names; traversing all class names and comparing them with face recognition SDK data in preset data; judging the file names of all dynamic library files and comparing them with face recognition SDK data in preset data; installing and running the app file; traversing all pages in the application; judging whether there are face recognition related keywords in the page; judging whether there is a camera calling behavior in the page; and deduplicating the data to confirm whether the application has face recognition related services. Compared with the prior art, the present invention compares the face recognition database by unpacking and extracting files from a target App, traversing each page and associating them with face recognition scene keywords, and effectively obtaining relevant information related to face recognition in the App.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a detection method for a mobile application face recognition service. Background Art

[0002] In recent years, with the rapid development of face recognition technology, "face scanning" has gradually become the main application area of ​​biometric technology in the new era. Especially after entering 2017, face recognition has ushered in a blowout. Faced with laws and regulations and certain business needs, Internet companies have launched account real-name authentication and implemented face authentication in related apps.

[0003] However, while face recognition technology is developing rapidly and penetrating into society, it has also brought us many security challenges. Information security risks caused by personal privacy data leakage and technology abuse need to be addressed urgently. The lack of network and data security mechanisms can easily lead to face data leakage. The current security technical standards and usage specifications for face recognition technology are not perfect. There are no relevant regulations on the responsibilities and obligations of face data controllers, the rights of face data subjects, and the security measures that should be adopted in the collection, storage, and processing of face data. Most apps do not clearly inform and obtain user consent when collecting face data, and do not even explain the purpose, scope, and method of using face recognition technology in the privacy policy, making passive collection and use of face data a normal practice. Some social entertainment apps and online education apps do not collect and use face data in accordance with relevant laws and regulations, resulting in frequent abuse of face recognition technology. However, face recognition services in many apps require users to register and use them, and they will only be triggered when related services are involved, such as remote account opening, card binding and verification, account login, face attendance, face payment, etc.

[0004] Therefore, it is necessary to design a detection method for mobile application face recognition services, which can directly detect whether the mobile application has face recognition services, thereby avoiding users being unaware of the purpose, scope and method of face recognition performed by some apps, and reducing the risks brought by face recognition. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a detection method for mobile application face recognition services, thereby preventing users from being unaware of the purpose, scope and method of face recognition by some apps and reducing the risks brought by face recognition.

[0006] In order to achieve the above object, the present invention provides a detection method for a mobile application face recognition service, comprising the following steps:

[0007] S1: Unpack the app files, and the files obtained by unpacking are recorded as set A;

[0008] S2: Classify the data in set A, record the dex files as set B, and record the dynamic library files as set C;

[0009] S3: Traverse the dex files in set B, and record the obtained class names and function names as set D;

[0010] S4: traverse all class names in set D and compare them with the face recognition SDK data in the preset data. If they are the same, add the face recognition SDK data to set E;

[0011] S5: traverse the set C, determine the file names of all dynamic library files and compare them with the face recognition SDK data in the preset data. If they are the same, add the face recognition SDK data to the set E;

[0012] S6: Install and run the app file, traverse all pages in the application, and store the page data in set F;

[0013] S7: traverse the set F to determine whether there are face recognition related keywords in the page. If so, add the page data in S6 to the set E;

[0014] S8: traverse the set F to determine whether there is a camera call behavior in the page. If so, add the page data in S6 to the set E;

[0015] S9: Filter the set E, and the deduplicated data can confirm whether the application has face recognition related business.

[0016] The face recognition SDK data is a third-party face recognition library.

[0017] Face recognition related keywords are associated with face recognition business scenarios.

[0018] The dynamic library file is a list of so files.

[0019] Compared with the prior art, the present invention can effectively obtain relevant information related to face recognition in the App by unpacking and extracting files from the target App to compare with the face recognition database, and by running the App package to traverse each page and associate them with face recognition scene keywords, and then determine whether the App has a face recognition calling mechanism and information, so that the regulatory industry can investigate whether the App collects face information, effectively reducing the risks brought by face recognition and protecting the rights and interests of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a schematic diagram of the detection method of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The present invention will now be further described with reference to the accompanying drawings.

[0023] See also Figure 1 The present invention provides a detection method for a mobile application face recognition service, comprising the following steps:

[0024] S1: Unpack the app files, and the files obtained by unpacking are recorded as set A;

[0025] S2: Classify the data in set A, record the dex files as set B, and record the dynamic library files as set C;

[0026] S3: Traverse the dex files in set B, and record the obtained class names and function names as set D;

[0027] S4: traverse all class names in set D and compare them with the face recognition SDK data in the preset data. If they are the same, add the face recognition SDK data to set E;

[0028] S5: traverse the set C, determine the file names of all dynamic library files and compare them with the face recognition SDK data in the preset data. If they are the same, add the face recognition SDK data to the set E;

[0029] S6: Install and run the app file, traverse all pages in the application, and store the page data in set F;

[0030] S7: traverse the set F to determine whether there are face recognition related keywords in the page. If so, add the page data in S6 to the set E;

[0031] S8: traverse the set F to determine whether there is a camera call behavior in the page. If so, add the page data in S6 to the set E;

[0032] S9: Filter the set E, and the deduplicated data can confirm whether the application has face recognition related business.

[0033] The face recognition SDK data is a third-party face recognition library.

[0034] Face recognition related keywords are associated with face recognition business scenarios.

[0035] The dynamic library file is a list of so files.

[0036] Working principle:

[0037] In the actual operation process of the present invention, the App is first parsed to obtain a list of Dex files and so files, and the function name and class name are obtained from the Dex file and compared with the third-party face recognition library. At the same time, the so file list is compared with the third-party face recognition library. If it exists, the corresponding face recognition business SDK is recorded, and then the App is installed and run to determine whether the page calls the camera and whether there is keyword information related to the face recognition application scenario in the page data. If so, the existence of the face recognition business is recorded, and the collected operation results are filtered and deduplicated to determine whether the target App has a face recognition business function.

[0038] The present invention directly starts from the mobile application installation package and determines whether the application has face recognition services by traversing the codes and page keywords in the application, thereby solving the problem of manual login for different apps and manual traversal of all services in the app. It can identify whether an app has face recognition technology with higher accuracy by identifying third-party face recognition technology and traversing all App pages, allowing the regulatory industry to investigate whether the app collects face information, greatly reducing the risk of customer information leakage.

[0039] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A detection method for mobile application face recognition service, characterized in that: The following steps are involved: S1: Unpack the app files, and the files obtained by unpacking are recorded as set A; S2: Classify the data in the set A, record the dex files as set B, and record the dynamic library files as set C; S3: traverse the dex files in the set B, and obtain the class names and function names as a set D; S4: traverse all class names in the set D and compare them with the face recognition SDK data in the preset data. If they are the same, add the face recognition SDK data to the set E; S5: traverse the set C, determine the file names of all dynamic library files and compare them with the face recognition SDK data in the preset data, and if they are the same, add the face recognition SDK data to the set E; S6: Install and run the app file, traverse all pages in the application, and store the page data in set F; S7: traverse the set F to determine whether there are face recognition related keywords in the page, and if so, add the page data to the set E; S8: traverse the set F to determine whether there is a camera calling behavior in the page, and if so, add the page data to the set E; S9: Filter the set E, and remove the duplicated data to confirm whether the application has face recognition related services.

2. A detection method for mobile application face recognition service according to claim 1, characterized in that: The face recognition SDK data is a third-party face recognition library.

3. The method for detecting a mobile application face recognition service according to claim 1, characterized in that: The face recognition related keywords are associated with face recognition business scenarios.

4. The method for detecting a mobile application face recognition service according to claim 1, characterized in that: The dynamic library file is a list of so files.

Images