Risk Assessment Method, Device, Equipment and Medium for Software Development Kit

Abstract

The present disclosure provides a risk assessment method, apparatus, device and medium for a software development kit, which can be applied to the field of information security technology and also to the field of artificial intelligence technology. The risk assessment method for the software development kit includes: scanning the code file of the static interface call of the software development kit to determine the first risk function information; by executing a test program, determining the second risk function information from the dynamic interface call log of the software development kit, wherein the test program is a test program generated using a code template and capable of implementing the functions of the software development kit; extracting the first feature information of the first risk function information and the second feature information of the second risk function; and inputting the first feature information and the second feature information into a risk assessment model to output risk assessment result information.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and particularly to a risk assessment method, apparatus, device, medium and program product for a software development kit. Background Art

[0002] Currently, since functional components such as face recognition and document recognition in application software mainly rely on third-party service providers, a large amount of user data collection, storage, transmission, and use processes are in an uncontrolled state, and there is a risk of user information leakage.

[0003] Since the software development kits of third-party service providers generally adopt security measures such as obfuscation and strengthening, the developers of application software are unable to understand the internal logic, information collection categories, and security mechanisms of the software development kits provided by third-party service providers, making it difficult to implement risk assessment and supervision of the software development kits integrated into applications. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a risk assessment method, apparatus, device, medium and program product for a software development kit.

[0005] According to a first aspect of the present disclosure, there is provided a risk assessment method for a software development kit, including:

[0006] Scanning the code files of static interface calls of the software development kit to determine the first risk function information;

[0007] By executing a test program, determining second risk function information from the dynamic interface call logs of the software development kit, where the test program is a test program generated using a code template and capable of implementing the functions of the software development kit;

[0008] Extracting the first feature information of the first risk function information and the second feature information of the second risk function; and

[0009] Inputting the first feature information and the second feature information into a risk assessment model to output risk assessment result information.

[0010] According to an embodiment of the present disclosure, the first feature information and the second feature information both include at least one of the following:

[0011] Risk function signature information, risk function sequence information, risk function parameter information.

[0012] According to an embodiment of the present disclosure, the above method further includes: determining the call relationship between the static interfaces of multiple software development kits by analyzing the code files;

[0013] In the case where the first static interface calls the second static interface, for the method information of the first static interface, a test program is generated using a code template.

[0014] According to an embodiment of the present disclosure, the above method further includes: when the risk assessment result information exceeds a preset threshold, storing the risk assessment result information and the version information of the software development kit in a software development kit information database.

[0015] According to an embodiment of the present disclosure, the above method further includes: in response to a risk assessment request for a target software development kit, querying the risk assessment result information of the target software development kit from the software development kit information database according to the version information of the target software development kit.

[0016] According to an embodiment of the present disclosure, the above method further includes:

[0017] Obtain a risk function sample data set, where the risk function sample data set includes multiple risk function sample data, and each piece of risk function sample data includes risk function signature data, risk function sequence data, and risk function parameter data;

[0018] Extract a feature data set of the risk function from the risk function sample data set;

[0019] Train a preset model using the feature data set to obtain a risk assessment model.

[0020] A second aspect of the present disclosure provides a risk assessment device for a software tool kit, including: a first determination module, a second determination module, a first extraction module, and an evaluation module. Among them, the first determination module is used to scan the code file of the static interface call of the software development kit to determine the first risk function information. The second determination module is used to determine the second risk function information from the dynamic interface call log of the software development kit by executing a test program, where the test program is a test program generated using a code template that can implement the functions of the software development kit. The first extraction module is used to extract the first feature information of the first risk function information and the second feature information of the second risk function. The evaluation module is used to input the first feature information and the second feature information into the risk assessment model and output the risk assessment result information.

[0021] According to an embodiment of the present disclosure, the above device further includes a third determination module and a generation module. Among them, the third determination module is used to determine the call relationship between the static interfaces of multiple software development kits by analyzing the code file. The generation module is used to, in the case where the first static interface calls the second static interface, generate a test program for the method information of the first static interface using a code template.

[0022] According to an embodiment of the present disclosure, the above-mentioned device further includes a storage module, configured to store the risk assessment result information and the version information of the software development kit in the software development kit information database when the risk assessment result information exceeds a preset threshold.

[0023] According to an embodiment of the present disclosure, the above-mentioned device further includes a query module, configured to respond to a risk assessment request for a target software development kit, and query the risk assessment result information of the target software development kit from the software development kit information database according to the version information of the target software development kit.

[0024] According to an embodiment of the present disclosure, the above-mentioned device further includes an acquisition module, a second extraction module, and a training module. Among them, the acquisition module is configured to acquire a risk function sample data set. The second extraction module is configured to extract a feature data set of the risk function from the risk function sample data set. The training module is configured to train a preset model using the feature data set to obtain a risk assessment model.

[0025] A third aspect of the present disclosure provides an electronic device, including: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned risk assessment method for the software development kit.

[0026] A fourth aspect of the present disclosure further provides a computer-readable storage medium, on which executable instructions are stored, and when the instructions are executed by a processor, the processor executes the above-mentioned risk assessment method for the software development kit.

[0027] A fifth aspect of the present disclosure further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the above-mentioned risk assessment method for the software development kit is implemented.

[0028] According to an embodiment of the present disclosure, the first risk function information and the second risk function information are determined by scanning the code file of the static interface call of the software development kit and executing the test program respectively, and the first feature information and the second feature information of the first risk function information and the second risk function information are extracted, and the first feature information and the second feature information are input into the risk assessment model to output the risk assessment result information. By static analysis and dynamic analysis, the first risk function information and the second risk function information are determined respectively, and then the risk assessment model is used for risk assessment, so as to achieve the technical effect of risk assessment of the software development kit. Description of the Drawings

[0029] Through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, the above content of the present disclosure as well as other objects, features and advantages will become clearer. In the drawings:

[0030] Figure 1 Schematically shows an exemplary framework diagram of an application system for a risk assessment method, device, equipment, medium and program product of a software development kit;

[0031] Figure 2 Schematically shows a flowchart of a risk assessment method for a software development kit according to an embodiment of the present disclosure;

[0032] Figure 3 Schematically shows a flowchart of a method for generating a test program according to an embodiment of the present disclosure;

[0033] Figure 4 Schematically shows a logic block diagram of a risk assessment method for a software development kit according to an embodiment of the present disclosure;

[0034] Figure 5 Schematically shows a structural block diagram of a risk assessment device for a software development kit according to an embodiment of the present disclosure; and

[0035] Figure 6 Schematically shows a block diagram of an electronic device suitable for implementing a risk assessment method for a software development kit according to an embodiment of the present disclosure. Detailed implementation manners

[0036] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, for the sake of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, obviously, one or more embodiments can also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

[0037] The terms used herein are merely for describing specific embodiments and are not intended to limit the present disclosure. The terms "including", "comprising" and the like used herein indicate the presence of the described features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0038] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0039] In the case of using expressions such as "at least one of A, B, and C", generally, it should be interpreted according to the meaning that those skilled in the art usually understand this expression (for example, "a system having at least one of A, B, and C" should include, but not be limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0040] It should be noted that the risk assessment method and device of the software development kit of the present disclosure can be used in the fields of artificial intelligence technology and information security technology, and can also be used in any field other than the field of artificial intelligence technology. The application fields of the risk assessment method and device of the software development kit are not limited.

[0041] Embodiments of the present disclosure provide a risk assessment method for a software development kit, including: scanning a code file of a static interface call of the software development kit to determine first risk function information; by executing a test program, determining second risk function information from the dynamic interface call log of the software development kit, where the test program is a test program generated using a code template and capable of implementing the functions of the software development kit; extracting first feature information of the first risk function information and second feature information of the second risk function; and inputting the first feature information and the second feature information into a risk assessment model to output risk assessment result information.

[0042] Figure 1 An exemplary framework diagram of an application system of the risk assessment method for a software development kit according to an embodiment of the present disclosure is schematically shown.

[0043] As Figure 1 shown, the exemplary framework diagram 100 of the application system of the risk assessment method for the software development kit according to this embodiment may include a static analysis subsystem 101, a dynamic analysis subsystem 102, a management subsystem 103, a software development kit management module 104, a mobile device pool 105, and a software development kit information database 106. The risk assessment method for the software development kit of the embodiments of the present disclosure is executed by the static analysis subsystem 101, the dynamic analysis subsystem 102, and the system management module 103.

[0044] The software development kit management module 104 sends the software development kit to be evaluated to the system management subsystem 103, and the management subsystem 103 controls the static analysis subsystem 101 and the dynamic analysis subsystem 102 to respectively perform static analysis operations and dynamic analysis operations on the software development kit to be evaluated.

[0045] The static analysis subsystem 101 includes a version matching module 101-1, a code analysis engine 101-2, and a first information sending module 101-3. The static analysis operation includes that the version matching module 101-1 queries the risk assessment result information of the target software development kit from the software development kit information database according to the version information of the software development kit to be evaluated; it also includes using the code analysis engine 101-2 to scan the code files of the static interface calls of the software development kit, determine the first risk function information, and send the first risk function information to the management subsystem 103 through the first information sending module 101-3.

[0046] The dynamic analysis subsystem 102 includes an interface minimization module 102-1, a test program generation module 102-2, a risk function monitoring module 102-3, a test module 102-4, a log processing module 102-5, and a second information sending module 102-6. The dynamic analysis operation includes that the dynamic analysis subsystem 102 selects a mobile device for executing the test program from the mobile device pool 105 and executes the test program. The test program is generated by using the test program generation module 102-2 after the interface minimization module 102-1 determines the method information for generating the test program. The test module 102-4 automatically executes the test program, and the risk function monitoring module 102-3 and the log processing module 102-5 determine the second risk function information from the dynamic interface call log of the software development kit, and send the second risk function information to the management subsystem 103.

[0047] The management subsystem 103 includes a static analysis control module 103-1, a dynamic analysis control module 103-2, a risk assessment module 103-3, a report integration module 103-4, and a storage module 103-5. The static analysis control module 103-1 is used to control the static analysis subsystem 101 to perform static analysis operations. The dynamic analysis module 103-2 is used to control the dynamic analysis subsystem 102 to perform dynamic analysis operations. The risk assessment module 103-3 extracts the first characteristic information of the first risk function information and the second characteristic information of the second risk function information, and inputs the first characteristic information and the second characteristic information into the risk assessment model to output the risk assessment result information, and outputs the risk assessment report through the report integration module 103-4. The storage module 103-5 is used to store the risk assessment result information and the version information of the software development kit to be evaluated in the software development kit information database 106, so that when performing a risk assessment on the software development kit subsequently, it can first query whether the software development kit to be evaluated has been evaluated according to the version information of the software development kit. If so, the risk assessment result can be directly retrieved from the software development kit information database 106 to avoid repeated assessment.

[0048] It should be understood that Figure 1 the number of subsystems and modules in [[ ]] is merely illustrative. According to the implementation requirements, there can be any number of subsystems and modules.

[0049] The following will be based on Figure 1 the scenario described Figures 2 to 6 to describe in detail the risk assessment method for the software development kit of the disclosed embodiments.

[0050] Figure 2 FIG. schematically shows a flowchart of the risk assessment method for the software development kit according to the embodiments of the present disclosure.

[0051] As Figure 2 shown, the risk assessment method for the software development kit of this embodiment includes operations S210 to S240.

[0052] In operation S210, scan the code file of the static interface call of the software development kit to determine the first risk function information.

[0053] According to the embodiments of the present disclosure, a code analysis engine can be used to scan the code file of the static interface call of the software development kit. For example, by scanning the source code file or decompiled file of the software development kit, the first risk function information of the static interface call of the software development kit can be determined. Invoking the first risk function information can include obtaining device information, tampering with system configurations, etc.

[0054] In operation S220, determine the second risk function information from the dynamic interface call log of the software development kit by executing a test program, where the test program is a test program generated using a code template and capable of implementing the functions of the software development kit.

[0055] According to the embodiments of the present disclosure, the software development kit usually exists in the jar data format or aar data format, and this data format cannot be directly executed for testing on a mobile device. A code template can be used to convert it into a test program that can include the functions of the software development kit and can be executed on a mobile device.

[0056] According to the embodiments of the present disclosure, two strategies of randomization or depth traversal can be selected to automatically execute the test program. For example: when selecting the randomization strategy to automatically execute the test program, the Monkey test tool can be used to generate random input events to trigger different user behaviors and execute the test program. It is also possible to trigger the execution of the test program by traversing the interactive controls in the Activity and clicking layer by layer.

[0057] According to an embodiment of the present disclosure, second risk function information is determined from the dynamic interface call logs of a software development kit. For example, a Frida script can be used to hook risk functions, and a Python script can be used to receive call logs to determine whether second risk function information exists in the logs. The operating system can also be customized by modifying and recompiling the underlying function code, and finally, the result of the log function processing can be obtained. The second risk function information can include database manipulation functions, process communication functions, and so on.

[0058] In operation S230, the first feature information of the first risk function information and the second feature information of the second risk function are extracted.

[0059] According to an embodiment of the present disclosure, a feature engineering of samples can be established for information such as package names, class names, and method names in the first risk function information and the second risk function information, and a dimensionality reduction algorithm can be used for feature screening to extract the first feature information and the second feature information.

[0060] In operation S240, the first feature information and the second feature information are input into a risk assessment model, and risk assessment result information is output.

[0061] According to an embodiment of the present disclosure, a risk assessment model can be established using Xgboost and logistic regression algorithms. The risk assessment result information can include risk probability information, risk score information, and so on.

[0062] According to an embodiment of the present disclosure, the first risk function information and the second risk function information are determined by scanning the code files of the static interface calls of the software development kit and executing test programs respectively, and the first feature information and the second feature information of the first risk function information and the second risk function information are extracted. The first feature information and the second feature information are input into a risk assessment model, and risk assessment result information is output. By determining the first risk function information and the second risk function information through static analysis and dynamic analysis respectively, and then using the risk assessment model for risk assessment, the technical effect of risk assessment of the software development kit is achieved.

[0063] Figure 3 A method flowchart for generating a test program according to an embodiment of the present disclosure is schematically shown.

[0064] As Figure 3 shown, this embodiment includes operations S310 to S320.

[0065] In operation S310, the code files are analyzed to determine the call relationships between the static interfaces of multiple software development kits.

[0066] According to an embodiment of the present disclosure, the call relationships between the static interfaces of multiple software development toolkits, for example: the method information of static interface B is called by static interface A, and the method information of static interface A is called by static interface C.

[0067] In operation S320, when the first static interface calls the second static interface, for the method information of the first static interface, a test program is generated using a code template.

[0068] According to an embodiment of the present disclosure, taking the example that the method information of static interface B is called by static interface A and the method information of static interface A is called by static interface C, a test program can be generated using a code template for the method information of static interface C.

[0069] According to an embodiment of the present disclosure, by analyzing the call relationships between static interfaces, a test program is generated using a code template for the method information of the called source static interface. This can effectively reduce the workload of generating test programs.

[0070] According to an embodiment of the present disclosure, the above method further includes:

[0071] When the risk assessment result information exceeds a preset threshold, the risk assessment result information and the version information of the software development toolkit are stored in the software development toolkit information database.

[0072] According to an embodiment of the present disclosure, for example, taking the risk assessment result information as the risk assessment score, the risk assessment score includes the scores of several risk items and is the final score calculated according to the weight of each risk item. Assuming the preset threshold is 60 points, the version information of the software development toolkit to be evaluated is VIM1.0, and its risk assessment score is 61, then the VIM1.0 of the software development toolkit to be evaluated and its risk assessment score 61 can be stored in the software development toolkit information database.

[0073] According to an embodiment of the present disclosure, by storing the version information and risk assessment result information of the evaluated software development toolkit in the software development toolkit information database, when performing the next risk assessment, it is possible to first query whether the software development toolkit to be evaluated has been evaluated according to its version information, avoiding repeated evaluation.

[0074] According to an embodiment of the present disclosure, the above method further includes: in response to a risk assessment request for a target software development toolkit, according to the version information of the target software development toolkit, query the risk assessment result information of the target software development toolkit from the software development toolkit information database.

[0075] According to an embodiment of the present disclosure, for example, the version information of the target software development kit is VIM1.0. The risk assessment result information of the target software development kit can be queried in the software development kit information database based on the version information of the target software development kit, and the risk assessment score is 61 points.

[0076] According to an embodiment of the present disclosure, for example, the version information of the target software development kit is VIM1.1. The risk assessment result information of the old version VIM1.1 of the target software development kit can be queried in the software development kit information database based on the version information of the target software development kit, and the risk assessment score is 61 points. Risk assessment can be performed based on the different parts between VIM1.1 and VIM1.0.

[0077] According to an embodiment of the present disclosure, by first querying the evaluation result corresponding to the evaluated version in the software development kit information database based on the version information of the software development kit, risk assessment can be performed on the different parts between the two versions to reduce duplicate evaluation.

[0078] According to an embodiment of the present disclosure, the above method further includes:

[0079] Obtain a risk function sample data set, where the risk function sample data set includes multiple pieces of risk function sample data, and each piece of risk function sample data includes risk function signature data, risk function sequence data, and risk function parameter data;

[0080] Extract the feature data set of the risk function from the risk function sample data set;

[0081] Train a preset model using the feature data set to obtain a risk assessment model.

[0082] According to an embodiment of the present disclosure, the risk assessment model is trained using sample data with risk function signature data, risk function sequence data, and risk function parameter data to improve the generalization of the risk assessment model.

[0083] Figure 4 Schematically shows a logic block diagram of a risk assessment method for a software development kit according to an embodiment of the present disclosure.

[0084] As Figure 4 shown, this embodiment includes operations S410 to S460.

[0085] In operation S410, use a code analysis engine to scan the code file of the static interface call of the software development kit to determine the first risk function information.

[0086] In operation S420, by executing a test program, second risk function information is determined from the dynamic interface call logs of the software development kit, where the test program is a test program generated using a code template and capable of implementing the functions of the software development kit.

[0087] In operation S430, the first feature information of the first risk function information and the second feature information of the second risk function are extracted.

[0088] In operation S440, the first feature information and the second feature information are input into a risk assessment model, and risk assessment result information is output.

[0089] In operation S450, it is determined whether the risk assessment result information exceeds a threshold. If so, operation S460 is executed. If not, no processing is performed.

[0090] In operation S460, the risk assessment result information and the version information of the software development kit are stored in the software development kit information database.

[0091] Based on the above risk assessment method for the software development kit, the present disclosure also provides a risk assessment device for the software development kit. The following will be combined with Figure 5 to describe the device in detail.

[0092] Figure 5 A structural block diagram of a risk assessment device for a software development kit according to an embodiment of the present disclosure is schematically shown.

[0093] As Figure 5 shown, the risk assessment device 500 for the software development kit in this embodiment includes: a first determination module 510, a second determination module 520, a first extraction module 530, and an evaluation module 540.

[0094] The first determination module 510 is configured to scan the code files of the static interface calls of the software development kit to determine the first risk function information.

[0095] The second determination module 520 is configured to determine the second risk function information from the dynamic interface call logs of the software development kit by executing a test program, where the test program is a test program generated using a code template and capable of implementing the functions of the software development kit.

[0096] The first extraction module 530 is configured to extract the first feature information of the first risk function information and the second feature information of the second risk function.

[0097] The evaluation module 540 is configured to input the first feature information and the second feature information into a risk assessment model and output risk assessment result information.

[0098] According to an embodiment of the present disclosure, the above-mentioned device 500 further includes a third determination module and a generation module. Among them, the third determination module is used to determine the call relationship between the static interfaces of multiple software development toolkits by analyzing the code file. The generation module is used to generate a test program using a code template for the method information of the first static interface in the case where the first static interface calls the second static interface.

[0099] According to an embodiment of the present disclosure, the above-mentioned device 500 further includes a storage module, which is used to store the risk assessment result information and the version information of the software development toolkit into the software development toolkit information database when the risk assessment result information exceeds a preset threshold.

[0100] According to an embodiment of the present disclosure, the above-mentioned device 500 further includes a query module, which is used to respond to a risk assessment request for a target software development toolkit and query the risk assessment result information of the target software development toolkit from the software development toolkit information database according to the version information of the target software development toolkit.

[0101] According to an embodiment of the present disclosure, the above-mentioned device 500 further includes an acquisition module, a second extraction module, and a training module. Among them, the acquisition module is used to acquire a risk function sample data set. The second extraction module is used to extract a feature data set of the risk function from the risk function sample data set. The training module is used to train a preset model using the feature data set to obtain a risk assessment model.

[0102] According to an embodiment of the present disclosure, any multiple of the first determination module 510, the second determination module 520, the first extraction module 530, and the evaluation module 540 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first determination module 510, the second determination module 520, the first extraction module 530, and the evaluation module 540 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or may be implemented by any other reasonable means such as hardware or firmware for integrating or packaging circuits, or may be implemented in any one of the three implementation manners of software, hardware, and firmware, or in an appropriate combination of any several of them. Alternatively, at least one of the first determination module 510, the second determination module 520, the first extraction module 530, and the evaluation module 540 may be at least partially implemented as a computer program module, and when the computer program module is run, corresponding functions may be executed.

[0103] Figure 6 Schematically shows a block diagram of an electronic device suitable for implementing a risk assessment method of a software development kit according to an embodiment of the present disclosure.

[0104] As Figure 6 shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which may perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 602 or a program loaded from a storage section 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 601 may also include on-board memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0105] In the RAM 603, various programs and data required for the operation of the electronic device 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 602 and / or the RAM 603. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 may also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0106] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, and the input / output (I / O) interface 605 is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read from it can be installed into the storage portion 608 as needed.

[0107] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist alone without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0108] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, device, or apparatus. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include one or more memories other than the above-described ROM 602 and / or RAM 603 and / or ROM 602 and RAM 603.

[0109] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product runs in a computer system, the program code is used to enable the computer system to implement the..... method provided by the embodiment of the present disclosure.

[0110] When the computer program is executed by the processor 601, it executes the above functions defined in the system / apparatus of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0111] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and be downloaded and installed through the communication part 609, and / or be installed from the removable medium 611. The program code contained in the computer program can be transmitted by any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0112] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or be installed from the removable medium 611. When the computer program is executed by the processor 601, it executes the above functions defined in the system of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, devices, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0113] In accordance with embodiments of the present disclosure, program code for executing the computer programs provided by the embodiments of the present disclosure may be written in any combination of one or more programming languages. Specifically, these computing programs may be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The programming languages include, but are not limited to, programming languages such as Java, C++, Python, the "C" language, or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., by connecting through the Internet using an Internet service provider).

[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and combinations of blocks in the block diagram or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0115] Those skilled in the art will appreciate that the features recited in the various embodiments and / or claims of the present disclosure may be combined or combined in various ways, even if such combinations or combinations are not explicitly recited in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features recited in the various embodiments and / or claims of the present disclosure may be combined and combined in various ways. All such combinations and / or combinations fall within the scope of the present disclosure.

[0116] The embodiments of the present disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments have been described separately above, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. A risk assessment method for a software development kit, comprising: Scanning the code files of the static interface calls of the software development kit to determine first risk function information, where the first risk function information includes the acquisition of device information and the tampering of system configuration; By executing a test program, determining second risk function information from the dynamic interface call logs of the software development kit, where the test program is a test program that can implement the functions of the software development kit generated by using a code template for the method information of the called source static interface by analyzing the call relationship between static interfaces; extracting first feature information of the first risk function information and second feature information of the second risk function, where the first feature information and the second feature information both include at least one of the following: risk function signature information, risk function sequence information, and risk function parameter information; and Inputting the first feature information and the second feature information into a risk assessment model and outputting risk assessment result information.

2. The method according to claim 1, further comprising: Determining the call relationship between multiple static interfaces of the software development kit by analyzing the code files; When a first static interface calls a second static interface, generating the test program for the method information of the first static interface by using the code template.

3. The method according to claim 1, further comprising: When the risk assessment result information exceeds a preset threshold, storing the risk assessment result information and the version information of the software development kit in a software development kit information database.

4. The method according to claim 3, further comprising: In response to a risk assessment request for a target software development kit, querying the risk assessment result information of the target software development kit from the software development kit information database according to the version information of the target software development kit.

5. The method according to claim 1, further comprising: Obtaining a risk function sample data set, where the risk function sample data set includes multiple risk function sample data, and each risk function sample data includes risk function signature data, risk function sequence data, and risk function parameter data; Extracting a feature data set of risk functions from the risk function sample data set; Training a preset model by using the feature data set to obtain the risk assessment model.

6. A risk assessment device for a software development kit, comprising: A first determination module for scanning the code files of the static interface calls of the software development kit to determine first risk function information, where the first risk function information includes the acquisition of device information and the tampering of system configuration; A second determination module for determining second risk function information from the dynamic interface call logs of the software development kit by executing a test program, where the test program is a test program that can implement the functions of the software development kit generated by using a code template for the method information of the called source static interface by analyzing the call relationship between static interfaces; A first extraction module, configured to extract first feature information of the first risk function information and second feature information of the second risk function, where the first feature information and the second feature information each include at least one of the following: risk function signature information, risk function sequence information, and risk function parameter information; and An evaluation module, configured to input the first feature information and the second feature information into a risk evaluation model and output risk evaluation result information.

7. An electronic device, comprising: One or more processors; A storage device, configured to store one or more programs, wherein, when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, having stored thereon executable instructions that, when executed by a processor, cause the processor to execute the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images