Method and device for determining authority information

Abstract

The present disclosure provides a method and device for determining permission information, which relate to the field of information security technology. The method comprises: obtaining multiple permission requests in a process of simulating the operation of a group of applications in a real machine sandbox environment; inputting each permission request into a trained machine learning model to determine the initiator of each permission request, wherein the initiator is the group of applications or a software development kit called by the group of applications; and determining permission information corresponding to the permission request initiated by at least one software development kit according to the initiator of each permission request.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method and device for determining permission information. Background Art

[0002] In recent years, with the popularization of mobile terminals, people are increasingly using various applications (Application, APP) installed on mobile terminals in their daily lives.

[0003] Although these applications have brought a lot of convenience to our daily lives, the information security risks that come with them cannot be ignored. Recently, the China Consumers Association announced the evaluation results of the "Personal Information Collection and Privacy Policy" of 100 applications. The evaluation results show that 59 of the 100 applications are suspected of excessively collecting "location information", 28 applications are suspected of excessively collecting "contact information", 23 applications are suspected of excessively collecting "identity information", and 22 applications are suspected of excessively collecting "mobile phone numbers". Excessive requests for permissions by various applications are the main cause of information security risks. Summary of the invention

[0004] The inventors have noticed that the widespread use of software development kits (SDKs) has resulted in the current situation where applications request excessive permissions.

[0005] Developers can directly call certain SDKs during the application development process to enable the application to have the desired functions, such as advertising function, payment function, statistics function, social function, push function, map function, etc. This reduces the application development cycle, cost and difficulty.

[0006] However, since the SDKs called are encapsulated, it is difficult for developers to obtain the source code of these SDKs, and thus it is difficult to know the permission information requested by the SDKs. In other words, when the applications are running, these SDKs will ask the operating system for various permissions unknown to the developers in the name of the applications, thus causing the applications to request excessive permissions.

[0007] In view of this, the embodiments of the present disclosure propose the following solution that can accurately determine the permission information corresponding to the SDK.

[0008] According to one aspect of an embodiment of the present disclosure, a method for determining permission information is provided, comprising: obtaining multiple permission requests in a process of simulating the operation of a group of applications in a real machine sandbox environment; inputting each permission request into a trained machine learning model to determine the initiator of each permission request, wherein the initiator is the group of applications or a software development kit called by the group of applications; and determining, based on the initiator of each permission request, permission information corresponding to the permission request initiated by at least one software development kit.

[0009] In some embodiments, the set of applications includes only one application.

[0010] In some embodiments, the method also includes: decompiling an application package of at least one sample application to obtain identification information, the identification information including an identification of a software development kit called by each sample application; for each identification in the identification information, training a machine learning model with a permission request carrying the identification as input and the identification as output to obtain a trained machine learning model.

[0011] In some embodiments, the identification information also includes an identification of each sample application.

[0012] In some embodiments, decompiling the application package of at least one sample application to obtain identification information includes: decompiling the application package of the at least one sample application to obtain at least one file for each sample application, the at least one file including a source code file; determining a first group of identifiers of a software development kit in the package import information of the source code file; wherein the identification information includes the first group of identifiers.

[0013] In some embodiments, the at least one file also includes files under the lib folder and a build.gradle file; the method also includes: determining a second group of identifiers of the software development kit in the files under the lib folder, and determining a third group of identifiers of the software development kit in the dependency information of the build.gradle file; wherein the identification information also includes the second group of identifiers and the third group of identifiers.

[0014] In some embodiments, the source code file is a java class source code file.

[0015] In some embodiments, the method further includes: saving the permission information corresponding to each software development kit and the identifier of the software development kit to a database; and in response to a query message from a user for a first software development kit, sending the permission information in the database corresponding to the identifier of the first software development kit to the user.

[0016] According to another aspect of an embodiment of the present disclosure, a device for determining permission information is provided, including: an acquisition module, configured to acquire multiple permission requests in a process of simulating the operation of a group of applications in a real machine sandbox environment; and a determination module, configured to input each permission request into a trained machine learning model to determine the initiator of each permission request, wherein the initiator is the group of applications or a software development kit called by the group of applications; and according to the initiator of each permission request, determining the permission information corresponding to the permission request initiated by at least one software development kit.

[0017] According to another aspect of an embodiment of the present disclosure, a device for determining permission information is provided, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute a method for determining permission information described in any one of the above embodiments based on instructions stored in the memory.

[0018] According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, comprising computer program instructions, wherein when the computer program instructions are executed by a processor, the method for determining the permission information described in any one of the above embodiments is implemented.

[0019] According to another aspect of the embodiments of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for determining the permission information described in any one of the above embodiments is implemented.

[0020] In the disclosed embodiment, the permission request obtained during the simulation of running the application in the real machine sandbox environment is input into the trained machine learning model to determine the initiator of the permission request. Then, the permission information corresponding to the SDK is determined based on the initiator of the permission request. In this way, the permission information corresponding to the SDK can be accurately determined.

[0021] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 is a flowchart of a method for determining permission information according to some embodiments of the present disclosure;

[0024] Figure 2is a flowchart of a method for determining permission information according to other embodiments of the present disclosure;

[0025] Figure 3 is a flowchart of a method for determining permission information according to yet other embodiments of the present disclosure;

[0026] Figure 4 is a schematic diagram of the structure of a device for determining permission information according to some embodiments of the present disclosure;

[0027] Figure 5 It is a structural diagram of a device for determining permission information according to other embodiments of the present disclosure. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0029] Unless specifically stated otherwise, the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure.

[0030] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0031] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0032] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0033] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0034] Figure 1 It is a flowchart of a method for determining permission information according to some embodiments of the present disclosure.

[0035] like Figure 1 As shown, the method for determining the authority information includes steps 102 to 106.

[0036] In step 102, multiple permission requests are obtained during the process of simulating the running of a group of applications in a real machine sandbox environment.

[0037] The real machine sandbox environment can be, for example, a real machine sandbox environment based on the Android operating system, and the application can be, for example, an Android application. During the simulation operation, the application can send permission requests to the operating system. These permission requests can be initiated by the application itself when it needs to request permissions, or by the SDK called by the application in the name of the application when it needs to request permissions.

[0038] The permission request may carry permission information to indicate which permission is being requested. The permission information includes, for example, "location information", "contact information", "identity information", etc. Taking sending a permission request carrying "location information" as an example, the application can collect the terminal's location after the operating system allows it.

[0039] A group of applications may include one or more applications. In some embodiments, a group of applications includes only one application, that is, only one application is simulated and run in the real machine sandbox environment. In this way, interference between different applications can be avoided, so that multiple permission requests of this one application can be accurately obtained.

[0040] In step 104, each permission request is input into the trained machine learning model to determine the initiator of each permission request.

[0041] Here, the initiator of each permission request is any application in this group of applications, or any SDK called by this group of applications.

[0042] For example, after inputting the permission request into the trained machine learning model, the feature value of the permission request can be obtained as output. Different feature values ​​can correspond to different initiators. The initiator of the permission request can be determined based on the feature value of the permission request.

[0043] In step 106, according to the initiator of each permission request, permission information corresponding to the permission request initiated by at least one SDK is determined.

[0044] For example, multiple permission requests of an application can be classified according to the initiator of each permission request to obtain a set of permission requests initiated by each initiator. Afterwards, the permission information requested by a certain SDK can be extracted from the set of permission requests initiated by the SDK to obtain the permission information corresponding to the SDK.

[0045] In the above embodiment, the permission request obtained in the process of simulating the running of the application in the real machine sandbox environment is input into the trained machine learning model to determine the initiator of the permission request. Then, the permission information corresponding to the SDK is determined according to the initiator of the permission request. In this way, the permission information corresponding to the SDK can be accurately determined.

[0046] In this case, developers can decide whether to call the SDK based on the permission information corresponding to the SDK during the application development process, thereby effectively solving the problem of excessive application requests for permissions and reducing information security risks.

[0047] Combine the following Figure 2 Explain the training of a machine learning model.

[0048] Figure 2 It is a flowchart of a method for determining permission information according to other embodiments of the present disclosure.

[0049] like Figure 2 As shown, in addition to steps 102 to 106 , the method for determining authority information further includes steps 202 to 204 .

[0050] In step 202, the application package of at least one sample application is decompiled to obtain identification information.

[0051] Here, the identification information includes the identification of the SDK called by each sample application, for example, the name of the SDK. This will be described in conjunction with some embodiments below.

[0052] In step 204, for each identifier in the identification information, the machine learning model is trained with the permission request carrying the identifier as input and the identifier as output to obtain a trained machine learning model.

[0053] For example, the identification information includes the identification of two SDKs (i.e., SDK1 and SDK2). In this case, the machine learning model can be first trained with the permission request carrying the identification of SDK1 as input and the identification of SDK1 as output. Then, the machine learning model can be trained with the permission request carrying the identification of SDK2 as input and the identification of SDK2 as output, thereby obtaining a trained machine learning model.

[0054] The machine learning model may be trained multiple times with multiple different permission requests carrying an SDK identifier as input and the SDK identifier as output. The multiple different permission requests may, for example, carry different permission information.

[0055] It should be understood that the more identifications there are in the identification information, the more samples there are for training the machine learning model, and the better the training effect of the machine learning model.

[0056] In the above embodiment, the machine learning model is trained with the permission request carrying the SDK identifier called by the sample application as input and the SDK identifier as output. In this way, the trained machine learning model can be used to accurately determine the initiator of the permission request, thereby accurately determining the permission information of the SDK.

[0057] The machine learning model can be, for example, a black-box model, whose workflow is roughly as follows.

[0058] First, the permission request is transformed into the logarithmic domain to obtain the coordinates corresponding to the permission request. Here, the coordinates corresponding to the permission requests initiated by different initiators are different, and the coordinates corresponding to the permission requests carrying different permission information are also different. At the same time, the constant matrix corresponding to the permission information carried by the permission request is transformed to the same logarithmic domain to obtain the initial coordinates corresponding to the permission request. Here, the initial coordinates corresponding to the permission requests carrying the same permission information are the same, and the initial coordinates corresponding to the permission requests carrying different permission information are different. Then, based on the preset algorithm, the path gradually approaching the coordinates corresponding to the permission request from the initial coordinates corresponding to the permission request is calculated to extract the pixel values ​​corresponding to certain specific points on the path. Afterwards, these pixel values ​​are calculated to obtain the pixel value of the central pixel point of the path. Finally, the initiator of the permission request can be determined according to the pixel value of the central pixel point.

[0059] Combine the following Figure 3 Some embodiments of decompiling an application package of a sample application to obtain identification information are described.

[0060] Figure 3 It is a flowchart of a method for determining permission information according to some other embodiments of the present disclosure.

[0061] like Figure 3 As shown, step 202 includes steps 2021 to 2022.

[0062] In step 2021, the application package of at least one sample application is decompiled to obtain at least one file of each sample application.

[0063] Here, the at least one file includes a source code file.

[0064] The application package of the sample application may be an Android application package (APK). The APK may be decompiled using an APK decompilation tool (e.g., APKTool) to obtain a source code file of the APK. The source code file may be a Java class source code file, such as a .class (class) file.

[0065] In some embodiments, before decompiling the application package of each sample application, the SHA1 value of the application package is first calculated using Secure Hash Algorithm 1 (SHA1), and whether the application package has been decompiled is determined based on the SHA1 value of the application package. After determining that the application package of the sample application has not been decompiled, the application package is decompiled. In this way, repeated decompilation of the same application package can be avoided, thereby reducing work pressure.

[0066] In step 2022, determine the first group identifier of the SDK in the import package information of the source code file.

[0067] For example, lines of code containing an import field may be extracted from a .class file, so as to obtain the identifier of the SDK imported by the application package from these lines of code to obtain a first set of identifiers.

[0068] If the application package of the sample application imports a certain SDK, this indicates that the sample application is more likely to call the SDK. That is, the first group of identifiers may include identifiers of SDKs that are commonly used in practice.

[0069] In these embodiments, the identification information includes a first set of identifications.

[0070] In the above embodiment, the first group of identifiers of the SDKs that are commonly used in practice is determined based on the package guide information in the source code file, so that the machine learning model can be trained based on the identifier information including the first group of identifiers. In this way, the trained machine learning model can be used to accurately determine the permission information of the SDKs that are commonly used.

[0071] In some embodiments, the at least one file obtained in step 221 also includes files in the lib folder and a build.gradle file. Figure 3 , step 202 also includes step 2023.

[0072] In step 2023, the second group identifier of the SDK in the file under the lib folder is determined, and the third group identifier of the SDK in the dependency information (dependency) of the build.gradle file is determined.

[0073] For example, the names of the jar files and the so files in the lib folder may be determined as the second group of identifiers of the SDK, and the identifier of the SDK declared by the dependency information in the build.gradle file may be used as the third group of identifiers.

[0074] In these embodiments, in addition to the first group of identifiers, the identifier information also includes a second group of identifiers and a third group of identifiers.

[0075] In the above embodiment, the second group of SDK identifiers in the files under the lib folder is further determined, and the third group of SDK identifiers in the dependency information of the build.gradle file is determined, so that the machine learning model can be trained later according to the identification information including the first group of identifiers, the second group of identifiers, and the third group of identifiers. This increases the number of SDK identifiers included in the identification information, enriches the samples of the trained machine learning model, and thus improves the training effect of the machine learning model. In this way, the trained machine learning model can be used to more accurately determine the initiator of the permission request, so that the permission information of the SDK can be more accurately determined.

[0076] Some other embodiments of the method for determining permission information of the present disclosure are further described below.

[0077] In some embodiments, the identification information also includes an identification of each sample application, such as the name of the sample application. That is, in these embodiments, the machine learning model is trained with the permission request carrying the identification of the sample application as input and the identification of the sample application as output.

[0078] In this way, the trained machine learning model can be used to more accurately determine whether the initiator of the permission request is the application itself or the SDK called by the application, thereby more accurately determining the permission information of the SDK.

[0079] In some embodiments, after the permission information corresponding to the SDK is determined, the permission information corresponding to the SDK is saved in a database corresponding to an identifier of the SDK.

[0080] In these embodiments, in response to a query message from a user for a first SDK, permission information corresponding to an identifier of the first SDK in a database is sent to the user.

[0081] For example, the query message for the first SDK may carry the identifier of the first SDK. After receiving the query message, the permission information corresponding to the identifier of the first SDK may be queried from the database. Then, a response message carrying the permission information may be sent to the user.

[0082] In this way, users can obtain the permission information requested by the SDK through a simple query, which can more effectively solve the problem of excessive permission requests by applications and further reduce information security risks.

[0083] Figure 4 It is a structural diagram of a device for determining permission information according to some embodiments of the present disclosure.

[0084] like Figure 4 As shown, the apparatus 400 for determining permission information includes an acquisition module 401 and a determination module 402 .

[0085] The acquisition module 401 is configured to acquire multiple permission requests in the process of simulating the running of a group of applications in a real machine sandbox environment.

[0086] The determination module 402 is configured to input each permission request into a trained machine learning model to determine the initiator of each permission request; and determine the permission information corresponding to the permission request initiated by at least one SDK according to the initiator of each permission request. Here, the initiator of the permission request is the group of applications or the SDK called by the group of applications.

[0087] It should be understood that the apparatus 400 for determining permission information may further include various other modules to execute the method for determining permission information of any of the above embodiments.

[0088] Figure 5 It is a structural diagram of a device for determining permission information according to other embodiments of the present disclosure.

[0089] like Figure 5 As shown, the apparatus 500 for determining permission information includes a memory 501 and a processor 502 coupled to the memory 501 , and the processor 502 is configured to execute the method for determining permission information of any one of the aforementioned embodiments based on instructions stored in the memory 501 .

[0090] The memory 501 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0091] The apparatus 500 for determining the authority information may further include an input / output interface 503, a network interface 504, a storage interface 505, etc. These interfaces 503, 504, 505, and the memory 501 and the processor 502 may be connected, for example, via a bus 506. The input / output interface 503 provides a connection interface for input / output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 504 provides a connection interface for various networked devices. The storage interface 505 provides a connection interface for external storage devices such as an SD card and a USB flash drive.

[0092] The embodiment of the present disclosure further provides a computer-readable storage medium, including computer program instructions, which, when executed by a processor, implement the method for determining permission information of any of the above embodiments.

[0093] The embodiments of the present disclosure further provide a computer program product, including a computer program, which, when executed by a processor, implements the method for determining permission information of any one of the above embodiments.

[0094] So far, various embodiments of the present disclosure have been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0095] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0096] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present disclosure. It should be understood that the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions specified in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0098] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0099] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0100] Although some specific embodiments of the present disclosure have been described in detail by way of examples, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified or some technical features may be replaced by equivalents without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A method for determining authority information, comprising: Get multiple permission requests during the process of simulating running a set of applications in a real device sandbox environment; Input each permission request into a trained machine learning model to determine the initiator of each permission request, the initiator being the group of applications or a software development kit called by the group of applications, wherein the machine learning model is trained for each identifier in the identification information, using the permission request carrying the identifier as input and the identifier as output, the identification information being obtained by decompiling an application package of at least one sample application, and the identification information including the identifier of the software development kit called by each sample application; According to the initiator of each permission request, permission information corresponding to the permission request initiated by at least one software development kit is determined.

2. The method according to claim 1, wherein: The set of applications includes only one application.

3. The method according to claim 1, wherein: The identification information also includes an identification of each sample application.

4. The method according to claim 1, wherein: The process of obtaining the identification information includes: Decompiling the application package of the at least one sample application to obtain at least one file of each sample application, wherein the at least one file includes a source code file; Determine a first group identifier of a software development kit in the package guide information of the source code file; The identification information includes the first group identification.

5. The method according to claim 4, wherein: The at least one file also includes files in the lib folder and a build.gradle file; The method further comprises: Determine the second set of identifiers of the software development kit in the files under the lib folder, and determine the third set of identifiers of the software development kit in the dependency information of the build.gradle file; The identification information further includes the second group identification and the third group identification.

6. The method according to claim 4, wherein: The source code file is a java class source code file.

7. The method according to claim 1, further comprising: Saving the permission information corresponding to each software development kit and the identifier of the software development kit to a database in correspondence; In response to a query message from a user for a first software development kit, permission information corresponding to the identifier of the first software development kit in the database is sent to the user.

8. A device for determining permission information, comprising: An acquisition module is configured to acquire multiple permission requests during a process of simulating running a set of applications in a real machine sandbox environment; as well as A determination module is configured to input each permission request into a trained machine learning model to determine an initiator of each permission request, wherein the initiator is the set of applications or a software development kit called by the set of applications; According to the initiator of each permission request, the permission information corresponding to the permission request initiated by at least one software development kit is determined, wherein the machine learning model is trained for each identifier in the identification information, with the permission request carrying the identifier as input and the identifier as output, and the identification information is obtained by decompiling an application package of at least one sample application, and the identification information includes the identifier of the software development kit called by each sample application.

9. A device for determining authority information, comprising: Memory; as well as A processor coupled to the memory is configured to execute the method for determining permission information according to any one of claims 1 to 7 based on instructions stored in the memory.

10. A computer-readable storage medium comprising computer program instructions, wherein: When the computer program instructions are executed by a processor, the method for determining the permission information according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method for determining the permission information according to any one of claims 1 to 7 is implemented.

Images