A method, system and terminal for detecting whether application permissions are compliant

Abstract

The present invention discloses a method, system and terminal for detecting whether application permissions are compliant. The method comprises: starting a traversal program to run the application to be detected for the first time, and when all permission authorization pop-ups of the application to be detected are detected, receiving and executing all operation instructions of clicking to reject, and recording a first screenshot and a first log; starting a traversal program to run the application to be detected for the second time, and when all permission authorization pop-ups of the application to be detected are detected, receiving and executing all operation instructions of clicking to agree, and recording a second screenshot and a second log; merging the log data in the first log and the second log, and analyzing the merged log data to obtain the permission compliance of the application to be detected. The present invention quickly determines the permission compliance of the application to be detected by automatically traversing the application to be detected.

Description

Technical Field

[0001] The present invention relates to the field of mobile application compliance detection technology, and in particular to a method, system, terminal and storage medium for detecting whether application permissions are compliant. Background Art

[0002] The application security compliance detection system comprehensively detects non-compliance items in mobile applications, including the collection and use of personal information by apps, the storage method of personal information, third-party SDK behavior analysis, the protection of user rights by app operators, and other violations and illegalities.

[0003] In the compliance test of the application, there is a permission compliance test item, which needs to determine whether the sensitive permission application is compliant. For example: the application has a forced exit after denying permission, which is non-compliant, which means that during the operation of the application, a permission authorization window pops up (such as: whether to allow making calls and managing call permissions, allow / deny). Forced exit after denying permission means that after clicking deny permission, the application is directly exited and subsequent functions cannot be used. According to the regulatory documents of the Ministry of Industry and Information Technology and other departments, applications with such scenarios are non-compliant; for example: the application frequently pops up after rejection, which is non-compliant; for example: the permission window still pops up after the application is restarted after exiting, etc.

[0004] Existing technologies lack automated methods for determining whether sensitive permission applications are compliant.

[0005] Therefore, the prior art still needs to be improved and developed. Summary of the invention

[0006] The main purpose of the present invention is to provide a method, system and terminal for detecting whether application permissions are compliant, aiming to solve the problem in the prior art of lack of automated judgment on whether sensitive permission applications are compliant.

[0007] To achieve the above object, the present invention provides a method for detecting whether application permissions are compliant, and the method for detecting whether application permissions are compliant comprises the following steps:

[0008] The traversal program is started for the first time to run the application to be detected. When all permission authorization pop-up windows of the application to be detected are detected, all operation instructions of clicking to reject are received and executed, and the first screenshot and the first log are recorded;

[0009] The traversal program is started for the second time to run the application to be detected. When all permission authorization pop-up windows of the application to be detected are detected, all operation instructions of clicking "Agree" are received and executed, and a second screenshot and a second log are recorded;

[0010] The log data in the first log and the second log are merged, and the permission compliance of the application to be detected is obtained based on the merged log data analysis.

[0011] Optionally, in the method for detecting whether application permissions are compliant, the first screenshot and the second screenshot are screenshots taken after a permission pop-up window appears on the application to be detected.

[0012] Optionally, in the method for detecting whether application permissions are compliant, the first screenshot and the second screenshot are used as a basis for determining that the application to be detected is non-compliant.

[0013] Optionally, in the method for detecting whether application permissions are compliant, the content of the first log or the second log includes: log type label, file path, keywords, current application status to be detected, timestamp, traversal stage and interface element content.

[0014] Optionally, in the method for detecting whether application permissions are compliant, the log type label includes: permission approved and permission denied.

[0015] Optionally, in the method for detecting whether application permissions are compliant, the current state of the application to be detected includes: foreground running, background running and exit state.

[0016] Optionally, the method for detecting whether application permissions are compliant includes:

[0017] After the traversal program is started for the first time to run the application to be detected, if the application to be detected is in the exit state after clicking the permission rejection, the application to be detected is non-compliant;

[0018] After the traversal program is started for the first time to run the application to be detected, if the application to be detected continues to pop up the permission authorization window after clicking permission rejection multiple times, the application to be detected is not compliant;

[0019] After the traversal program is started for the second time to run the application to be detected, if permission is agreed upon by clicking on the button and there is permission rejection in the application to be detected when the traversal program is started for the first time, the application to be detected is not compliant.

[0020] In addition, to achieve the above-mentioned purpose, the present invention further provides a system for detecting whether application permissions are compliant, wherein the system for detecting whether application permissions are compliant includes:

[0021] A first detection module is used to start the traversal program for the first time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all click-reject operation instructions, and record a first screenshot and a first log;

[0022] The second detection module is used to start the traversal program for the second time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all operation instructions of clicking "Agree", and record a second screenshot and a second log;

[0023] The merging and analyzing module is used to merge the log data in the first log and the second log, and obtain the permission compliance of the application to be detected based on the merged log data analysis.

[0024] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a detection program for whether application permissions are compliant that is stored in the memory and can be run on the processor, and when the detection program for whether application permissions are compliant is executed by the processor, the steps of the method for detecting whether application permissions are compliant as described above are implemented.

[0025] In addition, to achieve the above-mentioned purpose, the present invention also provides a storage medium, wherein the storage medium stores a detection program for whether application permissions are compliant, and when the detection program for whether application permissions are compliant is executed by a processor, the steps of the detection method for whether application permissions are compliant as described above are implemented.

[0026] The present invention starts the traversal program for the first time to run the application to be detected. When all permission authorization pop-ups of the application to be detected are detected, all operation instructions of clicking to reject are received and executed, and a first screenshot and a first log are recorded; the traversal program is started for the second time to run the application to be detected. When all permission authorization pop-ups of the application to be detected are detected, all operation instructions of clicking to agree are received and executed, and a second screenshot and a second log are recorded; the log data in the first log and the second log are merged, and the permission compliance of the application to be detected is obtained based on the merged log data analysis. The present invention quickly determines the permission compliance of the application to be detected by automatically traversing the application to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flow chart of a preferred embodiment of the method for detecting whether application permissions are compliant according to the present invention;

[0028] Figure 2 It is a schematic diagram of the principle of a preferred embodiment of the system for detecting whether application permissions are compliant according to the present invention;

[0029] Figure 3 Schematic diagram of the operating environment of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0031] like Figure 1 As shown, the method for detecting whether application permissions are compliant according to a preferred embodiment of the present invention comprises the following steps:

[0032] Step S10: start the traversal program for the first time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all click-to-reject operation instructions, and record the first screenshot and the first log.

[0033] Specifically, the present invention executes the automatic traversal program in segments and records the operation status of the permission window. Therefore, the traversal program is started for the first time (the traversal program is used to automatically run the application) to run the application to be detected. When all the permission authorization pop-ups of the application to be detected are detected, the operation instructions of clicking all rejects are received and executed, and the first screenshot and the first log are recorded, that is, the traversal is started, and all the permission authorization pop-ups are encountered, and all rejects are clicked, and data (the first screenshot and the first log) are recorded. The screenshot is used for display. The first screenshot is a screenshot after the permission pop-up window appears in the application to be detected. After the traversal program is found to have a permission pop-up window in the application, a screenshot will be taken and saved. If a conclusion of non-compliance is drawn when the data is finally analyzed, these screenshots can be used as a basis for display; the first log is used for compliance analysis; the content of the first log includes: log type label, file path, keywords, current application status to be detected, timestamp, traversal stage and interface element content; wherein, the log type label includes: permission consent and permission rejection, and the current application status to be detected includes: foreground running, background running and exit status.

[0034] Step S20, starting the traversal program for the second time to run the application to be detected, when all permission authorization pop-up windows of the application to be detected are detected, receiving and executing all operation instructions of clicking to agree, and recording a second screenshot and a second log.

[0035] Specifically, after the first start of the traversal program to run the application to be detected, the second start of the traversal program (the traversal program is used to automatically run the application) to run the application to be detected. When all permission authorization pop-ups of the application to be detected are detected, the operation instructions of clicking all the approvals are received and executed, and the second screenshot and the second log are recorded, that is, the traversal is started, and all permission authorization pop-ups are encountered, and all the approvals are clicked. Record data (the second screenshot and the second log), the screenshot is used for display, the second screenshot is the screenshot after the permission pop-up window appears in the application to be detected, the traversal program is found, and after the permission pop-up window appears in the application, the screenshot will be saved. If the conclusion of non-compliance is drawn when the data is finally analyzed, these screenshots can be used as a basis for display; the second log is used for compliance analysis; the content of the second log includes: log type label, file path, keywords, current application status to be detected, timestamp, traversal stage and interface element content; wherein, the log type label includes: permission approval and permission rejection, and the current application status to be detected includes: foreground running, background running and exit status.

[0036] Step S30: merge the log data in the first log and the second log, and analyze the merged log data to obtain the permission compliance of the application to be detected.

[0037] Specifically, the log data in the first log obtained in the step S10 and the second log obtained in the step S20 are merged, and the permission compliance of the application to be detected is analyzed based on the merged log data. The merging of the logs of the two stages is mainly used to: analyze whether the scenario is compliant when the permission window still pops up after the application is exited and restarted, because this scenario has an exit and restart stage.

[0038] In the present invention, the format design of a single log data is:

[0039] {

[0040] "dataTag":"Log type label (permission granted|permission denied, etc.)",

[0041] "imgpath":"Screenshot as file path",

[0042] "keyword":keyword,

[0043] "runstatus": "Current app status (foreground running, background running, exit status)",

[0044] "time": "timestamp",

[0045] "type":"Traversal phase (phase one | phase two)",

[0046] "xmlpath":"Interface element content"

[0047] }

[0048] After starting the traversal program for the first time to run the application to be detected, if the application to be detected is in the exit state after clicking the permission to deny, the application to be detected is not compliant; that is, when type = stage one, dataTag = permission to deny, runstatus = exit status, it means that after the permission is denied, the app directly exits and is not compliant; for example, when the application is running, a permission authorization window pops up (such as: whether to allow making calls and managing call permissions, allow / deny), and denying permission means clicking deny.

[0049] After starting the traversal program for the first time to run the application to be detected, if the application to be detected continues to pop up the permission authorization window after clicking permission rejection multiple times, the application to be detected is not compliant; that is, read all logs with type=stage one and dataTag=permission rejection, and obtain the specific permission name of the permission pop-up window according to the content on xmlpath. If the same permission name appears more than twice, it means that there is frequent permission request (during the running of the application, the user clicks to reject a certain permission, but the application still pops up the permission authorization window and asks the user to click. If the user does not click "Allow", the window will continue to pop up. This scenario is frequent permission request), which is not compliant.

[0050] After starting the traversal program for the second time to run the application to be detected, if you click on the permission to agree and there is a permission rejection in the application to be detected when the traversal program is started for the first time, the application to be detected is not compliant; that is, when type=stage two, dataTag=permission consent appears, and the permission was rejected in stage one, it is not compliant.

[0051] The present invention determines whether a sensitive permission application is compliant by automated means, thereby facilitating rapid determination of the permission compliance of an application to be tested.

[0052] Furthermore, if Figure 2 As shown, based on the above-mentioned method for detecting whether application permissions are compliant, the present invention also provides a system for detecting whether application permissions are compliant, and the system for detecting whether application permissions are compliant includes:

[0053] The first detection module 51 is used to start the traversal program for the first time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all click-reject operation instructions, and record a first screenshot and a first log;

[0054] The second detection module 52 is used to start the traversal program for the second time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all operation instructions of clicking "Agree", and record a second screenshot and a second log;

[0055] The merging and analyzing module 53 is used to merge the log data in the first log and the second log, and analyze the merged log data to obtain the permission compliance of the application to be detected.

[0056] Furthermore, if Figure 3 As shown, based on the above-mentioned method for detecting whether application permissions are compliant, the present invention also provides a terminal, which includes a processor 10, a memory 20 and a display 30. Figure 3 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0057] The memory 20 may be an internal storage unit of the terminal in some embodiments, such as a hard disk or memory of the terminal. The memory 20 may also be an external storage device of the terminal in other embodiments, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Further, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software and various types of data installed in the terminal, such as program codes of the installation terminal, etc. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a detection program 40 for whether application permissions are compliant is stored on the memory 20, and the detection program 40 for whether application permissions are compliant can be executed by the processor 10, thereby realizing the detection method for whether application permissions are compliant in the present application.

[0058] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing a detection method for whether the application permissions are compliant.

[0059] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal and to display a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.

[0060] In one embodiment, when the processor 10 executes the detection program 40 for determining whether the application permissions in the memory 20 are compliant, the following steps are implemented:

[0061] The traversal program is started for the first time to run the application to be detected. When all permission authorization pop-up windows of the application to be detected are detected, all operation instructions of clicking to reject are received and executed, and the first screenshot and the first log are recorded;

[0062] The traversal program is started for the second time to run the application to be detected. When all permission authorization pop-up windows of the application to be detected are detected, all operation instructions of clicking "Agree" are received and executed, and a second screenshot and a second log are recorded;

[0063] The log data in the first log and the second log are merged, and the permission compliance of the application to be detected is obtained based on the merged log data analysis.

[0064] The first screenshot and the second screenshot are screenshots taken after a permission pop-up window appears on the application to be detected.

[0065] The first screenshot and the second screenshot are used as a basis for determining that the application to be detected is non-compliant.

[0066] The content of the first log or the second log includes: log type label, file path, keyword, current application status to be detected, timestamp, traversal stage and interface element content.

[0067] The log type labels include: permission granted and permission denied.

[0068] The current state of the application to be detected includes: foreground running, background running and exit state.

[0069] The method for detecting whether the application permissions are compliant also includes:

[0070] After the traversal program is started for the first time to run the application to be detected, if the application to be detected is in the exit state after clicking the permission rejection, the application to be detected is non-compliant;

[0071] After the traversal program is started for the first time to run the application to be detected, if the application to be detected continues to pop up the permission authorization window after clicking permission rejection multiple times, the application to be detected is not compliant;

[0072] After the traversal program is started for the second time to run the application to be detected, if permission is agreed upon by clicking on the button and there is permission rejection in the application to be detected when the traversal program is started for the first time, the application to be detected is not compliant.

[0073] The present invention also provides a storage medium, wherein the storage medium stores a program for detecting whether application permissions are compliant, and when the program for detecting whether application permissions are compliant is executed by a processor, the steps of the method for detecting whether application permissions are compliant as described above are implemented.

[0074] In summary, the present invention provides a method, system, terminal and storage medium for detecting whether application permissions are compliant, the method comprising: starting a traversal program to run the application to be detected for the first time, and when all permission authorization pop-ups of the application to be detected are detected, receiving and executing all operation instructions of clicking to reject, and recording a first screenshot and a first log; starting a traversal program to run the application to be detected for the second time, and when all permission authorization pop-ups of the application to be detected are detected, receiving and executing all operation instructions of clicking to agree, and recording a second screenshot and a second log; merging the log data in the first log and the second log, and analyzing the merged log data to obtain the permission compliance of the application to be detected. The present invention quickly determines the permission compliance of the application to be detected by automatically traversing the application to be detected.

[0075] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the program can be stored in a computer-readable storage medium, and the program can include the processes of the above-mentioned method embodiments when executed. The storage medium can be a memory, a disk, an optical disk, etc.

[0076] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for detecting whether application permissions are compliant, characterized in that: The detection method of whether the application permissions are compliant includes: The traversal program is started for the first time to run the application to be detected. When any one of the permission authorization pop-up windows of the application to be detected is detected, all operation instructions of clicking to reject are received and executed, and a first screenshot and a first log are recorded; The traversal program is started for the second time to run the application to be detected. When all permission authorization pop-up windows of the application to be detected are detected, all operation instructions of clicking "Agree" are received and executed, and a second screenshot and a second log are recorded; Merging the log data in the first log and the second log, and analyzing the merged log data to obtain the permission compliance of the application to be detected; After the traversal program is started for the first time to run the application to be detected, if the application to be detected is in the exit state after clicking the permission rejection, the application to be detected is non-compliant; After the traversal program is started for the first time to run the application to be detected, if the application to be detected continues to pop up the permission authorization window after clicking permission rejection multiple times, the application to be detected is not compliant; After the traversal program is started for the second time to run the application to be detected, if the permission is agreed upon and there is a permission rejection in the first time the traversal program is started to run the application to be detected, the application to be detected is not compliant; By using automated means to determine whether sensitive permission applications are compliant, it is easy to quickly determine the permission compliance of the application to be tested.

2. The method for detecting whether application permissions are compliant according to claim 1, characterized in that: The first screenshot and the second screenshot are screenshots taken after a permission pop-up window appears for the application to be detected.

3. The method for detecting whether application permissions are compliant according to claim 2, characterized in that: The first screenshot and the second screenshot are used as a basis for determining that the application to be detected is non-compliant.

4. The method for detecting whether application permissions are compliant according to claim 1, characterized in that: The content of the first log or the second log includes: log type label, file path, keyword, current application status to be detected, timestamp, traversal stage and interface element content.

5. The method for detecting whether application permissions are compliant according to claim 4, characterized in that: The log type labels include: permission granted and permission denied.

6. The method for detecting whether application permissions are compliant according to claim 4, characterized in that: The current state of the application to be detected includes: foreground running, background running and exit state.

7. A system for detecting whether application permissions are compliant, characterized in that: The detection system for whether the application permissions are compliant includes: A first detection module is used to start the traversal program for the first time to run the application to be detected, and when any one of the permission authorization pop-up windows of the application to be detected is detected, receive and execute all click-reject operation instructions, and record a first screenshot and a first log; The second detection module is used to start the traversal program for the second time to run the application to be detected, and when all permission authorization pop-up windows of the application to be detected are detected, receive and execute all operation instructions of clicking "Agree", and record a second screenshot and a second log; A merging and analyzing module, used to merge the log data in the first log and the second log, and analyze the merged log data to obtain the permission compliance of the application to be detected; After the traversal program is started for the first time to run the application to be detected, if the application to be detected is in the exit state after clicking the permission rejection, the application to be detected is non-compliant; After the traversal program is started for the first time to run the application to be detected, if the application to be detected continues to pop up the permission authorization window after clicking permission rejection multiple times, the application to be detected is not compliant; After the traversal program is started for the second time to run the application to be detected, if the permission is agreed upon and there is a permission rejection in the first time the traversal program is started to run the application to be detected, the application to be detected is not compliant; By using automated means to determine whether sensitive permission applications are compliant, it is easy to quickly determine the permission compliance of the application to be tested.

8. A terminal, characterized in that: The terminal includes: a memory, a processor, and a program for detecting whether application permissions are compliant that is stored in the memory and can be run on the processor. When the program for detecting whether application permissions are compliant is executed by the processor, the steps of the method for detecting whether application permissions are compliant as described in any one of claims 1 to 6 are implemented.

9. A storage medium, characterized in that: The storage medium stores a program for detecting whether application permissions are compliant. When the program for detecting whether application permissions are compliant is executed by the processor, the steps of the method for detecting whether application permissions are compliant as described in any one of claims 1 to 6 are implemented.

Images