Security analysis method, device and equipment of application and storage medium

Abstract

This application provides a method, apparatus, device, and storage medium for application security analysis, relating to the field of terminal technology. The method is applied to an electronic device. The application framework layer of the electronic device includes an application monitoring module. After the first application initializes and runs, the electronic device controls the first application to load the application monitoring module. After the application monitoring module is loaded by the first application, when it detects that the first application is calling an interface, it acquires the interface call event of the first application to the interface, and then reports the acquired interface call event to the second application through the communication channel between the first and second applications. In this way, the second application can analyze whether the behavior of the first application has security risks based on the interface call event, and issue a warning when it determines that the first application has security risks. This application can perform behavior monitoring without modifying the application package, ensuring system stability.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a security analysis method, apparatus, device and storage medium for an application. Background Technology

[0002] With the rapid development of terminal technology, various applications can be installed on terminals. However, some applications may be malicious software with security vulnerabilities. For example, they may collect user data without authorization. Therefore, it is usually necessary to monitor the behavior of applications in order to analyze their security.

[0003] In related technologies, technicians can insert monitoring code into the application package according to actual needs to obtain an application package with monitoring capabilities. Thus, after installing and running the application based on this monitoring-enabled application package, the application's behavior can be monitored through the inserted monitoring code.

[0004] However, since the above implementation method modifies the application's application package, it may cause the application to fail to run or some functions to be unavailable, thus affecting the stability of the system. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for application security analysis, which solves the problem in the prior art where modifications to the application package may cause the application to fail to run or some functions to become unavailable, thereby affecting the stability of the system.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] Firstly, a security analysis method for an application is provided, applied to an electronic device. The application framework layer of the electronic device includes an application monitoring module, which monitors interface call events of a first application to an interface within the electronic device. The method includes: loading the application monitoring module for the first application in response to its initialization; the application monitoring module acquiring interface call events of the first application to an interface and reporting these events to the second application through a communication channel between the first and second applications; the second application analyzing the security of the first application based on the interface call events; and issuing a warning when the second application determines that the first application has a security vulnerability.

[0008] The application security analysis method provided in this application embodiment loads an application monitoring module after the first application initializes and runs. Once loaded by the first application, the application monitoring module acquires the interface call event when it detects the first application calling an interface, and then reports the acquired interface call event to a second application. In this way, the second application can analyze the behavior of the first application based on the interface call event to determine if there are any security risks. If security risks are found, it can issue timely warnings so that users can detect them promptly. This achieves behavior monitoring without modifying the application package, avoiding situations where application malfunctions or partial functionalities become unavailable due to application package modifications, thereby ensuring system stability.

[0009] Furthermore, once the application monitoring module is loaded into the process of the first application and becomes a runtime module of the first application, it actively interacts with the second application. The behavior monitoring of the first application no longer involves the application framework layer, thus decoupling the interface call event reporting mechanism from the system platform. Taking the Android platform as an example, embedding the application monitoring module in the application framework layer will not interfere with the normal operation of the entire Android platform, and changes and upgrades to the Android platform will not affect interface monitoring. Moreover, subsequent modifications to the application monitoring module in the application framework layer can be used to add and / or delete monitoring points without involving changes to the native Android code, thus avoiding performance loss and ensuring system stability and maintainability.

[0010] As an example of this application, the application monitoring module obtains the interface call event of the first application to the interface, including: the application monitoring module calls a hook method to obtain the interface call event, the hook method being used to obtain the interface call event of the first application to the interface during the process of the first application executing the interface call.

[0011] The application security analysis method provided in this embodiment calls a hook method. Since the hook method essentially backs up the API method of an interface and adds monitoring functionality before and after the backed-up API method, when the application monitoring module calls the hook method, it copies the API method address of the interface within the hook method, thus effectively backing up the API method. Therefore, by calling the hook method, not only can the interface be called, but the interface call event can also be obtained during the call process, thereby achieving the purpose of monitoring the interface call status.

[0012] As an example of this application, the application monitoring module invoking a hook method includes: the application monitoring module replacing the address of the application programming interface (API) method to be invoked with the address of the hook method. The application monitoring module then invokes the hook method based on the hook method address.

[0013] Normally, each interface corresponds to an API method, which can be called based on its address to invoke the interface. However, due to the need to monitor interface calls, the application security analysis method provided in this embodiment replaces the API method address to be called with a hook method address through an application monitoring module. This causes the application monitoring module to call the hook method instead. By executing the hook method, the application monitoring module can obtain the interface call event and call back the corresponding API method, thus monitoring the interface call process. This enables behavioral monitoring without modifying the application package, avoiding situations where modifications to the application package cause the application to malfunction or some functions to become unavailable, thereby ensuring system stability.

[0014] As an example of this application, before the application monitoring module obtains the interface call event of the first application, it further includes: the application monitoring module sending a monitoring service registration request to the second application, the monitoring service registration request being used to request the second application to determine whether to monitor the interface call event of the first application. In response to the second application determining to monitor the interface call event of the first application based on the monitoring service registration request, the application monitoring list is updated to obtain a first monitoring list, the first monitoring list including the application information of the first application.

[0015] The application security analysis method provided in this application embodiment obtains a first monitoring list by updating the application information of the first application in the application monitoring list when the first application is determined to be monitored, and the first monitoring list includes applications to be monitored. This allows for recording applications to be monitored through the first monitoring list, facilitating subsequent batch monitoring of applications in the first monitoring list.

[0016] As an example of this application, the method further includes: when the second application determines that it is monitoring the interface call events of the first application to the interface, sending a monitoring start notification to the application monitoring module, wherein the monitoring start notification is used to trigger the application monitoring module to obtain the interface call events of the first application to the interface.

[0017] The application security analysis method provided in this application sends a monitoring start notification to the application monitoring module in the second application when the second application determines that it is monitoring the interface call event of the first application. This allows the application monitoring module to monitor the interface call status of the first application after receiving the monitoring start notification, thereby achieving the monitoring purpose.

[0018] As an example of this application, the method further includes: updating the first monitoring list. The updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.

[0019] The application security analysis method provided in this application update the first monitoring list. Since the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed, the application that has undergone security analysis can be avoided from being monitored repeatedly when batch monitoring is performed again based on the updated first monitoring list. This can save the operating power of electronic devices.

[0020] As an example of this application, the application monitoring module obtains the interface call event of the first application to the interface, including: when the application monitoring module monitors that the first application calls the target interface, determining the call event of the first application to the target interface as the interface call event, wherein the target interface is an interface in the interface monitoring list, and the interface monitoring list is used to record the interface information of the interface to be monitored.

[0021] The application security analysis method provided in this application embodiment allows the application monitoring module to omit the first application's call events to the interface when the interface called by the first application is not the target interface. When the application monitoring module detects that the first application is calling the target interface, it acquires the call event of the target interface as an interface call event. The target interface is an interface in the interface monitoring list. That is, monitoring can be performed on interfaces in the interface monitoring list, such as interfaces involving user privacy, while other interfaces not in the list can be left unmonitored, such as interfaces that do not involve user privacy. This achieves selective monitoring of target interface call events, making the monitoring more targeted and thus saving power consumption of electronic devices.

[0022] As an example of this application, the method further includes: the application monitoring module sending an Android Interface Definition Language (AIDL) binding request to a target module, the target module being the second application or a connection establishment module of the application framework layer, the connection establishment module being used to establish a communication channel between the first application and the second application after the first application initializes and runs. The target module receives the AIDL binding request. Based on the AIDL binding request, the target module sends an AIDL binding object to the application monitoring module, the AIDL binding object including object data for establishing the communication channel. The application monitoring module receives the AIDL binding object.

[0023] AIDL is implemented through code-based communication. As an example of this application, the second application establishes a communication channel with the first application via AIDL. In implementation, the second application can define an AIDL binding object, which includes object data used to establish the communication channel. For example, the AIDL binding object includes at least one execution method, each execution method corresponding to a piece of code, or it can be understood that each execution method corresponds to an instance. Thus, after the application monitoring module obtains the AIDL binding object defined by the second application, it can communicate with the second application by calling the execution methods within the AIDL binding object.

[0024] If the first application and the second application communicate using existing communication methods, the first application can easily filter out monitoring-related instruction messages sent by the second application, allowing the first application to evade monitoring. The application security analysis method provided in this application embodiment uses an application monitoring module to obtain an AIDL binding object from the second application through a target module, and establishes a communication channel with the second application based on the AIDL binding object. The application monitoring module then monitors the first application based on this established communication channel, thereby preventing the first application from filtering out monitoring-related instruction messages and ensuring the reliability and stability of monitoring the first application.

[0025] As an example of this application, in response to the target module being the connection establishment module, the method further includes: the connection establishment module obtaining the AIDL binding object from the second application.

[0026] The application security analysis method provided in this application embodiment requests an AIDL binding object from the monitoring service management module in advance through the connection establishment module. This allows the first application to bind with the application market via the connection establishment module. If multiple first applications bind with the application market via AIDL, this reduces the operational burden on the application market to a certain extent compared to multiple first applications directly requesting AIDL binding from the application market.

[0027] As an example of this application, the second application includes a monitoring service management module and a behavior analysis module. The second application analyzes the security of the first application based on the interface call events, including: the monitoring service management module receiving interface call events of the first application to various interfaces transmitted by the application monitoring module; the behavior analysis module obtaining the interface call events of the first application to various interfaces from the monitoring service management module; and the behavior analysis module analyzing the security of the first application based on the interface call events of each interface.

[0028] Some API calls may be related. For example, the API for granting user permission may need to be called before the API for granting permission, meaning there is a sequential call order. In such cases, analyzing individual API call events may lead to inaccurate results. The application security analysis method provided in this application obtains API call events from the monitoring service management module using a behavior analysis module. This allows for comprehensive analysis by combining these API call events, thereby improving the accuracy and effectiveness of security analysis.

[0029] As an example of this application, the second application includes a monitoring service management module and a behavior analysis module. The second application analyzes the security of the first application based on the interface call events, including: the monitoring service management module receiving the interface call events transmitted by the application monitoring module; the monitoring service management module reporting the interface call events to the behavior analysis module based on a request from the behavior analysis module; and the behavior analysis module analyzing the security of the first application based on the interface call events.

[0030] In some embodiments, the behavior analysis module may have many analysis tasks, or its analysis tasks may not be completed. In such cases, if the monitoring service management module actively sends an interface call event to the behavior analysis module, the behavior analysis module may not be able to process it in a timely manner. Therefore, the security analysis method for applications provided in this application embodiment allows the behavior analysis module to actively request interface call events from the monitoring service management module based on its own working status, thereby enabling the behavior analysis module to perform security analysis fully and effectively.

[0031] Secondly, a security analysis device for an application is provided, configured in an electronic device. The application framework layer of the electronic device includes an application monitoring module. This module monitors interface call events of a first application to an interface within the electronic device. The device includes a target management module, the application monitoring module, and a second application. The target management module loads the application monitoring module for the first application in response to its initialization. The application monitoring module acquires interface call events from the first application and reports these events to the second application via a communication channel between the first and second applications. The second application analyzes the security of the first application based on the interface call events. The second application provides an early warning when it determines that the first application has a security vulnerability.

[0032] As an example of this application, the application monitoring module is used to: call a hook method to obtain the interface call event, wherein the hook method is used to obtain the interface call event of the first application to the interface during the process of the first application executing the interface call.

[0033] As an example of this application, the application monitoring module is used to: replace the address of the application programming interface (API) method to be called with the address of the hook method; and call the hook method based on the hook method address.

[0034] As an example of this application, the second application includes a monitoring service management module. The application monitoring module is configured to send a monitoring service registration request to the second application, the monitoring service registration request being used to request the second application to determine whether to monitor the interface call events of the first application. The monitoring service management module is configured to, in response to the second application determining to monitor the interface call events of the first application based on the monitoring service registration request, update the application monitoring list to obtain a first monitoring list, the first monitoring list including application information of the first application.

[0035] As an example of this application, the second application includes a monitoring service management module, which is configured to: when the second application determines that it is monitoring the interface call events of the first application to the interface, send a monitoring start notification to the application monitoring module, which is used to trigger the application monitoring module to obtain the interface call events of the first application to the interface.

[0036] As an example of this application, the monitoring service management module is further configured to: update the first monitoring list. Wherein, the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.

[0037] As an example of this application, the application monitoring module is used to: when the first application calls the target interface, determine the call event of the first application to the target interface as the interface call event, wherein the target interface is an interface in the interface monitoring list, and the interface monitoring list is used to record the interface information of the interface to be monitored.

[0038] As an example of this application, the apparatus includes a target module, which is a connection establishment module for the second application or the application framework layer. The connection establishment module is used to establish a communication channel between the first application and the second application after the first application initializes and runs. The application monitoring module is used to send an Android Interface Definition Language (AIDL) binding request to the target module. The target module is used to receive the AIDL binding request. The target module is used to send an AIDL binding object to the application monitoring module based on the AIDL binding request. The AIDL binding object includes object data for establishing the communication channel. The application monitoring module is used to receive the AIDL binding object.

[0039] As an example of this application, in response to the target module being the connection establishment module, the connection establishment module is configured to: obtain the AIDL binding object from the second application.

[0040] As an example of this application, the second application includes a monitoring service management module and a behavior analysis module. The monitoring service management module is used to receive interface call events of the first application to various interfaces transmitted by the application monitoring module. The behavior analysis module is used to obtain the interface call events of the first application to various interfaces from the monitoring service management module. The behavior analysis module is used to analyze the security of the first application based on the interface call events of each interface.

[0041] As an example of this application, the second application includes a monitoring service management module and a behavior analysis module. The monitoring service management module is used to receive the interface call events transmitted by the application monitoring module. The monitoring service management module is used to report the interface call events to the behavior analysis module based on a request from the behavior analysis module. The behavior analysis module is used to analyze the security of the first application based on the interface call events.

[0042] Thirdly, an electronic device is provided, comprising a processor and a memory. The memory stores a program that enables the electronic device to perform any of the methods described in the first aspect, and stores data related to implementing any of the methods described in the first aspect. The processor is configured to execute the program stored in the memory. The electronic device may further include a communication bus for establishing a connection between the processor and the memory.

[0043] Fourthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a computer, cause the computer to perform the method as described in any one of the first aspects above.

[0044] Fifthly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to perform the method described in the first aspect above.

[0045] The technical effects achieved by the second, third, fourth, and fifth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect mentioned above, and will not be repeated here.

[0046] The technical solution provided in this application can bring at least the following beneficial effects:

[0047] The application framework layer of the electronic device stores the application monitoring module. After the first application is initialized, the electronic device controls the first application to load the application monitoring module. Once loaded into the process of the first application and becoming a runtime module, the application monitoring module actively interacts with the second application. Specifically, the application monitoring module obtains interface call events from the first application and reports these events to the second application through the communication channel between the two applications. The second application then analyzes the behavior of the first application based on these interface call events to determine if there are any security vulnerabilities. If a security vulnerability is found, an early warning is issued. This embodiment of the application monitors the behavior of the first application without inserting monitoring code into the application package, avoiding situations where modifications to the application package cause the application to malfunction or some functions to become unavailable, thus ensuring system stability. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0049] Figure 2 A software structure block diagram of an electronic device provided in an embodiment of this application;

[0050] Figure 3A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0051] Figure 4 A schematic diagram illustrating the functions of a connection establishment module and an application monitoring module provided in this application embodiment;

[0052] Figure 5 This application provides a schematic diagram illustrating the functions of an application market.

[0053] Figure 6 A flowchart illustrating a security analysis method for an application provided in this application embodiment;

[0054] Figure 7 A schematic diagram of code implementation relationship provided for an embodiment of this application;

[0055] Figure 8 A flowchart illustrating a security analysis method for another application provided in this application embodiment;

[0056] Figure 9 A flowchart illustrating a security analysis method for another application provided in this application embodiment;

[0057] Figure 10 A schematic diagram of the structure of a security analysis device for an application provided in this application embodiment;

[0058] Figure 11 This is a schematic diagram of a second application provided in an embodiment of this application. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0060] It should be understood that "multiple" as mentioned in this application refers to two or more. In the description of this application, unless otherwise stated, " / " indicates "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, to facilitate a clear description of the technical solutions of this application, the terms "first," "second," etc., are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and that "first," "second," etc., do not necessarily imply differences.

[0061] As an example, the application security analysis method provided in this application embodiment can be applied to electronic devices capable of installing and running applications. This electronic device can be a device such as a wearable device, an in-vehicle infotainment system, or a terminal device. Exemplarily, the terminal device can include, but is not limited to, mobile phones, tablets, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). In one embodiment, the electronic device has an Android system, meaning the method can be applied to the Android platform.

[0062] Please see Figure 1 , Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0063] Electronic device 100 may include processor 110, external memory interface 120, internal memory 121, universal serial bus (USB) interface 130, charging management module 140, power management module 141, battery 142, antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone jack 170D, sensor module 180, button 190, motor 191, indicator 192, camera 193, display screen 194, and subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0064] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0065] Processor 110 may include one or more processing units, such as: application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0066] The controller can be the nerve center and command center of the electronic device 100. The controller can generate operation control signals according to the instruction opcode and timing signals to complete the control of fetching and executing instructions.

[0067] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0068] In some embodiments, the processor 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0069] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple I2C buses. The processor 110 can couple to the touch sensor 180K, charger, etc., through different I2C bus interfaces. For example, the processor 110 can couple to the touch sensor 180K through the I2C interface, enabling the processor 110 and the touch sensor 180K to communicate through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0070] The MIPI interface can be used to connect the processor 110 to peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI) and a display serial interface (DSI). In some embodiments, the processor 110 and the display screen 194 communicate via the DSI interface to realize the display function of the electronic device 100.

[0071] USB interface 130 is an interface that conforms to the USB standard specification, specifically it can be a Mini USB interface, Micro USB interface, USB Type C interface, etc.

[0072] It is understood that the interface connection relationships between the modules illustrated in the embodiments of the present invention are merely illustrative and do not constitute a structural limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0073] The power management module 141 is used to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to power the processor 110, internal memory 121, external memory, display 194, camera 193, and wireless communication module 160, etc.

[0074] The wireless communication function of electronic device 100 can be realized through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0075] The mobile communication module 150 can provide solutions for wireless communication, including 2G / 3G / 4G / 5G, applied to the electronic device 100. The mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc.

[0076] The wireless communication module 160 can provide solutions for wireless communication applications on the electronic device 100, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR) technology, etc.

[0077] In some embodiments, antenna 1 of electronic device 100 is coupled to mobile communication module 150, and antenna 2 is coupled to wireless communication module 160, enabling electronic device 100 to communicate with networks and other devices via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0078] Electronic device 100 implements display functions through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0079] Touch sensor 180K, also known as a "touch panel," can be located on display screen 194. The touch sensor 180K and display screen 194 together form a touchscreen, also known as a "touch screen." Touch sensor 180K detects touch operations applied to or near it. The touch sensor can transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through display screen 194. In other embodiments, touch sensor 180K may also be located on the surface of electronic device 100, in a different position than display screen 194.

[0080] Indicator 192 can be an indicator light, used to indicate charging status, power changes, or to indicate messages, missed calls, notifications, etc.

[0081] The software system of electronic device 100 can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. This embodiment of the invention uses the layered architecture Android system as an example to exemplify the software structure of electronic device 100.

[0082] Figure 2 This is a software structure block diagram of the electronic device 100 according to an embodiment of this application.

[0083] A layered architecture divides software into several layers, each with a clear role and function. Layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom: the application layer, the application framework layer, the Android runtime and system libraries, and the kernel layer.

[0084] The application layer can include a series of application packages.

[0085] like Figure 2 As shown, the application package can include applications such as gallery, camera, navigation, contacts, and app store.

[0086] An app store is a management application that can be used to manage other applications. For example, a user can trigger an electronic device to download an application from the app store. Alternatively, a user can trigger an electronic device to update the version of an installed application from the app store. Furthermore, in this embodiment, the app store can selectively monitor and analyze the behavior of some applications to determine whether these applications pose security risks.

[0087] The application framework layer provides application programming interfaces (APIs) and a programming framework for applications in the application layer. The application framework layer includes some predefined functions.

[0088] like Figure 2 As shown, the application framework layer may include a connection establishment module and an application monitoring module.

[0089] As an example, the connection establishment module can be used to establish a communication channel between the first application and the application market. This communication channel primarily lays the foundation for the application market to perform security analysis on the first application. As another example, the first application can refer to all applications installed on an electronic device, excluding the application market.

[0090] The application monitoring module can be loaded as a runtime module of the first application. When the first application calls an interface, the application monitoring module can obtain the interface call event and report it to the application marketplace through the aforementioned communication channel for security analysis. Here, a runtime module refers to a module that can run whenever needed.

[0091] In one possible implementation, the application framework layer may also include: a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, etc.

[0092] The window manager is used to manage windowed applications. It can retrieve screen size, determine the presence of a status bar, lock the screen, and capture screenshots, among other things.

[0093] Content providers are used to store and retrieve data, and make that data accessible to applications. This data may include videos, images, audio, phone calls made and received, browsing history and bookmarks, phone books, etc.

[0094] A view system includes visual controls, such as controls for displaying text and controls for displaying images. View systems can be used to build applications. A display interface can consist of one or more views. For example, a display interface including a text notification icon could include views for displaying text and views for displaying images.

[0095] The phone manager is used to provide communication functions for electronic device 100. For example, it manages call status (including connection and disconnection).

[0096] The file explorer provides applications with various resources, such as localized strings, icons, images, layout files, video files, and more.

[0097] The notification manager allows applications to display notifications in the status bar. These can be used to convey informational messages and can disappear automatically after a short pause, requiring no user interaction. For example, the notification manager can be used to notify users of download completion or message alerts. The notification manager can also display notifications as icons or scrolling text in the top status bar, such as notifications from background applications, or as dialog boxes on the screen. Examples include displaying text messages in the status bar, emitting sounds, vibrating electronic devices, and flashing indicator lights.

[0098] The Android Runtime consists of core libraries and a virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.

[0099] The core library consists of two parts: one part is the functionalities that need to be called by the Java language, and the other part is the Android core library.

[0100] The application layer and application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and application framework layer as binary files. The virtual machine is used to perform functions such as object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0101] System libraries can include multiple functional modules. For example: surface manager, media libraries, 3D graphics processing libraries (e.g., OpenGL ES), 2D graphics engines (e.g., SGL), etc.

[0102] The Surface Manager is used to manage the display subsystem and provides the blending of 2D and 3D layers for multiple applications.

[0103] The media library supports playback and recording of various common audio and video formats, as well as still image files. It supports multiple audio and video encoding formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG.

[0104] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0105] A 2D graphics engine is a graphics engine for 2D drawing.

[0106] The kernel layer is the layer between hardware and software. The kernel layer contains at least the display driver, camera driver, audio driver, and sensor driver.

[0107] The following example, using a scene of capturing a photograph, illustrates the workflow of the software and hardware of the electronic device 100.

[0108] When touch sensor 180K receives a touch operation, a corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, timestamp of the touch operation, etc.). The raw input event is stored in the kernel layer. The application framework layer retrieves the raw input event from the kernel layer and identifies the control corresponding to the input event. Taking a touch click as an example, where the corresponding control is the camera application icon, the camera application calls the application framework layer's interface to launch the camera application, and then calls the kernel layer to launch the camera driver, capturing still images or videos through camera 193.

[0109] based on Figure 1 and Figure 2 The illustrated embodiment provides an electronic device 100. The following describes the application scenarios involved in this application embodiment. Please refer to [link / reference]. Figure 3 , Figure 3 This is a schematic diagram illustrating an application scenario according to an exemplary embodiment, in practice:

[0110] The user triggers the electronic device to obtain the application package (APK) of APP1.

[0111] As an example, such as Figure 3 As shown in Figure (a), the application package of APP1 may be downloaded by the electronic device from a pop-up webpage. For example, the pop-up webpage may be a webpage recommended by an application that is running on the electronic device, meaning that APP1 may not be available on the app store and may not have undergone the security checks required before being available on the app store.

[0112] The user triggers the electronic device to install APP1 based on the downloaded application package. After the installation is completed, the electronic device can run APP1 to launch APP1.

[0113] Typically, the behavior of App1 after launch involves calling APIs. For example, if App1 needs to turn on Bluetooth, it will call the Bluetooth turn-on API; if it needs to connect to a network, it will call the network connection API; if it needs to retrieve contact information, it will call the contact information retrieval API; if it needs to retrieve the media access control (MAC) address, it will call the MAC address retrieval API; if it needs to activate the camera, it will call the camera activation API, and so on. In one possible implementation, App1's behavior may pose a security risk, as its API calls may involve unauthorized actions, such as unauthorized access to the user's private information from the electronic device.

[0114] In one embodiment, the app store in the electronic device can monitor the behavior of APP1 to determine whether there are any security risks, such as whether APP1 is engaging in malicious behavior, violating privacy regulations, or violating permission rules. As an example, when the app store detects that APP1's behavior poses a security risk, it can provide feedback to the user with the monitoring results and offer appropriate prompts.

[0115] In one possible implementation, electronic devices can prompt users via pop-up windows. For example... Figure 3 As shown in Figure (b), the pop-up window can display the warning text "APP1 is malicious software, uninstallation is recommended". As an example of this application, the electronic device can also provide the user with feedback on the specific content of APP1's malicious behavior in the pop-up window, for example, the specific content is "attempting to turn on the camera without authorization".

[0116] As an example of this application, please continue reading. Figure 3 As shown in Figure (b), the pop-up window can also include an "Uninstall" option 31. Thus, when a user needs to uninstall APP1, they can click option 31 to trigger the electronic device to uninstall APP1. For example, the electronic device might detect the user's triggering of option 31, close APP1, and then uninstall APP1. This facilitates quick uninstallation of APP1 and improves operational convenience.

[0117] As an example of this application, after the electronic device detects the user's triggering action on option 31, it can also display a confirmation message to the user asking whether they agree to uninstall before closing APP1. When the electronic device detects the user's agreement to uninstall based on the confirmation message, it closes APP1 and executes the uninstallation process. This method of performing the uninstallation operation only with user authorization improves the user experience.

[0118] As an example of this application, please continue reading. Figure 3 As shown in Figure (b), the pop-up window may also include a "Close Window" option 32. Thus, when the user does not need to uninstall APP1, they can click option 32. In response to the user clicking option 32, the electronic device closes the pop-up window.

[0119] Of course, the above example illustrates how an electronic device can prompt a user via a pop-up window. In another embodiment, the user can be prompted in any other user-perceptible manner. For example, vibration, sound alerts, or screen flashing can also be used to prompt the user. This application does not limit the scope of this embodiment.

[0120] It should be noted that the above example uses the scenario where the application package of APP1 is downloaded from a pop-up webpage. In another embodiment, the application package of APP1 can also be obtained through other download methods. For example, the application package of APP1 can be downloaded by the electronic device from a cloud drive or online storage, or it can be downloaded from an app store. This application embodiment does not specifically limit the download method of the application package of APP1, that is, the electronic device can monitor the behavior of all installed applications.

[0121] The following section introduces the functions of the connection establishment module and the application monitoring module in the application framework layer.

[0122] Please see Figure 4 The main function of the connection establishment module is to establish a communication channel between the first application and the application market. This communication channel is used for data exchange between the application market and the first application, so that the application market can determine whether to monitor the interface call behavior of the first application, and if it determines to monitor the interface call behavior of the first application, then monitor the interface call behavior of the first application. In other words, this communication channel establishes the foundation for the application market to monitor the first application.

[0123] The application monitoring module can be loaded as a runtime module of the first application. As an example, if the first application calls an interface, the application monitoring module can obtain the interface call event by replacing the interface method address, and send the obtained interface call event to the application marketplace through the aforementioned communication channel. This allows the application marketplace to analyze the security of the first application. A detailed implementation can be found below. Figure 6 The illustrated embodiment.

[0124] It should be noted that the connection establishment module and application monitoring module can be shared by multiple first applications. For example, multiple first applications can load the application monitoring module, and as an example, the loading process for multiple first applications can be parallel. Of course, the behavior monitoring process is sequential; that is, the security of one first application is determined before monitoring the next first application.

[0125] Please see Figure 5 Next, the application market involved in the embodiments of this application will be introduced. As an example, the application market integrates a monitoring service management module and a behavior analysis module.

[0126] As an example, the monitoring service management module can maintain an application monitoring list, which can be used to store application information of the first application to be monitored. When preset dynamic monitoring conditions are met, the monitoring service management module notifies the first application in the application monitoring list to enable behavior monitoring. These preset dynamic monitoring conditions can be pre-defined. Additionally, the monitoring service management module can also receive monitoring service registration requests from the first application. These requests can carry the application information of the first application, and the module can determine whether to perform behavior monitoring on the requesting first application based on the registration request. In one example, if it is determined that behavior monitoring will be performed on the requesting first application, its application information can be added to the application monitoring list. Furthermore, the monitoring service management module can also receive interface call events reported by the aforementioned application monitoring module.

[0127] The behavior analysis module can be used to analyze the security of a first application based on interface call events received by the monitoring service management module. In some embodiments, the behavior analysis module may include multiple plugins, each with different logical analysis functions. For example, the functions of multiple plugins may include, but are not limited to, analyzing whether a privacy policy statement exists and analyzing whether user data is collected without user authorization. The privacy policy statement refers to the application's statement of what permissions it requests and what operations it will perform.

[0128] It is worth mentioning that this embodiment does not require inserting monitoring code into the application package. Instead, it embeds an application monitoring module related to monitoring into the application framework layer, and installs an application marketplace that integrates a monitoring service management module and a behavior analysis module. This avoids situations where the application cannot run or some functions are unavailable, thus ensuring application stability. Furthermore, since the operation of the application marketplace is independent of the operation of other applications and does not affect them, system stability is also guaranteed.

[0129] The following section uses the application security analysis method provided in this embodiment of the application to an electronic device as an example to describe the specific implementation process of the method. Please refer to [link to relevant documentation]. Figure 6 , Figure 6 This is a schematic flowchart illustrating a security analysis method for an application according to an exemplary embodiment, which may specifically include some or all of the following:

[0130] 601: The connection establishment module requests an Android Interface Definition Language (AIDL) binding object from the monitoring service management module.

[0131] AIDL is an implementation of inter-process communication in the Android system. It can be used to establish communication connections between different processes, allowing one application to access the services of another. AIDL is implemented through code. In one example of this application, assuming an application marketplace and a first application establish a communication channel via AIDL, the application marketplace can define an AIDL binding object. This AIDL binding object includes object data used to establish the communication channel. For example, the AIDL binding object includes at least one execution method, each corresponding to a piece of code, or, more accurately, an instance of each execution method. Thus, if the first application obtains the AIDL binding object, it can communicate with the application marketplace by calling the execution methods within the AIDL binding object.

[0132] In this embodiment of the application, in order to facilitate the first application to establish communication with the application market, the connection establishment module in the electronic device can request the AIDL binding object from the monitoring service management module in the application market in advance.

[0133] 602: The monitoring service management module creates an AIDL binding object.

[0134] As mentioned earlier, an AIDL binding object includes at least one execution method. As an example, an AIDL binding object created by the monitoring service management module may include a registration method, an event reporting method, and a notification sending method. The registration method can be used by the first application to register with the application marketplace. The event reporting method can be used by the first application to send an API call event to the application marketplace, and the notification sending method is used by the application marketplace to send a notification message to the first application. For instance, if the first application obtains the AIDL binding object, when the registration method is called by the first application, the first application can initiate a monitoring service registration request to the application marketplace, thereby achieving registration communication between the first application and the application marketplace. Similarly, if the event reporting method is called by the first application, the first application can send an API call event to the application marketplace, thereby achieving reporting communication between the first application and the application marketplace. Furthermore, if the notification sending method is called by the application marketplace, the application marketplace can send a monitoring activation notification to the first application, instructing the first application to enable behavior monitoring.

[0135] It should be noted that this explanation uses the example of the monitoring service management module creating the AIDL binding object after the connection establishment module requests it. In another embodiment, the monitoring service management module can also pre-create the AIDL binding object, for example, before the connection establishment module requests it.

[0136] 603: The monitoring service management module sends the created AIDL binding object to the connection establishment module.

[0137] After receiving the AIDL binding object, the connection establishment module can temporarily store the AIDL binding object so that the first application can be bound to the application market via AIDL later.

[0138] It is worth mentioning that the connection establishment module requests the AIDL binding object from the monitoring service management module in advance, which allows the first application to bind with the application market through the connection establishment module. If there are multiple first applications binding with the application market, this can reduce the operating burden of the application market to a certain extent compared with multiple first applications directly requesting AIDL binding from the application market.

[0139] It should be noted that steps 601 to 603 above can be executed before the first application is initialized and run. The specific execution time is not specifically limited. For example, steps 601 to 603 can be executed after the application market is launched.

[0140] After introducing how the connection establishment module requests the AIDL binding object from the monitoring service management module, the monitoring process of the first application will be introduced next.

[0141] 604: First application initialization run.

[0142] As one example, the first application could be a newly installed application on an electronic device. As another example, the first application could be an application that has undergone a version update on an electronic device.

[0143] In one possible implementation, the initial run of the first application can refer to the first application being run for the first time after being installed on the electronic device. Typically, the first application can be the first installation on the electronic device, meaning that the first application has not been installed on the electronic device before. Of course, the first application can also be installed on the electronic device before, for example, the first application was previously installed on the electronic device but was uninstalled without being run.

[0144] In another possible implementation, the initial run of the first application can also refer to the first run of the first application after a version update on the electronic device. It is easy to understand that when the version of the first application is updated, the operations that the first application can perform may change, which may pose a security risk. Therefore, the first run of the first application after a version update can also be defined as the initial run of the first application.

[0145] For example, the first application is APP1, which is downloaded and installed from a pop-up advertising page.

[0146] 605: The first application loads the application monitoring module.

[0147] As an example, the application framework layer includes multiple management modules, one of which is used to manage the installation and uninstallation of applications. For ease of description, this embodiment refers to the management module used to manage the installation and uninstallation of applications as the target management module. Exemplarily, the target management module can be a PMS manager module. In this embodiment, a function can be added to the target management module to control the first application to actively load the application monitoring module of the application framework layer after initialization. That is, in response to the initialization of the first application, the application monitoring module is loaded for the first application; for example, after APP1 is initialized, the target management module loads the application monitoring module of the application framework layer for APP1.

[0148] 606: The application monitoring module sends an AIDL binding request to the connection establishment module.

[0149] The AIDL binding request is used by the connection establishment module to request an AIDL binding between the first application and the application marketplace. As an example, after the application monitoring module is loaded by the first application, it proactively sends an AIDL binding request to the connection establishment module to request an AIDL binding object.

[0150] 607: The connection establishment module sends the AIDL binding object to the application monitoring module.

[0151] As mentioned earlier, since the connection establishment module has pre-stored the AIDL binding object created by the application marketplace, it can send the stored AIDL binding object to the application monitoring module after receiving the AIDL binding request. This allows the application monitoring module to subsequently interact with the application marketplace by calling the execution methods within the AIDL binding object. In other words, once the first application obtains the AIDL binding object created by the monitoring service management module in the application marketplace, it signifies that an AIDL binding has been established between the first application and the application marketplace, thus establishing a communication channel between them.

[0152] 608: The application monitoring module sends a monitoring service registration request to the monitoring service management module.

[0153] As an example, the monitoring service registration request may carry application information for the first application. This application information can be used to uniquely identify the first application. For instance, this application information could be an application identifier for the first application. For example, the application identifier could be an application ID (identity).

[0154] In some embodiments, the first application may be a known application or an unknown application. A known application typically refers to an application known to have no security risks, and is generally downloaded from a known and reliable download source. An unknown application, on the other hand, typically refers to an application that may have security risks. For example, applications downloaded from an app store are generally considered known applications, while applications downloaded from an unknown website are generally considered unknown applications. Therefore, in practice, if the first application is a known application, its behavior may not be monitored; however, if the first application is an unknown application, its behavior will be monitored. In this embodiment, the application monitoring module can send a monitoring service registration request to the app store, sending the application information of the first application to the app store so that the app store can determine whether the first application is a known or unknown application, and thus determine whether to monitor its behavior.

[0155] As an example, during the AIDL binding process, the application monitoring module obtains the AIDL binding object created by the monitoring service management module. This AIDL binding object includes a registration method, which the application monitoring module can then call. At this point, the registration method in the application marketplace is triggered by the AIDL mechanism. Thus, the application monitoring module can send a monitoring service registration request to the monitoring service management module through the registration method. Correspondingly, the monitoring service management module receives the monitoring service registration request through the registration method. In other words, the registration method can be used by the first application and the application marketplace to negotiate how to send or receive monitoring service registration requests, thereby enabling registration communication between the first application and the application marketplace.

[0156] 609: The monitoring service management module determines whether to monitor the interface call events of the first application based on the monitoring service registration request.

[0157] In one possible implementation, the monitoring service management module can obtain a whitelist, which includes application information for known applications. It's easy to understand that the applications indicated in the whitelist are those without security risks, i.e., known applications. The monitoring management service module can determine whether the first application belongs to the whitelist. If the first application is not in the whitelist, it determines to monitor the interface call events of the first application, thus identifying the first application as the application to be monitored. If the first application is in the whitelist, it determines not to monitor the interface call events of the first application, thus identifying the first application as having no security risks.

[0158] For example, the app store can check whether the application identifier of APP1 is in the whitelist. If the application identifier of APP1 is in the whitelist, it means that APP1 is a known application. At this time, it can be determined not to monitor the API call events of APP1. Otherwise, if the application identifier of APP1 is not in the whitelist, it means that APP1 is an unknown application. At this time, it can be determined to monitor the API call events of APP1.

[0159] If the monitoring service management module determines, based on the monitoring service registration request, that it is monitoring the interface call events of the first application to the interface, then proceed to steps 610-614. If the monitoring service management module determines that it is not monitoring the interface call events of the first application to the interface, then proceed to step 615.

[0160] 610: The monitoring service management module updates the application monitoring list and obtains the first monitoring list.

[0161] The first monitoring list includes application information for the first application.

[0162] As an example, the specific implementation of the monitoring service management module updating the application monitoring list may include: the monitoring service management module adding the application information of the first application to the application monitoring list in order to update the application monitoring list.

[0163] It should be noted that this explanation only uses the example of the monitoring service management module recording the first application to be monitored using an application monitoring list. In another embodiment, the monitoring service management module can also use other methods to record the first application to be monitored; for example, the monitoring service management module can also use a set-based approach.

[0164] As another example, the specific implementation of the monitoring service management module updating the application monitoring list may also include: the monitoring service management module adding the application information of the first application to the application monitoring list and marking the status of the first application as pending monitoring.

[0165] In this way, the first monitoring list is obtained by updating the application monitoring list, and the applications to be monitored are recorded in the first monitoring list so that the applications in the first monitoring list can be monitored in batches later.

[0166] As an example, after the monitoring service management module determines the security of the first application, it can update the first monitoring list. As another example, the updated first monitoring list will not include applications that have already undergone security analysis; that is, the application information of the first application can be removed from the first monitoring list, thus avoiding duplicate monitoring of the first application.

[0167] As another example, in the updated first monitoring list, applications that have undergone security analysis are marked as analyzed. Exemplarily, the first application in the first monitoring list has a corresponding indicator, which can be used to indicate whether the first application has undergone security analysis. For example, an indicator of "1" indicates that the first application has undergone security analysis, and an indicator of "0" indicates that the first application has not undergone security analysis. In this case, after determining the security of the first application, the monitoring service management module updates the indicator corresponding to the first application so that the updated indicator indicates that the first application has undergone security analysis. For example, updating the indicator of the first application from "0" to "1" means that the monitoring service management module may not delete the application information of the first application from the first monitoring list after determining its security.

[0168] 611: The monitoring service management module determines whether the preset dynamic monitoring conditions are met.

[0169] Pre-set dynamic monitoring conditions can be configured in advance.

[0170] As an example, preset dynamic monitoring conditions could refer to intervals of a preset time, such as 5 minutes or 30 minutes.

[0171] The preset duration can be set by the user according to actual needs, or it can be set by the default setting of the electronic device. This application embodiment does not limit this.

[0172] As another example, the preset dynamic monitoring condition can refer to the number of applications to be monitored recorded in the first monitoring list reaching a preset value.

[0173] The preset value can be set by the user according to actual needs, or the preset value can be set by the electronic device by default. This application embodiment does not limit this.

[0174] When the preset value is 1, it indicates that the monitoring service management module monitors a single application. When the preset value is greater than 1, it indicates that the monitoring service management module can monitor the security of applications in batches.

[0175] For example, taking a preset value of 2 as an example, when the monitoring service management module determines that the number of applications to be monitored included in the first monitoring list is 2, it can be determined that the preset dynamic monitoring conditions are met.

[0176] If the monitoring service management module determines that the preset dynamic monitoring conditions are met, then proceed to step 612; otherwise, if the preset dynamic monitoring conditions are not met, then proceed to step 615.

[0177] 612: The monitoring service management module sends a monitoring start notification to the application monitoring module.

[0178] In implementation, because the application monitoring module obtains the AIDL binding object created by the monitoring service management module during the AIDL binding process, and this AIDL binding object includes a notification sending method, the monitoring service management module can call this method. At this point, the notification sending method in the first application can be triggered by the AIDL mechanism. Thus, the monitoring service management module can send a monitoring start notification to the first application through the notification sending method. Correspondingly, the application monitoring module receives the monitoring start notification through the notification sending method. In other words, the notification sending method can be used by the application market and the first application to negotiate how to send or receive notifications, thereby achieving communication.

[0179] It should be noted that if the first monitoring list includes application information for multiple applications to be monitored, the monitoring service management module can send monitoring start notifications to each of the multiple applications to be monitored.

[0180] In one embodiment of this application, when the first application corresponds to an indicator, as described above, there may be one or more applications that have already undergone security analysis among the multiple applications to be monitored recorded in the first monitoring list. Therefore, in order to avoid duplicate monitoring, the monitoring service management module can query the indicator of each application among the multiple applications to be monitored in the first monitoring list, and then send a monitoring start notification to the applications that have not undergone security analysis among the multiple applications to be monitored according to the indicator of each application.

[0181] 613: If the first application calls the target interface, the application monitoring module will perform method address replacement.

[0182] Here, "target" refers to an interface that belongs to the interface monitoring list, which can be preset. For example, the interface monitoring list includes interface information for the interfaces to be monitored. This interface information can be used to uniquely identify an interface; for example, the interface information is an interface ID.

[0183] After receiving the monitoring start notification, the application monitoring module can check whether the interface called by the first application belongs to the interface monitoring list during the interface call process. If the called interface belongs to the interface monitoring list, it is determined that the called interface is the target interface; otherwise, if the called interface does not belong to the interface monitoring list, it is determined that the called interface is not the target interface.

[0184] As an example, if the first application calls the target interface, the application monitoring module obtains the interface call event of the first application to the target interface. In implementation, since each interface corresponds to an application programming interface (API) method, and the interface call can be implemented by calling the API method, under normal circumstances, the first application calling the target interface will execute the API method corresponding to the target interface. However, in this embodiment, since it is necessary to monitor the call status of the target interface, the application monitoring module does not call the API method of the target interface at this time, but instead calls the hook method set in the application monitoring module. The application monitoring module can obtain the interface call event of the target interface by executing the hook method, and can call back the API method corresponding to the target interface through the hook method, thereby realizing the monitoring of the interface call status during the call to the target interface.

[0185] Specifically, in Android 5.0 and later, the Android system uses the Art Virtual Machine as its underlying implementation. Each API method in Android is represented by a structure object in the Art Virtual Machine; for example, this structure object is an `artMethod` structure object. In implementation, this can be done using... Figure 7The structure object is defined using the `Method{}` method. Each structure object contains at least one member variable, including a specified member variable, exemplified by `entry_point_from_quick_compiled_code`. This specified member variable is the API method address, which represents the execution entry point of the API method. The API method can be invoked through this entry point. Therefore, the application monitoring module can replace the API method address of the target interface's API method with the hook method address, thereby invoking the hook method based on the hook method address to obtain the interface invocation event of the target interface.

[0186] A hook method can be understood as a backup of the target interface's API methods, with monitoring functionality added before and after the backup. In implementation, the API method address of the target interface can be copied within the hook method, effectively backing up the target interface's API methods. Therefore, calling the hook method not only enables the call to the target interface but also captures the interface call events during the process, achieving the goal of monitoring the target interface's call status.

[0187] As an example, if the interface to be called is not the target interface, the application monitoring module directly calls the API method of the interface.

[0188] It is worth mentioning that the method address replacement method is used in this embodiment. Therefore, there is no need to add monitoring code for the call event at the actual call site of the target interface. Adding or removing the monitoring of the target interface only requires corresponding modifications to the application monitoring module. This makes the monitoring and management of the target interface not strongly coupled with the underlying Android system, thereby ensuring the stability of the system.

[0189] It should be noted that the embodiments in this application are illustrated by the example of the application monitoring module obtaining the interface call event of the target interface when the first application calls the target interface. In another embodiment, the application monitoring module can also obtain the interface call event of the called interface when the first application calls the interface. That is, as long as the first application performs the interface call operation, regardless of whether the called interface is the target interface, the application monitoring module will perform the operation of obtaining the interface call event.

[0190] As an example, an interface call event may include an interface identifier, such as an interface ID. As another example of this application, an interface call event may also include an interface call start time and / or an interface call end time. The interface call start time refers to the time when the interface call begins, and the interface call end time refers to the time when the interface call ends. For example, an interface call event may be an event log entry: "Interface A was called at 15:05:15".

[0191] It is worth mentioning that if the API call event includes the API call start time and / or API call end time, it can improve the accuracy of application market analysis in determining whether an application has security vulnerabilities in some scenarios.

[0192] 614: The application monitoring module reports the interface call event of the first application to the monitoring service management module.

[0193] Specifically, during the AIDL binding process, the application monitoring module obtains the AIDL binding object created by the monitoring service management module. This AIDL binding object includes an event reporting method, which the application monitoring module can then call. At this point, the event reporting method in the application marketplace is triggered by the AIDL mechanism. Thus, the application monitoring module can report interface call events to the application marketplace through this event reporting method. Correspondingly, the application marketplace receives the interface call events through the event reporting method. In other words, the event reporting method can be used by the first application and the application marketplace to negotiate how to send or receive interface call events, thereby enabling reporting communication between the first application and the application marketplace. In other words, the application monitoring module reports interface call events through the communication channel between the first application and the application marketplace, facilitating subsequent security analysis by the application marketplace. For example, the interface call event may include the interface identifier of the target interface and the interface call start time.

[0194] For example, during behavior monitoring, if APP1 calls the user address information retrieval interface 000001, it determines whether interface 000001 belongs to the interface monitoring list. If interface 000001 belongs to the interface monitoring list, it is determined that the interface called by APP1 is the target interface. At this time, APP1 uses the hook method address to replace the API method address of interface 000001 through the application monitoring module, thus APP1 executes the hook method. In the hook method, it reports the interface call event corresponding to APP1 starting to call interface 000001 to the application market. For example, the interface call event includes the interface ID. Then, it calls back the API method corresponding to interface 000001. As an example of this application, after the API method corresponding to interface 000001 finishes execution, it can also continue to report the interface call end time of interface 000001 to the application market.

[0195] In one embodiment, if APP1 calls the interface 000002 that allows the user to agree to the privacy statement, and if interface 000002 is in the interface monitoring list, APP1 reports the interface call event of interface 000002 to the application market in the manner described above.

[0196] It is worth mentioning that if the first application communicates with the app store using existing communication methods, the first application can easily filter out monitoring-related instruction messages sent by the app store, and the first application can choose whether to report its own API calls, allowing it to evade app store monitoring. However, because this embodiment embeds an application monitoring module at the application framework layer, after the first application initializes and runs, it loads the application monitoring module as a runtime module. The application monitoring module establishes a dedicated communication channel for monitoring between the first application and the app store, and monitors and reports the first application's behavior based on this communication channel. This ensures the reliability and effectiveness of monitoring the first application.

[0197] Furthermore, the embodiments of this application are based on the analysis of interface call events reported by the application monitoring module, which does not involve user privacy data, and therefore there is no threat of leaking user data privacy.

[0198] 615: The monitoring and management service module is waiting for the next monitoring service registration request.

[0199] It's easy to understand that if the monitoring service management module determines that it will not monitor the behavior of the first application, it can continue to wait for the next monitoring service registration request from the first application.

[0200] In this embodiment, the electronic device stores the application monitoring module in the application framework layer. After the first application is initialized, the electronic device controls the first application to load the application monitoring module. Once loaded into the process of the first application and becoming a runtime module, the application monitoring module actively interacts with the application marketplace. This means the application marketplace can monitor the behavior of the first application through the application monitoring module. Therefore, the behavior monitoring of the first application no longer involves the application framework layer, decoupling the interface call event reporting mechanism from the system platform. Taking the Android platform as an example, embedding the application monitoring module in the application framework layer will not interfere with the normal operation of the entire Android platform, and changes and upgrades to the Android platform will not affect interface monitoring. Furthermore, subsequent modifications to the application monitoring module in the application framework layer can be used to add and / or delete monitoring points without altering the native Android code, thus avoiding performance loss and ensuring system stability and maintainability.

[0201] It should be noted that the embodiments in this application only illustrate the example of application security analysis performed by an application market. In another embodiment, the security analysis of the application can also be performed by other management applications that integrate monitoring service management modules and behavior analysis modules. In some embodiments, this management application can be referred to as a second application. As an example, a designated application integrating monitoring service management modules and behavior analysis modules can be installed in an electronic device. This designated application is dedicated to analyzing the security of applications in the electronic device; that is, the second application can be the designated application. In this case, a communication channel can be established between the first application and the designated application through the connection establishment module of the application framework layer, so that the designated application can perform behavior monitoring and analysis of the first application through this communication channel. Alternatively, some or all of the modules in the monitoring service management module and behavior analysis module can be deployed in the cloud to perform security analysis of the first application through interaction between the electronic device and the cloud. Exemplarily, the monitoring service management module can be deployed in a known management application in the electronic device, and the behavior analysis module can be deployed in the cloud. In this way, after receiving the interface call event, the monitoring service management module can send the received interface call event to the cloud, and the cloud behavior analysis module can analyze the security of the first application based on the received interface call event.

[0202] The above description uses the method provided in this application embodiment applied to an electronic device as an example. In another embodiment, the method provided in this application embodiment can also be applied to a server. For example, the server can have a second application installed. After the first application is downloaded and installed on the server, during the initialization and operation of the first application, the second application on the server can monitor and analyze the security of the first application. This application embodiment does not limit this aspect.

[0203] Please see Figure 8 , Figure 8 This is a schematic diagram of a security analysis method for an application according to another exemplary embodiment. This method can be applied to the aforementioned electronic device and may specifically include some or all of the following:

[0204] 801 to 802 are the same as those described in 604 to 605 above, and will not be repeated here.

[0205] 803: The application monitoring module sends an AIDL binding request to the monitoring service management module.

[0206] In this embodiment, to ensure the reliability and stability of monitoring the first application, a communication channel can be established between the first and second applications based on the AIDL mechanism. This communication channel is dedicated to the second application's behavior monitoring of the first application. Therefore, the first and second applications need to be bound together via AIDL. After the first application loads the application monitoring module, it can directly send an AIDL binding request to the monitoring service management module. This AIDL binding request instructs the monitoring service management module to return an AIDL binding object.

[0207] As mentioned earlier, an AIDL binding object includes at least one execution method. As an example, an AIDL binding object created by the monitoring service management module may include a registration method, an event reporting method, and a notification sending method. The registration method can be used to register with a second application, the event reporting method can be used to send an interface call event to the second application, and the notification sending method is used by the second application to send a notification message to the first application. For instance, if the first application obtains the AIDL binding object, when the registration method is called by the first application, the first application can initiate a monitoring service registration request to the second application, thereby achieving registration communication between the first and second applications. Similarly, if the event reporting method is called by the first application, the first application can send an interface call event to the second application, thereby achieving reporting communication between the first and second applications. Furthermore, if the notification sending method is called by the second application, the second application can send a monitoring start notification to the first application, instructing the first application to start behavior monitoring.

[0208] 804: The monitoring service management module sends an AIDL binding object to the application monitoring module.

[0209] It should be noted that there is no specific limitation on the timing of the AIDL binding object creation by the monitoring service management module. As an example, the monitoring service management module can create the AIDL binding object before the first application is installed, for example, after the second application runs. As yet another example, the monitoring service management module can also create the AIDL binding object after receiving the first AIDL binding request from the first application for the first time.

[0210] 805: The application monitoring module sends a monitoring service registration request to the monitoring service management module.

[0211] 806: The monitoring service management module determines whether to monitor the interface call events of the first application to the interface.

[0212] 807: If the monitoring service management module determines that the first application being monitored is making an interface call, then update the application monitoring list.

[0213] 808: The monitoring service management module determines whether the preset dynamic monitoring conditions are met.

[0214] 809: If the monitoring service management module determines that the preset dynamic monitoring conditions are met, it will send a monitoring start notification to the application monitoring module.

[0215] 810: If the first application calls the target interface, the application monitoring module will perform method address replacement.

[0216] 811: The application monitoring module reports the interface call events of the first application.

[0217] 812: The monitoring and management service module is waiting for the next monitoring service registration request.

[0218] The specific implementation process of steps 805 to 812 above can be found in the specific implementation process of steps 608 to 615 above, and will not be repeated here.

[0219] It is worth mentioning that, in this embodiment of the application, after the first application loads the application monitoring module, the application monitoring module can directly request the second application to perform AIDL binding. This avoids the need to implant a connection establishment module at the application framework layer, thereby reducing modifications to the Android system.

[0220] Please see Figure 9 Next, we will introduce the execution process of the second application's security analysis of the first application, using the interaction between the monitoring service management module and the behavior analysis module as an example:

[0221] 901: The behavior analysis module requests the interface call event of the first application from the monitoring service management module.

[0222] As an example, after receiving an API call event from a first application, the monitoring service management module can store the API call event along with the application information of the first application. In one possible implementation, the API call events can be stored in a message queue corresponding to the first application information. In practice, the received API call events can be stored in the order they were received. In this way, the behavior analysis module can read the API call events from the message queue.

[0223] As an example, the behavior analysis module can request an interface to invoke an event from the monitoring service management module when the event acquisition conditions are met. These conditions can be preset according to actual needs. For instance, if the event acquisition condition is every preset time interval, the behavior analysis module can request the interface to invoke the event from the monitoring service management module every preset time interval.

[0224] The preset duration can be set by the user according to actual needs, or it can be set by default by the electronic device. This application embodiment does not limit this.

[0225] It should be noted that this explanation only uses the example of the monitoring service management module storing application information and interface call events in a message queue manner. In another embodiment, other methods can also be used to store application information and interface call events. For example, in some embodiments, the monitoring service management module can also use a list method for corresponding storage. For instance, if an interface call event includes an interface identifier, an interface call start time, and an interface call end time, the monitoring service management module can use Table 1 to store the interface call events and the application information of the first application.

[0226] Table 1

[0227]

[0228] 902: The monitoring service management module sends the interface call event of the first application to the behavior analysis module.

[0229] As an example, the monitoring service management module sends the interface call events of the first application to each interface to the behavior analysis module. That is, the first application may call multiple interfaces, and the application monitoring module can report the interface call events of the first application to each interface. In this way, the monitoring service module sends the interface call events of each interface obtained from the application monitoring module to the behavior analysis module.

[0230] It should also be noted that the above explanation uses the example of the behavior analysis module requesting the interface call event of the first application from the monitoring service management module. In another embodiment, the monitoring service management module can also proactively report the interface call event of the first application to the behavior analysis module.

[0231] 903: The behavior analysis module analyzes the security of the first application based on interface call events.

[0232] The behavior analysis module determines whether the first application has any security vulnerabilities based on the interface call events.

[0233] As an example, when the monitoring service management module sends the interface call events of the first application to each interface to the behavior analysis module, the behavior analysis module performs security analysis on the first application based on the interface call events of the first application to each interface.

[0234] As an example, each behavior analysis has a corresponding plugin. Each plugin can have its own analysis logic, allowing analysis of whether the corresponding behavior meets preset conditions to determine if the application has security vulnerabilities. These preset conditions can be set according to actual needs, and different plugins can have different preset conditions. For example, plugin A is a plugin for analyzing the existence of a privacy policy statement. Plugin A can be used to analyze whether a privacy policy statement exists. Its analysis process involves analyzing whether the privacy policy statement interface is called. For example, the preset condition for plugin A could be: the privacy policy statement interface is called. Similarly, plugin B is a plugin for analyzing the issue of collecting data without user consent. Plugin B can be used to analyze the issue of requesting permissions without user consent. Its analysis process involves analyzing whether the order of the privacy policy statement and the user's consent to request permissions meets requirements. For example, the preset condition for plugin B could be: the privacy policy statement occurred before the user's consent to request permissions occurred.

[0235] As an example, if the behavior analysis module determines that the first application has a security risk, such as if it determines that the target interface called by the first application is not within the scope of the first application's calls, then the first application is determined to have a security risk. In this case, an early warning can be issued to provide feedback to the user. For example, a pop-up window can be used to notify the user that some behaviors of the first application during operation have security risks. For specific implementation methods, please refer to the application scenarios section above, which will not be repeated here.

[0236] As an example, the second application can use a message queue to receive the interface call events returned by APP1. The plugin in the behavior analysis module analyzes the interface call events in the message queue. For example, if it is found that APP1 called interface 000001 and interface 000002 within a time period, and the time of calling interface 000001 is earlier than the time of calling interface 000002, it can be considered that APP1 has engaged in malicious behavior of collecting user address information without user consent. At this time, the user can be reminded of the malicious behavior of APP1 through pop-up windows or information prompts, and the user can be advised to uninstall APP1 to avoid leakage of privacy data.

[0237] It is worth mentioning that the embodiments of this application can prevent malicious software from invading users' electronic devices, allowing users to perceive the malicious behavior of installed applications in real time, thereby ensuring the security of users' privacy data.

[0238] It should be understood that the sequence number of each step in the above embodiments does not necessarily imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0239] Corresponding to the security analysis method of the application described in the above embodiments, Figure 10 This is a structural block diagram of a security analysis device for an application provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0240] This security analysis device is configured in an electronic device. The application framework layer of the electronic device includes an application monitoring module. This module monitors interface call events of a first application on the electronic device. Please refer to... Figure 10 The device includes a target management module 1010, an application monitoring module 1020, and a second application 1030.

[0241] Target management module 1010 is used to load the application monitoring module for the first application in response to the initialization and operation of the first application;

[0242] The application monitoring module 1020 is used to obtain the interface call events of the first application to the interface, and report the interface call events to the second application through the communication channel between the first application and the second application.

[0243] The second application 1030 is used to analyze the security of the first application based on the interface call events;

[0244] The second application 1030 is used to issue an early warning when it is determined that the first application has a security risk.

[0245] As an example of this application, the application monitoring module 1020 is used for:

[0246] Call the hook method to obtain the interface call event. The hook method is used to obtain the interface call event of the first application to the interface during the execution of the interface call by the first application.

[0247] As an example of this application, the application monitoring module 1020 is used for:

[0248] Replace the address of the API method to be called with the address of the hook method;

[0249] Hook methods are invoked based on their addresses.

[0250] As an example of this application, the second application 1030 includes a monitoring service management module;

[0251] The application monitoring module 1020 is used to send a monitoring service registration request to the second application. The monitoring service registration request is used to request the second application to determine whether to monitor the interface call events of the first application.

[0252] The monitoring service management module is used to respond to the second application's determination of the interface call event of the first application based on the monitoring service registration request, update the application monitoring list, and obtain the first monitoring list, which includes the application information of the first application.

[0253] As an example of this application, please refer to Figure 11 The second application 1030 includes a monitoring service management module 10301, which is used for:

[0254] When the second application determines that it is monitoring the interface call events of the first application to the interface, it sends a monitoring start notification to the application monitoring module. The monitoring start notification is used to trigger the application monitoring module to obtain the interface call events of the first application to the interface.

[0255] As an example of this application, the monitoring service management module 10301 is also used for:

[0256] Update the first monitoring list;

[0257] In this case, the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.

[0258] As an example of this application, the application monitoring module 1020 is used for:

[0259] If the first application is detected to call the target interface, the call event of the first application to the target interface is identified as an interface call event. The target interface is an interface in the interface monitoring list, which is used to record the interface information of the interface to be monitored.

[0260] As an example of this application, the device includes a target module, which is a connection establishment module for a second application or an application framework layer. The connection establishment module is used to establish a communication channel between the first application and the second application after the first application is initialized and running.

[0261] The application monitoring module is used to send Android Interface Definition Language (AIDL) binding requests to the target module.

[0262] The target module is used to receive AIDL binding requests;

[0263] The target module is used to send an AIDL binding object to the application monitoring module based on the AIDL binding request. The AIDL binding object includes object data used to establish a communication channel.

[0264] Application monitoring module 1020 is used to receive AIDL bound objects.

[0265] As an example of this application, in response to the target module being a connection establishment module, the connection establishment module is used for:

[0266] Obtain the AIDL binding object from the second application.

[0267] As an example of this application, please refer to Figure 11 The second application 1030 includes a monitoring service management module 10301 and a behavior analysis module 10302;

[0268] The monitoring service management module 10301 is used to receive interface call events from the first application to each interface transmitted by the application monitoring module.

[0269] The behavior analysis module 10302 is used to obtain the interface call events of the first application to each interface from the monitoring service management module;

[0270] The behavior analysis module 10302 is used to analyze the security of the first application based on the interface call events of each interface.

[0271] As an example of this application, please refer to Figure 11 The second application includes the 1030 monitoring service management module 10301 and the behavior analysis module 10302;

[0272] The monitoring service management module 10301 is used to receive interface call events transmitted by the application monitoring module;

[0273] The monitoring service management module 10301 is used to report interface call events to the behavior analysis module based on requests from the behavior analysis module.

[0274] The behavior analysis module 10302 is used to analyze the security of the first application based on the interface call event.

[0275] In this embodiment, the application monitoring module is stored in the application framework layer of the electronic device. After the first application is initialized, the electronic device controls the first application to load the application monitoring module. Once loaded into the process of the first application and becoming a runtime module, the application monitoring module actively interacts with the second application. Specifically, the application monitoring module obtains interface call events from the first application and reports these events to the second application through the communication channel between the two applications. The second application then analyzes the behavior of the first application based on these interface call events to determine if any security vulnerabilities exist. This embodiment monitors the behavior of the first application without inserting monitoring code into its application package, avoiding situations where modifications to the application package cause the application to malfunction or lose some functionality, thus ensuring system stability.

[0276] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0277] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0278] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0279] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units through some interfaces, and may be electrical, mechanical, or other forms.

[0280] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0281] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0282] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0283] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A security analysis method for an application, characterized in that, Applied in electronic devices, the application framework layer of the electronic device includes an application monitoring module, which is used to monitor interface call events of a first application to an interface in the electronic device. The method includes: In response to the initialization and operation of the first application, the application monitoring module is loaded into the process of the first application, thus becoming the runtime module of the first application. The application monitoring module acquires the interface call event of the first application to the interface, and reports the interface call event to the second application through the communication channel between the first application and the second application; The second application analyzes the security of the first application based on the interface call events; When the second application determines that the first application has a security risk, the second application will issue a warning.

2. The method as described in claim 1, characterized in that, The application monitoring module acquires the interface call events of the first application to the interface, including: The application monitoring module calls a hook method to obtain the interface call event. The hook method is used to obtain the interface call event of the first application to the interface during the process of the first application executing the interface call.

3. The method as described in claim 2, characterized in that, The application monitoring module calls hook methods, including: The application monitoring module replaces the address of the application interface API method to be called with the address of the hook method. The application monitoring module calls the hook method based on the hook method address.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: The application monitoring module sends an Android Interface Definition Language (AIDL) binding request to the target module. The target module is the second application or the connection establishment module of the application framework layer. The connection establishment module is used to establish a communication channel between the first application and the second application after the first application is initialized and running. The target module receives the AIDL binding request; The target module sends an AIDL binding object to the application monitoring module based on the AIDL binding request. The AIDL binding object includes object data used to establish the communication channel. The application monitoring module receives the AIDL binding object.

5. The method as described in claim 4, characterized in that, In response to the target module establishing the connection, the method further includes: The connection establishment module obtains the AIDL binding object from the second application.

6. The method according to any one of claims 1-3 and 5, characterized in that, Before the application monitoring module obtains the interface call event of the first application to the interface, it also includes: The application monitoring module sends a monitoring service registration request to the second application. The monitoring service registration request is used to request the second application to determine whether to monitor the interface call events of the first application. In response to the second application determining the interface call events of the first application to be monitored based on the monitoring service registration request, the application monitoring list is updated to obtain a first monitoring list, which includes the application information of the first application.

7. The method according to any one of claims 1-3 and 5, characterized in that, The method further includes: If the second application determines that it is monitoring the interface call events of the first application to the interface, it sends a monitoring start notification to the application monitoring module. The monitoring start notification is used to trigger the application monitoring module to obtain the interface call events of the first application to the interface.

8. The method as described in claim 6, characterized in that, The method further includes: Update the first monitoring list; In this case, the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.

9. The method according to any one of claims 1-3, 5 and 8, characterized in that, The application monitoring module acquires the interface call events of the first application to the interface, including: When the application monitoring module detects that the first application calls the target interface, the call event of the first application to the target interface is determined as the interface call event. The target interface is an interface in the interface monitoring list, which is used to record the interface information of the interface to be monitored.

10. The method as described in claim 1, characterized in that, The second application includes a monitoring service management module and a behavior analysis module. The second application analyzes the security of the first application based on the interface call events, including: The monitoring service management module receives the interface call events of the first application to each interface transmitted by the application monitoring module; The behavior analysis module obtains the interface call events of the first application to each interface from the monitoring service management module; The behavior analysis module analyzes the security of the first application based on the interface call events of each interface.

11. The method as described in claim 1, characterized in that, The second application includes a monitoring service management module and a behavior analysis module. The second application analyzes the security of the first application based on the interface call events, including: The monitoring service management module receives the interface call event transmitted by the application monitoring module; The monitoring service management module reports the interface call event to the behavior analysis module based on the request from the behavior analysis module. The behavior analysis module analyzes the security of the first application based on the event call from the interface.

12. A security analysis device for an application, characterized in that, Configured in an electronic device, the application framework layer of the electronic device includes an application monitoring module, which is used to monitor interface call events of a first application to an interface in the electronic device. The device includes a target management module, the application monitoring module, and a second application. The target management module is used to load the application monitoring module into the first application in response to the initialization and operation of the first application, so that the application monitoring module is loaded into the process of the first application and becomes the runtime module of the first application. The application monitoring module is used to acquire the interface call events of the first application to the interface, and report the interface call events to the second application through the communication channel between the first application and the second application. The second application is used to analyze the security of the first application based on the interface call events; The second application is used to issue an early warning when it is determined that the first application has a security risk.

13. The apparatus as claimed in claim 12, characterized in that, The application monitoring module is used for: A hook method is invoked to obtain the interface call event. The hook method is used to obtain the interface call event of the first application to the interface during the process of the first application executing the interface call.

14. The apparatus as claimed in claim 12 or 13, characterized in that, The device includes a target module, which is a connection establishment module for the second application or the application framework layer. The connection establishment module is used to establish a communication channel between the first application and the second application after the first application is initialized and running. The application monitoring module is used to send an Android Interface Definition Language (AIDL) binding request to the target module. The target module is used to receive the AIDL binding request; The target module is configured to send an AIDL binding object to the application monitoring module based on the AIDL binding request, wherein the AIDL binding object includes object data for establishing the communication channel. The application monitoring module is used to receive the AIDL binding object.

15. The apparatus as claimed in claim 12 or 13, characterized in that, The second application includes a monitoring service management module; The application monitoring module is used to send a monitoring service registration request to the second application. The monitoring service registration request is used to request the second application to determine whether to monitor the interface call events of the first application. The monitoring service management module is used to respond to the second application determining the interface call event of monitoring the first application according to the monitoring service registration request, update the application monitoring list, and obtain a first monitoring list, wherein the first monitoring list includes the application information of the first application.

16. The apparatus as claimed in claim 12 or 13, characterized in that, The second application includes a monitoring service management module, which is used for: If the second application determines that it is monitoring the interface call events of the first application to the interface, it sends a monitoring start notification to the application monitoring module. The monitoring start notification is used to trigger the application monitoring module to obtain the interface call events of the first application to the interface.

17. The apparatus as claimed in claim 15, characterized in that, The monitoring service management module is also used for: Update the first monitoring list; In this case, the updated first monitoring list does not include applications that have undergone security analysis, or the status of applications that have undergone security analysis in the updated first monitoring list is marked as analyzed.

18. The apparatus as claimed in claim 12, characterized in that, The second application includes a monitoring service management module and a behavior analysis module; The monitoring service management module is used to receive the interface call events of the first application to each interface transmitted by the application monitoring module. The behavior analysis module is used to obtain the interface call events of the first application to each interface from the monitoring service management module; The behavior analysis module is used to analyze the security of the first application based on the interface call events of each interface.

19. An electronic device comprising a processor and a memory, the memory being configured to store a program supporting the electronic device in performing the method of any one of claims 1-11, and to store data relating to implementing the method of any one of claims 1-11; the processor being configured to execute the program stored in the memory.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-11.

Images