API monitoring method, device, storage medium and equipment

Abstract

The present application discloses an API monitoring method, device, storage medium and equipment, the method comprising: installing an application package on a mobile device to which a mobile application to be tested belongs; after receiving a monitoring instruction issued by a user, controlling the mobile device to deploy the monitoring logic shown in the application package and preset test cases; when controlling the mobile device to start the mobile application to be tested and triggering the mobile application to be tested to run the preset test case, identifying the implementation class monitored by the monitoring logic as the target class; when the target class is called during the running of the preset test case by the mobile application to be tested, determining that the mobile application to be tested calls a sensitive API to collect privacy data. This method does not require artificial implantation of monitoring logic in mobile applications, and can achieve the monitoring logic of deploying sensitive APIs by simply controlling the mobile device to deploy the application package, which can reduce the workload of API monitoring work, thereby effectively reducing labor costs.

Description

Technical Field

[0001] The present application relates to the field of application development, and in particular to an API monitoring method, apparatus, storage medium and device. Background Art

[0002] With the popularization and general use of network and mobile phone technologies, people have paid more attention to the protection of privacy. In the field of monitoring, the application programming interface (API) that collects user privacy data is referred to as sensitive API. How to effectively monitor whether sensitive API is called by mobile applications to collect user privacy data has always been a research focus in the field of mobile application development.

[0003] The existing sensitive API monitoring methods usually require manual testing of each sensitive API in the mobile terminal, and based on the test results of each sensitive API, determine whether the mobile application is calling the sensitive API to collect the user's private data. However, the existing monitoring methods require manual implantation of monitoring logic in the mobile application during the testing process, and different monitoring logics need to be written multiple times for different versions of mobile applications, which increases the workload required for monitoring and increases labor costs. Summary of the invention

[0004] The present application provides an API monitoring method, apparatus, storage medium and device, the purpose of which is to reduce the workload of API monitoring work to effectively reduce labor costs.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] An API monitoring method, comprising:

[0007] Installing an application package on a mobile device to which the mobile application to be tested belongs; the application package includes pre-configured monitoring logic of a sensitive API; the monitoring logic is used to reflectively monitor the execution event of the sensitive API through a preset class name and method name; the execution event is used to indicate stack information of the sensitive API; the stack information includes an implementation class that triggers the call of the sensitive API;

[0008] After receiving the monitoring instruction issued by the user, control the mobile device to deploy the monitoring logic shown in the application package and the preset test case; the preset test case is used to simulate the use scenario of collecting private data without seeking the user's consent;

[0009] When the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run the preset test case, the implementation class monitored by the monitoring logic is identified as a target class;

[0010] When the target class is called during the running of the preset test case by the mobile terminal application to be tested, it is determined that the mobile terminal application to be tested calls the sensitive API to collect the privacy data of the user.

[0011] Optionally, installing the application package on a mobile device to which the mobile terminal application to be tested belongs includes:

[0012] Pre-configure monitoring logic for all sensitive APIs associated with mobile devices;

[0013] Parse the configuration package parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; the sensitive API to be tested is a sensitive API that needs to introduce monitoring logic;

[0014] Generate an application package based on the monitoring logic of the sensitive API to be tested;

[0015] The application package is installed on the mobile device to which the mobile terminal application to be tested belongs.

[0016] Optionally, after receiving the monitoring instruction sent by the user, controlling the mobile device to deploy the monitoring logic shown in the application package and the preset test case includes:

[0017] After receiving the monitoring instruction issued by the user, the mobile device is controlled to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; the preset exception handling logic is used to handle the exceptions generated during the operation of the monitoring logic.

[0018] Optionally, when controlling the mobile device to start the mobile application to be tested and triggering the mobile application to be tested to run the preset test case, after identifying the implementation class monitored by the monitoring logic as the target class, the method further includes:

[0019] When the target class is not called during the execution of the preset test case by the mobile application under test, it is determined that the mobile application under test has not called the sensitive API, the user's privacy data is collected, and a prompt is sent to the user that the mobile application under test has not called the sensitive API.

[0020] Optionally, when the target class is called during the process of the mobile application to be tested running the preset test case, after determining that the mobile application to be tested calls the sensitive API and collects the user's private data, the method further includes:

[0021] Identify the sensitive API to which the monitoring logic for monitoring the target class belongs as the target API;

[0022] Based on the target API and the target class, a test report of the mobile application to be tested is generated, and the test report is sent to the user.

[0023] An API monitoring device, comprising:

[0024] An installation unit is used to install an application package on a mobile device to which the mobile terminal application to be tested belongs; the application package includes a pre-configured monitoring logic of a sensitive API; the monitoring logic is used to reflectively monitor the execution event of the sensitive API through a preset class name and method name; the execution event is used to indicate the stack information of the sensitive API; the stack information includes an implementation class that triggers the call of the sensitive API;

[0025] A deployment unit, configured to control the mobile device to deploy the monitoring logic shown in the application package and preset test cases after receiving a monitoring instruction issued by the user; the preset test cases are used to simulate a usage scenario in which the privacy data is collected without the consent of the user;

[0026] an identification unit, configured to identify the implementation class monitored by the monitoring logic as a target class when controlling the mobile device to start the mobile application to be tested and triggering the mobile application to be tested to run the preset test case;

[0027] The determination unit is used to determine that the mobile terminal application to be tested calls the sensitive API and collects the user's privacy data when the target class is called during the mobile terminal application to be tested runs the preset test case.

[0028] Optionally, the installation unit is specifically used for:

[0029] Pre-configure monitoring logic for all sensitive APIs associated with mobile devices;

[0030] Parse the configuration package parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; the sensitive API to be tested is a sensitive API that needs to introduce monitoring logic;

[0031] Generate an application package based on the monitoring logic of the sensitive API to be tested;

[0032] The application package is installed on the mobile device to which the mobile terminal application to be tested belongs.

[0033] Optionally, the deployment unit is specifically used to:

[0034] After receiving the monitoring instruction issued by the user, the mobile device is controlled to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; the preset exception handling logic is used to handle the exceptions generated during the operation of the monitoring logic.

[0035] A computer-readable storage medium includes a stored program, wherein the program executes the API monitoring method.

[0036] An API monitoring device comprises: a processor, a memory and a bus; the processor and the memory are connected via the bus;

[0037] The memory is used to store programs, and the processor is used to run programs, wherein the API monitoring method is executed when the program is running.

[0038] The technical solution provided by the present application is to install the application package on the mobile device to which the mobile application to be tested belongs. After receiving the monitoring instruction issued by the user, the mobile device is controlled to deploy the monitoring logic shown in the application package, as well as the preset test case. When the mobile device is controlled to start the mobile application to be tested and the preset test case is triggered to run the mobile application to be tested, the implementation class monitored by the monitoring logic is identified as the target class. When the target class is called during the running of the preset test case by the mobile application to be tested, it is determined that the mobile application to be tested calls the sensitive API to collect the user's privacy data. Using the solution shown in the present application, there is no need to manually implant the monitoring logic in the mobile application, nor is there any need to manually develop the monitoring logic. It is only necessary to control the mobile device to deploy the application package, so that the monitoring logic of the sensitive API can be deployed without modifying the underlying logic of the mobile device to which the mobile application to be tested belongs, and the implementation class monitored by the monitoring logic can be used to determine whether the mobile application to be tested calls the sensitive API to collect the user's privacy data. Compared with the prior art, it can reduce the workload of API monitoring work, thereby effectively reducing labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flowchart of an API monitoring method provided in an embodiment of the present application;

[0041] Figure 2 A flowchart of another API monitoring method provided in an embodiment of the present application;

[0042] Figure 3 A schematic diagram of the architecture of an API monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] like Figure 1 As shown, it is a flowchart of an API monitoring method provided in an embodiment of the present application, comprising the following steps:

[0045] S101: Pre-configure monitoring logic for all sensitive APIs associated with the mobile terminal.

[0046] The monitoring logic is used to reflect and monitor the execution events of sensitive APIs through preset class names and method names. The execution events are used to indicate the stack information of sensitive APIs, and the stack information includes the implementation class that triggers the sensitive API calls.

[0047] It should be noted that the sensitive APIs mentioned in the embodiments of the present application include but are not limited to: obtaining user ID monitoring API, obtaining application list monitoring API, network request monitoring API and other APIs.

[0048] S102: Parse the configuration packaging parameters input by the user to obtain a sensitive API configuration table.

[0049] The sensitive API configuration table includes one or more sensitive APIs to be tested, and the sensitive APIs to be tested are sensitive APIs that require the introduction of monitoring logic.

[0050] It should be noted that users can input and configure packaging parameters through the preset front-end interface. For the sensitive API monitoring process, the sensitive APIs tested and called by different types of mobile applications are not the same, and not all sensitive APIs will be called by mobile applications. In order to save computing resources, users can select the sensitive API to be tested according to actual conditions.

[0051] S103: Generate an application package (Android application package, APK) based on the monitoring logic of the sensitive API to be tested.

[0052] S104: Install the APK on the mobile device to which the mobile application to be tested belongs.

[0053] S105: After receiving the monitoring instruction sent by the user, control the mobile device to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the APK.

[0054] Among them, the preset test cases are used to simulate the usage scenarios of collecting privacy data without obtaining user consent, and the preset exception handling logic is used to handle exceptions generated during the operation of the monitoring logic.

[0055] It should be noted that after receiving the monitoring instructions issued by the user, controlling the monitoring logic shown in the APK deployed on the mobile device can ensure that the monitoring logic of the sensitive API to be tested is deployed to the underlying logic of the mobile device only when the sensitive API is monitored, and will not affect the normal operation of other applications on the mobile device. When the sensitive API is not monitored, the monitoring logic will not be deployed in the underlying logic, thereby achieving zero intrusion on the underlying logic.

[0056] Compared with the existing technology, the monitoring logic is manually implanted in the underlying logic of the mobile device. Based on the simple installation feature of APK, the monitoring logic shown in the APK is controlled to be deployed on the mobile device. When the monitoring logic needs to be updated and maintained, there is no need to spend time manually modifying the underlying logic of the mobile device. Only new monitoring logic needs to be redeployed to update the monitoring logic, thereby realizing the plug-in deployment of the monitoring logic.

[0057] The so-called plug-in deployment can also divide the APK according to functional modules, package different functions into different APKs, and then use the preset main APK to load the APK of the corresponding function on demand. The user only needs to install the main APK. The main APK is equivalent to a shell, which will load the APK of other functional modules on demand. When plug-in access is performed, hot update deployment can be completed by simply updating the plug-in APK. By updating the APK using the plug-in deployment method, the installation and deployment of the monitoring logic can be completed in a shorter time, while general large-scale mobile applications take a long time from modifying the underlying code to installation. To this end, the scheme shown in this embodiment can effectively improve the maintenance and update efficiency of the monitoring logic and realize the hot update deployment of the monitoring logic.

[0058] It should be noted that, by using the preset exception handling logic to handle the exceptions generated during the operation of the monitoring logic, it is possible to prevent the monitoring logic with the exception from affecting other normally operating monitoring logics. In the embodiment of the present application, the preset exception handling logic includes but is not limited to the try catch mechanism disclosed in the prior art.

[0059] S106: When the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run a preset test case, the implementation class monitored by the monitoring logic is marked as a target class.

[0060] S107: Determine whether the target class is called during the execution of the preset test case by the mobile application to be tested.

[0061] If the target class is called during the running of the preset test case by the mobile application to be tested, S108 is executed, otherwise S109 is executed.

[0062] S108: Determine that the mobile application to be tested calls a sensitive API, collect the user's privacy data, and identify the sensitive API to which the monitoring logic for monitoring the target class belongs as the target API.

[0063] After executing S108 , the process continues to execute S110 .

[0064] S109: Determine that the mobile application to be tested does not call a sensitive API, collect the user's privacy data, and send a prompt to the user that the mobile application to be tested does not call a sensitive API.

[0065] S110: Generate a test report of the mobile application to be tested based on the target API and the target class, and send the test report to the user.

[0066] In summary, by using the scheme shown in this embodiment, there is no need to manually implant monitoring logic in the mobile application, nor is there any need to manually develop monitoring logic. By simply controlling the mobile device to deploy the APK, the monitoring logic of the sensitive API can be deployed without modifying the underlying logic of the mobile device to which the mobile application to be tested belongs, and the implementation class monitored by the monitoring logic can be used to determine whether the mobile application to be tested calls the sensitive API to collect the user's privacy data. Compared with the existing technology, the workload of API monitoring can be reduced, thereby effectively reducing labor costs.

[0067] It should be noted that S101 mentioned in the above embodiment is an optional implementation of the API monitoring method described in this application. In addition, S110 mentioned in the above embodiment is also an optional implementation of the API monitoring method described in this application. To this end, the process described in the above embodiment can be summarized as follows: Figure 2 The method described.

[0068] like Figure 2 FIG. 1 is a flow chart of another API monitoring method provided in an embodiment of the present application, comprising the following steps:

[0069] S201: Install the application package on the mobile device to which the mobile application to be tested belongs.

[0070] Among them, the application package includes pre-configured monitoring logic of sensitive APIs; the monitoring logic is used to reflect and monitor the execution events of sensitive APIs through preset class names and method names; the execution events are used to indicate the stack information of sensitive APIs; the stack information includes the implementation class that triggers the sensitive API call.

[0071] S202: After receiving the monitoring instruction issued by the user, control the mobile device to deploy the monitoring logic shown in the application package and the preset test cases.

[0072] Among them, the preset test cases are used to simulate usage scenarios where private data is collected without obtaining user consent.

[0073] S203: When the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run a preset test case, the implementation class monitored by the monitoring logic is marked as a target class.

[0074] S204: When the target class is called during the execution of a preset test case by the mobile application to be tested, it is determined that the mobile application to be tested calls a sensitive API to collect the user's private data.

[0075] In summary, by using the scheme shown in this embodiment, there is no need to manually implant monitoring logic in mobile applications, nor is there any need to manually develop monitoring logic. By simply controlling the deployment of application packages on mobile devices, the monitoring logic of sensitive APIs can be deployed without modifying the underlying logic of the mobile device to which the mobile application to be tested belongs, and the implementation class monitored by the monitoring logic can be used to determine whether the mobile application to be tested calls sensitive APIs to collect user privacy data. Compared with the existing technology, the workload of API monitoring can be reduced, thereby effectively reducing labor costs.

[0076] Corresponding to the API monitoring method provided in the above-mentioned embodiment of the present application, the embodiment of the present application also provides an API monitoring device.

[0077] like Figure 3 FIG. 1 is a schematic diagram of an API monitoring device provided in an embodiment of the present application, including:

[0078] The installation unit 100 is used to install the application package on the mobile device to which the mobile application to be tested belongs; the application package includes pre-configured monitoring logic of the sensitive API; the monitoring logic is used to reflect and monitor the execution events of the sensitive API through preset class names and method names; the execution events are used to indicate the stack information of the sensitive API; the stack information includes the implementation class that triggers the sensitive API call.

[0079] Optionally, the installation unit 100 is specifically used to: pre-configure the monitoring logic of all sensitive APIs associated with the mobile terminal; parse the configuration packaging parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; the sensitive API to be tested is a sensitive API that requires the introduction of monitoring logic; based on the monitoring logic of the sensitive API to be tested, generate an application package; and install the application package on the mobile device to which the mobile terminal application to be tested belongs.

[0080] The deployment unit 200 is used to control the monitoring logic shown in the deployment application package and the preset test cases shown in the mobile device after receiving the monitoring instructions issued by the user; the preset test cases are used to simulate the usage scenario of collecting private data without obtaining the user's consent.

[0081] Optionally, the deployment unit 200 is specifically used to: after receiving a monitoring instruction issued by a user, control the mobile device to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; the preset exception handling logic is used to handle exceptions generated during the operation of the monitoring logic.

[0082] The identification unit 300 is used to identify the implementation class monitored by the monitoring logic as a target class when controlling the mobile device to start the mobile application to be tested and triggering the mobile application to be tested to run a preset test case.

[0083] The determination unit 400 is used to determine that the mobile terminal application under test calls a sensitive API and collects the user's privacy data when the mobile terminal application under test calls the target class during the execution of a preset test case.

[0084] Optionally, the determination unit 400 is also used to: when the target class is not called during the execution of a preset test case by the mobile application under test, determine that the mobile application under test has not called a sensitive API, collect the user's privacy data, and send a prompt to the user that the mobile application under test has not called a sensitive API.

[0085] The reporting unit 500 is specifically used to: identify the sensitive API to which the monitoring logic for monitoring the target class belongs as the target API; generate a test report of the mobile application to be tested based on the target API and the target class, and send the test report to the user.

[0086] In summary, by using the scheme shown in this embodiment, there is no need to manually implant monitoring logic in mobile applications, nor is there any need to manually develop monitoring logic. By simply controlling the deployment of application packages on mobile devices, the monitoring logic of sensitive APIs can be deployed without modifying the underlying logic of the mobile device to which the mobile application to be tested belongs, and the implementation class monitored by the monitoring logic can be used to determine whether the mobile application to be tested calls sensitive APIs to collect user privacy data. Compared with the existing technology, the workload of API monitoring can be reduced, thereby effectively reducing labor costs.

[0087] The present application also provides a computer-readable storage medium, which includes a stored program, wherein the program executes the API monitoring method provided by the present application.

[0088] The present application also provides an API monitoring device, including: a processor, a memory, and a bus. The processor and the memory are connected via a bus, the memory is used to store programs, and the processor is used to run programs, wherein when the program is running, the API monitoring method provided by the present application is executed, including the following steps:

[0089] Installing an application package on a mobile device to which the mobile application to be tested belongs; the application package includes pre-configured monitoring logic of a sensitive API; the monitoring logic is used to reflectively monitor the execution event of the sensitive API through a preset class name and method name; the execution event is used to indicate stack information of the sensitive API; the stack information includes an implementation class that triggers the call of the sensitive API;

[0090] After receiving the monitoring instruction issued by the user, control the mobile device to deploy the monitoring logic shown in the application package and the preset test case; the preset test case is used to simulate the use scenario of collecting private data without seeking the user's consent;

[0091] When the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run the preset test case, the implementation class monitored by the monitoring logic is identified as a target class;

[0092] When the target class is called during the running of the preset test case by the mobile terminal application to be tested, it is determined that the mobile terminal application to be tested calls the sensitive API to collect the privacy data of the user.

[0093] Specifically, based on the above embodiment, the step of installing the application package on the mobile device to which the mobile terminal application to be tested belongs includes:

[0094] Pre-configure monitoring logic for all sensitive APIs associated with mobile devices;

[0095] Parse the configuration package parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; the sensitive API to be tested is a sensitive API that needs to introduce monitoring logic;

[0096] Generate an application package based on the monitoring logic of the sensitive API to be tested;

[0097] The application package is installed on the mobile device to which the mobile terminal application to be tested belongs.

[0098] Specifically, based on the above embodiment, after receiving the monitoring instruction issued by the user, controlling the mobile device to deploy the monitoring logic shown in the application package and the preset test case includes:

[0099] After receiving the monitoring instruction issued by the user, the mobile device is controlled to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; the preset exception handling logic is used to handle the exceptions generated during the operation of the monitoring logic.

[0100] Specifically, based on the above embodiment, when the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run the preset test case, after the implementation class monitored by the monitoring logic is identified as the target class, it also includes:

[0101] When the target class is not called during the execution of the preset test case by the mobile application under test, it is determined that the mobile application under test has not called the sensitive API, the user's privacy data is collected, and a prompt is sent to the user that the mobile application under test has not called the sensitive API.

[0102] Specifically, based on the above embodiment, when the target class is called during the process of the mobile application to be tested running the preset test case, after determining that the mobile application to be tested calls the sensitive API and collects the user's privacy data, it also includes:

[0103] Identify the sensitive API to which the monitoring logic for monitoring the target class belongs as the target API;

[0104] Based on the target API and the target class, a test report of the mobile application to be tested is generated, and the test report is sent to the user.

[0105] If the functions described in the method of the embodiment of the present application are implemented in the form of software functional units and sold or used as independent products, they can be stored in a storage medium readable by a computing device. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks or optical disks.

[0106] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0107] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An API monitoring method, characterized in that: include: Installing an application package on a mobile device to which the mobile application to be tested belongs; the application package including pre-configured monitoring logic of sensitive APIs; The monitoring logic is used to reflect and monitor the execution events of the sensitive API through the preset class name and method name; The execution event is used to indicate the stack information of the sensitive API; The stack information includes an implementation class that triggers the sensitive API call; After receiving the monitoring instruction sent by the user, control the mobile device to deploy the monitoring logic shown in the application package and the preset test case; The preset test case is used to simulate the usage scenario of collecting private data without obtaining the user's consent; When the mobile device is controlled to start the mobile application to be tested and the mobile application to be tested is triggered to run the preset test case, the implementation class monitored by the monitoring logic is identified as a target class; When the target class is called during the running of the preset test case by the mobile terminal application to be tested, it is determined that the mobile terminal application to be tested calls the sensitive API to collect the privacy data of the user.

2. The method according to claim 1, characterized in that The step of installing the application package on the mobile device to which the mobile terminal application to be tested belongs includes: Pre-configure monitoring logic for all sensitive APIs associated with mobile devices; Parse the configuration package parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; the sensitive API to be tested is a sensitive API that needs to introduce monitoring logic; Generate an application package based on the monitoring logic of the sensitive API to be tested; The application package is installed on the mobile device to which the mobile terminal application to be tested belongs.

3. The method according to claim 1, characterized in that After receiving the monitoring instruction sent by the user, controlling the mobile device to deploy the monitoring logic shown in the application package and the preset test case includes: After receiving the monitoring instruction issued by the user, the mobile device is controlled to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; the preset exception handling logic is used to handle the exceptions generated during the operation of the monitoring logic.

4. The method according to claim 1, characterized in that In the case of controlling the mobile device to start the mobile terminal application to be tested and triggering the mobile terminal application to be tested to run the preset test case, after marking the implementation class monitored by the monitoring logic as the target class, the method further includes: When the target class is not called during the execution of the preset test case by the mobile application under test, it is determined that the mobile application under test has not called the sensitive API, the user's privacy data is collected, and a prompt is sent to the user that the mobile application under test has not called the sensitive API.

5. The method according to claim 1, characterized in that In the case where the target class is called during the running of the preset test case by the mobile terminal application to be tested, after determining that the mobile terminal application to be tested calls the sensitive API and collects the privacy data of the user, the method further includes: Identify the sensitive API to which the monitoring logic for monitoring the target class belongs as the target API; Based on the target API and the target class, a test report of the mobile application to be tested is generated, and the test report is sent to the user.

6. An API monitoring device, characterized in that: include: An installation unit, used to install an application package on a mobile device to which the mobile application to be tested belongs; the application package includes pre-configured monitoring logic of sensitive APIs; The monitoring logic is used to reflect and monitor the execution events of the sensitive API through the preset class name and method name; The execution event is used to indicate the stack information of the sensitive API; The stack information includes an implementation class that triggers the sensitive API call; A deployment unit, configured to control the mobile device to deploy the monitoring logic shown in the application package and preset test cases after receiving a monitoring instruction issued by a user; The preset test case is used to simulate the usage scenario of collecting private data without obtaining the user's consent; an identification unit, configured to identify the implementation class monitored by the monitoring logic as a target class when controlling the mobile device to start the mobile application to be tested and triggering the mobile application to be tested to run the preset test case; The determination unit is used to determine that the mobile terminal application to be tested calls the sensitive API and collects the user's privacy data when the target class is called during the mobile terminal application to be tested runs the preset test case.

7. The device according to claim 6, characterized in that The installation unit is specifically used for: Pre-configure monitoring logic for all sensitive APIs associated with mobile devices; Parse the configuration package parameters input by the user to obtain a sensitive API configuration table; the sensitive API configuration table includes one or more sensitive APIs to be tested; The sensitive API to be tested is a sensitive API that needs to introduce monitoring logic; Generate an application package based on the monitoring logic of the sensitive API to be tested; The application package is installed on the mobile device to which the mobile terminal application to be tested belongs.

8. The device according to claim 6, characterized in that The deployment unit is specifically used for: After receiving the monitoring instruction issued by the user, control the mobile device to deploy the monitoring logic, preset test cases, and preset exception handling logic shown in the application package; The preset exception handling logic is used to handle the exceptions generated during the operation of the monitoring logic.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the API monitoring method described in any one of claims 1-5.

10. An API monitoring device, characterized in that: include: processor, memory, and bus; The processor is connected to the memory via the bus; The memory is used to store programs, and the processor is used to run programs, wherein the program executes the API monitoring method described in any one of claims 1-5 when running.

Images