Risk identification method and apparatus

Abstract

The application provides a risk identification method and device, which can be used in the financial field or other technical fields. The method comprises the following steps: obtaining a risk label file and fingerprint information of the risk label file sent by a server; saving the risk label file under at least one key file directory of a target application and saving the fingerprint information of the risk label file to a password management system; judging whether the risk label file under the key file directory of the target application is tampered according to the fingerprint information saved in the password management system; and determining that the target application has risks if the risk label file under at least one key file directory is tampered. The device is used for executing the above method. The risk identification method and device provided by the embodiment of the application can greatly improve the risk identification ability of the intelligent terminal application by actively capturing risks, change the current situation of relying on passive defense, and further protect the information and fund safety of the user.

Description

Technical Field

[0001] This invention relates to the financial or other technical fields, specifically to a risk identification method and apparatus. Background Technology

[0002] Currently, mobile application (APP) security defense measures mainly rely on hardening the APK installation package (hardening: APP security vendors add a protective shell to the APK installation package, increasing the difficulty of decompiling and cracking), obfuscating the source code (obfuscation: a series of variable and method name replacements are performed on the code so that the decompiled result is not exactly the same as the source code, increasing the difficulty of reading the source code), and using digital signature certificates for communication.

[0003] Faced with increasingly sophisticated technical attacks, various cracking techniques such as unpacking (unpacking: cracking a hardened APK to remove its protective shell), reverse engineering, and tampering are emerging, making mobile banking applications still highly vulnerable. Summary of the Invention

[0004] To address the problems in the prior art, embodiments of the present invention provide a risk identification method and apparatus that can at least partially solve the problems existing in the prior art.

[0005] On the one hand, the present invention provides a risk identification method, comprising:

[0006] Obtain the risk label file sent by the server and the fingerprint information of the risk label file;

[0007] The risk label file is stored in at least one key file directory of the target application, and the fingerprint information of the risk label file is stored in the password management system.

[0008] Based on the fingerprint information stored in the password management system, determine whether the risk label file in the key file directory of the target application has been tampered with;

[0009] If at least one of the risk label files in the critical file directory is tampered with, the target application is determined to be at risk.

[0010] Optionally, the risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information.

[0011] Optionally, after saving the risk label file in at least one critical file directory of the target application and saving the fingerprint information of the risk label file to the password management system, the method further includes:

[0012] At preset intervals, acquire new risk label files sent by the server, as well as the fingerprint information of the new risk label files;

[0013] The newly obtained risk label file replaces the risk label file in the key file directory of the target application, and the fingerprint information of the newly obtained risk label file replaces the fingerprint information in the password management system.

[0014] Optionally, the server sends the risk label file and the fingerprint information of the risk label file via the Hypertext Transfer Security Protocol.

[0015] Optionally, after determining that the target application poses a risk, the method further includes:

[0016] The device parameter information of the smart terminal is sent to the server so that the server can initiate a target risk control mechanism for the smart terminal.

[0017] Optionally, the target risk control mechanism includes:

[0018] When the smart terminal performs a sensitive operation, the sensitive operation is subjected to strong verification.

[0019] On the other hand, the present invention provides a risk identification device, comprising:

[0020] The acquisition module is used to acquire the risk label file sent by the server and the fingerprint information of the risk label file;

[0021] The storage module is used to save the risk label file in at least one key file directory of the target application and to save the fingerprint information of the risk label file to the password management system.

[0022] The judgment module is used to determine whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information stored in the password management system;

[0023] The determination module is used to determine that the target application has been maliciously attacked if at least one risk label file in the critical file directory has been tampered with.

[0024] Optionally, the risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information.

[0025] Optionally, the acquisition module is further configured to: acquire new risk label files sent by the server and the fingerprint information of the new risk label files at preset intervals;

[0026] The device further includes: a replacement module, used to replace the risk label file in the key file directory of the target application with the new risk label file obtained, and to replace the fingerprint information in the password management system with the fingerprint information of the new risk label file obtained.

[0027] Optionally, the server sends the risk label file and the fingerprint information of the risk label file via the Hypertext Transfer Security Protocol.

[0028] Optionally, the device further includes:

[0029] The sending module is used to send the device parameter information of the smart terminal to the server, so that the server can activate the target risk control mechanism for the smart terminal.

[0030] Optionally, the target risk control mechanism includes: performing strong verification on the sensitive operation when the smart terminal performs a sensitive operation.

[0031] In another aspect, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the risk identification method described in any of the above embodiments.

[0032] In another aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the risk identification method described in any of the above embodiments.

[0033] The present invention also provides a computer program product, the computer program product comprising a computer program, which, when executed by a processor, implements the steps of the risk identification method described in any of the above embodiments.

[0034] The risk identification method and apparatus provided in this invention acquires a risk label file sent by a server and the fingerprint information of the risk label file; saves the risk label file in at least one key file directory of the target application and saves the fingerprint information of the risk label file to a password management system; determines whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information saved in the password management system; if the risk label file in at least one key file directory has been tampered with, it is determined that the target application is at risk. In this way, by proactively capturing risks, the risk identification capability of smart terminal applications can be significantly improved, changing the current reliance on passive defense and further protecting users' information and financial security; the setting of the risk label file is isolated from normal business operations, is imperceptible to ordinary users, avoids the risk of misjudgment, and does not cause compatibility issues due to obfuscated code; moreover, the content of the risk label file can be flexibly changed and upgraded according to specific business content, making it difficult for illegal attackers to crack and guess. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0036] Figure 1 This is a flowchart illustrating a risk identification method provided in an embodiment of the present invention.

[0037] Figure 2 This is a partial flowchart of a risk identification method provided in an embodiment of the present invention.

[0038] Figure 3 This is a schematic diagram of the structure of a risk identification device proposed in an embodiment of the present invention.

[0039] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily ordered.

[0041] The terms "first," "second," etc., used in this document do not specifically refer to any order or sequence, nor are they intended to limit the invention; they are merely used to distinguish elements or operations described using the same technical terms.

[0042] The terms “include,” “including,” “have,” “contain,” etc., used in this article are all open-ended terms, meaning that they include but are not limited to.

[0043] The term "and / or" as used in this document includes any or all of the items mentioned.

[0044] The acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0045] The risk identification method provided in this embodiment of the invention can be executed by a computer, among other things.

[0046] Figure 1 This is a flowchart illustrating a risk identification method provided in an embodiment of the present invention, which can be applied to smart terminals, such as... Figure 1 As shown, the risk identification method provided in this embodiment of the invention includes:

[0047] S101. Obtain the risk label file sent by the server and the fingerprint information of the risk label file;

[0048] In this step, after the target application is installed on the smart terminal, such as a banking app on a mobile phone, when a connection is first established with the server via the network, the server sends a risk label file and the corresponding fingerprint information (e.g., MD5 value) to the smart terminal. The risk label file includes actively distributed decoy information. When attempting to crack the application or launch an attack, malicious attackers will try to tamper with this decoy information to achieve their illegal purposes.

[0049] S102, save the risk label file in at least one key file directory of the target application, and save the fingerprint information of the risk label file to the password management system;

[0050] In this step, after receiving the risk label file and its fingerprint information from the server, the smart terminal can copy the risk label file multiple times and save it to multiple vulnerable key file directories of the target application. Which files in the target application are vulnerable key files can be specified in advance based on the characteristics of the target application. The fingerprint information of the risk label file is then saved to the smart terminal's password management system, for example, in the case of a mobile phone, to the phone's keychain or a local file used to store passwords.

[0051] S103. Determine whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information stored in the password management system;

[0052] In this step, when malicious attackers attempt to crack an application or launch an attack, they will try every means to scan the critical information in the various file directories of the app. They will believe that the decoy information in the risk label file preset in step S102 is the sensitive information they want to obtain, and will try to tamper with this information to achieve their illegal purposes. At the same time, some flashing tools or emulators may also change this information, causing the target application to run on a risky device.

[0053] Since a change to a file will inevitably lead to a change in its fingerprint information, the smart terminal can periodically detect whether the risk label file has changed based on the fingerprint information stored in the password management system, such as the MD5 value in the mobile phone keychain. Since the decoy information in the risk label file has no actual business or technical significance, and these values ​​are not modified in normal business processes, it can be determined that the risk label file has been illegally tampered with when the risk label file changes.

[0054] S104. If at least one risk label file in the critical file directory is tampered with, then the target application is determined to be at risk.

[0055] In this step, if the risk label file exists in multiple key file directories of the target application, and the risk label file in at least one of the key file directories is tampered with, then the target application is determined to be at risk.

[0056] The risk identification method provided in this invention involves acquiring a risk label file sent by a server and its fingerprint information; storing the risk label file in at least one critical file directory of the target application and storing the fingerprint information of the risk label file in a password management system; determining whether the risk label file in the critical file directory of the target application has been tampered with based on the fingerprint information stored in the password management system; and determining whether the risk label file in at least one critical file directory has been tampered with if the risk label file in at least one critical file directory has been tampered with. This proactive risk detection significantly improves the risk identification capabilities of smart terminal applications, changing the current reliance on passive defense and further protecting user information and financial security. The risk label file is isolated from normal business operations, is imperceptible to ordinary users, avoids the risk of misjudgment, and does not cause compatibility issues due to obfuscated code. Furthermore, the content of the risk label file can be flexibly changed and upgraded according to specific business content, making it difficult for malicious attackers to crack and decipher.

[0057] Optionally, the risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information.

[0058] In this embodiment, the timestamp is a string used to identify time, such as 20211206150611, which represents 15:06:11 on December 6, 2021; the operating system version number is a string used to identify the operating system version, such as Android 9.0, which represents Android operating system version 9.0; the user status is a string used to identify whether the user is active, such as true for active and false for inactive; and the transaction information is a sequence number used to identify specific transaction information, which can be generated according to certain business rules. The above four key pieces of information can be generated based on the information of the smart terminal on which the target application is installed and / or the user information of the target application. For example, the timestamp is the time when the target application first establishes a connection with the server through the network; the operating system version number is the operating system version number of the smart terminal; the user status is the status of the user of the target application; and the transaction information is the sequence number of one of the specific transaction information of the user of the target application.

[0059] The four key pieces of information mentioned above can also be randomly generated, as long as each piece of information conforms to the corresponding information format and can serve as a decoy. The risk label file may also include other types of information, not limited to the four types mentioned above. This embodiment uses the four types of information mentioned above as examples to introduce the generation process of the risk label file and its fingerprint information:

[0060] Step 1: The server selects one or more of the above four key pieces of information using a random algorithm.

[0061] Step 2: Based on the selected key information, randomly select corresponding values ​​from the sample library to fill in the blanks.

[0062] In this step, the sample library contains the value databases of the four key information types mentioned above. Based on the selected key information, a value is randomly selected from the value database of that key information as the field value of that key information.

[0063] Step 3: Combine the values ​​of the key elements in order and write them into the corresponding risk label file.

[0064] In this step, the values ​​of key elements are combined sequentially to generate risk labels (strings), which are then written into the corresponding risk label file.

[0065] Step 4: Generate and save the MD5 value of the risk label file.

[0066] In this step, the MD5 value of the risk label file can be generated using the MD5 message digest algorithm. When verifying whether the risk label file has been tampered with on the smart terminal, the same algorithm is used to calculate the MD5 value of the risk label file in the key file directory.

[0067] like Figure 2 As shown, optionally, after saving the risk label file in at least one critical file directory of the target application and saving the fingerprint information of the risk label file to the password management system, the method further includes:

[0068] S105. At preset intervals, acquire new risk label files sent by the server and the fingerprint information of the new risk label files;

[0069] In this step, the target application on the smart terminal can request a new risk label file and corresponding fingerprint information from the server at preset intervals. After receiving the request from the smart terminal, the server can generate a new risk label file and its fingerprint information according to the risk label file and fingerprint information generation process in the above embodiment, and return it to the smart terminal.

[0070] S106, replace the risk label file in the key file directory of the target application with the obtained new risk label file, and replace the fingerprint information in the password management system with the fingerprint information of the obtained new risk label file.

[0071] In this step, after receiving a new risk label file and its fingerprint information from the server, the smart terminal replaces the risk label file in the target application's critical file directory with the new risk label file, and replaces the fingerprint information in the password management system with the fingerprint information from the new risk label file. This achieves the effect of flexible risk label file upgrades and increased resistance to cracking.

[0072] Optionally, the server sends the risk label file and the fingerprint information of the risk label file via the Hypertext Transfer Security Protocol.

[0073] In this embodiment, the server sends the risk label file and the fingerprint information to the smart terminal via HTTPS, thereby encrypting the data transmission and ensuring its security.

[0074] Optionally, after determining that the target application poses a risk, the method may further include: sending the device parameter information of the smart terminal to the server, so that the server initiates a target risk control mechanism for the smart terminal.

[0075] In this embodiment, after determining that the target application installed locally poses a risk, the smart terminal sends its own device parameter information to the server, so that the server can activate the target risk control mechanism for the smart terminal to ensure the security of the target application when used on the smart terminal.

[0076] Optionally, the target risk control mechanism includes: performing strong verification on the sensitive operation when the smart terminal performs a sensitive operation.

[0077] In this embodiment, the sensitive operation refers to operations related to user privacy and user fund security. For example, when the target application is a bank app, the sensitive operation may include a transfer operation. According to a pre-set risk control plan, when the smart terminal performs a sensitive operation, it ensures that the device requires strong verification and other risk control measures. For instance, when performing a transfer operation on the smart terminal, in addition to regular key verification, facial recognition and other verification measures are also required.

[0078] It should be noted that the user information in the embodiments of this application is obtained through legal and compliant means, and the acquisition, storage, use, and processing of user information are authorized and agreed upon by the customer.

[0079] The risk identification method provided in this invention has the following advantages compared with previous passive security solutions for mobile applications that mainly rely on hardening and obfuscation:

[0080] 1. Take the initiative to identify and address risks.

[0081] 2. It is isolated from normal business operations, so it is not noticeable to ordinary users, and there is no risk of being misjudged or compatibility issues caused by obfuscated code.

[0082] 3. The content of the risk label file can be flexibly changed and upgraded according to specific business content, making it difficult for illegal attackers to crack and guess.

[0083] Figure 3 This is a schematic diagram of the structure of a risk identification device according to an embodiment of the present invention, as shown below. Figure 3 As shown in the figure, a risk identification device proposed in an embodiment of the present invention includes:

[0084] The acquisition module 21 is used to acquire the risk label file sent by the server and the fingerprint information of the risk label file;

[0085] The storage module 22 is used to store the risk label file in at least one key file directory of the target application and to store the fingerprint information of the risk label file in the password management system.

[0086] The judgment module 23 is used to determine whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information stored in the password management system;

[0087] The determination module 24 is used to determine that the target application has been maliciously attacked if at least one risk label file in the critical file directory has been tampered with.

[0088] The risk identification device provided in this invention acquires a risk label file sent by a server and the fingerprint information of the risk label file; saves the risk label file in at least one key file directory of the target application and saves the fingerprint information of the risk label file to a password management system; determines whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information saved in the password management system; if the risk label file in at least one key file directory has been tampered with, it is determined that the target application is at risk. In this way, by proactively capturing risks, the risk identification capability of smart terminal applications can be significantly improved, changing the current situation of relying on passive defense and further protecting users' information and financial security; the setting of the risk label file is isolated from normal business operations, is imperceptible to ordinary users, avoids the risk of misjudgment, and does not cause compatibility issues due to obfuscated code; moreover, the content of the risk label file can be flexibly changed and upgraded according to specific business content, making it difficult for illegal attackers to crack and guess.

[0089] Optionally, the risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information.

[0090] Optionally, the acquisition module is further configured to: acquire new risk label files sent by the server and the fingerprint information of the new risk label files at preset intervals;

[0091] The device further includes: a replacement module, used to replace the risk label file in the key file directory of the target application with the new risk label file obtained, and to replace the fingerprint information in the password management system with the fingerprint information of the new risk label file obtained.

[0092] Optionally, the server sends the risk label file and the fingerprint information of the risk label file via the Hypertext Transfer Security Protocol.

[0093] Optionally, the device further includes:

[0094] The sending module is used to send the device parameter information of the smart terminal to the server, so that the server can activate the target risk control mechanism for the smart terminal.

[0095] Optionally, the target risk control mechanism includes: performing strong verification on the sensitive operation when the smart terminal performs a sensitive operation.

[0096] The embodiments of the device provided in this invention can be used to execute the processing flow of the above-described method embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above-described method embodiments.

[0097] It should be noted that the risk identification method and apparatus provided in the embodiments of the present invention can be used in the financial field, or in any technical field other than the financial field. The embodiments of the present invention do not limit the application field of the risk identification method and apparatus.

[0098] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the electronic device may include a processor 301, a communications interface 302, a memory 303, and a communication bus 304, wherein the processor 301, the communications interface 302, and the memory 303 communicate with each other via the communication bus 304. The processor 301 can call logical instructions in the memory 303 to execute the methods described in any of the above embodiments, such as: acquiring a risk label file sent by a server and fingerprint information of the risk label file; storing the risk label file in at least one key file directory of the target application; storing the fingerprint information of the risk label file in a password management system; determining whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information stored in the password management system; and determining that the target application is at risk if at least one risk label file in the key file directory has been tampered with.

[0099] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0100] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the methods provided in the above-described method embodiments, such as: obtaining a risk label file sent by a server and fingerprint information of the risk label file; saving the risk label file in at least one key file directory of the target application and saving the fingerprint information of the risk label file to a password management system; determining whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information saved in the password management system; and determining that the target application is at risk if at least one risk label file in the key file directory has been tampered with.

[0101] This embodiment provides a computer-readable storage medium storing a computer program that causes a computer to execute the methods provided in the above-described method embodiments. For example, the methods include: acquiring a risk label file sent by a server and fingerprint information of the risk label file; storing the risk label file in at least one critical file directory of a target application; storing the fingerprint information of the risk label file in a password management system; determining whether the risk label file in the critical file directory of the target application has been tampered with based on the fingerprint information stored in the password management system; and determining that the target application is at risk if at least one risk label file in the critical file directory has been tampered with.

[0102] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0103] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0104] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0106] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0107] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A risk identification method, characterized in that, include: Obtain the risk label file sent by the server and the fingerprint information of the risk label file; The risk label file is stored in at least one key file directory of the target application, and the fingerprint information of the risk label file is stored in the password management system. Based on the fingerprint information stored in the password management system, it is determined whether the risk label file in the key file directory of the target application has been tampered with; wherein, the change of the risk label file causes a change in the fingerprint information of the file; If at least one of the risk label files in the critical file directory is tampered with, the target application is determined to be at risk. The risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information; the risk label file will not be modified during normal business processes. The process of generating the risk label file and its fingerprint information specifically includes: the server using a random algorithm to select one or more of the aforementioned timestamps, operating system version numbers, user status, and transaction information; randomly selecting corresponding values ​​from a sample library to fill in the selected key information; wherein, the sample library stores value libraries of the aforementioned four key information types, and randomly selecting a corresponding value means randomly selecting a value from the value library of the corresponding key information as the field value of that key information; after sequentially combining the values ​​of the key information, a risk label is generated and written into the corresponding risk label file; wherein, the risk label is a string; and the MD5 value of the risk label file is generated and saved.

2. The method according to claim 1, characterized in that, After saving the risk label file in at least one critical file directory of the target application and saving the fingerprint information of the risk label file to the password management system, the method further includes: At preset intervals, acquire new risk label files sent by the server, as well as the fingerprint information of the new risk label files; The newly obtained risk label file replaces the risk label file in the key file directory of the target application, and the fingerprint information of the newly obtained risk label file replaces the fingerprint information in the password management system.

3. The method according to claim 1, characterized in that, The server sends the risk label file and its fingerprint information via the Hypertext Transfer Security Protocol (HTTP).

4. The method according to any one of claims 1 to 3, characterized in that, After determining that the target application poses a risk, the method further includes: The device parameter information of the smart terminal is sent to the server so that the server can initiate a target risk control mechanism for the smart terminal.

5. The method according to claim 4, characterized in that, The target risk control mechanism includes: When the smart terminal performs a sensitive operation, the sensitive operation is subject to multiple verifications.

6. A risk identification device, characterized in that, include: The acquisition module is used to acquire the risk label file sent by the server and the fingerprint information of the risk label file; The storage module is used to save the risk label file in at least one key file directory of the target application and to save the fingerprint information of the risk label file to the password management system. The judgment module is used to determine whether the risk label file in the key file directory of the target application has been tampered with based on the fingerprint information stored in the password management system; wherein, the change of the risk label file causes the fingerprint information of the file to change; The determination module is used to determine that the target application has been maliciously attacked if at least one risk label file in the critical file directory has been tampered with. The risk label file includes at least one of the following information: timestamp, operating system version number, user status, and transaction information; the risk label file will not be modified during normal business processes. The process of generating the risk label file and its fingerprint information specifically includes: the server using a random algorithm to select one or more of the aforementioned timestamps, operating system version numbers, user status, and transaction information; randomly selecting corresponding values ​​from a sample library to fill in the selected key information; wherein, the sample library stores value libraries of the aforementioned four key information types, and randomly selecting a corresponding value means randomly selecting a value from the value library of the corresponding key information as the field value of that key information; after sequentially combining the values ​​of the key information, a risk label is generated and written into the corresponding risk label file; wherein, the risk label is a string; and the MD5 value of the risk label file is generated and saved.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 5.

Images