Method for determining function type and electronic device

Abstract

The application provides a method for determining function types and an electronic device, and relates to the technical field of terminals. The method comprises the following steps: if a first device detects that a to-be-identified application program interface (API) function is called, acquiring a function feature set of the to-be-identified API function, wherein the function feature set comprises at least one of a class name, a return value, a function name and a function parameter; inputting the function feature set into an API function identification model by the first device, and obtaining a function type of the to-be-identified API function. The technical scheme provided by the application improves the identification efficiency and accuracy of API functions and reduces the identification cost.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a method for determining function types and an electronic device. Background Technology

[0002] With the development of terminal technology, the application of various electronic devices is becoming increasingly widespread. The operation of electronic devices relies on various application programming interface (API) functions. These API functions can be used to implement different functions, such as obtaining the current location of the electronic device, obtaining the image in the viewfinder of the electronic device, and so on.

[0003] In existing technologies, API functions of different function types can be manually labeled in advance. If an electronic device needs to process an API function of a specific function type, it can find the API function of that specific function type according to the label corresponding to that specific function type.

[0004] However, manual labeling is not only labor-intensive but also difficult to accurately label these API functions, resulting in low efficiency and accuracy in API function identification, as well as high cost. Summary of the Invention

[0005] In view of this, this application provides an electronic device for determining function types, which can improve the efficiency and accuracy of API function identification and reduce the cost of identification.

[0006] To achieve the above objectives, in a first aspect, embodiments of this application provide a method for determining function types, including:

[0007] If the first device detects that the API function to be identified has been called, it obtains the function feature set of the API function to be identified, wherein the function feature set includes at least one of class name, return value, function name and function parameters;

[0008] The first device inputs the function feature set into the API function recognition model to obtain the function type of the API function to be recognized.

[0009] In some embodiments, when the first device detects that any API function (or a specific API function) is called by any application (or a specific application), it can identify the any API function (or the specific API function) as an API function to be identified and obtain the set of function features of the API function to be identified.

[0010] In this embodiment, since any API function of any function type will have function characteristics matching that function type, if the first device detects that the API function to be identified has been called, it can obtain the set of function characteristics of the API function being identified. This set of function characteristics includes at least one of the following: class name, return value, function name, and function parameters. Then, the set of function characteristics is input into the API function identification model, thereby identifying the API function to be identified through the preset API function identification model and obtaining the function type of the API function to be identified. Compared with manual labeling, this improves the efficiency and accuracy of identification and reduces the cost of identification.

[0011] Optionally, the API function recognition model includes a modular classification learning model.

[0012] Among them, the modular classification learning model can extract general classification rules from a large amount of empirical data. These classification rules are not only more intuitive in expression, making them easier for users to understand and operate, but also cover positive examples as much as possible and reduce negative examples. In other words, they can minimize inaccurate classification rules, thereby improving the accuracy of API function identification.

[0013] In some embodiments, multiple first sample API functions can be represented as a sample space X(x1, x2, x3, ..., xi, ...), where xi represents the i-th first sample API function; the function features of the i-th first sample API function xi can be represented as a feature space A(ai1, ai2, ai3, ..., aij, ...), where aij represents the j-th function feature of the i-th first sample API function xi; the function type of API function classification can be represented as a range space Y(y1, y2, ..., yk, ...), where yk represents the k-th function type. The recognition results of multiple training samples can be represented as multiple tuples, i.e., D = (<x1,y1> , ...,<xi,yk> ,...),<xi,yk> Let yk represent the function type of the i-th first sample API function xi. Here, i, j, and k are all positive integers.

[0014] In some embodiments, the value space Y represents a specific function type, and yi can represent the subtypes included in that specific function type, which can correspond to a class name. For example, if the specific function type is to leak user privacy, and the corresponding class names include location, SMS, log, and phone number, then the value space Y can include four elements, which correspond to location, SMS, log, and phone number, respectively.

[0015] Optionally, before the first device inputs the function feature set into a preset API function recognition model, the method further includes:

[0016] The first device acquires multiple first sample API functions, each of which has at least one function feature among the class name, the return value, the function name, and the function parameters, and each of the first sample API functions is labeled with a corresponding function type;

[0017] The first device obtains the API function recognition model based on at least one function feature of each of the first sample API functions and the function type labeled by each of the first sample API functions.

[0018] It should be noted that each of the first sample API functions has at least one of the following function characteristics: class name, return value, function name, and function parameters, and different API functions may have different function characteristics.

[0019] Optionally, the method further includes:

[0020] If the function type is a target function type, then the first device obtains the first tracking data based on the API function to be identified;

[0021] The first device determines the first propagation path of the first data to be tracked.

[0022] In some embodiments, the first device may determine the return value of the API function to be identified as the first data to be tracked. Of course, in practical applications, the first device may also obtain the first data to be tracked based on the API function to be identified in other ways. For example, the first device may determine the data processed by the API function to be identified as the first data to be tracked.

[0023] Optionally, the method further includes:

[0024] The first device adds a tracking marker to the first data to be tracked based on the target function type.

[0025] The tracking marker facilitates subsequent identification and tracking of the first data to be tracked. The first device can store the first data to be tracked in correspondence with the tracking marker that marks the first data to be tracked. The storage location can be memory, register, or cache, or it can be stored in other locations.

[0026] In some embodiments, API functions that may leak user privacy (i.e., functions of the type that leak user privacy) can be called tainted functions, and correspondingly, the first data to be tracked can be called tainted data, and the added tracking tag can be a tainted tag.

[0027] Optionally, the first device determines the first propagation path of the first data to be tracked, including:

[0028] If the first device detects that a first processing operation has been performed on the first data to be tracked, then the tracking marker is deleted.

[0029] In some embodiments, if the first device detects that a first processing operation has been performed on the first data to be tracked, it may stop tracking the first data to be tracked; of course, the first device may also continue to track the first data to be tracked if it detects that a first processing operation has been performed on the first data to be tracked.

[0030] The first propagation path may include a first source point, a first convergence point, and at least one first processing operation. If the first data to be tracked undergoes at least one first processing operation and propagates to the first convergence point, the data propagated to the first convergence point is the second data to be tracked. The second data to be tracked can be obtained by processing the first data to be tracked through at least one first processing operation; that is, the second data to be tracked can be the same as the first data to be tracked or generated based on the first data to be tracked.

[0031] In some embodiments, if the objective function type is a user privacy leakage type, the first device can also assess the risk of user privacy leakage, and the first device can indicate the assessment result through the first detection result, thereby promptly reminding the user when a risk of user privacy leakage is detected. In some embodiments, if the objective function type is a user privacy leakage type, the first data to be tracked has not undergone harmless processing such as encryption or obfuscation during its propagation from the first source point to the first convergence point, and the first convergence point points to the first storage location in the first device, then the first device can determine that the risk of user privacy leakage is high. In some embodiments, if the objective function type is a user privacy leakage type, the first data to be tracked has undergone harmless processing such as encryption or obfuscation during its propagation from the first source point to the first convergence point, and the first convergence point points to the first storage location in the first device, then the first device can determine that the risk of user privacy leakage is low. The first storage location may include a storage location with lower security, such as a log.

[0032] In some embodiments, the first device may also output a first detection result when determining a first propagation path. The first detection result may include the first propagation path.

[0033] Optionally, the first processing operation corresponds to the target function type.

[0034] Optionally, the first propagation path includes a first convergence point, and the method further includes:

[0035] If the first convergence point points to the second device, the first device sends tracking instruction information to the second device. The tracking instruction information is used to instruct the second device to determine the second propagation path of the second data to be tracked in the second device. The second data to be tracked is the same as the first data to be tracked, or the second data to be tracked is generated based on the first data to be tracked.

[0036] The second device can be any device other than the first device. If the first aggregation point sends the second data to be tracked to the local end of the first device (such as a log, SD card, or other storage medium), then the first aggregation point is determined to point to the first device; if the first aggregation point is an API function used for network communication, such as write, then the first aggregation point is determined to point to an external second device.

[0037] Optionally, before the first device sends tracking indication information to the second device, the method further includes:

[0038] The first device acquires a first data packet to be sent to the second device based on the first aggregation point, and the original packet body of the first data packet includes the second data to be tracked;

[0039] The first device generates a second data packet based on the tracking indication information and the original packet body of the first data packet;

[0040] The first device sends tracking indication information to the second device, including:

[0041] The first device sends the second data packet to the second device.

[0042] Hook technology can intercept and modify API functions, thereby changing their execution behavior. Therefore, the first device can use hook technology to intercept the first data packet from the first aggregation point, parse the first data packet, obtain the original packet body, which may include second data to be tracked. Then, the packet body and tracking indication information are repackaged and encapsulated to obtain the second data packet.

[0043] Optionally, the tracking indication information includes first position indication information, first length indication information, and first function type indication information;

[0044] Wherein, the first position indication information is used to indicate the position of the second data to be tracked in the original package body, the first length indication information is used to indicate the length of the first data to be tracked, and the first function type indication information is used to indicate the target function type.

[0045] In some embodiments, the first location indication information may be the offset of the second data to be tracked within the original package.

[0046] Optionally, the tracking indication information further includes first identification information, second length indication information, and third length indication information;

[0047] Wherein, the first identification information is used to indicate that the second data packet carries the first data to be tracked, the second length indication information is used to indicate the length of the tracking indication information, and the third length indication information is used to indicate the length of the second data packet.

[0048] Optionally, the tracking indication information further includes a first checksum, which is used to verify the second data packet.

[0049] In some embodiments, the first device may send a first propagation path to the second device, and correspondingly, the second device may send a second propagation path to the first device, thereby enabling the first device and the second device to determine the complete data propagation path and improve the accuracy of data tracking.

[0050] Optionally, the target function type is the user privacy leakage type, the first data to be tracked includes user privacy information, and the first processing operation includes at least one of encryption operation and obfuscation operation.

[0051] Secondly, embodiments of this application provide a data processing method, including:

[0052] If the first device determines that the first convergence point of the first propagation path points to the second device, then the first device sends tracking instruction information to the second device. The first propagation path is obtained by the first device when it determines that the function type of the API function to be identified is the target function type, based on the API function to be identified, obtaining the first data to be tracked, and tracking the first data to be tracked. The tracking instruction information is used to instruct the second device to determine the second propagation path of the second data to be tracked in the second device. The second data to be tracked is the same as the first data to be tracked, or the second data to be tracked is generated by the first device based on the first data to be tracked.

[0053] In this embodiment, when the function type of the API function to be identified is determined to be the target function type, the first device can obtain the first data to be tracked based on the API function to be identified, track the first data to be tracked to obtain the first propagation path, and determine that the first convergence point of the first propagation path points to the second device. Then, the first device can send tracking instruction information to the second device, thereby instructing the second device to determine the second propagation path of the second data to be tracked that is the same as or based on the first data to be tracked. In other words, cross-device data tracking can be achieved, which improves the accuracy of data tracking.

[0054] Optionally, before the first device sends tracking indication information to the second device, the method further includes:

[0055] The first device acquires a first data packet to be sent to the second device based on the first aggregation point, and the original packet body of the first data packet includes the second data to be tracked;

[0056] The first device generates a second data packet based on the tracking indication information and the original packet body of the first data packet;

[0057] The first device sends tracking indication information to the second device, including:

[0058] The first device sends the second data packet to the second device.

[0059] Optionally, the tracking indication information includes first position indication information, first length indication information, and first function type indication information;

[0060] Wherein, the first position indication information is used to indicate the position of the second data to be tracked in the original package body, the first length indication information is used to indicate the length of the first data to be tracked, and the first function type indication information is used to indicate the target function type.

[0061] Optionally, the tracking indication information further includes first identification information, second length indication information, and third length indication information;

[0062] Wherein, the first identification information is used to indicate that the second data packet carries the first data to be tracked, the second length indication information is used to indicate the length of the tracking indication information, and the third length indication information is used to indicate the length of the second data packet.

[0063] Optionally, the tracking indication information further includes a first checksum, which is used to verify the second data packet.

[0064] Thirdly, embodiments of this application provide a data processing method, including:

[0065] The second device receives tracking indication information. The tracking indication information is sent by the first device when the first convergence point of the first propagation path points to the second device. The first propagation path is obtained by the first device when it determines that the function type of the API function to be identified is the target function type, based on the API function to be identified, obtaining the first tracking data, and tracking the first tracking data.

[0066] The second device determines a second propagation path of the second data to be tracked in the second device, wherein the second data to be tracked is the same as the first data to be tracked, or the second data to be tracked is generated by the first device based on the first data to be tracked.

[0067] Fourthly, embodiments of this application provide a data processing apparatus, which may be disposed in the first device or the second device, and the data processing apparatus may perform the method described in any one of the first aspects and / or the method described in any one of the second aspects.

[0068] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the method described in any one of the first aspects and / or the method described in any one of the second aspects when the computer program is invoked.

[0069] In a sixth aspect, embodiments of this application provide a chip system including a processor coupled to a memory, the processor executing a computer program stored in the memory to implement the method described in any one of the first aspects and / or the method described in any one of the second aspects.

[0070] The chip system can be a single chip or a chip module composed of multiple chips.

[0071] In a seventh aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any one of the first aspects above.

[0072] Eighthly, embodiments of this application provide a computer program product that, when run on an electronic device, causes the electronic device to perform the method described in any one of the first aspects and / or the method described in any one of the second aspects.

[0073] It is understood that the beneficial effects of the third to eighth aspects mentioned above can be found in the relevant descriptions in the first or second aspects mentioned above, and will not be repeated here. Attached Figure Description

[0074] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0075] Figure 2 This is a flowchart illustrating a method for determining a function type provided in an embodiment of this application;

[0076] Figure 3 This is a schematic diagram of the structure of a modular classification learning model provided in an embodiment of this application;

[0077] Figure 4 A schematic diagram of a first propagation path provided for an embodiment of this application;

[0078] Figure 5 This is a schematic diagram of the structure of a second data packet provided in an embodiment of this application;

[0079] Figure 6 This is a schematic diagram of another structure of the second data packet provided in an embodiment of this application;

[0080] Figure 7 This is a schematic diagram of another structure of the second data packet provided in an embodiment of this application;

[0081] Figure 8 A schematic diagram of a second propagation path provided in an embodiment of this application;

[0082] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0083] The method for determining the function type provided in this application embodiment can be applied to electronic devices such as mobile phones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). This application embodiment does not impose any restrictions on the specific type of electronic device.

[0084] Please refer to Figure 1 , Figure 1 This is a schematic diagram of the structure of an electronic device 100 provided in an embodiment of this application. The electronic device 100 may include a processor 110, a memory 120, and a communication module 130, etc.

[0085] The processor 110 may include one or more processing units, and the memory 120 is used to store program code and data. In this embodiment, the processor 110 can execute computer execution instructions stored in the memory 120 to control and manage the operation of the electronic device 100.

[0086] The communication module 130 can be used for communication between various internal modules of the electronic device 100, or for communication between the electronic device 100 and other external electronic devices. For example, if the electronic device 100 communicates with other electronic devices via a wired connection, the communication module 130 may include an interface, such as a USB interface. The USB interface can be an interface conforming to the USB standard specification, specifically a Mini USB interface, a Micro USB interface, a USB Type-C interface, etc. The USB interface can be used to connect a charger to charge the electronic device 100, or to transfer data between the electronic device 100 and peripheral devices. It can also be used to connect headphones for audio playback. This interface can also be used to connect other electronic devices, such as AR devices.

[0087] Alternatively, the communication module 130 may include audio devices, radio frequency circuits, Bluetooth chips, wireless fidelity (Wi-Fi) chips, near-field communication (NFC) modules, etc., which can enable the electronic device 100 to interact with other electronic devices in a variety of different ways.

[0088] Optionally, the electronic device 100 may also include a display screen 140, which can display images or videos in the human-computer interaction interface.

[0089] Optionally, the electronic device 100 may also include peripheral devices 150, such as a mouse, keyboard, speaker, microphone, etc.

[0090] It should be understood that, in addition to Figure 1 In addition to the various components or modules listed, the embodiments of this application do not specifically limit the structure of the electronic device 100. In other embodiments of this application, the electronic device 100 may also include more or fewer components than those shown in the figures, or combine some components, or split some components, or have different component arrangements. The components shown in the figures may be implemented in hardware, software, or a combination of software and hardware.

[0091] To facilitate understanding of the technical solutions in the embodiments of this application, the application scenarios of the embodiments of this application will be introduced first below.

[0092] API functions are predefined functions. Electronic devices can provide various API functions to applications through their installed operating systems or libraries, allowing applications to call these functions without needing to understand the underlying source code implementation and working mechanism. However, for purposes such as managing and maintaining electronic devices, it is still necessary to identify certain specific API function types to perform specific processing on these API functions and their related data. For example, to ensure the confidentiality and integrity of information in an electronic device, it may be necessary to use taint analysis techniques to determine whether the electronic device will leak user privacy. Therefore, it is necessary to first identify which API functions in the electronic device have a function type that leaks user privacy. If an API function has a function type that leaks user privacy, it indicates that the API function poses a risk of leaking user privacy.

[0093] Among these, taint analysis technology, also known as information flow analysis and tracking technology, can tag data in electronic devices and track the propagation path of that data within the devices.

[0094] In some embodiments, API functions of specific function types can be manually labeled beforehand. Then, when an API function carrying a label corresponding to that specific function type is detected, the detected API function and its related data can be processed. For example, API functions in an electronic device that may leak user privacy can be manually labeled first. When the electronic device detects a labeled API function, it can determine that the API function may leak user privacy. The electronic device can also determine the return value of the API function as tainted data, thereby determining the propagation path of the tainted data within the electronic device.

[0095] However, in the above embodiments, when it is necessary to detect API functions of a certain function type, it mainly relies on manual labeling of API functions in advance, which is inefficient and costly. Moreover, manual labeling is bound to have problems of omission or mislabeling, which leads to low accuracy in detecting API functions of that specific function type.

[0096] To address the aforementioned technical problems, this application provides a method for identifying function types. In this application, since any API function of any function type will possess function characteristics matching that function type, if a first device detects that an API function to be identified has been called, it can obtain the set of function characteristics of the API function being identified. This set of function characteristics includes at least one of class name, return value, function name, and function parameters. Then, the set of function characteristics is input into an API function identification model, thereby identifying the API function to be identified through this preset API function identification model, and obtaining the function type of the API function to be identified. Compared with manual labeling, this method improves the efficiency and accuracy of identification and reduces the cost of identification.

[0097] The technical solutions of this application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0098] Please refer to Figure 2 This is a flowchart illustrating a method for determining a function type provided in an embodiment of this application. It should be noted that this method does not rely on... Figure 2 The specific order described below is a limitation. It should be understood that in other embodiments, the order of some steps in the method can be interchanged according to actual needs, or some steps can be omitted or deleted. The method includes the following steps:

[0099] S201, the first device acquires multiple first sample API functions.

[0100] Each of the first sample API functions has at least one of the following function characteristics: class name, return value, function name, and function parameters. Different API functions may have different function characteristics, and each of the first sample API functions is labeled with a corresponding function type.

[0101] The class name indicates the data type processed by the API function. The return value terminates the API function's execution and returns the result. The function name is determined by the user when defining the API function; this name is used to call the API function. Function parameters are variables specified when the API function is called. For any API function of any function type, the API function may have function characteristics that match the function type. For example, for an API function that may leak user privacy, the class name of the API function may include at least one of location, SMS, log, and phone number. The API function will return a return value of a specific numeric type, and as shown in Table 1 below, the prefix of the function name of the API function may include "get", and the suffix may include any one of the keywords such as "Id", "Number", "Name", "Version", "Index", and "Info". On the other hand, the prefix of the function name of an API function that will not leak user privacy will include "set", and the suffix will include any one of the keywords such as "id", "Num", "name", "Tag", "Properties", and "Type". The prefix indicates the operation performed by the API function, and the suffix indicates the object operated on by the API function. Therefore, the prefix and suffix together describe the main function of the API function. For example, if the prefix of an API function is "get" and the suffix is ​​"Id", then the main function of the API function is to obtain the user identifier.

[0102] Table 1

[0103]

[0104]

[0105] It should be noted that the function type can be set by the user in advance. For example, the function type can include at least one of the following: leaking user privacy, posing a security risk, abnormal network bandwidth usage, or abnormal memory usage.

[0106] It should also be noted that since the function names are named using camelCase, the function names of the first sample API functions can be obtained according to camelCase. That is, the first device can determine a keyword by the sequence of letters from any uppercase English letter in the function name (including the uppercase English letter) to the other uppercase English letter (excluding the other uppercase English letter).

[0107] In some embodiments, the first device may receive multiple first sample API functions submitted by a user or relevant technical personnel; in some embodiments, the first device may obtain multiple first sample API functions from its own device; in some embodiments, the first device may receive multiple first sample API functions sent by other devices. In other embodiments, the first device may obtain multiple API functions to be annotated, and then receive annotation operations from a user or relevant technical personnel for each API function to be annotated. These annotation operations are used to annotate the corresponding function type of the API function to be annotated, and then the annotated API function is determined as a first sample API function. It should be noted that in practical applications, the first device may obtain multiple first sample API functions through at least one of the above methods, or the first device may also obtain multiple first sample API functions through other methods. This application embodiment does not specifically limit the method by which the first device obtains multiple first sample API functions.

[0108] S202, the first device trains and obtains an API function recognition model based on multiple first sample API functions.

[0109] Since manually determining whether an API function to be identified belongs to a specific function type is not only inefficient and inaccurate, but also costly, as mentioned above, API functions of different function types can have function features that match that function type. Therefore, the first device can obtain an API function identification model based on at least one function feature of each first sample API function and the function type labeled on each first sample API function. That is, the API function identification model is obtained by training the first sample API functions, which facilitates the subsequent identification of the API function to be identified using the API function identification model.

[0110] The first device can input at least one function feature of the first sample API function into the created API function recognition model, compare the function type identified by the API function recognition model with the function type labeled by the first sample API function, and adjust the model parameters in the API function recognition model based on the comparison result so that the API function recognition model meets the preset training termination condition (such as the recognition accuracy is greater than the preset accuracy threshold).

[0111] In some embodiments, the API function recognition model may include a modular classification learning (PRIM) model. A modular classification learning model can extract general classification rules from a large amount of empirical data. These rules are not only more intuitive in expression, making them easier for users to understand and operate, but also cover positive examples as much as possible while minimizing negative examples. In other words, it can minimize inaccurate classification rules, thereby improving the accuracy of API function recognition.

[0112] For example, the classification rules of a modular classification learning model can be represented as:

[0113]

[0114] Here, f1=1, f2=2, f3=2, and f4=1 are four discrimination conditions. If a sample satisfies both f1=1 and f2=2, then the sample belongs to category y1; if the sample satisfies both f3=2 and f4=1, then the sample belongs to category y2.

[0115] In some embodiments, multiple first sample API functions can be represented as a sample space X(x1, x2, x3, ..., xi, ...), where xi represents the i-th first sample API function; the function features of the i-th first sample API function xi can be represented as a feature space A(ai1, ai2, ai3, ..., aij, ...), where aij represents the j-th function feature of the i-th first sample API function xi; the function type of API function classification can be represented as a range space Y(y1, y2, ..., yk, ...), where yk represents the k-th function type. The recognition results of multiple training samples can be represented as multiple tuples, i.e., D = (<x1,y1> , ...,<xi,yk> ,...),<xi,yk> Let yk represent the function type of the i-th first sample API function xi. Here, i, j, and k are all positive integers.

[0116] In some embodiments, the value space Y represents a specific function type, and yi can represent the subtypes included in that specific function type, which can correspond to a class name. For example, if the specific function type is to leak user privacy, and the corresponding class names include location, SMS, log, and phone number, then the value space Y can include four elements, which correspond to location, SMS, log, and phone number, respectively.

[0117] For example, the structure of this modular classification learning model can be as follows: Figure 3As shown. First, obtain the return value and function parameters of the API function. If the return value of the API function is empty (i.e., RetValue = NULL), it can be determined that the function type of the API function is not a user privacy leakage type (i.e., Sensitive API = false). If the API function has a return value (i.e., RetValue = Value) or no function parameters (i.e., ParamValue = NULL), then continue to obtain the function name of the API function. If the function name of the API function is empty (i.e., FunGet = NULL), it can be determined that the function type of the API function is not a user privacy leakage type. If the function name of the API function is Get (i.e., FunGet = get), then continue to obtain the class name of the API function. If the class name of the API function is Telephone (i.e., Class = Telephony), then it is determined that the function type of the API function is a user privacy leakage type and the subtype is "Tel (short for Telephony)" (i.e., Sensitive API = true and Type = Tel), meaning that the API function may leak the user's phone number. If the class name of the API function is "Short Message Service (SMS)" (i.e., Class = SMS), then the function type of the API function is determined to be leaking user privacy and the subtype is "SMS" (i.e., Sensitive API = true and Type = SMS), meaning that the API function may leak the user's SMS messages.

[0118] Understandably, Figure 3 Only one example of a learning model using this modular classification method is provided. Figure 3 The classification process or structure of the API function recognition model is not limited. In practical applications, the classification rules included in this modular classification learning model, as well as the types and order of acquiring each function feature, can be determined according to the actual needs of API function recognition. For example, this modular classification learning model can include more or fewer classification rules, and can acquire more or fewer function features, etc.

[0119] Through the above steps, the first device has obtained the API function recognition model. Therefore, in the following steps, the first device can perform subsequent data processing operations using the obtained API function recognition model. It should be noted that the first device can train and generate the API function recognition model at any time before using it. It should also be noted that the training and use of the API function recognition model can be independent, and the trained API function recognition model can be reused. For example, in some embodiments, the first device can only train and generate the API function recognition model without using it for subsequent data processing operations; in some embodiments, the first device can obtain the API function recognition model trained and generated by other devices and perform subsequent data processing operations based on the API function recognition model.

[0120] S203, the first device acquires the set of function features of the API function to be identified.

[0121] In order to identify API functions of certain specific function types so that other data processing can be performed based on those specific function types, such as avoiding or reducing user privacy leaks, detecting and removing viruses and Trojans, the first device can obtain a set of function features of the API functions to be identified.

[0122] In some embodiments, when the first device detects that any API function (or a specific API function) is called by any application (or a specific application), it can identify that API function (or the specific API function) as an API function to be identified and obtain the function feature set of the API function to be identified. Of course, in practical applications, the first device can also determine the API function to be identified in other ways. This application embodiment does not specifically limit the way the first device determines the API function to be identified.

[0123] S204, the first device inputs the function feature set into the API function recognition model to obtain the function type of the API function to be recognized.

[0124] The API function recognition model identifies the function type of the API function to be identified based on the function feature set of the API function. This allows for a quick and accurate determination of the function type of the API function to be identified. Compared with manually labeling the function type of API functions, this method saves costs, improves recognition efficiency, and increases recognition accuracy.

[0125] In some embodiments, the API function recognition model includes a modular classification learning model. In this case, the first device can input the function feature set of the API function to be recognized into the modular classification learning model, and determine the classification rule matched by the API function to be recognized based on the function features included in the function feature set, thereby determining the function type of the API function to be recognized.

[0126] S205, if the function type of the API function to be identified is the target function type, then the first device obtains the first tracking data based on the API function to be identified.

[0127] Since the function type of the API function to be identified is the target function type, that is, the API function to be identified may be an API function that the user or the first device is concerned about. For example, the API function to be identified may be an API function that may leak user privacy or an API function that may spread viruses. Therefore, the first tracking data can be obtained based on the API function to be identified in order to determine the scope of influence of the API function to be identified and to perform other related processing operations.

[0128] In some embodiments, the first device may determine the return value of the API function to be identified as the first data to be tracked. Of course, in practical applications, the first device may also obtain the first data to be tracked based on the API function to be identified in other ways. For example, the first device may determine the data processed by the API function to be identified as the first data to be tracked.

[0129] In some embodiments, the first device may add tracking markers to the first data to be tracked based on the objective function model, so as to facilitate the subsequent identification and tracking of the first data to be tracked.

[0130] The first device can store the first data to be tracked and the corresponding tracking mark that marks the first data to be tracked. The storage location can be memory, register or cache, or of course, it can be stored in other locations.

[0131] In some embodiments, API functions that may leak user privacy (i.e., functions of the type that leak user privacy) can be called tainted functions, and correspondingly, the first data to be tracked can be called tainted data, and the added tracking tag can be a tainted tag.

[0132] It should be noted that the tracking tag corresponding to the target function type can be generated by the first device based on the business or programming language corresponding to the API function to be processed. In some embodiments, the tracking tag can be determined based on the recognition result of the API function to be recognized by the aforementioned API function recognition model. For example, if the first device recognizes an API function as "Sensitive API = true and Type = Tel" using the API function recognition model, then the recognition result can be used as the tracking tag. Alternatively, "Sensitive API" and "Tel" can be extracted from the recognition result as the tracking tag. In some embodiments, the first device can receive the tracking tag submitted by the user for the target function type in advance. Of course, in practical applications, the first device can also determine the tracking tag corresponding to the target function type in other ways. This application embodiment does not specifically limit the method by which the first device determines the tracking tag corresponding to the target function type.

[0133] For example, code snippet 1 of an application is shown below:

[0134]

[0135]

[0136] The code segment 11 mentioned above includes two API functions: "getLastKnownLocation()" and "send_data()". If the API function identification model determines that the function type of "getLastKnownLocation()" is leaking user privacy, and the user privacy that may be leaked is the user's current location information, then the return value loc of "getLastKnownLocation()" (i.e., the current location information) can be determined as the first data to be tracked, and the first device can also add a corresponding tracking tag to the first data to be tracked.

[0137] In some embodiments, users or relevant technicians can detect the API function recognition model to verify the function types identified by multiple API functions to be identified. If it is determined that the accuracy of the API function recognition model is lower than the accuracy threshold, the correct function type of the API function that was incorrectly identified can be marked. Then, the marked API function is used as the second sample API function. The API function recognition model is then trained again using the second sample API function until the accuracy of the API function recognition model is greater than or equal to the accuracy threshold.

[0138] S206, the first device determines the first propagation path of the first data to be tracked.

[0139] A propagation path can be abstracted as a triple <sources, sinks, first processing operation>. A propagation path may include a source and a sink, and may also include at least one first processing operation. This propagation path can be used to describe whether data introduced by the source can be propagated to the sink through at least one first processing operation.

[0140] A source point can represent an interface that introduces data.

[0141] A convergence point can represent the endpoint of data transmission, including data sent to other external devices or stored on storage media such as logs or Secure Digital (SD) cards at the local end of the first device.

[0142] The first processing operation can be predetermined by the first device. In some embodiments, the first processing operation may correspond to a target function type or an API function to be processed, and the first device may receive the first processing operation specified by a user or a relevant technician based on the target function type or the API function to be identified. Of course, in practical applications, the first device may also determine the first processing operation in other ways, and the embodiments of this application do not specifically limit the way the first device determines the first processing operation.

[0143] In some embodiments, the objective function type is the user privacy leakage type, and the first data to be tracked includes user privacy information. However, it is understood that if the first device performs at least one of encryption and obfuscation operations on the user privacy information before the convergence point, it will be difficult for other devices to identify or use the user privacy information even if they obtain it. That is, since encryption and obfuscation operations can render user privacy information harmless, if user privacy information has undergone at least one of encryption and obfuscation operations, it can be considered that it no longer has the possibility of leaking user privacy. Therefore, the first processing operation may include at least one of encryption and obfuscation operations.

[0144] The first device can track the first data to be tracked using any one or more analysis methods, such as explicit flow analysis and implicit flow analysis, thereby determining the first source point and the first convergence point in the first propagation path. It can also determine at least one first processing operation after the first source point and before the first convergence point, thus obtaining the first propagation path of the first data to be tracked within the first device. That is, the first propagation path may include the first source point, the first convergence point, and at least one first processing operation. Furthermore, if the first data to be tracked passes through at least one first processing operation and propagates to the first convergence point, the data propagated to the first convergence point is the second data to be tracked. The second data to be tracked can be obtained by processing the first data to be tracked through at least one first processing operation; that is, the second data to be tracked can be the same as the first data to be tracked or generated based on the first data to be tracked.

[0145] Explicit flow analysis examines how the trace marker for the first piece of data to be traced propagates along the data dependencies between variables in the program. Implicit flow analysis examines how the trace marker propagates along the control dependencies between variables in the program, that is, how the trace marker propagates from conditional instructions to the statements they control. Explicit or implicit flow analysis can be further divided into static propagation analysis and dynamic propagation analysis. Static propagation analysis can detect whether the first piece of data to be traced can propagate from the source to the destination by analyzing the data dependencies between program variables without running or modifying the code. Dynamic propagation analysis can detect whether the first piece of data to be traced can propagate from the source to the destination by monitoring the propagation of the first piece of data to be traced in the system program in real time during program execution.

[0146] For example, the first device tracks the user's current location information based on code segment 1. Since the current location information is assigned to the string "loc," meaning the current location information is introduced through the string "loc," the string "loc" becomes the first source point. Next, the first device concatenates a portion of the obtained user privacy information with three asterisks using "temp = loc.substring(4,10) + "***"" (i.e., the first processing operation). The resulting string can no longer represent the user's current location; that is, the first device has rendered the current location information harmless. Then, the first device sends out the harmless current location information using "send_data(temp)," meaning "send_data(temp)" can serve as the first convergence point.

[0147] In some embodiments, if the first device detects that a first processing operation has been performed on the first data to be tracked, it may delete the tracking marker. In some embodiments, if the first device detects that a first processing operation has been performed on the first data to be tracked, it may stop tracking the first data to be tracked; of course, the first device may also continue tracking the first data to be tracked even if it detects that a first processing operation has been performed on the first data to be tracked.

[0148] Please refer to Figure 4 This diagram illustrates a first propagation path provided in an embodiment of this application. After the first data to be tracked is introduced into the first device from the first source point, it undergoes processing operations 1 and 2. Following processing operation 1, the data undergoes processing operation 3. After processing operation 2, the data undergoes processing operations 4 and 5, and finally propagates to the first convergence point after processing operation 5. Therefore, the first propagation path of the first data to be tracked is: first source point - processing operation 2 - processing operation 5 - first convergence point.

[0149] S207, the first device determines whether the first convergence point points to the external second device. If yes, proceed to S208; otherwise, end the tracking and output the first detection result.

[0150] With the increasing prevalence of distributed systems, more and more devices are running them. Compared to single devices, applications on multiple devices can cooperate with each other, making data propagation in distributed scenarios more covert. For example, if the first device is a camera with a shooting function, and the second device is a mobile phone with network communication capabilities, a malicious application can use the camera to capture images and then transmit those images to other devices via the mobile phone. In other words, data may propagate across devices. If only the first propagation path of the first piece of data to be tracked within the first device is determined, it may be difficult to accurately detect the complete data propagation process. Therefore, to adapt to the tracking needs in distributed scenarios and improve tracking accuracy, the first device can determine whether the first convergence point points to a second device outside the first device. If so, the first device can determine that the second piece of data to be tracked may have propagated to the second device, and thus can continue with subsequent steps, thereby achieving cross-device data tracking and improving the accuracy of data tracking.

[0151] The second device can be any device other than the first device. If the first aggregation point sends the second data to be tracked to the local end of the first device (such as a log, SD card, or other storage medium), then the first aggregation point is determined to point to the first device; if the first aggregation point is an API function used for network communication, such as write, then the first aggregation point is determined to point to an external second device.

[0152] In some embodiments, the first detection result may include a first propagation path. In some embodiments, the first device may also output the first detection result when determining the first propagation path.

[0153] In some embodiments, if the objective function type is a user privacy leakage type, the first device can also assess the risk of user privacy leakage, and the first device can indicate the assessment result through the first detection result, thereby promptly reminding the user when a risk of user privacy leakage is detected. In some embodiments, if the objective function type is a user privacy leakage type, the first data to be tracked has not undergone harmless processing such as encryption or obfuscation during its propagation from the first source point to the first convergence point, and the first convergence point points to the first storage location in the first device, then the first device can determine that the risk of user privacy leakage is high. In some embodiments, if the objective function type is a user privacy leakage type, the first data to be tracked has undergone harmless processing such as encryption or obfuscation during its propagation from the first source point to the first convergence point, and the first convergence point points to the first storage location in the first device, then the first device can determine that the risk of user privacy leakage is low. The first storage location may include a storage location with lower security, such as a log.

[0154] It should be noted that the rules for the first device to assess the risk of leaking user privacy can be determined in advance by the first device. This application embodiment does not limit the way the first device determines the rules or the specific content of the rules.

[0155] S208, the first device sends a second data packet to the second device, the second data packet including tracking indication information.

[0156] The tracking indication information can be generated by the first device during the tracking of the first data to be tracked, and the tracking indication information can be used to instruct the second device to determine the second propagation path of the second data to be tracked in the second device.

[0157] In some embodiments, since the first aggregation point can send the second data to be tracked to the second device, the first device can obtain the first data packet to be sent to the second device based on the first aggregation point. The body of the first data packet may include the second data to be tracked. The first device generates the second data packet based on the tracking indication information and the original body of the first data packet, and then sends the second data packet to the second device.

[0158] Hooking technology can intercept and modify API functions, thereby changing their execution behavior. Therefore, the first device can intercept the first data packet from the first aggregation point using hooking technology, parse the first data packet to obtain its original body, which may include second data to be tracked. Then, the body and tracking indication information are repackaged and encapsulated to obtain the second data packet.

[0159] Please refer to Figure 5 This is a schematic diagram of the structure of a second data packet provided in an embodiment of this application. In some embodiments, the tracking indication information may include first position indication information, first length indication information, and first function type indication information. The first position indication information can be used to indicate the position of the second data to be tracked within the original packet body, so that the second device can accurately obtain the second data to be tracked. In some embodiments, the first position indication information can be the offset of the second data to be tracked within the original packet body. The first length indication information can be used to indicate the length of the second data to be tracked. The first function type indication information can be used to indicate the target function type. In some embodiments, the tracking indication information may further include first identification information, second length indication information, and third length indication information. The first identification information can be used to indicate that the second data packet carries the first data to be tracked, and the first identification information can be represented by 1. The second length indication information can be used to indicate the length of the tracking indication information. The third length indication information can be used to indicate the length of the second data packet, that is, the sum of the length of the tracking indication information and the length of the original packet body. The length occupied by the first identification information, the second length indication information, and the third length indication information in the second data packet can be a fixed value. In some embodiments, the tracking indication information may further include a first checksum, which can be used to verify the second data packet to determine whether the transmitted data is corrupted.

[0160] Please refer to Figure 6The first identification information, second length indication information, third length indication information, first position indication information, first function type indication information, and first checksum can be represented sequentially by seven fields in the header structure of the second data packet. The first field occupies 1 bit; if this field is 1, it represents the first identification information; if this field is 0, it represents the second identification information, which indicates that the second data packet does not contain the second data to be tracked. The second field occupies 15 bits and represents the second length indication information. The third field occupies 16 bits and represents the third length indication information. The fourth field occupies 8 bits and represents the first position indication information. The fifth field occupies 8 bits and represents the first length indication information. The sixth field occupies 4 bits and represents the first function type indication information. The seventh field occupies 12 bits and represents the first checksum. These seven fields occupy a total of 8 bytes.

[0161] It should be noted that the type, length, position, and order of the information included in the tracking indication information can be determined according to the actual tracking needs. This application does not limit the type, length, position, or order of the information included in the tracking indication information. For example, in some embodiments, the order of the above seven fields and their meanings remain unchanged, but the first field occupies 8 bits, the second field occupies 8 bits, the third field occupies 16 bits, the fourth field occupies 16 bits, the fifth field occupies 16 bits, the sixth field occupies 8 bits, and the seventh field occupies 16 bits, meaning the above seven fields occupy a total of 12 bytes.

[0162] In some embodiments, since data may propagate to a second device, the first device can send a first propagation path to the second device. Correspondingly, the second device can determine a second propagation path for the second data to be tracked within the second device based on the tracking indication information. That is, the embodiments of this application can determine the complete data propagation path, improving the accuracy of data tracking.

[0163] It should be noted that in practical applications, the first device can also send tracking indication information to the second device in other ways. For example, in some embodiments, the first device can send tracking indication information and the first data packet to the second device separately.

[0164] S209, the second device determines whether the second data packet contains the second data to be tracked. If it does, then execute S210; otherwise, the process ends.

[0165] The second device can use hook technology to detect whether a network input API function has been called. If so, it can determine that data has been received from an external device. If the second device receives a second data packet, it can detect whether the second data packet carries tracking indication information. If so, the second device can determine whether the second data packet contains second data to be tracked based on the detected tracking indication information.

[0166] For example, the second data packet received by the second device is as follows: Figure 7 As shown. The second device first detects that the first bit in the header structure of the second data packet is 1, that is, it determines that the second data packet carries the first identification information, and then the second device can determine that the second data packet carries the second data to be tracked.

[0167] S210, the second device determines the second propagation path of the second data to be tracked in the second device.

[0168] Since the second data packet includes second data to be tracked, and the second data to be tracked is the same as or generated based on the first data to be tracked, the second device can track the second data to be tracked in order to determine the complete data propagation process.

[0169] Please continue to refer to Figure 7 The second device determines the starting position of the original packet body in the second data packet based on bits 2 to 16 of the header structure, which are "000000000000100" and bits 17 to 32, which are "0000000100100010". Then, the second device determines the starting position of the second data to be tracked in the original packet body based on bits 33 to 40 of the header structure, which are "00100100". It determines the length of the second data to be tracked based on bits 41 to 48 of the header structure, which are "00001000", and determines that the target function type corresponding to the second data to be tracked is "leaking user privacy" based on bits 49 to 52 of the header structure, which are "0010". Therefore, the second device can obtain the second data to be tracked from the original packet body and track it. If the second device also obtains the first checksum as "100010101000" from bits 53-64 of the header structure, and the first checksum is the same as the second checksum calculated by the second device for the header structure, then the second device can determine that the received second data packet is correct and can continue to track the second data to be tracked in the second data packet; otherwise, if the first checksum is different from the second checksum calculated by the second device for the header structure, then the second device can determine that the received second data packet has been corrupted and can stop subsequent operations, including discarding the second data packet or not tracking the second data to be tracked in the second data packet.

[0170] The second propagation path may include a second source point and a second convergence point, and may also include at least one second processing operation. The propagation process of the second data to be tracked in the second device sequentially passes through the network driver layer, system framework layer, application layer, and system framework layer. The second device can track the second data to be tracked in a similar manner to how the first device tracks the second data to be tracked, thereby determining the second propagation path.

[0171] In some embodiments, the second device may, in a manner similar to S207-S208, after determining that the second convergence point in the second propagation path points to the third device, continue to instruct the third device to determine the third propagation path of the third data to be tracked in the third device, wherein the third data to be tracked is the same as the second data to be tracked, or the third data to be tracked can be generated based on the second data to be tracked. Accordingly, the second device may also send the first propagation path and the second propagation path to the third device, thereby ensuring that the data propagation path can be obtained as completely as possible, and improving the accuracy of tracking.

[0172] For example, code snippet 2 in an application is shown below:

[0173]

[0174] Here, "Data recv_data = recv_data(package)" indicates that the second device detects the API function "recv_data" used for network communication through hook technology and receives the second data packet sent by the external device; "booleanisTaint = checkTaintValid(recv_data)" indicates that the second data packet contains the second data to be tracked; "isTaint = true" indicates that the second data packet contains the second data to be tracked; "String taint_data = parse_data(recv_data)" indicates that the second data packet is parsed to obtain the second data to be tracked; and "Log.i(taint_data)" indicates that the second data to be tracked is written to the log for storage.

[0175] Please refer to Figure 8 This diagram illustrates a second propagation path according to an embodiment of this application. After entering through the second source point, the second data to be tracked undergoes processing operations 6 and 7, respectively. After processing operation 7, the second data to be tracked undergoes processing operation 8. After processing operation 6, the second data to be tracked undergoes processing operations 9 and 10, respectively, and after processing operation 10, it propagates to the second convergence point. Therefore, the second propagation path of the second data to be tracked is: second source point - processing operation 6 - processing operation 10 - second convergence point.

[0176] In some embodiments, the second device may output a second detection result when determining the second propagation path, and the second detection result may include the second propagation path.

[0177] In some embodiments, the second device may send the second propagation path to the first device when determining the second propagation path, so that the first device can obtain the complete propagation path as much as possible.

[0178] In some embodiments, if the target function type is the user privacy leakage type, the second device can also assess the risk of user privacy leakage, and the second device can indicate the assessment result through the second detection result, thereby enabling timely reminders to users when user privacy is detected to be leaked in a distributed scenario.

[0179] In this embodiment, since any API function of any function type will have function characteristics matching that function type, if the first device detects that the API function to be identified has been called, it can obtain the set of function characteristics of the API function being identified. This set of function characteristics includes at least one of the following: class name, return value, function name, and function parameters. Then, the set of function characteristics is input into the API function identification model, thereby identifying the API function to be identified through the preset API function identification model and obtaining the function type of the API function to be identified. Compared with manual labeling, this improves the efficiency and accuracy of identification and reduces the cost of identification.

[0180] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0181] Based on the same inventive concept, embodiments of this application also provide an electronic device, which may be the first device, the second device, or the third device mentioned above. Figure 9 A structural schematic diagram of an electronic device 900 is provided for an embodiment of this application, as shown below. Figure 9 As shown, the electronic device provided in this embodiment includes a memory 910 and a processor 920. The memory 910 is used to store computer programs; the processor 920 is used to execute the method described in the above method embodiment when the computer program is invoked.

[0182] The electronic device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so they will not be described again here.

[0183] Based on the same inventive concept, this application also provides a chip system. The chip system includes a processor coupled to a memory, which executes a computer program stored in the memory to implement the methods described in the above-described method embodiments.

[0184] The chip system can be a single chip or a chip module composed of multiple chips.

[0185] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods described in the above-described method embodiments.

[0186] This application also provides a computer program product that, when run on an electronic device, causes the electronic device to implement the method described in the above-described method embodiments.

[0187] If the integrated units described above are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable storage medium can include at least: any entity or device capable of carrying computer program code to a photographic device / terminal device, a recording medium, a computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0188] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0189] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0190] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0191] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0192] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0193] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0194] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0195] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0196] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for determining the function type, characterized in that, include: If the first device detects that the API function to be identified has been called, it obtains the function feature set of the API function to be identified, wherein the function feature set includes at least one of class name, return value, function name and function parameters; The first device inputs the function feature set into the API function recognition model to obtain the function type of the API function to be recognized; If the function type is a target function type, then the first device obtains the first tracking data based on the API function to be identified; The first device determines a first propagation path for the first data to be tracked, the first propagation path including a first convergence point; If the first convergence point points to the second device, the first device sends tracking instruction information to the second device. The tracking instruction information is used to instruct the second device to determine the second propagation path of the second data to be tracked in the second device. The second data to be tracked is the same as the first data to be tracked, or the second data to be tracked is generated based on the first data to be tracked.

2. The method according to claim 1, characterized in that, The API function recognition model includes a modular classification learning model.

3. The method according to claim 1 or 2, characterized in that, Before the first device inputs the function feature set into the API function recognition model, the method further includes: The first device acquires multiple first sample API functions, each of which has at least one function feature among the class name, the return value, the function name, and the function parameters, and each of the first sample API functions is labeled with a corresponding function type; The first device obtains the API function recognition model based on at least one function feature of each of the first sample API functions and the function type labeled by each of the first sample API functions.

4. The method according to claim 1, characterized in that, The method further includes: The first device adds a tracking marker to the first data to be tracked based on the target function type.

5. The method according to claim 4, characterized in that, The first device determines the first propagation path of the first data to be tracked, including: If the first device detects that a first processing operation has been performed on the first data to be tracked, then the tracking marker is deleted.

6. The method according to claim 5, characterized in that, The first processing operation corresponds to the target function type.

7. The method according to claim 1, characterized in that, Before the first device sends tracking indication information to the second device, the method further includes: The first device acquires a first data packet to be sent to the second device based on the first aggregation point, and the original packet body of the first data packet includes the second data to be tracked; The first device generates a second data packet based on the tracking indication information and the original packet body of the first data packet; The first device sends tracking indication information to the second device, including: The first device sends the second data packet to the second device.

8. The method according to claim 7, characterized in that, The tracking indication information includes first position indication information, first length indication information, and first function type indication information; Wherein, the first position indication information is used to indicate the position of the second data to be tracked in the original package body, the first length indication information is used to indicate the length of the first data to be tracked, and the first function type indication information is used to indicate the target function type.

9. The method according to claim 8, characterized in that, The tracking indication information also includes first identification information, second length indication information, and third length indication information; Wherein, the first identification information is used to indicate that the second data packet carries the first data to be tracked, the second length indication information is used to indicate the length of the tracking indication information, and the third length indication information is used to indicate the length of the second data packet.

10. The method according to claim 8 or 9, characterized in that, The tracking indication information also includes a first checksum, which is used to verify the second data packet.

11. The method according to claim 5 or 6, characterized in that, The target function type is the user privacy leakage type, the first data to be tracked includes user privacy information, and the first processing operation includes at least one of encryption operation and obfuscation operation.

12. An electronic device, characterized in that, include: A memory and a processor, the memory being used to store a computer program; the processor being used to execute the method as described in any one of claims 1-11 when the computer program is invoked.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-11.

Images