Application detection method, system, device and computer equipment

Abstract

The application relates to a detection method, system and device of an application program, computer equipment, a storage medium and a computer program product, and relates to the technical field of information security. The method is applied to a detected end and comprises the following steps: in response to a detection request for an application program sent by a detection end, the application program is instrumented to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module that needs to be loaded when the application program runs; the calling function is a function that needs to be called when the loading module executes; the actual module attribute information and the actual function attribute information are taken as response data and are sent to the detection end, so that the detection end determines a detection result of the application program according to the actual module attribute information and the actual function attribute information. The method can improve the detection accuracy of the application program, thereby improving the security of the application program.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a detection method, system and device of an application program, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] In the application development stage, a modular approach is adopted, so that the application program is composed of multiple modules, so that the developer can reuse the modules to reduce the development workload. A module is composed of functions that complete a certain specific function. The process of running an application program can also be regarded as a process of calling a series of functions. In order to ensure the running safety of the application program, the application program needs to be detected to identify whether the application program is attacked maliciously.

[0003] In the conventional technology, the detection method of the application program is to first perform static measurement on the application program to obtain a static program verification value corresponding to the application program, and then determine the detection result of the application program according to the static program verification value.

[0004] However, by using the conventional technology, the detection is only performed by the static program verification value, the detection dimension is relatively single, which leads to low detection accuracy and is not conducive to the safety of the application program running. SUMMARY

[0005] Therefore, it is necessary to provide a detection method, system and device of an application program, a computer device, a computer readable storage medium and a computer program product, which can improve the detection accuracy of the application program.

[0006] In a first aspect, the present application provides a detection method of an application program. The method is applied to a detection end and includes:

[0007] In response to a detection request for the application program sent by the detection end, the application program is instrumented to obtain actual module attribute information of a loaded module and actual function attribute information of a called function; wherein the loaded module is a module that needs to be loaded when the application program runs, and the called function is a function that needs to be called when the loaded module executes;

[0008] The actual module attribute information and the actual function attribute information are sent to the detection end as response data to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information.

[0009] In one embodiment, the instrumenting of the application program to obtain the actual module attribute information of the loaded module and the actual function attribute information of the called function includes:

[0010] The loading module in the application program is instrumented to obtain an actual loading path of the loading module and an actual module check value corresponding to the loading module.

[0011] The calling function in the loading module is instrumented to obtain an actual starting address of the calling function and an actual function name of the calling function.

[0012] In one of the embodiments, the method further includes:

[0013] In response to a detection request for an application program sent by the detection terminal, the application program is statically measured to obtain an actual program check value corresponding to the application program.

[0014] The actual module attribute information and the actual function attribute information are sent to the detection terminal as response data to instruct the detection terminal to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information.

[0015] The actual module attribute information, the actual function attribute information and the actual program check value are sent to the detection terminal as response data to instruct the detection terminal to determine a detection result of the application program according to the actual module attribute information, the actual function attribute information and the actual program check value.

[0016] In a second aspect, the application provides a detection method of an application program. The method is applied to a detection terminal and includes:

[0017] A detection request for an application program is sent to a detected terminal.

[0018] Response data returned by the detected terminal for the detection request is received. The response data includes actual module attribute information of a loading module and actual function attribute information of a calling function. The loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes.

[0019] A detection result of the application program is determined according to the response data.

[0020] In one of the embodiments, the detection result of the application program is determined according to the response data, which includes:

[0021] An actual loading path of the loading module and an actual module check value corresponding to the loading module in the actual module attribute information are extracted.

[0022] If the actual loading path is inconsistent with a standard loading path of the preset loading module, it is determined that the detection result of the application program is a first detection result; wherein the first detection result indicates that a library file of the application program is tampered with.

[0023] If the actual module verification value is inconsistent with a standard module verification value corresponding to the preset loading module, it is determined that the detection result of the application program is a first detection result.

[0024] In one embodiment, the determining the detection result of the application program according to the response data comprises:

[0025] extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information;

[0026] determining an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs according to the actual loading path and the actual starting address;

[0027] performing hash calculation on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to the function call path; wherein the function call path corresponds to the application program;

[0028] If the actual path metric value is inconsistent with a standard path metric value corresponding to the preset function call path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that a control flow of the application program is hijacked in a running process.

[0029] In one embodiment, the calling function is a plurality of calling functions and constitutes a calling function sequence.

[0030] The hash calculation on the actual offset address, the actual function name and the actual module name to obtain the actual path metric value corresponding to the function call path comprises:

[0031] For a first calling function in the calling function sequence, the actual offset address of the first calling function, the actual function name of the first calling function, the actual module name of the loading module to which the first calling function belongs and an initial path metric value are subjected to hash calculation to obtain a path metric value corresponding to the first calling function.

[0032] hashing the actual offset address of the next calling function, the actual function name of the next calling function, the actual module name of the loading module to which the next calling function belongs, and the path metric value corresponding to the last calling function in the sequence of calling functions, to obtain the path metric value corresponding to the next calling function;

[0033] The path metric value corresponding to the last calling function in the sequence of calling functions is determined as the actual path metric value corresponding to the function call path.

[0034] In one of the embodiments, the response data further includes an actual program verification value corresponding to the application program.

[0035] The determining of the detection result of the application program according to the response data includes:

[0036] If the actual program verification value is inconsistent with a preset standard program verification value corresponding to the application program, it is determined that the detection result of the application program is a third detection result; wherein the third detection result indicates that the application program is tampered.

[0037] In a third aspect, the application provides a detection system of an application program. The system includes a detection end and a detected end, wherein,

[0038] The detection end is configured to send a detection request for an application program to the detected end.

[0039] The detected end is configured to respond to the detection request, to instrument the application program, to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes.

[0040] The detected end is further configured to send the actual module attribute information and the actual function attribute information as response data to the detection end.

[0041] The detection end is further configured to determine the detection result of the application program according to the response data.

[0042] In a fourth aspect, the application further provides a detection device of an application program. The device is used in a detected end and includes:

[0043] The attribute obtaining module is configured to, in response to a detection request for an application sent by a detection terminal, instrument the application, and obtain actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module that needs to be loaded when the application runs, and the calling function is a function that needs to be called when the loading module executes;

[0044] The response sending module is configured to send the actual module attribute information and the actual function attribute information as response data to the detection terminal, so as to instruct the detection terminal to determine a detection result of the application according to the actual module attribute information and the actual function attribute information.

[0045] In a sixth aspect, the present application further provides a detection device of an application. The device is used in a detection terminal, and comprises:

[0046] The request sending module is configured to send a detection request for an application to a detected terminal;

[0047] The data receiving module is configured to receive response data returned by the detected terminal for the detection request; the response data comprises actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module that needs to be loaded when the application runs, and the calling function is a function that needs to be called when the loading module executes;

[0048] The result determining module is configured to determine a detection result of the application according to the response data.

[0049] In a seventh aspect, the present application further provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0050] In response to a detection request for an application sent by a detection terminal, the application is instrumented, and actual module attribute information of a loading module and actual function attribute information of a calling function are obtained; the loading module is a module that needs to be loaded when the application runs, and the calling function is a function that needs to be called when the loading module executes;

[0051] The actual module attribute information and the actual function attribute information are sent as response data to the detection terminal, so as to instruct the detection terminal to determine a detection result of the application according to the actual module attribute information and the actual function attribute information.

[0052] In an eighth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the following steps:

[0053] in response to the detection end sending a detection request for an application, instrumenting the application to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application runs, and the calling function is a function that needs to be called when the loading module executes;

[0054] sending the actual module attribute information and the actual function attribute information as response data to the detection end, to instruct the detection end to determine a detection result of the application according to the actual module attribute information and the actual function attribute information.

[0055] In a ninth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the following steps:

[0056] in response to the detection end sending a detection request for an application, instrumenting the application to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application runs, and the calling function is a function that needs to be called when the loading module executes;

[0057] sending the actual module attribute information and the actual function attribute information as response data to the detection end, to instruct the detection end to determine a detection result of the application according to the actual module attribute information and the actual function attribute information.

[0058] The application program detection method, system, device, computer device, storage medium and computer program product can be used for the following purposes. The detection end sends a detection request for an application program to a detected end. The detected end responds to the detection request, and performs instrumentation on the application program to obtain actual module attribute information of a loading module and actual function attribute information of a calling function. The loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes. Then, the detected end sends the actual module attribute information of the loading module and the actual function attribute information of the calling function to the detection end. The detection end determines a detection result of the application program according to the actual module attribute information of the loading module and the actual function attribute information of the calling function. It can be understood that the application dynamically obtains the actual module attribute information of the loading module and the actual function attribute information of the calling function corresponding to the application program running by using the instrumentation method, and then completes the detection of the application program based on the multi-dimensional detection information. Since the detection information used by the method is more, the application program can be detected by more dimensional factors whether it is attacked maliciously, and therefore, the detection accuracy of the application program is improved, and the security of the application program running is improved. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 An application environment diagram of the application program detection method in an embodiment;

[0060] Figure 2 A flowchart of the application program detection method in an embodiment;

[0061] Figure 3 A flowchart of the application program detection method in another embodiment;

[0062] Figure 4 A schematic diagram of calculating an actual path metric value corresponding to a function calling path in an embodiment;

[0063] Figure 5 A schematic diagram of a function calling path in an embodiment;

[0064] Figure 6 A structural block diagram of the application program detection device in an embodiment;

[0065] Figure 7 A structural block diagram of the application program detection device in another embodiment;

[0066] Figure 8 An internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0067] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0068] The application program detection method provided by the embodiments of the present application can be applied to an application environment as shown in Figure 1 . Specifically, the detection end 102 sends a detection request for the application program to the detected end 104. The detected end 104 responds to the detection request by instrumenting the application program to obtain actual module attribute information of a loaded module and actual function attribute information of a called function. The loaded module is a module that needs to be loaded when the application program runs, and the called function is a function that needs to be called when the loaded module executes. The detected end 104 sends the actual module attribute information and the actual function attribute information as response data to the detection end 102. The detection end 102 determines the detection result of the application program according to the response data.

[0069] The detection end 102 and the detected end 104 can be, but are not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle-mounted device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc.

[0070] In one embodiment, as shown in Figure 2 , an application program detection method is provided. Taking the detected end 104 in Figure 1 as an example, the method comprises the following steps:

[0071] Step S202, in response to the detection request for the application program sent by the detection end, instrumenting the application program to obtain actual module attribute information of a loaded module and actual function attribute information of a called function.

[0072] The loaded module is a module that needs to be loaded when the application program runs. The called function is a function that needs to be called when the loaded module executes.

[0073] Specifically, the detection end sends a detection request for the application program to the detected end. The detected end responds to the detection request, and performs instrumentation on the application program based on a module level and a function level, and dynamically obtains actual module attribute information of a loaded module and actual function attribute information of a called function. Optionally, the actual module attribute information includes an actual module name of the loaded module, a low address of the loaded module, a high address of the loaded module, an actual loading path of the loaded module, and an actual module verification value corresponding to the loaded module. The actual function attribute information includes an actual function name of the called function, a function parameter of the called function, an actual starting address of the called function, and a return address of the called function.

[0074] In step S204, the actual module attribute information and the actual function attribute information are sent to the detection end as response data, so as to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information.

[0075] Specifically, the detected end sends the actual module attribute information and the actual function attribute information to the detection end as response data. The detection end determines a detection result of the application program according to the actual module attribute information and the actual function attribute information. Optionally, the detection end determines the detection result of the application program by judging whether the actual module attribute information is consistent with preset standard module attribute information of the loaded module, and whether the actual function attribute information is consistent with preset standard function attribute information of the called function.

[0076] In the above method for detecting the application program, the detection end sends a detection request for the application program to the detected end. The detected end responds to the detection request, and performs instrumentation on the application program, and obtains actual module attribute information of a loaded module and actual function attribute information of a called function. The loaded module is a module that needs to be loaded when the application program runs, and the called function is a function that needs to be called when the loaded module executes. Then, the detected end sends the actual module attribute information of the loaded module and the actual function attribute information of the called function to the detection end. The detection end determines a detection result of the application program according to the actual module attribute information of the loaded module and the actual function attribute information of the called function. It can be understood that the method dynamically obtains the actual module attribute information of the loaded module and the actual function attribute information of the called function corresponding to the application program running by using the instrumentation manner, and then completes the detection of the application program based on the multi-dimensional detection information. Since the detection information used by the method is more, the application program can be detected by more dimensional factors whether it is attacked maliciously, and thus the detection accuracy of the application program is improved, and the security of the application program running is improved.

[0077] In one embodiment, step S202 includes the following steps:

[0078] In step S2022, the loading module in the application program is instrumented to obtain the actual loading path of the loading module and the actual module verification value corresponding to the loading module.

[0079] In step S2024, the calling function in the loading module is instrumented to obtain the actual starting address of the calling function and the actual function name of the calling function.

[0080] Specifically, the detected end instruments the loading module in the application program through a dynamic instrumentation tool to obtain the actual loading path of the loading module and the actual module verification value corresponding to the loading module. Optionally, when the application program is loaded into the memory and runs, the detected end instruments the loading module in the application program based on the module level through the dynamic instrumentation tool to obtain the actual module attribute information of each loading module in the module sequence required to be loaded when the application program runs.

[0081] The detected end instruments the calling function in the loading module through the dynamic instrumentation tool to obtain the actual starting address of the calling function and the actual function name of the calling function. Optionally, when the application program is loaded into the memory and runs, the detected end instruments the calling function in the loading module based on the function level through the dynamic instrumentation tool to obtain the actual function attribute information of each calling function in the function sequence required to be called when the loading module executes. Optionally, the detected end analyzes the function before the application program calls the function according to the instrumented position to obtain the actual function name of the calling function, the function parameter of the calling function and the actual starting address of the calling function. The detected end analyzes the function after the application program calls the function according to the instrumented position to obtain the return address of the calling function.

[0082] In this embodiment, the application program is instrumented based on the module level and the function level, which can accurately obtain the actual module attribute information of the loading module and the actual function attribute information of the calling function when the application program runs, thereby facilitating to improve the accuracy of subsequent detection.

[0083] In one embodiment, the method further includes the following steps:

[0084] In step S203, in response to the detection request for the application program sent by the detected end, the application program is statically measured to obtain the actual program verification value corresponding to the application program.

[0085] Specifically, after receiving the detection request for the application sent by the detection end, the detected end performs static measurement on the application to obtain an actual program verification value corresponding to the application. Optionally, the detected end calculates a hash value of the application, and determines the hash value as the actual program verification value corresponding to the application. On the other hand, the detected end performs instrumentation on the application to obtain actual module attribute information of the loading module and actual function attribute information of the called function.

[0086] Further, step S204 includes the following steps:

[0087] Step S2042, the actual module attribute information, the actual function attribute information and the actual program verification value are sent to the detection end as response data, so as to instruct the detection end to determine the detection result of the application according to the actual module attribute information, the actual function attribute information and the actual program verification value.

[0088] Specifically, the detected end sends the actual module attribute information, the actual function attribute information and the actual program verification value to the detection end as response data. The detection end determines the detection result of the application according to the actual module attribute information, the actual function attribute information and the actual program verification value. Optionally, the detection end determines the detection result of the application by judging whether the actual module attribute information is consistent with the preset standard module attribute information of the loading module, whether the actual function attribute information is consistent with the preset standard function attribute information of the called function, and whether the actual program verification value is consistent with the standard program verification value corresponding to the application.

[0089] In this embodiment, the detection of the application is completed based on the actual module attribute information, the actual function attribute information and the actual program verification value, the detection dimension is more, and the accuracy of the detection is further improved.

[0090] In one embodiment, as shown in Figure 3 , a detection method of an application is provided. Taking the detection end 102 in Figure 1 as an example, the method includes the following steps:

[0091] Step S302, a detection request for the application is sent to the detected end.

[0092] Specifically, the detection end sends a detection request for the application to the detected end.

[0093] Step S304, receiving response data returned by the detected end for the detection request.

[0094] The response data includes actual module attribute information of the loaded module and actual function attribute information of the called function.

[0095] Specifically, the detected end, in response to the detection request, inserts a probe into the application based on the module level and the function level, dynamically obtains the actual module attribute information of the loaded module and the actual function attribute information of the called function, and sends the actual module attribute information and the actual function attribute information as the response data to the detection end. Optionally, the detected end records the actual module attribute information and the actual function attribute information in the specified trace files image.out and trace.out respectively, and sends the specified trace files image.out and trace.out to the detection end. The detection end receives the response data returned by the detected end.

[0096] In step S306, the detection result of the application is determined according to the response data.

[0097] Specifically, the detection end determines the detection result of the application according to the actual module attribute information and the actual function attribute information. Optionally, the detection end determines the detection result of the application by judging whether the actual module attribute information is consistent with the preset standard module attribute information of the loaded module, and whether the actual function attribute information is consistent with the preset standard function attribute information of the called function.

[0098] In the above method for detecting the application, the detection end sends a detection request for the application to the detected end. The detected end, in response to the detection request, inserts a probe into the application, and obtains the actual module attribute information of the loaded module and the actual function attribute information of the called function. The loaded module is a module that needs to be loaded when the application runs, and the called function is a function that needs to be called when the loaded module executes. Then, the detected end sends the actual module attribute information of the loaded module and the actual function attribute information of the called function to the detection end. The detection end determines the detection result of the application according to the actual module attribute information of the loaded module and the actual function attribute information of the called function. It can be understood that the method dynamically obtains the actual module attribute information of the loaded module and the actual function attribute information of the called function corresponding to the application running by using the probe method, and then completes the detection of the application based on the multi-dimensional detection information. Since the detection information used by this method is more, the application can be detected by more dimensional factors whether it is attacked maliciously, so as to improve the detection accuracy of the application and improve the security of the application running.

[0099] In one embodiment, step S306 includes the following steps:

[0100] Step S3062, extracting the actual loading path of the loaded module and the actual module verification value corresponding to the loaded module in the actual module attribute information;

[0101] Step S3064, if the actual loading path is inconsistent with the preset standard loading path of the loaded module, determining that the detection result of the application program is the first detection result;

[0102] Step S3066, if the actual module verification value is inconsistent with the preset standard module verification value corresponding to the loaded module, determining that the detection result of the application program is the first detection result.

[0103] The first detection result indicates that the library file of the application program is tampered or subjected to a library file hijacking attack.

[0104] Specifically, the detection end traverses each record in the specified tracking file image.out, extracts the actual loading path of the loaded module and the actual module verification value corresponding to the loaded module in the actual module attribute information, and matches the preset standard loading path of the loaded module and the standard module verification value corresponding to the loaded module stored in the database. If the actual loading path is inconsistent with the preset standard loading path of the loaded module, the detection end determines that the detection result of the application program is the first detection result; if the actual loading path is consistent with the preset standard loading path of the loaded module, the detection end determines that the application program is not subjected to malicious attacks. If the actual module verification value is inconsistent with the preset standard module verification value corresponding to the loaded module, the detection end determines that the detection result of the application program is the first detection result. If the actual module verification value is consistent with the preset standard module verification value corresponding to the loaded module, the detection end determines that the application program is not subjected to malicious attacks. Then, the detection end can display the first detection result in a visual manner.

[0105] In this embodiment, the whitelist idea is used to verify whether the measurement value is consistent with the standard value, which is a kind of active detection method, which can not only solve the space and performance overhead problem caused by the instruction patching analysis method for embedded devices, reduce the detection workload, but also effectively cope with unknown attack types.

[0106] In one embodiment, step S306 includes the following steps:

[0107] Step S3061, extracting the actual loading path of the loaded module in the actual module attribute information, and extracting the actual starting address of the called function and the actual function name of the called function in the actual function attribute information;

[0108] Step S3063, determining the actual offset address of the called function and the actual module name of the loaded module to which the called function belongs according to the actual loading path and the actual starting address;

[0109] Step S3065, hash calculation is performed on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to the function call path;

[0110] Step S3067, if the actual path metric value is inconsistent with a preset standard path metric value corresponding to the function call path, it is determined that the detection result of the application program is a second detection result.

[0111] The function call path corresponds to the application program. The second detection result indicates that the control flow of the application program is hijacked in the running process, and there is a memory attack, which may be caused by a Return-into-libc attack, a ROP attack or the like.

[0112] Specifically, the detection end traverses each record in the specified trace file trace.out, and extracts the actual starting address of the called function and the actual function name of the called function in the actual function attribute information. The detection end traverses each record in the specified trace file image.out, and extracts the actual loading path of the loaded module in the actual module attribute information. Then, the detection end determines the actual offset address of the called function and the actual module name of the loaded module to which the called function belongs according to the actual loading path and the actual starting address. Then, the detection end performs hash calculation on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to the function call path. Finally, the detection end matches the actual path metric value with a preset standard path metric value corresponding to the function call path stored in the database. If the actual path metric value is inconsistent with the preset standard path metric value corresponding to the function call path, the detection end determines that the detection result of the application program is a second detection result. If the actual path metric value is consistent with the preset standard path metric value corresponding to the function call path, the detection end determines that the application program is not attacked maliciously.

[0113] In this embodiment, the white list idea is used to verify whether the metric value is consistent with the standard value, which is an active detection method. The method can not only solve the space and performance overhead problems caused by the instruction patching analysis method for embedded devices, reduce the detection workload, but also effectively cope with unknown attack types.

[0114] In one embodiment, the called function is multiple, and the multiple called functions constitute a called function sequence. Based on this, step S3065 includes the following steps:

[0115] Step S306a, for the first called function in the called function sequence, hash calculation is performed on the actual offset address of the first called function, the actual function name of the first called function, the actual module name of the loaded module to which the first called function belongs and the initial path metric value to obtain a path metric value corresponding to the first called function;

[0116] Step S306b, for the non-first calling function in the calling function sequence, the actual offset address of the next calling function, the actual function name of the next calling function, the actual module name of the loaded module to which the next calling function belongs, and the path metric value corresponding to the previous calling function are hashed to obtain the path metric value corresponding to the next calling function.

[0117] Step S306c, the path metric value corresponding to the last calling function in the calling function sequence is determined as the actual path metric value corresponding to the function call path.

[0118] Specifically, as shown in Figure 4 , Figure 4 each node represents a function call. Each calling function is described by the actual offset address offset_addr of the calling function, the actual function name func_name of the calling function, and the actual module name func_image of the loaded module to which the calling function belongs. The calling function A is the first function called by the application program, and the path metric value Hpath1 corresponding to the calling function A is calculated, with H(0) and the actual offset address, the actual function name, and the actual module name of the loaded module to which the calling function A belongs as inputs. Since A is the first function called, the path metric value corresponding to the previous calling function input at this time is the initial path metric value H(0). Optionally, H(0) is set to 0. The second function called by the application program is B, and the path metric value Hpath1 corresponding to the previous calling function and the actual offset address, the actual function name, and the actual module name of the loaded module to which the calling function B belongs are input to calculate the path metric value Hpath2 corresponding to the calling function B. Figure 4 In the application program, Hpath5 is the path metric value corresponding to the last calling function in the calling function sequence to be called this time, so Hpath5 is determined as the actual path metric value corresponding to the function call path.

[0119] In this embodiment, the actual offset address of the next calling function, the actual function name of the next calling function, the actual module name of the loaded module to which the next calling function belongs, and the path metric value corresponding to the previous calling function are collectively input to the metric function H and hashed to finally obtain the actual path metric value corresponding to the function call path. This method can completely describe the entire running process of the application program and is beneficial to improve the accuracy of detection.

[0120] In one embodiment, the response data further includes an actual program verification value corresponding to the application program. Based on this, step S306 includes the following steps:

[0121] Step S3060, if the actual program check value is inconsistent with the preset standard program check value corresponding to the application program, it is determined that the detection result of the application program is the third detection result.

[0122] The third detection result indicates that the application program is tampered.

[0123] Specifically, the detection end matches the actual program check value with the preset standard program check value corresponding to the application program stored in the database. If the actual program check value is inconsistent with the preset standard program check value corresponding to the application program, the detection end determines that the detection result of the application program is the third detection result; if the actual program check value is consistent with the preset standard program check value corresponding to the application program, the detection end determines that the application program is not attacked maliciously.

[0124] In this embodiment, the white list idea is used to verify whether the measurement value is consistent with the standard value, which is a kind of active detection method, which can not only solve the space and performance overhead problem caused by the instruction patch analysis method for embedded devices, reduce the detection workload, but also effectively cope with unknown attack types.

[0125] In one embodiment, before step S302, the method further comprises the following steps:

[0126] The verification end performs static measurement on the application program to obtain the standard program check value corresponding to the application program, and stores the standard program check value in the white list database.

[0127] The verification end uses a combination of static and dynamic methods to simulate different application program inputs, analyze the running track of the application program (binary file) when normally executed under different inputs, including the loading module list and the function call path.

[0128] Specifically, the function call path is represented by {<f1,f2>,<f2,f3>……<fi-1,fi>……<fn-1,fn>}, where fi-1 represents the function called by the i-1th, and fi represents the function called by the ith. In the function call path, <fi-1, fi> does not necessarily represent the direct function call relationship between fi-1 and fi, but the execution order between the two calling functions, indicating that fi is the direct successor function of fi-1 after execution. Figure 5 For the example graph of the function call path, according to the definition, it can be converted into two function call paths: Figure 5 Function call path Path1: {<func_A,func_B>,<func_B,func_C>,<func_C,func_D>,<func_D,func_E>};

[0129] Function call path Path2: {<func_A, func_F>, <func_F, func_G>}.

[0130] Wherein, <func_A, func_B> of function call path Path1 indicates that func_A and func_B have function call relationship, that is, func_A calls func_B; but <func_C, func_D> does not indicate that func_C calls func_D, but indicates that func_D calls after func_C runs.

[0131] The verification end counts the calling execution times of the calling functions in each loaded module during each execution of the application based on the running track, that is, the loaded module list and the function call path, and takes the loaded modules with the calling execution times in the top N as the main loaded modules. The verification end measures the function call path during the running of the main loaded modules by using the hash algorithm H, and constructs a standard path measurement value whitelist list of the function call path.

[0132] The detection end statically measures the loaded modules according to the running track, and obtains the standard module check values corresponding to each loaded module. A loaded module whitelist list is constructed. One record in the loaded module whitelist list is described by the module name of the loaded module, the loading path of the loaded module, and the standard module check value corresponding to the loaded module.

[0133] In one embodiment, a detection system of an application program is also provided, comprising a detection end and a detected end, wherein,

[0134] The detection end is configured to send a detection request for the application program to the detected end;

[0135] The detected end is configured to respond to the detection request, and perform instrumentation on the application program to obtain actual module attribute information of the loaded module and actual function attribute information of the calling function; wherein, the loaded module is a module required to be loaded during the running of the application program, and the calling function is a function required to be called during the execution of the loaded module.

[0136] The detected end is further configured to send the actual module attribute information and the actual function attribute information as response data to the detection end;

[0137] The detection end is further configured to determine a detection result of the application program according to the response data.

[0138] In one embodiment, the detected end is specifically configured to perform instrumentation on the loaded module in the application program to obtain an actual loading path of the loaded module and an actual module check value corresponding to the loaded module; and perform instrumentation on the calling function in the loaded module to obtain an actual starting address of the calling function and an actual function name of the calling function.

[0139] In one embodiment, the detected end is further configured to perform static measurement on the application program in response to the detection request sent by the detection end, to obtain an actual program verification value corresponding to the application program.

[0140] The detected end is specifically configured to send the actual module attribute information, the actual function attribute information and the actual program verification value as response data to the detection end, so as to instruct the detection end to determine the detection result of the application program according to the actual module attribute information, the actual function attribute information and the actual program verification value.

[0141] In one embodiment, the detection end is specifically configured to extract an actual loading path of the loading module and an actual module verification value corresponding to the loading module in the actual module attribute information; if the actual loading path is inconsistent with a preset standard loading path of the loading module, the detection end determines that the detection result of the application program is a first detection result; wherein the first detection result indicates that the library file of the application program is tampered with; if the actual module verification value is inconsistent with a preset standard module verification value corresponding to the loading module, the detection end determines that the detection result of the application program is the first detection result.

[0142] In one embodiment, the detection end is specifically configured to extract an actual loading path of the loading module in the actual module attribute information, and extract an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; according to the actual loading path and the actual starting address, the detection end determines an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs; the detection end performs hash calculation on the actual offset address, the actual function name and the actual module name, to obtain an actual path metric value corresponding to the function call path; wherein the function call path corresponds to the application program; if the actual path metric value is inconsistent with a preset standard path metric value corresponding to the function call path, the detection end determines that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process.

[0143] In one embodiment, the detection end is specifically configured to determine that the detection result of the application program is a third detection result if the actual program verification value is inconsistent with a preset standard program verification value corresponding to the application program; wherein the third detection result indicates that the application program is tampered with.

[0144] It should be understood that although each step in the flowchart involved in the embodiments described above is shown in sequence according to the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise specified herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps or stages in other steps.

[0145] Based on the same inventive concept, the embodiments of the present application also provide an application detection device for implementing the application detection method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more application detection device embodiments provided below can refer to the limitations of the application detection method described above, which will not be repeated here.

[0146] In one embodiment, as shown in Figure 6 An application detection device is provided, which is used in a detected end and includes:

[0147] The attribute acquisition module 402 is configured to perform instrumentation on the application in response to the detection request for the application sent by the detection end, and obtain actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module that needs to be loaded during running of the application, and the calling function is a function that needs to be called during execution of the loading module.

[0148] The response sending module 404 is configured to send the actual module attribute information and the actual function attribute information as response data to the detection end, so as to instruct the detection end to determine a detection result of the application according to the actual module attribute information and the actual function attribute information.

[0149] In one embodiment, the attribute acquisition module 402 is specifically configured to perform instrumentation on the loading module in the application to obtain an actual loading path of the loading module and an actual module verification value corresponding to the loading module; and perform instrumentation on the calling function in the loading module to obtain an actual starting address of the calling function and an actual function name of the calling function.

[0150] In one embodiment, as shown in Figure 7 An application detection device is provided, which is used in a detection end and includes:

[0151] The request sending module 502 is configured to send a detection request for the application to the detected end;

[0152] The data receiving module 504 is configured to receive response data returned by the detected end for the detection request; wherein the response data comprises actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module to be loaded by the application during runtime, and the calling function is a function to be called during execution of the loading module;

[0153] The result determining module 506 is configured to determine a detection result of the application according to the response data.

[0154] In one embodiment, the result determining module 506 is specifically configured to extract an actual loading path of the loading module and an actual module verification value corresponding to the loading module in the actual module attribute information; if the actual loading path is inconsistent with a preset standard loading path of the loading module, it is determined that the detection result of the application is a first detection result; wherein the first detection result indicates that the library file of the application is tampered with; if the actual module verification value is inconsistent with a preset standard module verification value corresponding to the loading module, it is determined that the detection result of the application is the first detection result.

[0155] In one embodiment, the result determining module 506 is specifically configured to extract an actual loading path of the loading module in the actual module attribute information, and extract an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; determine an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs according to the actual loading path and the actual starting address; perform hash calculation on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application; if the actual path metric value is inconsistent with a preset standard path metric value corresponding to the function call path, it is determined that the detection result of the application is a second detection result; wherein the second detection result indicates that the control flow of the application is hijacked during the running process.

[0156] In one embodiment, the result determining module 506 is specifically configured to determine that the detection result of the application is a third detection result if the actual program verification value is inconsistent with a preset standard program verification value corresponding to the application; wherein the third detection result indicates that the application is tampered with.

[0157] The above-mentioned various modules in the application program detection device can be realized by software, hardware and combinations thereof, in whole or in part. The above-mentioned various modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above-mentioned various modules.

[0158] In one embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram thereof can be as shown in FIG. 1. Figure 8 The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication) or other technologies. The computer program is executed by the processor to implement a detection method of an application program. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0159] Those skilled in the art can understand that Figure 8 The structure shown in FIG. 1 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0160] In one embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0161] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0162] In one embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0163] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0164] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0165] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0166] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method of detecting an application program, characterized by, The method is applied to a detection end, and comprises: In response to a detection request for an application program sent by the detection end, the application program is instrumented to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes; The actual module attribute information and the actual function attribute information are sent to the detection end as response data to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information; the determination of the detection result of the application program according to the actual module attribute information and the actual function attribute information comprises: extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; According to the actual loading path and the actual starting address, an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs are determined; Hash calculation is performed on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application program; the function call path represents an execution order of the calling function; If the actual path metric value is inconsistent with a standard path metric value corresponding to the function call path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process.

2. The method of claim 1, wherein, The instrumenting of the application program to obtain the actual module attribute information of the loading module and the actual function attribute information of the calling function comprises: The loading module in the application program is instrumented to obtain an actual loading path of the loading module and an actual module check value corresponding to the loading module; The calling function in the loading module is instrumented to obtain an actual starting address of the calling function and an actual function name of the calling function.

3. The method of claim 1, wherein, The method further comprises: In response to a detection request for an application program sent by the detection end, the application program is instrumented to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes; The actual module attribute information and the actual function attribute information are sent to the detection end as response data to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information; the determination of the detection result of the application program according to the actual module attribute information and the actual function attribute information comprises: extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; According to the actual loading path and the actual starting address, an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs are determined; 4. A method of detecting an application program, characterized by, Hash calculation is performed on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application program; the function call path represents an execution order of the calling function; If the actual path metric value is inconsistent with a standard path metric value corresponding to the function call path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process. The instrumenting of the application program to obtain the actual module attribute information of the loading module and the actual function attribute information of the calling function comprises: The loading module in the application program is instrumented to obtain an actual loading path of the loading module and an actual module check value corresponding to the loading module; The calling function in the loading module is instrumented to obtain an actual starting address of the calling function and an actual function name of the calling function. The method further comprises: In response to a detection request for an application program sent by the detection end, the application program is instrumented to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes; The actual module attribute information and the actual function attribute information are sent to the detection end as response data to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information; the determination of the detection result of the application program according to the actual module attribute information and the actual function attribute information comprises: extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; According to the actual loading path and the actual starting address, an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs are determined; Hash calculation is performed on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application program; the function call path represents an execution order of the calling function; If the actual path metric value is inconsistent with a standard path metric value corresponding to the function call path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process. The instrumenting of the application program to obtain the actual module attribute information of the loading module and the actual function attribute information of the calling function comprises: The loading module in the application program is instrumented to obtain an actual loading path of the loading module and an actual module check value corresponding to the loading module; The calling function in the loading module is instrumented to obtain an actual starting address of the calling function and an actual function name of the calling function. The method further comprises: In response to a detection request for an application program sent by the detection end, the application program is instrumented to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes; The actual module attribute information and the actual function attribute information are sent to the detection end as response data to instruct the detection end to determine a detection result of the application program according to the actual module attribute information and the actual function attribute information; the determination of the detection result of the application program according to the actual module attribute information and the actual function attribute information comprises: extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; According to the actual loading path and the actual starting address, an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs are determined; Hash calculation is performed on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application program; the function call path represents an execution order of the calling function; If the actual path metric value is inconsistent with a standard path metric value corresponding to the function call path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process. The instrumenting of the application program to obtain the actual module attribute information of the loading module and the actual function attribute information of the calling function comprises: The loading module in the application program is instrumented to obtain an actual loading path of the loading module and an actual module check value corresponding to the loading module; The calling function in the loading module is instrumented to obtain an actual starting address of the calling function and an actual function name of the calling function. receive response data returned by the detected end for the detection request; wherein the response data comprises actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module to be loaded by the application program at runtime, and the calling function is a function to be called when the loading module is executed; determine a detection result of the application program according to the response data; the determining a detection result of the application program according to the response data comprises: extracting an actual loading path of the loading module in the actual module attribute information, and extracting an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information; determining an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs according to the actual loading path and the actual starting address; performing hash calculation on the actual offset address, the actual function name and the actual module name to obtain an actual path metric value corresponding to a function call path; wherein the function call path corresponds to the application program; and the function call path represents an execution order of the calling function; if the actual path metric value is inconsistent with a standard path metric value corresponding to the function call path, determining that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked during the running process.

5. The method of claim 4, wherein, the determining a detection result of the application program according to the response data comprises: extracting an actual loading path of the loading module and an actual module check value corresponding to the loading module in the actual module attribute information; if the actual loading path is inconsistent with a standard loading path of the loading module, determining that the detection result of the application program is a first detection result; wherein the first detection result indicates that the library file of the application program is tampered with; if the actual module check value is inconsistent with a standard module check value corresponding to the loading module, determining that the detection result of the application program is the first detection result.

6. The method of claim 4, wherein, the calling function is multiple and constitutes a calling function sequence; the performing hash calculation on the actual offset address, the actual function name and the actual module name to obtain the actual path metric value corresponding to the function call path comprises: for a first calling function in the calling function sequence, performing hash calculation on an actual offset address of the first calling function, an actual function name of the first calling function, an actual module name of the loading module to which the first calling function belongs and an initial path metric value to obtain a path metric value corresponding to the first calling function; for a non-first calling function in the calling function sequence, performing hash calculation on an actual offset address of the next calling function, an actual function name of the next calling function, an actual module name of the loading module to which the next calling function belongs and a path metric value corresponding to the previous calling function to obtain a path metric value corresponding to the next calling function; The path metric value corresponding to the last calling function in the sequence of calling functions is determined as an actual path metric value corresponding to the function calling path.

7. The method of claim 4, wherein, The response data further includes an actual program verification value corresponding to the application program. The determining of the detection result of the application program according to the response data includes: If the actual program verification value is inconsistent with a preset standard program verification value corresponding to the application program, it is determined that the detection result of the application program is a third detection result; wherein the third detection result indicates that the application program is tampered.

8. A detection system of an application program, comprising a detection end and a detected end, wherein, The detection end is configured to send a detection request for an application program to the detected end. The detected end is configured to respond to the detection request by instrumenting the application program to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes. The detected end is further configured to send the actual module attribute information and the actual function attribute information as response data to the detection end. The detection end is further configured to determine the detection result of the application program according to the response data. The detection end is specifically configured to extract an actual loading path of the loading module in the actual module attribute information, and extract an actual starting address of the calling function and an actual function name of the calling function in the actual function attribute information. According to the actual loading path and the actual starting address, an actual offset address of the calling function and an actual module name of the loading module to which the calling function belongs are determined. The actual offset address, the actual function name, and the actual module name are subjected to hash calculation to obtain an actual path metric value corresponding to a function calling path; wherein the function calling path corresponds to the application program; and the function calling path represents an execution order of the calling function. If the actual path metric value is inconsistent with a preset standard path metric value corresponding to a function calling path, it is determined that the detection result of the application program is a second detection result; wherein the second detection result indicates that the control flow of the application program is hijacked in the running process.

9. An application program detecting apparatus characterized by comprising: The device is used in the detected end to implement the detection method of the application program of any one of claims 1-3, comprising: An attribute acquisition module is configured to respond to a detection request for an application program sent by a detection end, instrument the application program to obtain actual module attribute information of a loading module and actual function attribute information of a calling function; wherein the loading module is a module that needs to be loaded when the application program runs, and the calling function is a function that needs to be called when the loading module executes. A response sending module is configured to send the actual module attribute information and the actual function attribute information as response data to the detection end, so as to instruct the detection end to determine the detection result of the application program according to the actual module attribute information and the actual function attribute information.

10. An application program detecting apparatus characterized by comprising: The device is used for detecting the terminal to realize the detection method of the application program in any one of claims 4-7, comprising: A request sending module is configured to send a detection request for the application program to the detected terminal; A data receiving module is configured to receive response data returned by the detected terminal for the detection request; wherein the response data comprises actual module attribute information of a loading module and actual function attribute information of a calling function; the loading module is a module to be loaded when the application program runs, and the calling function is a function to be called when the loading module executes; A result determining module is configured to determine the detection result of the application program according to the response data. 11.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-10. The processor executes the computer program to realize the steps of the method in any one of claims 1-3 or 4-7.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1-3 or 4-7.

13. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1-3 or 4-7.

Images