Privacy information leakage detection method, device and electronic equipment

Abstract

The present disclosure provides a method, device and electronic device for detecting the leakage of privacy information. Among them, a method for detecting the leakage of privacy information includes: obtaining an application to be detected, and reverse parsing the application to obtain a target file after parsing; statically analyzing the target file to obtain a dynamic loading path and a target privacy protocol of the application; generating a first detection result according to the target privacy protocol and a preset protocol; detecting the user privacy information used by the application in the dynamic loading process according to the dynamic loading path to generate a second detection result; determining whether the application is an abnormal program that causes the leakage of user privacy information based on the first detection result and the second detection result.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular to a method, device and electronic device for detecting leakage of private information. Background Art

[0002] With the development of mobile Internet technology, Android applications have developed rapidly. At the same time, Android applications also use a large number of SDKs (Software Development Kits, third-party software programs) while obtaining various user data. These third-party software programs also obtain a large amount of user data during the operation of Android applications.

[0003] Among them, as users pay more attention to their personal privacy data, relevant laws and regulations have been introduced at home and abroad to protect user privacy data. In this context, how to detect whether an Android application complies with relevant regulations when using user privacy information is of great significance to both regulatory authorities and the main companies that launched the Android application.

[0004] However, when detecting whether an application complies with regulations in obtaining user privacy information, the prior art usually only analyzes and detects the Android application itself, while ignoring the detection of third-party software programs associated with the Android application. As a result, the prior art has the problem of poor detection accuracy when detecting whether an application complies with regulations in obtaining user privacy information.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The present disclosure provides a method, device and electronic device for detecting privacy information leakage, so as to at least solve the technical problem of poor detection accuracy in the prior art when detecting whether an application program complies with regulations in obtaining user privacy information.

[0007] According to one aspect of the present disclosure, a method for detecting privacy information leakage is provided, comprising: obtaining an application to be detected, and reverse parsing the application to obtain a target file after parsing; statically analyzing the target file to obtain a dynamic loading path and a target privacy protocol of the application, wherein the target privacy protocol at least includes a first privacy protocol of the application and a second privacy protocol of a third-party software program associated with the application, and the dynamic loading path is a control flow path to reach dynamic loading; generating a first detection result according to the target privacy protocol and a preset protocol, wherein the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when not running, and the preset protocol is used to determine whether the target privacy protocol complies with preset specifications; detecting user privacy information used by the application in the dynamic loading process according to the dynamic loading path to generate a second detection result, wherein the second detection result is used to characterize whether the application is a program that illegally uses user privacy information when running; and determining whether the application is an abnormal program that causes user privacy information leakage based on the first detection result and the second detection result.

[0008] Optionally, the method for detecting privacy information leakage also includes: detecting whether the code in the target file has been shelled, wherein the shelling process includes at least one of the following processing methods: encrypting the code, hiding the code, and obfuscating the code; in the case where the code has been shelled, unshelling the code to obtain the original code before the shelling process, wherein the unshelling process is the reverse processing process of the shelling process; determining the dynamic loading path of the application and the target privacy protocol based on the original code.

[0009] Optionally, the method for detecting privacy information leakage also includes: extracting a first privacy protocol of the application and marking information of a third-party software program based on the original code; obtaining a second privacy protocol of the third-party software program based on the marking information; analyzing the first privacy protocol and the second privacy protocol using semantic analysis, and integrating the analysis results to obtain a target privacy protocol.

[0010] Optionally, the method for detecting privacy information leakage also includes: when the content of the target privacy protocol does not match the content of the preset protocol, determining that the application is a program that illegally uses the user privacy information when it is not running; when the content of the target privacy protocol matches the content of the preset protocol, obtaining a first code in the target file, wherein the first code is used to represent the user privacy information that the application actually wants to obtain; and determining whether the application is a program that illegally uses the user privacy information when it is not running based on the first code and the target privacy protocol.

[0011] Optionally, the method for detecting privacy information leakage also includes: parsing the first code to obtain the user privacy information that the application actually wants to obtain; when the user privacy information that the application actually wants to obtain matches the content of the target privacy protocol, determining that the application is a program that legally uses the user privacy information when it is not running; when the user privacy information that the application actually wants to obtain does not match the content of the target privacy protocol, determining that the application is a program that illegally uses the user privacy information when it is not running.

[0012] Optionally, the method for detecting privacy information leakage also includes: inserting a second code for recording dynamically loaded information into the application; generating an input event for triggering the dynamic loading process of the application based on the dynamic loading path; triggering the dynamic loading process of the application through the input event, and obtaining all information loaded by the application in the dynamic loading process through the second code; using a data flow analysis method to track the transmission process of user privacy information in all information on the dynamic loading path, and generating a second detection result based on the tracking result.

[0013] Optionally, the method for detecting privacy information leakage also includes: performing data flow analysis starting from the entry point of the dynamic loading path to identify user privacy information in all information; marking the identified user privacy information to obtain marked data; taint propagating the marked data; when it is detected that the application makes a dynamic loading call at the target node on the dynamic loading path, obtaining the target dynamic loading information recorded by the second code at the target node; using the target dynamic loading information, tracking the marked data between the dynamic loading path and the external code to obtain a tracking result.

[0014] Optionally, the method for detecting privacy information leakage also includes: when the transmission process of the marked data between the dynamic loading path and the external code matches the target privacy protocol, determining that the application is a program that legally uses the user's privacy information when it is running; when the transmission process of the marked data between the dynamic loading path and the external code does not match the target privacy protocol, determining that the application is a program that illegally uses the user's privacy information when it is running.

[0015] Optionally, the method for detecting privacy information leakage also includes: when the first detection result indicates that the application is a program that legally uses user privacy information when not running, and the second detection result indicates that the application is a program that legally uses user privacy information when running, determining that the application is a normal program that will not cause leakage of user privacy information; when the first detection result indicates that the application is a program that illegally uses user privacy information when not running, or the second detection result indicates that the application is a program that illegally uses user privacy information when running, determining that the application is an abnormal program that causes leakage of user privacy information.

[0016] According to another aspect of the present disclosure, a detection device for privacy information leakage is also provided, including: an acquisition module, configured to acquire an application to be detected, and reversely parse the application to obtain a target file after parsing; a static analysis module, configured to statically analyze the target file to obtain a dynamic loading path and a target privacy protocol of the application, wherein the target privacy protocol at least includes a first privacy protocol of the application and a second privacy protocol of a third-party software program associated with the application, and the dynamic loading path is a control flow path to reach dynamic loading; a first detection module, configured to generate a first detection result according to the target privacy protocol and a preset protocol, wherein the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when not running, and the preset protocol is used to determine whether the target privacy protocol complies with a preset specification; a second detection module, configured to detect user privacy information used by the application in the dynamic loading process according to the dynamic loading path, and generate a second detection result, wherein the second detection result is used to characterize whether the application is a program that illegally uses user privacy information when running; a determination module, configured to determine whether the application is an abnormal program that causes user privacy information leakage based on the first detection result and the second detection result.

[0017] According to another aspect of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned method for detecting leakage of private information when running.

[0018] According to another aspect of the present disclosure, an electronic device is also provided, which includes one or more processors; a storage device for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned method for detecting privacy information leakage during operation.

[0019] In the present disclosure, the application is statically detected according to the target privacy protocol and the preset protocol, and the application is dynamically detected according to the dynamic loading path. After obtaining the application to be detected and reversing the application to obtain the parsed target file, the target file is statically analyzed to obtain the dynamic loading path and the target privacy protocol of the application, and then the first detection result is generated according to the target privacy protocol and the preset protocol, and the user privacy information used by the application in the dynamic loading process is detected according to the dynamic loading path to generate a second detection result, and finally, based on the first detection result and the second detection result, it is determined whether the application is an abnormal program that causes the leakage of user privacy information. Among them, the target privacy protocol at least includes the first privacy protocol of the application and the second privacy protocol of the third-party software program associated with the application, and the dynamic loading path is the control flow path to reach the dynamic loading; the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is not running, and the preset protocol is used to determine whether the target privacy protocol meets the preset specification; the second detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is running.

[0020] As can be seen from the above content, in the present disclosure, the target privacy protocol includes not only the first privacy protocol of the application, but also the second privacy protocol of the third-party software program associated with the application. Therefore, compared with the prior art that only detects the application itself, when the present disclosure performs static detection on the application according to the target privacy protocol and the preset protocol, in addition to detecting the application itself, it also detects the third-party software program related to the application, thereby improving the comprehensiveness of the detection of user privacy information. In addition, the present disclosure will also detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, thereby realizing the detection of the user privacy information leakage behavior caused by the dynamic loading of the application. On this basis, it is determined whether the application is an abnormal program based on the first detection result and the second detection result. In fact, after the static detection result and the dynamic detection result of the application are comprehensively analyzed, the final detection result is obtained, thereby achieving the effect of improving the detection accuracy of user privacy information.

[0021] It can be seen that through the technical solution disclosed in the present invention, the purpose of comprehensively detecting the process of application using user privacy information is achieved, thereby achieving the effect of preventing user privacy information from being leaked by the application, and further solving the technical problem of poor detection accuracy in the prior art when detecting whether the application obtains user privacy information in compliance with regulations. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0023] Figure 1 is a flow chart of a method for detecting privacy information leakage according to an embodiment of the present disclosure;

[0024] Figure 2 is a flow chart of static analysis of an application to be detected according to an embodiment of the present disclosure;

[0025] Figure 3 is a flow chart of static analysis of an application to be detected according to an embodiment of the present disclosure;

[0026] Figure 4 is a flow chart of static analysis of an application to be detected according to an embodiment of the present disclosure;

[0027] Figure 5 is a flow chart of a dynamic analysis of an application to be detected according to an embodiment of the present disclosure;

[0028] Figure 6 It is a schematic diagram of an optional device for detecting privacy information leakage according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present disclosure, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present disclosure.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0031] In addition, it should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0032] Example 1

[0033] According to an embodiment of the present disclosure, an embodiment of a method for detecting leakage of privacy information is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] In addition, it should be noted that electronic devices can be used as the executor of the privacy information leakage detection method in the embodiments of the present disclosure, wherein the electronic devices can be servers, laptops, desktop computers, smart tablets, smart phones and other devices.

[0035] Figure 1 is a flow chart of a method for detecting a privacy information leakage according to an embodiment of the present disclosure, such as Figure 1 As shown, the method comprises the following steps:

[0036] Step S101, obtaining an application to be detected, and reverse parsing the application to obtain a parsed target file.

[0037] In step S101, the application to be detected is an Android application, and the process of reverse parsing the application can be a process in which the electronic device unpacks the APK (Android application package) to be detected by using an Android analysis tool, such as APKtool (an application compilation tool), to obtain a target file. The target file at least contains the source code and configuration file information of the application to be detected, specifically, including: configuration files, bytecode files, application interfaces, icons and other resource files.

[0038] Step S102, statically analyzing the target file to obtain the dynamic loading path of the application and the target privacy protocol.

[0039] In step S102, the target privacy protocol includes at least a first privacy protocol of the application and a second privacy protocol of a third-party software program associated with the application, and the dynamic loading path is a control flow path to the dynamic loading, wherein the third-party software program is an SDK associated with the application.

[0040] In addition, the electronic device can obtain the first privacy protocol of the application itself based on the code in the target file, and can also obtain the marking information of the third-party software program, and then use search engine search, automatic crawling, and page content parsing and other technologies based on the marking information to collect the second privacy protocol of the third-party software program, and finally integrate the first privacy protocol with the second privacy protocol to obtain the target privacy protocol.

[0041] It should be noted that in actual application scenarios, when an application is removed from the shelves due to illegal use of user privacy data, it may not be because the code of the application itself is non-compliant, but because the third-party software program used is non-compliant. Therefore, the present disclosure integrates the second privacy protocol of the third-party software program with the first privacy protocol of the application itself, thereby ensuring that the third-party software program is also detected while the application itself is detected, thereby improving the comprehensiveness of the detection of the application. In addition, when detecting third-party software programs, the prior art usually uses manual detection methods, which consumes a lot of manpower. The present disclosure uses an automated method to detect the compliance of third-party software programs and the application itself, reducing manpower and achieving the effect of improving detection efficiency.

[0042] Step S103: Generate a first detection result according to the target privacy protocol and the preset protocol.

[0043] In step S103, the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is not running, and the preset protocol is used to determine whether the target privacy protocol meets the preset specification. Among them, the preset protocol is the relevant laws and regulations formulated by the regulatory agency based on the user privacy information. Specifically, the operator writes the preset protocol based on the content of the relevant laws and regulations, and stores the preset protocol so that the electronic device can call it at any time. When the content in the target privacy protocol does not match the content in the preset protocol, the electronic device will determine that the application is a program that illegally uses user privacy information when it is not running. For example, if the content in the target privacy protocol exceeds the content specified in the preset protocol (i.e., the relevant laws and regulations), the electronic device determines that the application is a program that illegally uses user privacy information. In addition, when the content of the target privacy protocol matches the content of the preset protocol, the electronic device also needs to detect whether the user privacy data actually to be obtained by the application is consistent with the target privacy protocol. If it is consistent, it is determined that the application is a program that legally uses user privacy information when it is not running. If it is not consistent, it is still necessary to determine that the application is a program that illegally uses user privacy information when it is not running.

[0044] Through the above process, the present disclosure will first detect whether the first privacy agreement and the second privacy agreement comply with relevant laws and regulations, and then after confirming that the first privacy agreement and the second privacy agreement all comply with relevant laws and regulations, detect whether the user privacy data actually to be obtained by the application complies with the target privacy agreement. It can be seen that compared with the prior art that only detects the application itself, the present disclosure performs a more comprehensive static detection of Android applications and third-party software programs.

[0045] Step S104: Detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path to generate a second detection result.

[0046] In step S104, the second detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is running. Among them, the process based on the dynamic loading path includes at least the following parts: analyzing static information (i.e., target file) to determine the dynamic loading path; generating an input event for triggering the dynamic loading process of the application based on the static information; inserting a second code for saving dynamic loading information into the application to be detected; triggering the dynamic loading process of the application through the input event; based on the acquired dynamic loading information and path information, using a data flow analysis method to track the transmission process of user privacy information during the dynamic loading process, and obtaining a second detection result based on the tracking result.

[0047] It should be noted that user privacy information refers to data information that can uniquely identify the user's personal identity, such as the IMEI (international mobile equipment identity) number, IMSI (international mobile subscriber identity) number, mobile phone number, etc. of the device used by the user, as well as personal data used by the user, such as geographic location information and application list, etc. The present disclosure detects the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, thereby achieving the effect of detecting the user privacy information leakage behavior caused by the dynamic loading of the application, and avoiding the problem of user privacy data being leaked when the application is dynamically loaded.

[0048] Step S105: determining whether the application is an abnormal program that causes leakage of user privacy information based on the first detection result and the second detection result.

[0049] In step S105, when the first detection result indicates that the application is a program that legally uses user privacy information when not running, and the second detection result indicates that the application is a program that legally uses user privacy information when running, the electronic device determines that the application is a normal program that will not cause leakage of user privacy information; when the first detection result indicates that the application is a program that illegally uses user privacy information when not running, or the second detection result indicates that the application is a program that illegally uses user privacy information when running, the electronic device determines that the application is an abnormal program that causes leakage of user privacy information.

[0050] Through the above process, the present invention obtains the final detection result by comprehensively analyzing the static detection results and dynamic detection results of the application, thereby achieving comprehensive detection of the compliance of the application in a non-running state and in a running state, thereby improving the detection accuracy of user privacy information.

[0051] Based on the contents of the above steps S101 to S105, it can be known that in the embodiment of the present disclosure, the application is statically detected according to the target privacy protocol and the preset protocol, and the application is dynamically detected according to the dynamic loading path. After obtaining the application to be detected and reversing the application to obtain the parsed target file, the target file is statically analyzed to obtain the dynamic loading path and the target privacy protocol of the application, and then the first detection result is generated according to the target privacy protocol and the preset protocol, and the user privacy information used by the application in the dynamic loading process is detected according to the dynamic loading path to generate a second detection result, and finally, based on the first detection result and the second detection result, it is determined whether the application is an abnormal program that causes the leakage of user privacy information. Among them, the target privacy protocol at least includes the first privacy protocol of the application and the second privacy protocol of the third-party software program associated with the application, and the dynamic loading path is the control flow path to reach the dynamic loading; the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is not running, and the preset protocol is used to determine whether the target privacy protocol meets the preset specification; the second detection result is used to characterize whether the application is a program that illegally uses user privacy information when it is running.

[0052] As can be seen from the above content, in the present disclosure, the target privacy protocol includes not only the first privacy protocol of the application, but also the second privacy protocol of the third-party software program associated with the application. Therefore, compared with the prior art that only detects the application itself, when the present disclosure performs static detection on the application according to the target privacy protocol and the preset protocol, in addition to detecting the application itself, it also detects the third-party software program related to the application, thereby improving the comprehensiveness of the detection of user privacy information. In addition, the present disclosure will also detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, thereby realizing the detection of the user privacy information leakage behavior caused by the dynamic loading of the application. On this basis, it is determined whether the application is an abnormal program based on the first detection result and the second detection result. In fact, after the static detection result and the dynamic detection result of the application are comprehensively analyzed, the final detection result is obtained, thereby achieving the effect of improving the detection accuracy of user privacy information.

[0053] It can be seen that through the technical solution disclosed in the present invention, the purpose of comprehensively detecting the process of application using user privacy information is achieved, thereby achieving the effect of preventing user privacy information from being leaked by the application, and further solving the technical problem of poor detection accuracy in the prior art when detecting whether the application obtains user privacy information in compliance with regulations.

[0054] In an optional embodiment, after obtaining the target file, the electronic device will also detect whether the code in the target file has been shelled. If the code has been shelled, the electronic device will unshell the code to obtain the original code before the shelling process. Finally, the electronic device determines the dynamic loading path of the application and the target privacy protocol based on the original code. The shelling process includes at least one of the following processing methods: encrypting the code, hiding the code, and obfuscating the code; the unshelling process is the reverse process of the shelling process.

[0055] Optionally, in the prior art, some Android applications use shelling technology. After the shelling process, the SDK associated with the Android application will not be available for query. Therefore, in order to ensure that the SDK related information can be obtained, the shelled application needs to be unshelled. Figure 2 As shown, for an Android application, the electronic device first performs reverse parsing such as unpacking, and then obtains the target file, wherein the target file at least includes: a configuration file and a bytecode file. Then the electronic device detects whether the code in the target file has been shelled. If it has been shelled, the Android application is unshelled, and then the original code after the unshelling is statically analyzed, for example, analyzing the calling of key functions in the bytecode file, analyzing the permission information of the application to obtain user privacy information, analyzing the dynamic loading and triggering conditions of the application, analyzing the correspondence between the control variables and the interface controls in the application, and analyzing whether the application obtains the location information, IMEI and IMSI of the user's device.

[0056] Optional, such as Figure 3 As shown, if the electronic device detects that the code in the target file corresponding to an Android application has not been shelled, the electronic device will no longer need to unshell the target file and can directly perform static analysis on the code in the target file.

[0057] It is easy to notice that the present disclosure solves the problem of being unable to obtain information about third-party software programs associated with an application due to application shelling by identifying whether the application to be detected has been shelled and unshelling the shelled application.

[0058] In an optional embodiment, the electronic device first extracts a first privacy protocol of the application and marking information of a third-party software program based on the original code, then obtains a second privacy protocol of the third-party software program according to the marking information, and finally analyzes the first privacy protocol and the second privacy protocol by semantic analysis, and integrates the analysis results to obtain a target privacy protocol.

[0059] Optional, such as Figure 4 As shown, after the electronic device completes the static analysis of the application to be detected, the analysis result is stored in the form of a software asset database, and then the electronic device can directly obtain the required information from the software asset database. Among them, the electronic device can extract the first privacy protocol of the application to be detected based on the original code, and analyze the first privacy protocol by semantic analysis to obtain the first analysis result. At the same time, the electronic device can also extract the tag information of the SDK associated with the application based on the original code, and according to the tag information, obtain the developer information and developer website information of the SDK for the matching rules given by the SDK, and then use search engines, automatic crawling and page content parsing and other technologies to realize the collection of the second privacy protocol of the SDK, and finally analyze the second privacy protocol by semantic analysis to obtain the second analysis result. The electronic device integrates the first analysis result with the second analysis result to generate the final target privacy protocol. The target privacy protocol can be understood as the privacy information usage compliance behavior specification corresponding to this application to be detected and the associated SDK.

[0060] In an optional embodiment, after generating the target privacy agreement, the electronic device needs to detect whether the target privacy agreement complies with relevant laws and regulations. Specifically, first, when the content of the target privacy agreement does not match the content of the preset agreement, the electronic device determines that the application is a program that illegally uses the user's privacy information when it is not running. For example, Figure 4 As shown, the operator makes a preset agreement based on the content of relevant laws and regulations. When the content of the target privacy agreement does not match the content of the preset agreement, it means that the content of the target privacy agreement does not comply with relevant laws and regulations. At this time, the electronic device determines that the application is a program that illegally uses user privacy information when it is not running.

[0061] In addition, when the content of the target privacy protocol matches the content of the preset protocol, the electronic device obtains the first code in the target file, wherein the first code is used to characterize the user privacy information that the application actually wants to obtain. Then the electronic device determines whether the application is a program that illegally uses the user privacy information when it is not running based on the first code and the target privacy protocol. Specifically, the electronic device parses the first code to obtain the user privacy information that the application actually wants to obtain. Then, when the user privacy information that the application actually wants to obtain matches the content of the target privacy protocol, the electronic device determines that the application is a program that legally uses the user privacy information when it is not running; when the user privacy information that the application actually wants to obtain does not match the content of the target privacy protocol, the electronic device determines that the application is a program that illegally uses the user privacy information when it is not running.

[0062] Optional, such as Figure 4 As shown, after the target privacy agreement complies with relevant laws and regulations, the electronic device also needs to detect whether the user privacy information actually to be obtained by the application program complies with the provisions of the target privacy agreement. Specifically, the electronic device first obtains a first code for representing the user privacy information actually to be obtained by the application program, for example, a code for representing the relevant function for obtaining the user privacy information, a code for representing the relevant permission information for obtaining the user privacy information, the electronic device parses the first code, and stores the parsing result in a static behavior library, and then the electronic device compares and detects the user privacy information actually to be obtained by the application program with the content of the target privacy agreement. If the two do not match, for example, the content of the target privacy agreement does not stipulate the acquisition of the user's bank card number, but the application program actually wants to obtain the user's bank card number, in this case, the electronic device will determine that the application program is a program that illegally uses the user's privacy information when it is not running. If the user privacy information actually to be obtained by the application program matches the content of the target privacy agreement, the electronic device determines that the application program is a program that legally uses the user's privacy information when it is not running.

[0063] Optionally, the following table gives an example of static instrumentation of an application using a target privacy protocol:

[0064]

[0065] In an optional embodiment, the electronic device will also detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, and generate a second detection result. Specifically, the electronic device first inserts a second code for recording the dynamic loading information in the application, and then generates an input event for triggering the dynamic loading process of the application based on the dynamic loading path, and then triggers the dynamic loading process of the application through the input event, and obtains all the information loaded by the application in the dynamic loading process through the second code. Finally, the electronic device uses a data flow analysis method to track the transmission process of the user privacy information in all information on the dynamic loading path, and generates a second detection result based on the tracking result.

[0066] Optional, such as Figure 5 As shown, after the electronic device performs static analysis on the application to be detected and stores the analysis results of the static analysis in a static database (i.e., a software asset database), the electronic device first retrieves static information from the static database, and then determines the dynamic loading path of the application to be detected based on the static information, and generates path information. Then, the electronic device generates an input event for triggering the dynamic loading process of the application according to the path information.

[0067] In addition, before generating an input event, the electronic device can use the Soot tool to perform a plug-in operation on the application to be detected. Among them, the Soot tool is a work for analyzing, plugging and optimizing Android applications. First, according to the node where the dynamic loading is determined in the path information generation process, the corresponding position in the application that needs to be plugged is found. Then, the Soot tool is used to plug in these corresponding positions. Among them, plugging is to insert a second code for recording dynamic loading information in the application. In addition, since the dynamic loading call process generally requires multiple program statements to complete, including loading files, class loading and method calls, the second code for saving dynamic loading information can be inserted after each statement. For example, there is external file path information in the statement for creating the DexClassLoader class loader, so the second code for saving the loaded file can be inserted after the DexClassLoader class loader statement. After completing the plug-in operation, the electronic device can start triggering the dynamic loading process of the application through the input event.

[0068] It should be noted that, although the purpose of triggering dynamic loading can be achieved by directly executing input events on the application to be detected, in order to be able to perform comprehensive detection of the dynamically loaded external code, it is necessary to obtain the dynamically loaded external code during the dynamic loading process, as well as basic information such as the called classes and methods to complete the comprehensive detection. It can be seen that the present disclosure implants the second code into the application to be detected by using the stub technology, thereby saving the relevant information in the dynamic loading process when the application is running, thereby realizing the preservation of information such as the code fragments and corresponding content passed through the entire dynamic loading process. On this basis, the electronic device can generate a second detection result by analyzing the transmission process of the user privacy information in this information on the dynamic loading path.

[0069] In an optional embodiment, the electronic device can use a data flow analysis method to track the transmission process of user privacy information in all information on the dynamic loading path. Specifically, the electronic device starts data flow analysis from the entry point of the dynamic loading path, identifies the user privacy information in all information, and then marks the identified user privacy information to obtain marked data, and performs taint propagation on the marked data. When it is detected that the application performs a dynamic loading call on the target node on the dynamic loading path, the electronic device obtains the target dynamic loading information recorded by the second code at the target node, and uses the target dynamic loading information to track the marked data between the dynamic loading path and the external code to obtain the tracking result.

[0070] Optional, such as Figure 5 As shown, the present disclosure provides a path-oriented taint analysis method. Specifically, the electronic device analyzes each dynamic loading path and detects whether there is any illegal transmission of user privacy information on each dynamic loading path. First, for a path that can reach a dynamic loading call, data flow analysis is performed on the control flow path P starting from its entrance. When a key sensitive function (for example, a function that obtains user privacy information such as a device number and a mobile phone number) is found to be called, the user privacy information obtained is marked with a taint to obtain marked data, and the marked data is tracked on the subsequent path. Then, if a dynamic loading call is found at a certain target node on the path, the target dynamic loading information recorded by the second code at the target node is obtained. Finally, using the target dynamic loading information, the marked data can be tracked between the dynamic loading path and the external code to obtain a tracking result.

[0071] In an optional embodiment, the tracing process may include the following processes: tracing whether tainted data (i.e., marker data) is passed into external code through parameters of dynamic loading calls and leaked by external code; checking whether external code obtains tainted data, and tracing the transmission process of tainted data in external code; checking whether external code obtains tainted data, and tracing whether the tainted data has a return value, and if so, continuing to trace the return value on path P to detect whether it will be transmitted.

[0072] In an optional embodiment, when the transmission process of the marked data between the dynamic loading path and the external code matches the target privacy protocol, the electronic device determines that the application is a program that legally uses the user's privacy information when it is running; when the transmission process of the marked data between the dynamic loading path and the external code does not match the target privacy protocol, the electronic device determines that the application is a program that illegally uses the user's privacy information when it is running.

[0073] Optionally, through the tracking results, the electronic device can obtain the transmission process of the marked data between the dynamic loading path and the external code. On this basis, the electronic device determines whether the application is a program that illegally uses the user's privacy information while in operation by detecting whether the transmission process complies with the provisions of the target privacy agreement. For example, if the target privacy agreement stipulates that the application to be detected cannot transmit the user's mobile phone number to the external code, but the tracking results show that the application to be detected transmits the user's mobile phone number to the external code, then the electronic device determines that the application is a program that illegally uses the user's privacy information while in operation.

[0074] In an optional embodiment, when the first detection result indicates that the application is a program that legally uses user privacy information when not running, and the second detection result indicates that the application is a program that legally uses user privacy information when running, the electronic device determines that the application is a normal program that will not cause leakage of user privacy information; when the first detection result indicates that the application is a program that illegally uses user privacy information when not running, or the second detection result indicates that the application is a program that illegally uses user privacy information when running, the electronic device determines that the application is an abnormal program that causes leakage of user privacy information.

[0075] From the above content, it can be seen that the present disclosure determines whether an application is an abnormal program based on the first detection result and the second detection result. In fact, the final detection result is obtained after a comprehensive analysis of the static detection result and the dynamic detection result of the application, thereby achieving the effect of improving the detection accuracy of user privacy information.

[0076] Example 2

[0077] According to an embodiment of the present disclosure, there is also provided an embodiment of a device for detecting leakage of private information, wherein: Figure 6 is a schematic diagram of an optional detection device for privacy information leakage according to an embodiment of the present disclosure, such as Figure 6 As shown, the processing device includes: an acquisition module 601 , a static analysis module 602 , a first detection module 603 , a second detection module 604 and a determination module 605 .

[0078] Among them, the acquisition module 601 is configured to acquire the application to be detected and reversely parse the application to obtain the parsed target file; the static analysis module 602 is configured to perform static analysis on the target file to obtain the dynamic loading path and the target privacy protocol of the application, wherein the target privacy protocol at least includes the first privacy protocol of the application and the second privacy protocol of the third-party software program associated with the application, and the dynamic loading path is the control flow path to reach the dynamic loading; the first detection module 603 is configured to generate a first detection result according to the target privacy protocol and the preset protocol, wherein the first detection result is configured to characterize whether the application is a program that illegally uses user privacy information when it is not running, and the preset protocol is configured to determine whether the target privacy protocol complies with the preset specification; the second detection module 604 is configured to detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, and generate a second detection result, wherein the second detection result is configured to characterize whether the application is a program that illegally uses user privacy information when it is running; the determination module 605 is configured to determine whether the application is an abnormal program that causes the leakage of user privacy information based on the first detection result and the second detection result.

[0079] Optionally, the static analysis module further includes: a third detection module, an unpacking module and a first determination module. The third detection module is configured to detect whether the code in the target file has been unpacked, wherein the unpacking process includes at least one of the following processing methods: encrypting the code, hiding the code, and obfuscating the code; the unpacking module is configured to unpack the code when the code has been unpacked to obtain the original code before the unpacking process, wherein the unpacking process is the reverse process of the unpacking process; the first determination module is configured to determine the dynamic loading path and target privacy protocol of the application based on the original code.

[0080] Optionally, the first determination module further includes: an extraction module, a first acquisition module, and an analysis module. The extraction module is configured to extract the first privacy protocol of the application and the tag information of the third-party software program based on the original code; the first acquisition module is configured to obtain the second privacy protocol of the third-party software program according to the tag information; and the analysis module is configured to analyze the first privacy protocol and the second privacy protocol by semantic analysis, and integrate the analysis results to obtain the target privacy protocol.

[0081] Optionally, the first detection module further includes: a second determination module, a second acquisition module, and a third determination module. The second determination module is configured to determine that the application is a program that illegally uses user privacy information when it is not running when the content of the target privacy protocol does not match the content of the preset protocol; the second acquisition module is configured to obtain the first code in the target file when the content of the target privacy protocol matches the content of the preset protocol, wherein the first code is configured to represent the user privacy information that the application actually wants to obtain; the third determination module is configured to determine whether the application is a program that illegally uses user privacy information when it is not running based on the first code and the target privacy protocol.

[0082] Optionally, the third determination module further includes: a parsing module, a fourth determination module and a fifth determination module. The parsing module is configured to parse the first code to obtain the user privacy information that the application actually wants to obtain; the fourth determination module is configured to determine that the application is a program that legally uses the user privacy information when it is not running, when the user privacy information that the application actually wants to obtain matches the content of the target privacy agreement; the fifth determination module is configured to determine that the application is a program that illegally uses the user privacy information when it is not running, when the user privacy information that the application actually wants to obtain does not match the content of the target privacy agreement.

[0083] Optionally, the second detection module further includes: a recording module, a generating module, a second acquisition module and a tracking module. Among them, the recording module is configured to insert a second code configured to record dynamic loading information into the application; the generating module is configured to generate an input event configured to trigger the dynamic loading process of the application based on the dynamic loading path; the second acquisition module is configured to trigger the dynamic loading process of the application through the input event, and obtain all information loaded by the application in the dynamic loading process through the second code; the tracking module is configured to use a data flow analysis method to track the transmission process of user privacy information in all information on the dynamic loading path, and generate a second detection result based on the tracking result.

[0084] Optionally, the above-mentioned tracking module also includes: an identification module, a marking module, a propagation module, a third acquisition module and a first tracking module. Among them, the identification module is configured to perform data flow analysis starting from the entry point of the dynamic loading path to identify user privacy information in all information; the marking module is configured to perform marking processing on the identified user privacy information to obtain marked data; the propagation module is configured to perform taint propagation on the marked data; the third acquisition module is configured to obtain the target dynamic loading information recorded by the second code at the target node when it is detected that the application performs a dynamic loading call at the target node on the dynamic loading path; the first tracking module is configured to use the target dynamic loading information to track the marked data between the dynamic loading path and the external code to obtain the tracking result.

[0085] Optionally, the tracking module further includes: a sixth determination module and a seventh determination module. The sixth determination module is configured to determine that the application is a program that legally uses user privacy information when the transmission process of the marker data between the dynamic loading path and the external code matches the target privacy protocol; the seventh determination module is configured to determine that the application is a program that illegally uses user privacy information when the transmission process of the marker data between the dynamic loading path and the external code does not match the target privacy protocol.

[0086] Optionally, the above-mentioned determination module also includes: an eighth determination module and a ninth determination module. The eighth determination module is configured to determine that the application is a normal program that will not cause leakage of user privacy information when the first detection result indicates that the application is a program that legally uses user privacy information when not in operation, and the second detection result indicates that the application is a program that legally uses user privacy information when in operation; the ninth determination module is configured to determine that the application is an abnormal program that causes leakage of user privacy information when the first detection result indicates that the application is a program that illegally uses user privacy information when not in operation, or the second detection result indicates that the application is a program that illegally uses user privacy information when in operation.

[0087] Example 3

[0088] According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the method for detecting the leakage of private information in the above-mentioned embodiment 1 when running.

[0089] Example 4

[0090] According to another aspect of an embodiment of the present disclosure, an electronic device is also provided, which includes one or more processors; a storage device for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the method for detecting privacy information leakage in the above-mentioned embodiment 1 when running.

[0091] The serial numbers of the above-mentioned embodiments of the present disclosure are only for description and do not represent the advantages or disadvantages of the embodiments.

[0092] In the above embodiments of the present disclosure, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0093] In the several embodiments provided in the present disclosure, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0094] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0095] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0096] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0097] The above are only preferred embodiments of the present disclosure. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present disclosure. These improvements and modifications should also be regarded as the protection scope of the present disclosure.

[0098] Industrial Applicability

[0099] The solution provided by the disclosed embodiment can be applied to the field of information security technology. In the disclosed embodiment, when static detection of the application is performed according to the target privacy protocol and the preset protocol, in addition to detecting the application itself, third-party software programs related to the application are also detected, thereby improving the comprehensiveness of the detection of user privacy information. In addition, the disclosure will also detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, thereby realizing the detection of user privacy information leakage caused by the dynamic loading of the application. On this basis, it is determined whether the application is an abnormal program based on the first detection result and the second detection result. In fact, the final detection result is obtained after the static detection result and the dynamic detection result of the application are comprehensively analyzed, thereby achieving the effect of improving the detection accuracy of user privacy information.

Claims

1. A method for detecting leakage of private information, comprising: Obtaining an application to be detected, and performing reverse analysis on the application to obtain a target file after analysis; Performing static analysis on the target file to obtain a dynamic loading path and a target privacy protocol of the application, wherein the target privacy protocol at least includes a first privacy protocol of the application and a second privacy protocol of a third-party software program associated with the application, and the dynamic loading path is a control flow path to reach dynamic loading; Generate a first detection result according to the target privacy protocol and the preset protocol, wherein the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when not running, and the preset protocol is used to determine whether the target privacy protocol meets the preset specification; According to the dynamic loading path, the user privacy information used by the application in the dynamic loading process is detected to generate a second detection result, wherein the second detection result is used to indicate whether the application is a program that illegally uses the user privacy information when in operation; Determining whether the application is an abnormal program that causes leakage of the user's privacy information based on the first detection result and the second detection result; Among them, the method for detecting privacy information leakage includes: extracting the first privacy protocol of the application and the marking information of the third-party software program based on the original code of the application; obtaining the second privacy protocol of the third-party software program according to the marking information; analyzing the first privacy protocol and the second privacy protocol by semantic analysis, and integrating the analysis results to obtain the target privacy protocol.

2. The method according to claim 1, wherein: Perform static analysis on the target file to obtain the dynamic loading path of the application and the target privacy protocol, including: Detecting whether the code in the target file has been shelled, wherein the shelling process includes at least one of the following processing methods: encrypting the code, hiding the code, and obfuscating the code; In the case where the code has been subjected to the shelling process, the code is unshelled to obtain the original code before the shelling process is performed, wherein the unshelling process is a reverse process of the shelling process; A dynamic loading path of the application and the target privacy protocol are determined based on the original code.

3. The method according to claim 1, wherein: Generating a first detection result according to the target privacy protocol and the preset protocol includes: When the content of the target privacy protocol does not match the content of the preset protocol, determining that the application program is a program that illegally uses the user's privacy information when it is not running; When the content of the target privacy protocol matches the content of the preset protocol, obtaining a first code in the target file, wherein the first code is used to represent the user privacy information that the application actually wants to obtain; Determine whether the application program is a program that illegally uses the user's privacy information when not running, based on the first code and the target privacy protocol.

4. The method according to claim 3, wherein: Determining whether the application is a program that illegally uses the user's privacy information when not running according to the first code and the target privacy protocol includes: Parsing the first code to obtain the user privacy information that the application actually wants to obtain; When the user privacy information actually to be acquired by the application matches the content of the target privacy protocol, determining that the application is a program that legally uses the user privacy information when not in operation; When the user privacy information actually to be acquired by the application program does not match the content of the target privacy protocol, it is determined that the application program is a program that illegally uses the user privacy information when not in operation.

5. The method according to claim 1, wherein: According to the dynamic loading path, user privacy information used by the application in the dynamic loading process is detected to generate a second detection result, including: Inserting a second code for recording dynamic loading information into the application program; Based on the dynamic loading path, generating an input event for triggering a dynamic loading process of the application program; triggering a dynamic loading process of the application program through the input event, and acquiring all information loaded by the application program in the dynamic loading process through the second code; A data flow analysis method is used to track the transmission process of the user privacy information in all the information on the dynamic loading path, and a second detection result is generated based on the tracking result.

6. The method according to claim 5, wherein: The data flow analysis method is used to track the transmission process of the user privacy information in all the information on the dynamic loading path, including: Performing data flow analysis from the entry point of the dynamic loading path to identify user privacy information in all the information; Marking the identified user privacy information to obtain marked data; Performing taint propagation on the marked data; When it is detected that the target node on the dynamic loading path of the application program performs a dynamic loading call, obtaining target dynamic loading information recorded by the second code at the target node; The target dynamic loading information is used to track the marking data between the dynamic loading path and the external code to obtain the tracking result.

7. The method according to claim 6, wherein: Generating a second detection result based on the tracking result includes: When the transmission process of the tag data between the dynamic loading path and the external code matches the target privacy protocol, determining that the application program is a program that legally uses the user privacy information in the running state; When the transmission process of the marking data between the dynamic loading path and the external code does not match the target privacy protocol, it is determined that the application program is a program that illegally uses the user privacy information when in operation.

8. The method according to claim 1, wherein: Determining whether the application is an abnormal program that causes the leakage of the user's privacy information based on the first detection result and the second detection result includes: When the first detection result indicates that the application is a program that legally uses the user privacy information when not running, and the second detection result indicates that the application is a program that legally uses the user privacy information when running, determining that the application is a normal program that will not cause leakage of the user privacy information; When the first detection result indicates that the application is a program that illegally uses the user privacy information when not running, or when the second detection result indicates that the application is a program that illegally uses the user privacy information when running, the application is determined to be an abnormal program that causes the leakage of the user privacy information.

9. A device for detecting leakage of private information, comprising: An acquisition module is configured to acquire an application to be detected and reversely parse the application to obtain a target file after the analysis; a static analysis module configured to perform static analysis on the target file to obtain a dynamic loading path and a target privacy protocol of the application, wherein the target privacy protocol at least includes a first privacy protocol of the application and a second privacy protocol of a third-party software program associated with the application, and the dynamic loading path is a control flow path to reach dynamic loading; A first detection module, configured to generate a first detection result according to the target privacy protocol and a preset protocol, wherein the first detection result is used to characterize whether the application is a program that illegally uses user privacy information when not running, and the preset protocol is used to determine whether the target privacy protocol meets the preset specification; A second detection module is configured to detect the user privacy information used by the application in the dynamic loading process according to the dynamic loading path, and generate a second detection result, wherein the second detection result is used to indicate whether the application is a program that illegally uses the user privacy information when running; a determination module, configured to determine whether the application is an abnormal program that causes the leakage of the user's privacy information based on the first detection result and the second detection result; Among them, the privacy information leakage detection device is also used to extract the first privacy protocol of the application and the marking information of the third-party software program based on the original code of the application; obtain the second privacy protocol of the third-party software program according to the marking information; analyze the first privacy protocol and the second privacy protocol by semantic analysis, and integrate the analysis results to obtain the target privacy protocol.

10. The device according to claim 9, wherein: The static analysis module includes: A third detection module is used to detect whether the code in the target file has been shelled, wherein the shelling process includes at least one of the following processing methods: encrypting the code, hiding the code, and obfuscating the code; a shell removal processing module, used for, when the code has been shelled, performing shell removal processing on the code to obtain the original code before the shelling processing is performed, wherein the shell removal processing is a reverse processing process of the shelling processing; The first determination module is used to determine the dynamic loading path of the application and the target privacy protocol based on the original code.

11. The device according to claim 9, wherein: The first detection module includes: A second determination module, configured to determine that the application program is a program that illegally uses the user's privacy information when the content of the target privacy protocol does not match the content of the preset protocol; A second acquisition module, configured to acquire a first code in the target file when the content of the target privacy protocol matches the content of the preset protocol, wherein the first code is used to represent the user privacy information that the application actually wants to acquire; The third determination module is used to determine whether the application program is a program that illegally uses the user's privacy information when not running, based on the first code and the target privacy protocol.

12. The device according to claim 11, wherein: The third determining module comprises: A parsing module, used to parse the first code to obtain the user privacy information that the application actually wants to obtain; A fourth determination module, configured to determine that the application is a program that legally uses the user privacy information when the application is not running, when the user privacy information actually to be obtained by the application matches the content of the target privacy protocol; The fifth determination module is used to determine that the application is a program that illegally uses the user privacy information when it is not running, when the user privacy information actually to be obtained by the application does not match the content of the target privacy protocol.

13. The device according to claim 9, wherein: The second detection module includes: A recording module, used for inserting a second code for recording dynamic loading information into the application program; A generating module, used for generating an input event for triggering a dynamic loading process of the application program based on the dynamic loading path; A second acquisition module, configured to trigger the dynamic loading process of the application program through the input event, and acquire all information loaded by the application program in the dynamic loading process through the second code; The tracking module is used to track the transmission process of the user privacy information in all the information on the dynamic loading path by using a data flow analysis method, and generate a second detection result based on the tracking result.

14. The device according to claim 13, wherein: The tracking module comprises: An identification module, configured to perform data flow analysis starting from an entry point of the dynamic loading path, and identify user privacy information in all the information; A marking module is used to mark the identified user privacy information to obtain marked data; A propagation module, used for performing taint propagation on the marked data; A third acquisition module is used to acquire target dynamic loading information recorded by the second code at the target node when detecting that the application program makes a dynamic loading call at the target node on the dynamic loading path; The first tracking module is used to track the marking data between the dynamic loading path and the external code by using the target dynamic loading information to obtain the tracking result.

15. The device according to claim 14, wherein: The tracking module comprises: A sixth determination module, configured to determine that the application program is a program that legally uses the user's privacy information when the transmission process of the tag data between the dynamic loading path and the external code matches the target privacy protocol; The seventh determination module is used to determine that the application program is a program that illegally uses the user privacy information when in operation when the transmission process of the tag data between the dynamic loading path and the external code does not match the target privacy protocol.

16. The device according to claim 9, wherein: The determining module comprises: an eighth determination module, configured to determine that the application is a normal program that will not cause leakage of the user's privacy information when the first detection result indicates that the application is a program that legally uses the user's privacy information when not running, and when the second detection result indicates that the application is a program that legally uses the user's privacy information when running; A ninth determination module is used to determine that the application is an abnormal program that causes the leakage of the user privacy information when the first detection result indicates that the application is a program that illegally uses the user privacy information when not running, or when the second detection result indicates that the application is a program that illegally uses the user privacy information when running.

17. A computer-readable storage medium having a computer program stored therein, wherein: The computer program is configured to execute the method for detecting leakage of private information as claimed in any one of claims 1 to 8 when running.

18. An electronic device, comprising one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors are enabled to run the programs, wherein: The program is configured to execute the method for detecting the leakage of private information as described in any one of claims 1 to 8 when running.

Images