Application monitoring method, apparatus, electronic device, system, and storage medium

Abstract

Embodiments of the application disclose an application program monitoring method, device, electronic equipment, system and storage medium, the application program monitoring method comprises: running a target application program, and determining whether the target application program calls a preset function according to a preset function library in the running process; when it is determined that the target application program calls the preset function, recording function call information of the target application program, and intercepting a running interface of the target application program; uploading the function call information and the running interface to a server, so that the server generates a monitoring report for the target application program according to the function call information and the running interface. Embodiments of the application can completely and comprehensively restore the function call scene, and improve the auditing efficiency of the application program.

Description

Technical Field

[0001] This invention relates to computer technology, and more particularly to an application monitoring method, apparatus, electronic device, system, and storage medium. Background Technology

[0002] Dynamic scanning of the application's installation package can reveal the functions called by the application, which can provide a reference for the application's compliance review. In the process of implementing this invention, the inventors found that existing scanning methods have the following problems: (1) the scan results are relatively one-sided and cannot fully and comprehensively reconstruct the function call scenario based on the scan results; (2) some information depends on manual operation to obtain, resulting in low review efficiency. Summary of the Invention

[0003] This invention provides an application monitoring method, apparatus, electronic device, system, and storage medium that can completely and comprehensively reconstruct function call scenarios, thereby improving the efficiency of application review.

[0004] In a first aspect, embodiments of the present invention provide an application monitoring method, applied to a testing device, the method comprising:

[0005] Run the target application, and during the execution, determine whether the target application calls a preset function based on a preset function library;

[0006] When it is determined that the target application has called the preset function, the function call information of the target application is recorded, and the running interface of the target application is captured.

[0007] The function call information and the running interface are uploaded to the server so that the server can generate a monitoring report for the target application based on the function call information and the running interface.

[0008] Optionally, before running the target application, the following may also be included:

[0009] Obtain the identification information of the target application from the server. The identification information of the target application includes the name and version number of the target application.

[0010] Download and install the target application from the server or app store based on the target application's identification information.

[0011] Optionally, before running the target application, the following may also be included:

[0012] The identification information of the monitoring scene is obtained from the server. The identification information of the monitoring scene includes the name and scene code of the monitoring scene.

[0013] The target application to run includes:

[0014] The target application is controlled to run in the corresponding monitoring scenario based on the identification information of the monitoring scenario, and the monitoring scenario includes multiple scenarios.

[0015] Optionally, determining whether the target application calls a preset function based on a preset function library includes:

[0016] Monitor whether the functions called by the target application belong to the preset function library;

[0017] When the function called by the target application belongs to the preset function library, it is determined that the target application has called the preset function. The preset function library is established by crawling the feature information of the preset function through a web crawler and / or uploading the feature information of the preset function from the terminal. The feature information of the preset function includes: the name of the preset function, the class name of the class to which the preset function belongs, the description information of the preset function, and the name of the permission corresponding to the preset function.

[0018] Optionally, the recorded function call information includes:

[0019] The function call information is recorded using a hook function, which includes: the identifier information of the preset function, the call time, and the function call stack.

[0020] Optionally, capturing the running interface of the target application includes:

[0021] Use a preset screenshot program to capture the running interface of the target application.

[0022] Optionally, capturing the running interface of the target application using a preset screenshot program includes:

[0023] The real-time screen interface of the target application is sent to the preset screenshot program in the form of a video stream through a preset socket interface, so that the preset screenshot program can capture the running interface of the target application when it calls the preset function from the real-time screen interface.

[0024] Optionally, the preset function includes system-defined permission functions and / or sensitive functions involving sensitive information, including information involving user personal and / or privacy information.

[0025] Secondly, embodiments of the present invention provide another application monitoring method, including:

[0026] The test device receives function call information and running interface of the target application uploaded by the test device. The function call information and running interface are recorded and captured by the test device when the target application calls a preset function according to a preset function library during the running of the target application.

[0027] A monitoring report is generated for the target application based on the function call information and the running interface.

[0028] Optionally, before receiving the function call information and runtime interface of the target application uploaded by the test device, the following steps are also included:

[0029] A monitoring task created by a receiving terminal is received, wherein the monitoring task includes the identification information of the target application and the identification information of the monitoring scene;

[0030] The monitoring task is sent to the testing device so that the testing device downloads and installs the target application according to the identification information of the target application, and controls the target application to run in the corresponding monitoring scenario according to the identification information of the monitoring scenario.

[0031] Optionally, the method further includes:

[0032] The monitoring report is sent to the terminal.

[0033] Thirdly, embodiments of the present invention provide an application monitoring device, comprising:

[0034] A determination module is used to run the target application and, during the running process, determine whether the target application calls a preset function based on a preset function library.

[0035] The processing module is used to record the function call information of the target application and capture the running interface of the target application when it is determined that the target application has called the preset function;

[0036] An upload module is used to upload the function call information and the running interface to the server, so that the server can generate a monitoring report for the target application based on the function call information and the running interface.

[0037] Fourthly, embodiments of the present invention provide another application monitoring device, comprising:

[0038] The receiving module is used to receive function call information and running interface of the target application uploaded by the test device. The function call information and running interface are recorded and captured by the test device when the target application calls a preset function according to the preset function library during the running of the target application.

[0039] The generation module is used to generate a monitoring report for the target application based on the function call information and the running interface.

[0040] Fifthly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the application monitoring method as described in any of the embodiments of the present invention.

[0041] Sixthly, embodiments of the present invention also provide an application monitoring system, including a terminal, a test device for executing the application monitoring method as described in any of the embodiments of the present invention, and a server for executing the application monitoring method as described in any of the embodiments of the present invention.

[0042] In a seventh aspect, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the application monitoring method as described in any of the embodiments of the present invention.

[0043] In this embodiment of the invention, a target application can be run, and during the run, it can be determined whether the target application calls a preset function based on a preset function library. When it is determined that the target application has called a preset function, the function call information of the target application is recorded, and the running interface of the target application is captured. The function call information and the running interface are uploaded to the server, so that the server can generate a monitoring report for the target application based on the function call information and the running interface. In other words, this embodiment of the invention can provide the function call information and running interface when the application calls a preset function to the server to generate a monitoring report, thereby improving the comprehensiveness of the monitoring results. In addition, by displaying the monitoring results through the monitoring report, the monitoring results can be displayed intuitively and visually. The displayed function call information and running interface can completely and comprehensively reconstruct the function call scenario, providing an effective and accurate reference for application review. Furthermore, the recording of function call information and the capture of the running interface are executed automatically throughout the entire monitoring process, improving the efficiency of application review.

[0044] Furthermore, the identification information of the monitoring scene can be obtained from the server. During the monitoring process, the target application can be controlled to run in different monitoring scenes based on the identification information of the monitoring scene, realizing automatic switching of monitoring scenes and further improving monitoring efficiency. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a flowchart illustrating an application monitoring method provided in an embodiment of the present invention.

[0047] Figure 2 This is another flowchart illustrating the application monitoring method provided in this embodiment of the invention.

[0048] Figure 3 These are some screenshots illustrating the running interface of the application provided in this embodiment of the invention.

[0049] Figure 4a , Figure 4b These are schematic diagrams illustrating some display effects of the monitoring report provided in the embodiments of the present invention.

[0050] Figure 5 This is another flowchart illustrating the application monitoring method provided in this embodiment of the invention.

[0051] Figure 6 This is a schematic diagram of the application monitoring device provided in an embodiment of the present invention.

[0052] Figure 7 This is another structural schematic diagram of the application monitoring device provided in an embodiment of the present invention.

[0053] Figure 8 This is a schematic diagram of the application monitoring system provided in an embodiment of the present invention.

[0054] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0055] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0056] Figure 1This is a flowchart illustrating an application monitoring method provided in an embodiment of the present invention. This method can be executed by an application monitoring device provided in this embodiment, which can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated into a testing device, such as a mobile phone, personal computer (PC), tablet computer, laptop computer, desktop computer, or other computer device with storage units and a microprocessor, possessing computing capabilities. The following embodiments will illustrate this using the integration of the device into a testing device as an example. (Reference) Figure 1 The method may specifically include the following steps:

[0057] Step 101: Run the target application and determine whether the target application calls the preset function based on the preset function library during the running process.

[0058] For example, the target application can refer to the application that needs to be monitored. The target application can be an Android (Google's mobile operating system) application or an iOS (Apple's mobile operating system) application. The following explanation will use an Android application as the target application.

[0059] In practice, the testing equipment can obtain monitoring tasks from the server. These tasks can be created by monitoring personnel via a terminal on the server. A monitoring task may include the identification information of the target application to be monitored and the identification information of the monitoring scene. When there are multiple monitoring tasks, the task may also include the identification information of the monitoring task itself. Specifically, the identification information of the target application may include the name and version number of the target application; the identification information of the monitoring scene may include the name and scene code (Identity, ID) of the monitoring scene; and the identification information of the monitoring task may include the name and type of the monitoring task. In this embodiment of the invention, the monitoring task may be a scene recording and screenshot task.

[0060] After receiving the monitoring task from the server, the test device can check whether it has the target application installed. If the target application is not installed, it can download and install the target application from the app store (APP Store) or the server based on the target application's identification information; if the target application is already installed, it will directly enter the monitoring process.

[0061] Upon entering the monitoring process, the testing equipment can control the target application to run in the corresponding monitoring scenario based on the identification information of the monitoring scenario. During the running process, it determines whether the target application calls preset functions based on a preset function library. These monitoring scenarios may include, but are not limited to: startup scenario, login scenario, foreground scenario, home button to background scenario, home button to foreground scenario, screen lock scenario, unlock scenario, communication scenario, and device restart scenario. By controlling the target application to run in different monitoring scenarios, the comprehensiveness of the detection results can be improved.

[0062] In a specific implementation, the preset function library can be pre-established in the following way: obtain the feature information of the preset functions, and establish the preset function library based on the feature information of the preset functions. The preset function library can include a large amount of feature information of the preset functions.

[0063] Specifically, in this embodiment of the invention, the preset function may include system-defined permission functions and / or sensitive functions involving sensitive information. System-defined permission functions include permission functions for reading International Mobile Equipment Identity (IMEI), permission functions for reading user contacts, permission functions for turning on the microphone, permission functions for obtaining location information, etc. Sensitive functions involving sensitive information include sensitive functions for reading the application list, sensitive functions for obtaining the user's web browsing history, etc.

[0064] For example, the characteristic information of a preset function may include: the name of the preset function, the class name of the class to which the preset function belongs, the description of the preset function, and the name of the permission corresponding to the preset function.

[0065] In specific implementation, the feature information of the preset function can be obtained in the following ways: (1) The feature information of the preset function can be obtained by using a web crawler; (2) The feature information of the preset function can be collected manually. For example, the feature information of the preset function can be sorted out manually, and then the sorted feature information of the preset function can be uploaded to the server through the terminal. The feature information of the preset function uploaded by the terminal can be obtained; (3) The feature information of the preset function crawled by the web crawler and the feature information of the preset function uploaded by the terminal can be obtained at the same time. No specific limitation is made here.

[0066] When determining whether a target application calls a preset function based on a preset function library, it is possible to monitor whether the function called by the target application belongs to the preset function library. If the function called by the target application belongs to the preset function library, it is determined that the target application has called a preset function. Specifically, the preset functions called by the target application may include one or more.

[0067] Step 102: When it is determined that the target application has called a preset function, record the function call information of the target application and capture the running interface of the target application.

[0068] For example, the function call information may include, but is not limited to: the identifier of the preset function, the call time (timestamp), and the function call stack. The identifier of the preset function may include its name, class name, description, etc., and the function call stack may include the original code executed when the preset function was called, the line number, etc.

[0069] Step 103: Upload the function call information and the running interface to the server so that the server can generate a monitoring report for the target application based on the function call information and the running interface.

[0070] For example, after receiving the function call information and the running interface, the server can store the information and interface, and combine them with a preset report template to generate a monitoring report for the target application. Monitoring personnel can then review this report to understand the specific scenario in which the preset function was called, providing a valuable reference for compliance audits of the application.

[0071] In this embodiment of the invention, function call information and runtime interface when an application calls a preset function can be provided to the server to generate a monitoring report, thereby improving the comprehensiveness of the monitoring results. By displaying the monitoring results through the monitoring report, the monitoring results can be presented intuitively and visually. The displayed function call information and runtime interface can completely and comprehensively reconstruct the function call scenario, providing an effective and accurate reference for application review. In addition, the recording of function call information and the capture of runtime interface are automatically executed throughout the entire monitoring process, improving the efficiency of application review.

[0072] Furthermore, the identification information of the monitoring scene can be obtained from the server. During the monitoring process, the target application can be controlled to run in different monitoring scenes based on the identification information of the monitoring scene, realizing automatic switching of monitoring scenes and further improving monitoring efficiency.

[0073] The application monitoring method provided by the embodiments of the present invention is further described below, such as... Figure 2 As shown, the method in this embodiment can still be executed by a testing device, and may specifically include the following steps:

[0074] Step 201: Obtain the identification information of the target application and the identification information of the monitoring scenario from the server.

[0075] In practice, monitoring personnel can create monitoring tasks on the server via a terminal. A monitoring task can include the identification information of the target application to be monitored and the identification information of the monitoring scene. When there are multiple monitoring tasks, the monitoring task can also include the identification information of the monitoring task itself. Specifically, the identification information of the target application can include the name and version number of the target application; the identification information of the monitoring scene can include the name and scene code of the monitoring scene; and the identification information of the monitoring task can include the name and type of the monitoring task. In this embodiment of the invention, the monitoring task can be a scene recording and screenshot task.

[0076] Step 202: Download and install the target application based on its identification information.

[0077] That is, if the target application is not installed on the test device, the target application can be downloaded and installed from the app store or server based on the target application's identification information.

[0078] Step 203: Control the target application to run in the corresponding monitoring scenario based on the identification information of the monitoring scenario.

[0079] For example, monitoring scenarios may include, but are not limited to: startup scenarios, login scenarios, foreground scenarios, scenarios where the Home button is pressed to switch to the background, scenarios where the Home button is pressed to switch to the foreground, screen lock scenarios, unlock scenarios, communication scenarios, and device restart scenarios. By controlling the target application to run in different monitoring scenarios, the comprehensiveness of the detection results can be improved.

[0080] Step 204: During the execution process, monitor whether the functions called by the target application belong to the preset function library.

[0081] Step 205: If the function called by the target application belongs to the preset function library, it is determined that the target application has called the preset function.

[0082] Specifically, the preset functions called by the target application may include one or more.

[0083] Specifically, in this embodiment of the invention, the preset function may include system-defined permission functions and / or sensitive functions involving sensitive information. System-defined permission functions include, for example, permission functions for reading IMEI, permission functions for reading user contacts, permission functions for turning on the microphone, permission functions for obtaining location information, etc.; sensitive functions involving sensitive information include, for example, sensitive functions for reading the application list, sensitive functions for obtaining the user's web browsing history, etc.

[0084] Taking reading the device's IMEI as an example, the corresponding permission function can be as follows:

[0085]

[0086] In this context, "android.telephony.TelephonyManager" is the Java package name, "getImei" is the name of the permission function, "readIMEI" is the description of the permission function, "system" indicates that the permission function is of type system definition, and "READ_PHONE_STATE" is the name of the corresponding permission.

[0087] Taking reading the application list as an example, the corresponding sensitive functions can be as follows:

[0088]

[0089] In this context, "android.content.pm.PackageManager" is the Java package name, "getInstalledPackages" is the name of the sensitive function, "read application list" is the description of the sensitive function, "custom" indicates that the sensitive function is user-defined, and "UNKNOWN" is the name of the corresponding permission, which is unknown in this case.

[0090] Step 206: When it is determined that the target application has called a preset function, record the function call information of the target application and capture the running interface of the target application.

[0091] In practice, hook functions can be used to record function call information of the target application in the monitoring information list. This function call information may include, but is not limited to, the identifier of the preset function, the call time (timestamp), and the function call stack. The identifier of the preset function may include the function name, class name, and description, while the function call stack includes the original code executed when the preset function was called and its line number. Recording function call information using hook functions can accurately capture various relevant information when a function call occurs, providing a valuable reference for subsequent application auditing.

[0092] Specifically, a preset screenshot program can be used to capture the running interface of the target application. This preset screenshot program can be a self-developed screenshot program adapted to the monitoring method provided in this embodiment of the invention. This screenshot program can be developed using C language, supported by a local function library, and has an exposed preset socket interface, employing a streaming method for screenshotting. The streaming method for screenshotting can be as follows: the real-time screen interface of the target application is sent to the preset screenshot program as a video stream through the preset socket interface. When it is detected that the target application has called a preset function, a screenshot command can be sent to the preset screenshot program, enabling the preset screenshot program to capture the running interface of the target application when the preset function is called from the real-time screen interface. The real-time screen interface of the target application can be captured using a preset application programming interface (API). After capture, the real-time screen interface is encoded into a video stream. The preset API can be a private API of the Android Open Source Project (AOSP), such as ScreenshotClient.

[0093] In the application scenario of this invention embodiment, it is required to quickly and accurately capture the running interface at the moment when the application calls the preset function. In practice, it was found that some existing system screenshot programs are relatively slow and not accurate enough. Therefore, this invention embodiment specifically developed the above-mentioned preset screenshot program, which improves the screenshot speed and accuracy by capturing the running interface at a specified moment from the video stream formed by the real-time screen interface, thereby adapting to the application scenario of this invention embodiment and ultimately improving the monitoring effect.

[0094] In a specific embodiment, taking a financial management application as an example, the captured running interface of the target application can be as follows: Figure 3 As shown, it can include multiple interfaces.

[0095] Step 207: Upload the function call information and the running interface to the server so that the server can generate a monitoring report for the target application based on the function call information and the running interface.

[0096] Specifically, the testing equipment can periodically (e.g., every two seconds) read function call information from the monitoring information list and upload the read function call information along with the captured running interface within the corresponding time period to the server. After receiving the function call information and the running interface, the server can store the function call information and the running interface, and combine the function call information and the running interface with a preset report template to generate a monitoring report for the target application.

[0097] In one specific embodiment, the generated monitoring report may be as follows: Figure 4a and Figure 4b As shown, the monitoring report not only displays the runtime interface when the target application calls preset functions, but also displays function call stack information. Monitoring personnel can understand the specific scenarios in which preset functions are called by reviewing this report, providing a valuable reference for application compliance audits.

[0098] The monitoring method provided in this embodiment of the invention can be understood as being implemented through a monitoring program on the test device side. Specifically, root privileges can be obtained on the test device, then the Xposed framework can be installed to take over the initial process of the virtual machine, and then the monitoring program can be installed on the test device. The monitoring program executes the application monitoring method provided in this embodiment of the invention, thereby achieving monitoring of the target application.

[0099] In this embodiment of the invention, function call information and runtime interface when an application calls a preset function can be provided to the server to generate a monitoring report, thereby improving the comprehensiveness of the monitoring results. By displaying the monitoring results through the monitoring report, the monitoring results can be presented intuitively and visually. The displayed function call information and runtime interface can completely and comprehensively reconstruct the function call scenario, providing an effective and accurate reference for application review. In addition, the recording of function call information and the capture of runtime interface are automatically executed throughout the entire monitoring process, improving the efficiency of application review.

[0100] Furthermore, the identification information of the monitoring scene can be obtained from the server. During the monitoring process, the target application can be controlled to run in different monitoring scenes based on the identification information of the monitoring scene, realizing automatic switching of monitoring scenes and further improving monitoring efficiency.

[0101] The application monitoring method provided by the embodiments of the present invention is described below from the server side, such as... Figure 5 As shown, the method may include the following steps:

[0102] Step 301: Receive the function call information and running interface of the target application uploaded by the test device. The function call information and running interface are recorded and captured by the test device when the target application calls the preset function according to the preset function library during the running of the target application.

[0103] In specific implementation, before executing step 301, the server can obtain monitoring tasks created by monitoring personnel from the terminal. These monitoring tasks may include identification information of the target application to be monitored and identification information of the monitoring scene. When there are multiple monitoring tasks, the monitoring task may also include identification information for the monitoring task itself. Specifically, the identification information of the target application may include the name and version number of the target application; the identification information of the monitoring scene may include the name and scene code of the monitoring scene; and the identification information of the monitoring task may include the name and type of the monitoring task. In this embodiment of the invention, the monitoring task may be a scene recording and screenshot task.

[0104] Specifically, the terminal can be the user terminal of the monitoring personnel. The terminal can be a computer device with storage unit and microprocessor installed, such as a PC, tablet computer, laptop computer, or desktop computer, which has computing power.

[0105] After receiving the monitoring task from the terminal, the server can send the task to the test device. Upon receiving the task, the test device can check if the target application is installed. If not, it can download and install the target application from the app store or server based on its identifier. If the application is already installed, the device directly enters the monitoring process. During this process, the test device can control the target application to run in the corresponding monitoring scenario based on its identifier. During execution, it can determine whether the target application calls preset functions based on a preset function library. These monitoring scenarios may include, but are not limited to: startup, login, foreground, home button to background, home button to foreground, screen lock, unlock, communication, and device restart. Controlling the target application to run in different monitoring scenarios improves the comprehensiveness of the detection results. When the test device determines that the target application has called a preset function, it can record the function call information and capture the application's interface. The recorded function call information and the captured interface are then uploaded to the server.

[0106] Step 302: Generate a monitoring report for the target application based on the function call information and the running interface.

[0107] After receiving the function call information and the running interface, the server can store these elements, for example, categorized by scenario code or function name. After storage, the server can combine the function call information and the running interface with a preset report template to generate a monitoring report for the target application, which is then sent to the terminal. Monitoring personnel can view the monitoring report on the terminal to understand the specific scenario in which the preset function was called, providing a valuable reference for the application's compliance review.

[0108] In this embodiment of the invention, a monitoring report can be generated by combining function call information and the running interface when the application calls a preset function, thereby improving the comprehensiveness of the monitoring results. The monitoring report is sent to the terminal, so that the monitoring results can be displayed intuitively and visually on the terminal. The function call information and running interface displayed can completely and comprehensively restore the function call scenario, providing an effective and accurate reference for application review. In addition, the recording of function call information and the capture of the running interface are automatically executed throughout the monitoring process, improving the efficiency of application review.

[0109] Furthermore, the system can send identification information of monitoring scenarios to the testing equipment. During the monitoring process, the testing equipment can control the target application to run in different monitoring scenarios based on the identification information of the monitoring scenarios, thereby realizing automatic switching of monitoring scenarios, further improving monitoring efficiency and the comprehensiveness of monitoring results.

[0110] It should be noted that the interface diagrams shown in the embodiments of this disclosure are intended to illustrate the monitoring methods provided by the embodiments of the present invention, and the messages presented on the specific interfaces (including but not limited to text, images, emoticons, etc.) do not constitute a limitation on the solution.

[0111] Figure 6 This is a structural diagram of an application monitoring device provided in an embodiment of the present invention. This device can be integrated into a testing device and is suitable for executing the application monitoring method provided in the embodiments of the present invention. Figure 6 As shown, the device may specifically include:

[0112] The determination module 401 is used to run the target application and, during the running process, determine whether the target application calls a preset function based on a preset function library.

[0113] The processing module 402 is used to record the function call information of the target application and capture the running interface of the target application when it is determined that the target application has called the preset function;

[0114] The upload module 403 is used to upload the function call information and the running interface to the server, so that the server can generate a monitoring report for the target application based on the function call information and the running interface.

[0115] In one embodiment, the device further includes:

[0116] The download module is used to obtain the identification information of the target application from the server, download the target application according to the identification information, and install it.

[0117] In one embodiment, the device further includes:

[0118] The acquisition module is used to acquire the identification information of the monitoring scene from the server, and the target application is controlled to run in the monitoring scene identified by the identification information of the monitoring scene.

[0119] In one embodiment, the determining module 401 determines whether the target application calls a preset function based on a preset function library, including:

[0120] Monitor whether the functions called by the target application belong to the preset function library;

[0121] When the function called by the target application belongs to the preset function library, it is determined that the target application has called the preset function.

[0122] In one embodiment, the processing module 402 records function call information, including:

[0123] The function call information is recorded using a hook function, which includes: the identifier information of the preset function, the call time, and the function call stack.

[0124] In one embodiment, the processing module 402 intercepts the running interface of the target application, including:

[0125] Use a preset screenshot program to capture the running interface of the target application.

[0126] In one embodiment, the processing module 402 uses a preset screenshot program to capture the running interface of the target application, including:

[0127] The real-time screen interface of the target application is sent to the preset screenshot program in the form of a video stream through a preset socket interface, so that the preset screenshot program can capture the running interface of the target application when it calls the preset function from the real-time screen interface.

[0128] In one embodiment, the preset function includes system-defined permission functions and / or sensitive functions involving sensitive information.

[0129] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is merely an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0130] The apparatus of this invention can run a target application and, during operation, determine whether the target application calls a preset function based on a preset function library. When it is determined that the target application has called a preset function, the apparatus records the function call information and captures the application's running interface. This function call information and the running interface are then uploaded to a server, allowing the server to generate a monitoring report for the target application based on these elements. In other words, this invention provides the server with function call information and the running interface when an application calls a preset function to generate a monitoring report, improving the comprehensiveness of the monitoring results. The function call information and running interface allow for a complete and comprehensive reconstruction of the function call scenario, providing effective and accurate reference for application review. Furthermore, the recording of function call information and the capture of the running interface are performed automatically throughout the monitoring process, improving the efficiency of application review.

[0131] Furthermore, the identification information of the monitoring scene can be obtained from the server. During the monitoring process, the target application can be controlled to run in different monitoring scenes based on the identification information of the monitoring scene, realizing automatic switching of monitoring scenes and further improving monitoring efficiency.

[0132] Figure 7 This is another structural diagram of the application monitoring device provided in the embodiments of the present invention. This device can be integrated into a server and is suitable for executing the application monitoring method provided in the embodiments of the present invention. Figure 7 As shown, the device may specifically include:

[0133] The receiving module 501 is used to receive the function call information and running interface of the target application uploaded by the test device. The function call information and the running interface are recorded and captured by the test device when the target application calls a preset function according to the preset function library during the running of the target application.

[0134] The generation module 502 is used to generate a monitoring report for the target application based on the function call information and the running interface.

[0135] In one embodiment, the receiving module 501 is further configured to:

[0136] A monitoring task created by a receiving terminal is received, wherein the monitoring task includes the identification information of the target application and the identification information of the monitoring scene;

[0137] The device further includes:

[0138] The sending module is used to send the monitoring task to the test device, so that the test device can download and install the target application according to the identification information of the target application, and control the target application to run in the corresponding monitoring scenario according to the identification information of the monitoring scenario.

[0139] In one embodiment, the sending module is further configured to send the monitoring report to the terminal.

[0140] The device of this invention can generate a monitoring report by combining function call information and the running interface when an application calls a preset function, thereby improving the comprehensiveness of the monitoring results. Sending the monitoring report to the terminal allows for a direct and visual display of the monitoring results. The displayed function call information and running interface can completely and comprehensively reconstruct the function call scenario, providing an effective and accurate reference for application review. Furthermore, the recording of function call information and the capture of the running interface are performed automatically throughout the entire monitoring process, improving the efficiency of application review.

[0141] Furthermore, identification information of monitoring scenarios can be sent to the testing equipment. During the monitoring process, the testing equipment can control the target application to run in different monitoring scenarios based on the identification information of the monitoring scenarios, realizing automatic switching of monitoring scenarios and further improving monitoring efficiency.

[0142] This invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the application monitoring method provided in any of the above embodiments.

[0143] This invention also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the application monitoring method provided in any of the above embodiments.

[0144] Figure 8 An exemplary system architecture is shown that can be applied to the application monitoring method or application monitoring device of the present invention.

[0145] like Figure 8 As shown, the system architecture may include a terminal 601, a test device 602 for executing the application monitoring method of the present invention embodiments, and a server 603 for executing the application monitoring method of the present invention embodiments.

[0146] Terminal 601, test device 602, and server 603 are interconnected by a network. The network serves as a medium for providing communication links and can include various connection types, such as wired, wireless communication links, or fiber optic cables. The interactions between the various devices are described in the preceding embodiments and will not be repeated here.

[0147] The following is for reference. Figure 9 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing an electronic device according to embodiments of the present invention. Figure 9 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0148] like Figure 9 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0149] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0150] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this invention.

[0151] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0152] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0153] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor can be described as including a determining module, a processing module, and an uploading module; or, a processor can be described as including a receiving module and a generating module. The names of these modules do not necessarily limit the module itself.

[0154] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include: running a target application, and during the running process determining whether the target application calls a preset function according to a preset function library; when it is determined that the target application calls the preset function, recording the function call information of the target application and capturing the running interface of the target application; and uploading the function call information and the running interface to a server, so that the server generates a monitoring report for the target application based on the function call information and the running interface.

[0155] Alternatively, when one or more of the above programs are executed by the device, the device includes: receiving function call information and running interface of the target application uploaded by the test device, wherein the function call information and the running interface are recorded and captured by the test device when the target application calls a preset function according to a preset function library during the running of the target application; and generating a monitoring report for the target application based on the function call information and the running interface.

[0156] According to the technical solution of this invention, a monitoring report can be generated by combining function call information and the running interface when an application calls a preset function, thereby improving the comprehensiveness of the monitoring results. Sending the monitoring report to the terminal allows the monitoring results to be displayed intuitively and visually on the terminal. The displayed function call information and running interface can completely and comprehensively reconstruct the function call scenario, providing an effective and accurate reference for application review. Furthermore, the recording of function call information and the capture of the running interface are automatically executed throughout the monitoring process, improving the efficiency of application review.

[0157] Furthermore, identification information of monitoring scenarios can be sent to the testing equipment. During the monitoring process, the testing equipment can control the target application to run in different monitoring scenarios according to the identification information of the monitoring scenarios, realizing automatic switching of monitoring scenarios, further improving monitoring efficiency and the comprehensiveness of audit results.

[0158] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An application monitoring method, characterized in that, include: The system obtains the identification information of the monitoring scene from the server, controls the target application to run in different monitoring scenes based on the identification information of the monitoring scene, and determines whether the target application calls the preset function according to the preset function library during the operation. The preset function includes system-defined permission functions and / or sensitive functions involving sensitive information. The system-defined permission functions include at least one of the following: permission function to read the International Mobile Equipment Identity (IMEI), permission function to read the user's contacts, permission function to turn on the microphone, and permission function to obtain location information. The sensitive functions involving sensitive information include at least one of the following: sensitive function to read the application list and sensitive function to obtain the user's web browsing history. The monitoring scenes include startup scene, login scene, foreground scene, home button to background scene, home button to foreground scene, screen lock scene, unlock scene, communication scene, and device restart scene. When it is determined that the target application has called the preset function, the function call information of the target application is recorded, and the running interface of the target application at the moment of calling the preset function is captured; The method for capturing the interface includes: using a preset application programming interface (API) to capture the real-time screen interface of the target application; after capturing, encoding the real-time screen interface into a video stream; sending the real-time screen interface of the target application as a video stream to a preset screenshot program through a preset socket interface; when it is detected that the target application calls a preset function, sending a screenshot command to the preset screenshot program so that the preset screenshot program can capture the running interface of the target application when the preset function is called from the real-time screen interface. The default API is a system-private API; The function call information and the running interface are uploaded to the server so that the server can generate a monitoring report for the target application based on the function call information and the running interface. Monitoring personnel can learn about the specific scenario when the preset function is called by viewing the monitoring report, and the monitoring report provides a reference for the compliance review of the application.

2. The application monitoring method according to claim 1, characterized in that, The step of determining whether the target application calls a preset function based on a preset function library includes: Monitor whether the functions called by the target application belong to the preset function library; When the function called by the target application belongs to the preset function library, it is determined that the target application has called the preset function.

3. The application monitoring method according to claim 1, characterized in that, The recording of function call information of the target application includes: The function call information is recorded using a hook function, which includes: the identifier information of the preset function, the call time, and the function call stack.

4. An application monitoring method, characterized in that, include: A monitoring task created by a receiving terminal, wherein the monitoring task includes the identification information of the target application and the identification information of the monitoring scene; The monitoring task is sent to the testing device so that the testing device controls the target application to run in different monitoring scenarios based on the identification information of the target application and the identification information of the monitoring scenario. The system receives function call information and the running interface of the target application uploaded by the testing device. The function call information and the running interface are recorded and captured by the testing device during the operation of the target application, based on a preset function library, when the target application calls a preset function. The running interface is the interface at the moment the target application calls the preset function. The preset function includes system-defined permission functions and / or sensitive functions involving sensitive information. The system-defined permission functions include at least one of the following: permission functions to read the International Mobile Equipment Identity (IMEI), permission functions to read user contacts, permission functions to enable the microphone, and permission functions to obtain location information. The sensitive functions involving sensitive information include at least one of the following: sensitive functions to read the application list and sensitive functions to obtain the user's web browsing history. The monitoring scenarios include startup scenarios, login scenarios, foreground scenarios, Home button to background scenarios, Home button to foreground scenarios, screen lock scenarios, unlock scenarios, communication scenarios, and device restart scenarios. The method for capturing the interface includes: using a preset application programming interface (API) to capture the real-time screen interface of the target application; after capturing, encoding the real-time screen interface into a video stream; sending the real-time screen interface of the target application as a video stream to a preset screenshot program through a preset socket interface; when it is detected that the target application calls a preset function, sending a screenshot command to the preset screenshot program so that the preset screenshot program can capture the running interface of the target application when the preset function is called from the real-time screen interface. The default API is a system-private API; Based on the function call information and the running interface, a monitoring report is generated for the target application. By viewing the monitoring report, the monitoring personnel can learn about the specific scenarios when the preset function is called. The monitoring report provides a reference for the compliance review of the application.

5. The application monitoring method according to claim 4, characterized in that, The method further includes: The monitoring report is sent to the terminal.

6. An application monitoring device, characterized in that, include: The determination module is used to obtain the identification information of the monitoring scene from the server, control the target application to run in different monitoring scenes according to the identification information of the monitoring scene, and determine whether the target application calls the preset function according to the preset function library during the operation. The preset function includes system-defined permission functions and / or sensitive functions involving sensitive information. The system-defined permission functions include at least one of the following: permission function to read the International Mobile Equipment Identity (IMEI), permission function to read the user's contacts, permission function to turn on the microphone, and permission function to obtain location information. The sensitive functions involving sensitive information include at least one of the following: sensitive function to read the application list and sensitive function to obtain the user's web browsing history. The monitoring scenes include startup scene, login scene, foreground scene, Home button to background scene, Home button to foreground scene, screen lock scene, unlock scene, communication scene, and device restart scene. The processing module is used to record the function call information of the target application and capture the running interface of the target application at the moment when it is determined that the target application has called the preset function. The method for capturing the interface includes: capturing the real-time screen interface of the target application using a preset application programming interface (API); encoding the real-time screen interface into a video stream after capture; sending the real-time screen interface of the target application as a video stream to a preset screenshot program through a preset socket interface; when it is detected that the target application calls a preset function, a screenshot command is sent to the preset screenshot program so that the preset screenshot program can capture the running interface of the target application when the preset function is called from the real-time screen interface; the preset API is a system private API; The upload module is used to upload the function call information and the running interface to the server, so that the server can generate a monitoring report for the target application based on the function call information and the running interface. Monitoring personnel can learn about the specific scenario when the preset function is called by viewing the monitoring report, and the monitoring report provides a reference for the compliance review of the application.

7. An application monitoring device, characterized in that, include: The receiving module is used to receive monitoring tasks created by the terminal, wherein the monitoring task includes the identification information of the target application and the identification information of the monitoring scene; The monitoring task is sent to the testing device so that the testing device controls the target application to run in different monitoring scenarios based on the identification information of the target application and the identification information of the monitoring scenario. The system receives function call information and the running interface of the target application uploaded by the testing device. The function call information and the running interface are recorded and captured by the testing device during the operation of the target application, based on a preset function library, when the target application calls a preset function. The running interface is the interface at the moment the target application calls the preset function. The preset function includes system-defined permission functions and / or sensitive functions involving sensitive information. The system-defined permission functions include at least one of the following: permission functions to read the International Mobile Equipment Identity (IMEI), permission functions to read user contacts, permission functions to enable the microphone, and permission functions to obtain location information. The sensitive functions involving sensitive information include at least one of the following: sensitive functions to read the application list and sensitive functions to obtain the user's web browsing history. The monitoring scenarios include startup scenarios, login scenarios, foreground scenarios, Home button to background scenarios, Home button to foreground scenarios, screen lock scenarios, unlock scenarios, communication scenarios, and device restart scenarios. The method for capturing the interface includes: capturing the real-time screen interface of the target application using a preset application programming interface (API); encoding the real-time screen interface into a video stream after capture; sending the real-time screen interface of the target application as a video stream to a preset screenshot program through a preset socket interface; when it is detected that the target application calls a preset function, a screenshot command is sent to the preset screenshot program so that the preset screenshot program can capture the running interface of the target application when the preset function is called from the real-time screen interface; the preset API is a system private API; The generation module is used to generate a monitoring report for the target application based on the function call information and the running interface. Monitoring personnel can learn about the specific scenarios when the preset function is called by viewing the monitoring report. The monitoring report provides a reference for the compliance review of the application.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the application monitoring method as described in any one of claims 1 to 3, or when the processor executes the program, it implements the application monitoring method as described in any one of claims 4 to 5.

9. An application monitoring system, characterized in that, It includes a terminal, a test device for performing the application monitoring method as described in any one of claims 1 to 3, and a server for performing the application monitoring method as described in any one of claims 4 to 5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the application monitoring method as described in any one of claims 1 to 3, or when the program is executed by the processor, it implements the application monitoring method as described in any one of claims 4 to 5.

Images