Mini Program Risk Detection Method and Device

Abstract

This specification provides a method and apparatus for risk detection in mini-programs. According to the method of this embodiment, firstly, before the mini-program sends a network request to an external mini-program server, the client identifies whether the request data carried in the network request includes privacy data. If the request data includes privacy data, an identification result is generated, and then the identification result is sent to the external server. Finally, the network request is processed based on the risk confirmation result returned by the server. This application can improve the security of risk detection.

Description

[0001] This application is a divisional application. The original application has the application number 202110323887.8, the application date is March 26, 2021, and the invention title is "Mini Program Risk Detection Method and Apparatus". Technical Field

[0002] This specification relates to one or more embodiments in the field of computer technology, and more particularly to a method and apparatus for detecting risks in mini-programs. Background Technology

[0003] A mini-program is an application that can be used without downloading or installation. It typically runs within a host application, which provides the mini-program with business interfaces to implement various functions. When the mini-program calls these interfaces, it can access the user's private data. If the mini-program sends user privacy data to the mini-program server during data communication via network interfaces, it poses a risk of user privacy data leakage.

[0004] Current technologies determine whether a mini-program poses a risk of leaking user privacy data by performing security scans on its static code. However, this method has relatively low reliability. Therefore, a more reliable method for mini-program risk detection is needed. Summary of the Invention

[0005] This specification describes one or more embodiments of a method and apparatus for detecting risks in mini-programs to improve reliability.

[0006] According to the first aspect, a method for detecting risks in mini-programs is provided and applied to the client. The method includes: pre-applying the external network interface provided by the host application using Hook or static code replacement; when the mini-program calls the external network interface to send a network request to the external mini-program server, routing the execution logic corresponding to the mini-program calling the external network interface to the security aspect module pre-built in the host application.

[0007] The security aspect module in the host application receives network requests sent by the mini-program to the external mini-program server.

[0008] The security aspect module in the host application identifies whether the request data carried by the network request includes privacy data;

[0009] When the requested data includes privacy data, the security aspect module in the host application generates a recognition result;

[0010] The security aspect module in the host application sends the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result.

[0011] The security aspect module in the host application receives the risk confirmation result returned by the server and processes the network request based on the risk confirmation result;

[0012] The step of identifying whether the request data carried in the network request includes privacy data includes:

[0013] The system identifies whether the request data carried in the network request meets a pre-set string rule. If it does, it determines that the data request includes privacy data; otherwise, it determines that the data request does not include privacy data.

[0014] The string rules include: string matching logic and / or regular expressions;

[0015] When the string rule includes string matching logic, if the request data is the same as the string included in the string rule, then it is determined that the request data includes private data.

[0016] When the string rule includes a regular expression, the regular expression specifies the string format. If the request data conforms to the string format, it is determined that the request data includes private data.

[0017] Before identifying whether the request data carried in the network request includes privacy data, the method further includes:

[0018] The request data carried by the network request is interpreted using a data state machine interpreter, the interpretation result is determined as the request data carried by the network request, and the process of identifying whether the request data carried by the network request includes privacy data is performed.

[0019] The generation of recognition results includes:

[0020] Obtain at least one of the following information: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; wherein, the host application is an application that the mini-program depends on to run;

[0021] The acquired information at least one of the above-mentioned pieces of information is determined as the identification result.

[0022] The step of processing the network request based on the risk confirmation result includes:

[0023] If the risk assessment result indicates that a risk exists, the network request will not be processed.

[0024] When the risk confirmation result indicates that there is no risk, the network request is sent to the mini-program server through a preset external network interface based on the address information of the mini-program server carried in the network request.

[0025] Based on the second aspect, a method for detecting risks in mini-programs is provided, which is applied to servers, including:

[0026] Obtain the identification result sent by the client; the identification result is used to characterize that the network request data carried by the mini program to the external mini program server includes privacy data;

[0027] The network request is risk-assessed based on the identification results.

[0028] The risk assessment result is sent to the client so that the client can process the network request based on the risk assessment result.

[0029] in,

[0030] The identification results include: the data type of the privacy data and the identity information of the mini-program;

[0031] The step of risk assessment of the network request based on the identification result includes:

[0032] Based on the identity information of the mini-program included in the identification result, determine the data types that need to be intercepted in advance for the mini-program;

[0033] Based on the data type of the privacy data included in the identification result, determine whether the data type is a data type that needs to be blocked for the mini-program. If so, confirm that the network request is risky; otherwise, confirm that the network request is not risky.

[0034] in,

[0035] The identification results include: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; the host application is the application that the mini-program depends on to run;

[0036] The step of risk assessment of the network request based on the identification result includes:

[0037] Based on the data type of the privacy data included in the identification result, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request, determine the number of times the mini-program sends privacy data of that data type to the external mini-program server in the host application of the client.

[0038] Determine whether the number of attempts has reached a preset threshold. If it has, then the network request is confirmed to be risky; otherwise, the network request is confirmed to be risk-free.

[0039] According to the third aspect, a mini-program risk detection device is provided, located on the client side, including:

[0040] The receiving unit is configured to receive network requests sent by the mini-program to an external mini-program server. Specifically, the external network interface provided by the host application is pre-aspected using either a hook or static code replacement method. When the mini-program calls this external network interface to send a network request to the external mini-program server, the execution logic corresponding to the mini-program's call to the external network interface is routed to a security aspect module pre-installed in the host application, so that the receiving unit can receive the network request sent by the mini-program to the external mini-program server.

[0041] The identification unit is configured to identify whether the request data carried by the network request includes privacy data;

[0042] The generation unit is configured to generate an identification result when the requested data includes privacy data;

[0043] The sending unit is configured to send the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result.

[0044] The processing unit is configured to receive the risk confirmation result returned by the server and process the network request according to the risk confirmation result;

[0045] The identification unit is configured to identify whether the request data carried by the network request meets a pre-set string rule. If it does, it determines that the data request includes privacy data; otherwise, it determines that the data request does not include privacy data.

[0046] The string rules include: string matching logic and / or regular expressions;

[0047] When the string rule includes string matching logic, if the request data is the same as the string included in the string rule, then it is determined that the request data includes private data.

[0048] When the string rule includes a regular expression, the regular expression specifies the string format. If the request data conforms to the string format, it is determined that the request data includes private data.

[0049] According to the fourth aspect, another mini-program risk detection device based on the third aspect is provided, located on a server, including:

[0050] The acquisition unit is configured to acquire the identification result sent by the client; the identification result is used to characterize that the request data carried in the network request sent by the mini program to the external mini program server includes privacy data;

[0051] A risk assessment unit is configured to assess the risk of the network request based on the assessment result.

[0052] The sending unit is configured to send the risk confirmation result to the client so that the client can process the network request based on the risk confirmation result.

[0053] According to a fifth aspect, a computer-readable storage medium is provided having a computer program stored thereon that, when executed in a computer, causes the computer to perform the methods described in any embodiment of this specification.

[0054] According to a sixth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any embodiment of this specification.

[0055] The mini-program risk detection method and apparatus provided in this specification allow for the detection of network requests sent by a mini-program to an external mini-program server during operation. Before the mini-program sends the network request, the client directly detects it. The detection identifies whether the request data includes private data. If private data is included, the detection result is sent to the external server for risk confirmation. The client then processes the network request based on the risk confirmation result. Furthermore, the string rules include string matching logic and / or regular expressions. When the string rules include string matching logic, if the request data matches a string included in the string rule, it is determined that the request data includes private data. When the string rules include regular expressions, the regular expression specifies a string format; if the request data conforms to this string format, it is determined that the request data includes private data. This reduces the risk of private data leakage and improves the reliability of mini-program risk detection. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram of a system architecture provided in one embodiment of this specification;

[0058] Figure 2 This is a flowchart of a method for detecting risks in a mini-program provided in one embodiment of this specification;

[0059] Figure 3 This is a flowchart of a WeChat mini-program risk detection method provided in another embodiment of this specification;

[0060] Figure 4 This is a schematic diagram of a mini-program risk detection device provided in one embodiment of this specification;

[0061] Figure 5 This is a schematic diagram of a mini-program risk detection device provided in another embodiment of this specification;

[0062] Figure 6 This is a schematic diagram of a mini-program risk detection device provided in another embodiment of this specification. Detailed Implementation

[0063] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0064] In existing technologies, by performing a security scan on the static code of a mini-program, if the mini-program is found to be calling sensitive business interfaces, it is determined that there is a risk of leaking user privacy data; if no such calls are detected, it is determined that there is no risk of leaking user privacy data. However, mini-programs often call sensitive business interfaces due to normal business needs, so a mini-program cannot be deemed risky solely based on these calls. Furthermore, during actual operation, a mini-program can call multiple business interfaces, combine the results from these interfaces to extract user privacy data, and then send this data to the mini-program's server via a network interface. Therefore, even without calling sensitive business interfaces, the mini-program can still send out privacy data.

[0065] Considering that when a mini-program sends data to the mini-program server, it does so through an external network interface provided by the host application. This specification allows the mini-program to detect whether the data sent to the server contains private information before calling this external network interface, thereby reducing the risk of privacy data leakage and improving the reliability of mini-program risk detection.

[0066] The following describes the specific implementation of the above concept.

[0067] To facilitate understanding of this manual, the system architecture used in this manual will be described first. For example... Figure 1 As shown, the system architecture mainly includes a client, a server, and one or more mini-program servers ( Figure 1 (Taking two mini-program servers as an example).

[0068] The client contains an application that can act as a host application for each mini-program. Each mini-program can rely on the business interfaces provided by the host application to implement its business functions and interact with the corresponding mini-program server through the external network interfaces provided by the host application. For example, the host application is "Alipay", and the mini-programs are "Cainiao", "Transportation", "Ele.me", etc.

[0069] The client can be a smart device located on the user's end, such as a mobile phone, tablet, or laptop.

[0070] A server can be a server that hosts an application or a server that provides services to clients.

[0071] A mini-program server is a server that provides services to mini-programs. A mini-program server can provide services to more than one mini-program included in the host application.

[0072] The following sections explain the methods for detecting risks in mini-programs executed on both the client and server sides.

[0073] Figure 2 A flowchart illustrating a method for detecting risks in a mini-program according to one embodiment is shown. This method is executed by a client. It is understood that this method can be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 Subsequently, the specific implementation includes:

[0074] Step 200: Receive network requests sent by the mini-program to the external mini-program server;

[0075] Step 202: Identify whether the request data carried in the network request includes privacy data;

[0076] Step 204: When the requested data includes privacy data, generate an identification result;

[0077] Step 206: Send the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result;

[0078] Step 208: Receive the risk confirmation result returned by the server, and process the network request according to the risk confirmation result.

[0079] exist Figure 2 In the illustrated mini-program risk detection method, if a mini-program sends a network request to an external mini-program server during operation, the client directly detects the network request before the mini-program sends it to the server. This is done by identifying whether the request data includes private data. If private data is found, the detection result is sent to the external server for risk confirmation. The client then processes the network request based on the risk confirmation result. This reduces the risk of privacy data leakage and improves the reliability of mini-program risk detection.

[0080] The following description Figure 2 The execution method for each step is shown.

[0081] Regarding step 200, in the client, before the mini-program sends a network request to the external mini-program server, it first sends the network request to a processing module, which receives the network request sent by the mini-program to the external mini-program server.

[0082] In the embodiments of this specification, the processing module is pre-installed in the host application and is used to intercept the network request before the mini-program sends a network request to the external mini-program server. The processing module processes the network request before it is sent to the mini-program server, and then decides whether to send the network request to the mini-program server based on the processing result.

[0083] In one embodiment of this specification, the processing module can be implemented by a security aspect module. Since the mini-program sends network requests to the mini-program server by calling an external network interface provided by the host application, in a specific implementation, the external network interface can be aspected using a hook function or static code replacement. This allows the execution logic corresponding to the mini-program's call to the external network interface to be routed to a security aspect module, which then performs a series of processing steps on the network request. This series of processing steps on the network request performed by the security aspect module constitutes the mini-program risk detection method executed on the client side in this embodiment of the specification.

[0084] Aspect-oriented programming (AOP) is a programming paradigm that dynamically adds functionality to a program without modifying the source code, through pre-compilation, runtime dynamic proxies, or injection. Therefore, using a security aspect module to perform risk detection on a mini-program allows for monitoring and control of network requests sent out by the mini-program.

[0085] For step 202, identify whether the request data carried by the network request includes private data.

[0086] When a mini-program sends a network request to the mini-program server, it may send private data to the mini-program server, which could lead to the leakage of private data.

[0087] For the identification of privacy data, string rules can be preset and used to determine which data is privacy data. Specifically, step 202 may include: identifying whether the request data carried by the network request meets the preset string rules. If it does, it is determined that the data request includes privacy data; otherwise, it is determined that the data request does not include privacy data.

[0088] The string rules can include, but are not limited to, string matching logic and regular expressions.

[0089] When a string rule includes string matching logic, if the requested data is the same as the string included in that string rule, it indicates that the requested data includes private data.

[0090] When the current string rule includes a regular expression, the regular expression can specify the string format. If the requested data conforms to the string format, it indicates that the requested data includes private data. For example, ID card numbers are private data. A regular expression can be used to define the string format of ID card numbers to identify whether the requested data includes ID card numbers. The regular expression can be: ^[1-9]\d{5}(18|19|(

[23] \d))\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\d{3}[0-9Xx]$. The strings in the requested data are validated. If there is a string in the requested data that satisfies the regular expression, it indicates that the requested data includes ID card numbers. Since ID card numbers are private data specified in the string rule, it can be concluded that the requested data includes private data.

[0091] It should be noted that the string rule can be set by the client itself, set by the server and sent to the client, or obtained by other means. This specification does not limit this embodiment.

[0092] By pre-setting string rules, when receiving network requests from mini-programs, these rules can quickly identify whether the request data carries private data, improving identification efficiency. Furthermore, as business needs evolve, the string rules can be updated to ensure the accuracy of private data identification, further reducing the risk of privacy data leakage.

[0093] In one embodiment of this specification, if the request data carried in the network request is in a certain specific format, such as JSON format, the meaning of the request data may not be directly determined. Therefore, after step 200 and before step 202, the method may further include: interpreting the request data carried in the network request using a data state machine interpreter, determining the interpretation result as the request data carried in the network request, and executing step 202.

[0094] By using a data state machine interpreter to interpret the requested data, the actual meaning of the requested data can be determined. In subsequent processes, the interpretation results can be directly used to identify privacy data, thereby improving the accuracy of privacy data identification and further reducing the risk of privacy data leakage.

[0095] For step 204, when the requested data includes private data, an identification result is generated.

[0096] In the embodiments described in this specification, if the requested data includes private data, the client can directly intercept the network request. However, there are many types of private data, and it is a normal business requirement for a mini-program to send certain private data to the mini-program server. Therefore, the server needs to comprehensively determine whether the network request poses a risk.

[0097] When requesting data that includes private information, the first approach is to send the request data as an identification result to the server, allowing the server to directly determine whether the network request poses a risk. The second approach is to keep the request data on the client's local machine, sending only the privacy-related information as an identification result to the server. Since the request data does not leave the client, the risk of privacy data leakage can be further reduced.

[0098] To ensure that the server can perform risk assessment based on the identification results, the generated identification results may specifically include:

[0099] Obtain at least one of the following information: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program's server carried in the network request; wherein, the host application is an application that the mini-program depends on to run;

[0100] The acquired information at least one of the above-mentioned pieces of information is determined as the identification result.

[0101] For example, the data types for privacy data can include ID card numbers, mobile phone numbers, GPS location information, etc. The identity information of the mini-program, the host application, and the client can be names or unique identifiers. The address information of the mini-program server can be URLs, etc.

[0102] It should be noted that the specific content included in the recognition result sent by the client to the server can be determined in advance through negotiation between the client and the server.

[0103] In this embodiment of the specification, if after identifying privacy data in step 202, it is determined that the requested data does not contain privacy data, then the client can send the network request to the mini-program server through an external network interface based on the address information of the mini-program server carried in the network request.

[0104] In step 208, after receiving the risk confirmation result returned by the server, the network request can be processed according to the risk confirmation result.

[0105] In the embodiments described in this specification, the risk confirmation result includes two types: one is that a risk exists, and the other is that no risk exists. Therefore, the client's processing of network requests based on the risk confirmation result also includes two types, specifically:

[0106] If the risk assessment result indicates that a risk exists, the network request will not be processed.

[0107] If the risk assessment result indicates that there is no risk, the network request is sent to the mini-program server through a pre-defined external network interface based on the address information of the mini-program server carried in the network request.

[0108] When a risk assessment indicates a risk, to mitigate the risk of privacy data leakage, the client should not allow the mini-program to send network requests to the mini-program server. Since the network request is obtained by the security aspect module that interfaces with external network interfaces before the mini-program has even sent it to the server, the network request can be ignored when the risk assessment indicates a risk. Alternatively, the client can display a notification to the user that the mini-program is potentially disseminating private data.

[0109] If the risk assessment result shows no risk, it indicates that the network request can be sent to the mini-program server. Since the mini-program has not yet sent the network request to the mini-program server through the external network interface, the security aspect module, which performs aspecting on the external network interface, has obtained the network request. Therefore, when it is determined that there is no risk, the security aspect module sends the network request to the mini-program server through the external network interface based on the address information of the mini-program server carried in the network request.

[0110] In the embodiments described in this specification, the client only pre-sets string rules to identify whether the requested data includes private data, without confirming the risk of the network request. The server makes a comprehensive judgment on the risk of the network request, which reduces the client's memory usage and resource consumption. Furthermore, identifying whether the requested data includes private data in the client, rather than sending the requested data to the server for identification, ensures that the risk detection of the mini-program is achieved without the requested data leaving the client, thereby further reducing the risk of privacy data leakage.

[0111] Figure 3 A flowchart illustrating a method for detecting risks in mini-programs according to one embodiment is shown. This method is executed by a server. It is understood that this method can be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. See also... Figure 3 Subsequently, the specific implementation includes:

[0112] Step 300: Obtain the identification result sent by the client; the identification result is used to characterize that the network request data carried by the mini-program to the external mini-program server includes privacy data;

[0113] Step 302: Perform risk assessment on the network request based on the identification results;

[0114] Step 304: Send the risk confirmation result to the client so that the client can process the network request based on the risk confirmation result.

[0115] exist Figure 3 In the illustrated mini-program risk detection method, upon receiving the identification result sent by the client, it indicates that the network request data carried by the mini-program on the client to the external mini-program server includes private data. The server can then perform risk assessment on the network request based on the identification result and send the risk assessment result to the client. Because the server can comprehensively judge whether the network request is risky, the risk assessment result is more accurate, thereby reducing the risk of privacy data leakage and improving the reliability of mini-program risk detection.

[0116] In the embodiments of this specification, when the server performs risk assessment on a network request based on the identification result, it may do so in at least, but not limited to, the following two methods:

[0117] Method 1: Determine the risks of network requests based on the type of privacy data.

[0118] When using method one to assess the risk of a network request, the identification result must include at least the data type of the privacy data. The server can pre-set the data types to be blocked, such as ID card numbers and mobile phone numbers. If the data type of the privacy data included in the identification result matches the pre-set blocked data type, then the network request is confirmed to be risky.

[0119] Since different mini-programs may send network requests to external mini-program servers, and there is a normal business scenario requirement for their request data to carry certain types of privacy data, the types of data that need to be intercepted can be set separately for different mini-programs to meet the flexibility of mini-program risk detection.

[0120] Specifically, the identification result may include: the data type of the privacy data and the identity information of the mini-program.

[0121] Then step 302 may include: determining the data types that need to be blocked in advance for the mini program based on the identity information of the mini program included in the identification result; determining whether the data type is the data type that needs to be blocked for the mini program based on the data type of privacy data included in the identification result; if so, confirming that the network request has a risk; otherwise, confirming that the network request does not have a risk.

[0122] Method 2: Assess the risk of network requests based on the number of times the mini-program sends private data.

[0123] When using Method 2 to assess the risk of a network request, the identification result must include at least the mini-program's identity information. The server can pre-set a threshold number of times and record the number of times each mini-program sends private data. Each time the server receives an identification result from the client, it increments the record for the number of times private data is sent to that mini-program based on the mini-program's identity information included in the identification result. The server then determines whether the number of times after the increment reaches the set threshold. If it does, the network request is considered risky; otherwise, it is considered risk-free.

[0124] To further enhance the flexibility of mini-program risk detection, when the server confirms the risk of network requests based on the identification results, it can adopt any of the following confirmation rules: the number of times the mini-program sends privacy data in the same client, the number of times the mini-program sends privacy data in the same host application, the number of times the mini-program sends privacy data to the same mini-program server, the number of times the mini-program sends privacy data of the same data type, and the number of times the mini-program sends privacy data of the same data type to the same mini-program server in the same host application of the same client.

[0125] Preferably, the identification result includes: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; the host application is an application that the mini-program depends on to run;

[0126] Then step 302 may include: determining the number of times the mini-program sends privacy data of that data type to the external mini-program server in the host application of the client, based on the data type of the privacy data included in the identification result, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; and determining whether the number of times reaches a preset number threshold. If it does, the network request is confirmed to be risky; otherwise, the network request is confirmed to be risk-free.

[0127] Another embodiment also provides a mini-program risk detection device, which is located in the client. For example... Figure 4 An embodiment of a mini-program risk detection device is shown. It is understood that this device can be implemented using any device, equipment, platform, or cluster of devices with computing and processing capabilities. Figure 4 As shown, the device 40 includes:

[0128] Receiving unit 41 is configured to receive network requests sent by the mini program to an external mini program server;

[0129] The identification unit 42 is configured to identify whether the request data carried by the network request includes privacy data;

[0130] The generation unit 43 is configured to generate an identification result when the request data includes privacy data;

[0131] The sending unit 44 is configured to send the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result.

[0132] The processing unit 45 is configured to receive the risk confirmation result returned by the server and process the network request based on the risk confirmation result.

[0133] In one possible implementation, the identification unit 42 is configured to identify whether the request data carried by the network request satisfies a pre-set string rule. If it does, it is determined that the data request includes privacy data; otherwise, it is determined that the data request does not include privacy data. The string rule includes string matching logic and / or regular expressions.

[0134] When the string rule includes string matching logic, if the request data is the same as the string included in the string rule, then it is determined that the request data includes private data.

[0135] When the string rule includes a regular expression, the regular expression specifies the string format. If the request data conforms to the string format, it is determined that the request data includes private data.

[0136] One possible implementation, such as Figure 5As shown, the device 40 may further include: an interpretation unit 46, configured to interpret the request data carried by the network request using a data state machine interpreter before the identification unit identifies whether the request data carried by the network request includes privacy data, determine the interpretation result as the request data carried by the network request, and trigger the identification unit to perform the operation of identifying whether the request data carried by the network request includes privacy data.

[0137] In one possible implementation, the generation unit 43 is configured to acquire at least one of the following information: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; wherein the host application is an application that the mini-program depends on to run; and to determine the acquired at least one of the above information as the identification result;

[0138] And / or,

[0139] The processing unit 45 is configured to not process the network request when the risk confirmation result indicates that there is a risk; and to send the network request to the mini-program server through a preset external network interface when the risk confirmation result indicates that there is no risk.

[0140] In another embodiment, based on the above... Figure 4 or Figure 5 The implementation of the illustrated device also provides a mini-program risk detection device, which is located in a server. Figure 6 An embodiment of a mini-program risk detection device is shown. It is understood that this device can be implemented using any device, equipment, platform, or cluster of devices with computing and processing capabilities. Figure 6 As shown, the risk detection device 60 for the mini-program includes:

[0141] The acquisition unit 61 is configured to acquire the identification result sent by the client; the identification result is used to characterize that the request data carried in the network request sent by the mini program to the external mini program server includes privacy data;

[0142] Risk confirmation unit 62 is configured to perform risk confirmation on the network request based on the identification result;

[0143] Sending unit 63 is configured to send the risk confirmation result to the client so that the client can process the network request based on the risk confirmation result.

[0144] In one possible implementation, the identification result includes: the data type of the privacy data and the identity information of the mini-program;

[0145] The risk confirmation unit 62 is configured to determine, based on the identity information of the mini-program included in the identification result, the data types that need to be blocked in advance for the mini-program; and to determine, based on the data types of privacy data included in the identification result, whether the data type is a data type that needs to be blocked for the mini-program. If so, the network request is confirmed to be risky; otherwise, the network request is confirmed to be risk-free.

[0146] or,

[0147] The identification results include: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; the host application is the application that the mini-program depends on to run;

[0148] The risk confirmation unit 62 is configured to determine, based on the data type of the privacy data included in the identification result, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request, the number of times the mini-program sends privacy data of that data type to the external mini-program server in the host application of the client; and to determine whether the number of times reaches a preset threshold. If it does, the network request is confirmed to be risky; otherwise, the network request is confirmed to be risk-free.

[0149] This specification provides, in one embodiment, a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods of any embodiment in the specification.

[0150] This specification provides a computing device according to one embodiment, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to perform the method of any embodiment of the specification.

[0151] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the mini-program risk detection device. In other embodiments of this specification, the mini-program risk detection device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0152] The information interaction and execution process between the modules in the above-mentioned device and system are based on the same concept as the method embodiments in this specification, and the specific details can be found in the descriptions in the method embodiments in this specification, so they will not be repeated here.

[0153] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0154] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, widgets, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0155] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. Mini-program risk detection methods, applied to the client side, including: The external network interface provided by the host application is aspected in advance using Hook or static code replacement. When the mini-program calls the external network interface to send a network request to the external mini-program server, the execution logic corresponding to the mini-program calling the external network interface is routed to the security aspect module pre-built in the host application. The security aspect module in the host application receives network requests sent by the mini-program to the external mini-program server. The security aspect module in the host application identifies whether the request data carried by the network request includes privacy data; When the requested data includes privacy data, the security aspect module in the host application generates a recognition result; The security aspect module in the host application sends the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result. The security aspect module in the host application receives the risk confirmation result returned by the server and processes the network request based on the risk confirmation result; The step of identifying whether the request data carried in the network request includes privacy data includes: The system identifies whether the request data carried in the network request meets a pre-set string rule. If it does, it determines that the data request includes privacy data; otherwise, it determines that the data request does not include privacy data. The string rules include: string matching logic and / or regular expressions; When the string rule includes string matching logic, if the request data is the same as the string included in the string rule, then it is determined that the request data includes private data. When the string rule includes a regular expression, the regular expression specifies the string format. If the request data conforms to the string format, it is determined that the request data includes private data.

2. The method according to claim 1, further comprising, before identifying whether the request data carried in the network request includes privacy data: The request data carried by the network request is interpreted using a data state machine interpreter, the interpretation result is determined as the request data carried by the network request, and the process of identifying whether the request data carried by the network request includes privacy data is performed.

3. The method according to claim 1, wherein, The generated recognition result includes: Obtain at least one of the following information: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; wherein, the host application is an application that the mini-program depends on to run; The acquired information at least one of the above-mentioned pieces of information is determined as the identification result.

4. The method according to claim 1, wherein, The process of processing the network request based on the risk confirmation result includes: If the risk assessment result indicates that a risk exists, the network request will not be processed. When the risk confirmation result indicates that there is no risk, the network request is sent to the mini-program server through a preset external network interface based on the address information of the mini-program server carried in the network request.

5. A method for detecting risks in mini-programs based on any one of the methods described in claims 1 to 4, applied to a server, comprising: Obtain the recognition results sent by the client; The identification result is used to characterize that the network request data carried by the mini-program to the external mini-program server includes privacy data; The network request is risk-assessed based on the identification results. The risk assessment result is sent to the client so that the client can process the network request based on the risk assessment result.

6. The method according to claim 5, wherein, The identification results include: the data type of the privacy data and the identity information of the mini-program; The step of risk assessment of the network request based on the identification result includes: Based on the identity information of the mini-program included in the identification result, determine the data types that need to be intercepted in advance for the mini-program; Based on the data type of the privacy data included in the identification result, determine whether the data type is a data type that needs to be blocked for the mini-program. If so, confirm that the network request is risky; otherwise, confirm that the network request is not risky.

7. The method according to claim 5, wherein, The identification results include: the data type of the privacy data, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request; the host application is the application that the mini-program depends on to run; The step of risk assessment of the network request based on the identification result includes: Based on the data type of the privacy data included in the identification result, the identity information of the mini-program, the identity information of the host application, the identity information of the client, and the address information of the mini-program server carried in the network request, determine the number of times the mini-program sends privacy data of that data type to the external mini-program server in the host application of the client. Determine whether the number of attempts has reached a preset threshold. If it has, then the network request is confirmed to be risky; otherwise, the network request is confirmed to be risk-free.

8. A mini-program risk detection device, located on the client side, includes: The receiving unit is configured to receive network requests sent by the mini-program to an external mini-program server. Specifically, the external network interface provided by the host application is pre-aspected using either a hook or static code replacement method. When the mini-program calls this external network interface to send a network request to the external mini-program server, the execution logic corresponding to the mini-program's call to the external network interface is routed to a security aspect module pre-installed in the host application, so that the receiving unit can receive the network request sent by the mini-program to the external mini-program server. The identification unit is configured to identify whether the request data carried by the network request includes privacy data; The generation unit is configured to generate an identification result when the requested data includes privacy data; The sending unit is configured to send the identification result to an external server so that the server can perform risk assessment on the network request based on the identification result. The processing unit is configured to receive the risk confirmation result returned by the server and process the network request based on the risk confirmation result; The identification unit is configured to identify whether the request data carried by the network request meets a pre-set string rule. If it does, it determines that the data request includes privacy data; otherwise, it determines that the data request does not include privacy data. The string rules include: string matching logic and / or regular expressions; When the string rule includes string matching logic, if the request data is the same as the string included in the string rule, then it is determined that the request data includes private data. When the string rule includes a regular expression, the regular expression specifies the string format. If the request data conforms to the string format, it is determined that the request data includes private data.

9. A mini-program risk detection device implemented based on the apparatus of claim 8, located on a server, comprising: The acquisition unit is configured to acquire the recognition results sent by the client; The identification result is used to characterize that the network request data carried by the mini-program to the external mini-program server includes privacy data; A risk assessment unit is configured to assess the risk of the network request based on the assessment result. The sending unit is configured to send the risk confirmation result to the client so that the client can process the network request based on the risk confirmation result.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-7.

Images