Method and device for intercepting instant messaging messages, electronic device, and storage medium

Abstract

The present application provides an instant messaging message interception method and device, electronic device, and storage medium, the method comprising: loading a message interception script file of an instant messaging software; when the instant messaging software sends a message, calling the message interception script file; obtaining the window message of the instant messaging software by running the message interception script file; sending the window message to a scanning program for detection by running the message interception script file, and determining whether to transmit the window message externally based on the detection result. Since there is no need to perform reverse engineering, Hooking, and other processing, it can be applied to different versions of IM software to implement message review and interception, without destroying the security mechanism of the Chrominum engine, and maintaining the security of the instant messaging software.

Description

Technical Field

[0001] The present application relates to the technical field of data security, and particularly to a method and device for intercepting instant messaging messages, an electronic device, and a computer-readable storage medium. Background Art

[0002] As is well known, messages and files of current mainstream IM (Instant Messaging) software are encrypted during transmission. Therefore, some technical processing is required to obtain instant messages and file contents.

[0003] The architecture of IM software is divided into a CS (Client / Server) architecture and a Chromium-based architecture. For software with a CS architecture, there are the following auditing / interception solutions on the market:

[0004] There are two solutions for auditing IM instant messages: 1. Through reverse engineering, a copy is sent to the injected dll (i.e., the auditing program) before the message is sent to the network, so that auditing can be achieved; 2. By calculating the position of the send key of the IM software and using methods such as hook (a monitoring processing platform) for the mouse and keyboard, the message is first passed through the dll before being sent to the network, so that auditing / interception can be achieved, and even the sending of the message can be blocked.

[0005] The above solutions can solve the auditing / interception of some IM software messages, but there are also certain problems: 1. The reverse engineering solution needs to adapt to different versions of IM software, with a large workload. In order to be compatible with the most IM software in the market, mainly auditing of messages is carried out and interception cannot be achieved; 2. Chromium is an independent implementation completely different from the Windows native system, and virtual sandbox anti-escape protection is implemented for security reasons, so the general hook method fails. Summary of the Invention

[0006] An embodiment of the present application provides a method for intercepting instant messaging messages to be compatible with IM software of different headquarters and achieve message review and interception.

[0007] In a first aspect, an embodiment of the present application provides a method for intercepting instant messaging messages, including:

[0008] Loading a message interception script file of the instant messaging software;

[0009] When the instant messaging software sends a message, calling the message interception script file;

[0010] Obtaining window messages of the instant messaging software by running the message interception script file;

[0011] By running the message interception script file, the window message is sent to the scanning program for detection, and according to the detection result, it is determined whether to transmit the window message externally.

[0012] The technical solution provided by the above embodiment loads a message interception script file. When the instant messaging software sends a message, the message interception script is called to obtain the window message, and the window message is checked by a scanning program. According to the detection result, it is determined whether to transmit the window message externally. Since there is no need to do reverse engineering, Hook and other processing, it can be applied to different versions of IM software to realize message review and interception, without destroying the security mechanism of Chrominum, and maintaining the security of the instant messaging software.

[0013] In one embodiment, the message interception script file loaded into the instant messaging software includes:

[0014] Check whether the instant messaging software has the message interception script file installed;

[0015] If the message interception script file is not plugged in, plug the message interception script file into the instant messaging software and load the message interception script file.

[0016] In the above embodiment, the message interception script file is in the form of a plug-in, so that it can be applied to different versions of IM software to improve compatibility.

[0017] In one embodiment, after checking whether the instant messaging software is the message interception script file, the method further includes:

[0018] If the message interception script file has been installed externally, load the message interception script file.

[0019] In one embodiment, the step of plugging the message interception script file into the instant messaging software includes:

[0020] Change the address pointing to the original message sending script to point to the address of the message interception script file.

[0021] In the above embodiment, the plug-in uses redirection and does not delete the original message sending script, which is simple and convenient.

[0022] In one embodiment, the message interception script file loaded into the instant messaging software includes:

[0023] Use the message interception script file to replace the original message sending script of the instant messaging software, and load the message interception script file.

[0024] In the above embodiment, the js script is directly replaced, which is simple to handle.

[0025] In one embodiment, sending the window message to a scanner for detection by running the message interception script file and determining whether to externally transmit the window message according to the detection result includes:

[0026] Sending the window message to the scanner by running the message interception script file;

[0027] Obtaining the detection result of the window message by running the scanner and returning the detected result to the message interception script file;

[0028] Determining whether to externally transmit the window message according to the detection result by running the message interception script file.

[0029] In the above embodiment, before the window message is sent to the network, a piece of data is first sent to the scanner, and whether to release it is determined according to the analysis result of the scanner, realizing the interception of data.

[0030] In one embodiment, sending the window message to the scanner by running the message interception script file includes:

[0031] Sending the window message to the scanner via the Hypertext Transfer Protocol by running the message interception script file.

[0032] Since IM messages are based on js, the Chromium engine will impose many security restrictions and cannot access local resources, but can access the network. Therefore, in the above embodiment, the obtained window message is sent to the scanner via https communication, which can not damage the security mechanism of Chrominum.

[0033] In a second aspect, an embodiment of the present application further provides an instant messaging message interception device, including:

[0034] A script loading module, configured to load a message interception script file of an instant messaging software;

[0035] A script calling module, configured to call the message interception script file when the instant messaging software sends a message;

[0036] A message acquisition module, configured to obtain a window message of the instant messaging software by running the message interception script file;

[0037] A message sending module, configured to send the window message to a scanner for detection by running the message interception script file and determining whether to externally transmit the window message according to the detection result.

[0038] In a third aspect, an embodiment of the present application provides an electronic device, which includes:

[0039] a processor;

[0040] a memory for storing instructions executable by the processor;

[0041] wherein, the processor is configured to execute the above-mentioned instant messaging message interception method.

[0042] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the above-mentioned instant messaging message interception method.

[0043] In a fourth aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, causes the computer to execute the above-mentioned instant messaging message interception method. Description of the Drawings

[0044] To more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required to be used in the embodiments of the present application.

[0045] Figure 1 is a schematic structural diagram of the electronic device provided by the embodiment of the present application;

[0046] Figure 2 is a schematic flowchart of an instant messaging message interception method provided by the embodiment of the present application;

[0047] Figure 3 is Figure 2 a detailed flowchart corresponding to step S210 in the embodiment;

[0048] Figure 4 is Figure 2 a detailed flowchart corresponding to step S240 in the embodiment;

[0049] Figure 5 is a schematic flowchart of an instant messaging message interception method provided by another embodiment of the present application;

[0050] Figure 6 is a block diagram of an instant messaging message interception device provided by the embodiment of the present application. Detailed Embodiments

[0051] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application.

[0052] Like reference numerals and letters refer to like items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present application, terms such as "first", "second", etc. are only used for distinguishing descriptions and cannot be construed as indicating or implying relative importance.

[0053] Figure 1 FIG. is a schematic structural diagram of an electronic device provided by an embodiment of the present application. The electronic device 100 can be used to execute the instant messaging message interception method provided by the embodiment of the present application. As Figure 1 shown, the electronic device 100 includes: one or more processors 102, and one or more memories 104 for storing processor-executable instructions. Wherein, the processor 102 is configured to execute the instant messaging message interception method provided in the following embodiments of the present application.

[0054] The processor 102 can be a gateway, or a smart terminal, or a device including a central processing unit (CPU), an image processing unit (GPU), or other forms of processing units having data processing capabilities and / or instruction execution capabilities. It can process the data of other components in the electronic device 100 and can also control other components in the electronic device 100 to perform desired functions.

[0055] The memory 104 may include one or more computer program products, and the computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 102 may run the program instructions to implement the instant messaging message interception method described below. Various application programs and various data may also be stored in the computer-readable storage medium, such as various data used and / or generated by the application programs, etc.

[0056] In one embodiment, Figure 1 As shown, the electronic device 100 may further include an input device 106, an output device 108, and a data acquisition device 110, and these components are interconnected through a bus system 112 and / or other forms of connection mechanisms (not shown). It should be noted that Figure 1 The components and structure of the electronic device 100 shown are exemplary and not restrictive. According to needs, the electronic device 100 may also have other components and structures.

[0057] The input device 106 can be a device used by a user to input instructions, and can include one or more of a keyboard, a mouse, a microphone, a touch screen, etc. The output device 108 can output various information (such as images or sounds) to the outside (for example, to the user), and can include one or more of a display, a speaker, etc. The data acquisition device 110 can acquire an image of an object, and store the acquired image in the memory 104 for use by other components. Exemplarily, the data acquisition device 110 can be a camera.

[0058] In one embodiment, each device in the exemplary electronic device 100 for implementing the instant messaging message interception method of the embodiments of the present application can be integrally arranged or separately arranged. For example, the processor 102, the memory 104, the input device 106, and the output device 108 can be integrally arranged, while the data acquisition device 110 is separately arranged.

[0059] In one embodiment, the exemplary electronic device 100 for implementing the instant messaging message interception method of the embodiments of the present application can be implemented as a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.

[0060] Figure 2 It is a schematic flowchart of an instant messaging message interception method provided by an embodiment of the present application. This method can be executed by an electronic device such as a computer. As Figure 2 shown, this method includes the following steps S210 - step S240.

[0061] Step S210: Load the message interception script file of the instant messaging software.

[0062] Among them, the instant messaging software can be chat tools such as QQ, WeChat, MSN (Microsoft Service Network) with a CS architecture or a Chromium architecture. The message interception script file can be a custom program with a function of blocking message sending. The message interception script file can be a js (JavaScript) script file. In one embodiment, the instant messaging software does not need to be improved, and the message interception script file can be in the form of an add-on. Although the Chromium engine decoding is a black box for Windows, the Chromium engine will still load the add-on js script file. According to needs, the instant messaging software can also be improved, and the message interception script file is used as a part of the instant messaging software. The message interception script file can be stored locally or obtained from a server.

[0063] For different versions of the instant messaging software, in one embodiment, as Figure 3As shown, the above step S210 specifically includes: Step S211: Check whether the instant messaging software has the message interception script file externally attached. In an embodiment, when the IM process (a part of the detection engine) starts, the IM process can check whether the instant messaging software has the message interception script file externally attached. "Externally attached" means that the message interception script file is an auxiliary tool for the instant messaging software.

[0064] Step S212: If the message interception script file is not externally attached, externally attach the message interception script file to the instant messaging software and load the message interception script file. Step S212': If the message interception script file has been externally attached, load the message interception script file.

[0065] Among them, the way of redirecting the file can be adopted to change the address pointing to the original message sending script to the address where the message interception script file is located. Thus, when the instant messaging software calls the original message sending script, it will be redirected to call the message interception script file, realizing the external attachment of the message interception script file. The original message sending script can be considered as the message sending script before improvement, relative to the message interception script file. The message interception script file can be considered as the improved message sending script, which can block or release messages.

[0066] In another embodiment, the way of directly replacing the js file can also be adopted to replace the original message sending script of the instant messaging software with the message interception script file, so that the message interception script file can be directly loaded when the instant messaging software starts.

[0067] Step S220: When the instant messaging software sends a message, call the message interception script file.

[0068] When the instant messaging software is sending a message, the instant messaging software can call the message interception script file. For example, when the instant messaging software receives a message sending instruction, it calls the message interception script file.

[0069] Step S230: Obtain the window message of the instant messaging software by running the message interception script file.

[0070] Among them, the window message refers to the message to be sent input by the user in the message input window of the instant messaging software.

[0071] Step S240: Send the window message to the scanning program for detection by running the message interception script file, and determine whether to externally transmit the window message according to the detection result.

[0072] Among them, the message interception script file can send window messages to the scanner of the detection engine. The scanner can detect the window messages, such as whether they contain a certain sensitive word. Among them, the detection result can include allowing or blocking. For example, if a certain sensitive word is included, the detection result is blocking; on the contrary, if the preset sensitive word is not included, the detection result is allowing. If the detection result is blocking, the message interception script file does not transmit the window message externally, that is, it does not transmit the window message to the server through the network. If the detection result is allowing, the message interception script file transmits the window message to the server through the network.

[0073] In one embodiment, as Figure 4 shown, the above step S240 specifically includes:

[0074] Step S241: By running the message interception script file, send the window message to the scanner.

[0075] In one embodiment, the computer can send the window message to the scanner through the Hypertext Transfer Protocol by running the message interception script file. Since the window message is based on js, the Chromium engine will impose many security restrictions and cannot access local resources, but it can access the network. Therefore, the improved message sending part can send the obtained window message to the scanner through https communication. Then, it decides whether to call the original sending interface according to the result returned by the scanner.

[0076] Step S242: By running the scanner, obtain the detection result of the window message and return the detected result to the message interception script file.

[0077] Among them, the scanner can detect the window message, and the specific detection process can be set as needed, such as including a specified sensitive word. The detection result can be including (corresponding to blocking) or not including (corresponding to allowing).

[0078] Step S243: By running the message interception script file, determine whether to transmit the window message externally according to the detection result.

[0079] For example, the message interception script file can, according to the detection result, if the detection result is including a sensitive word, the message interception script file can not transmit the window message to the network and give a prompt to the user. If it does not contain a sensitive word, the message interception script file can send the window message to the network.

[0080] As Figure 5 shown, before the improvement, when sending a message, the original message sending script was directly called, and the message was directly sent to the network through the send function.

[0081] After the modified IM process starts, it first checks whether the instant messaging software has an external message interception script file and loads the external message interception script file. When the instant messaging software sends a message, it will first call the send function of the external message interception script file, and first send the window message to the scanning process. The scanning process returns the detection result (allow or block) to the external message interception script file. The external message interception script file decides whether to send the message to the network according to the detection result.

[0082] In the above solution, it is not necessary to reverse-analyze the instant messaging software and send back binary window messages, and the processing method is simple; since the data to be processed is at the JS layer, the window messages to be checked are in plain text and readable, so there is no uncertainty, which increases the stability. There is no need to reverse, Hook, etc. the security mechanism under the Chromium engine, and it will not damage the security mechanism of the Chrominum engine of the instant messaging software, maintaining the security of the instant messaging software. On the basis of protecting the security of the engine, message auditing is realized, which has high stability and broad spectrum.

[0083] The following is an embodiment of the device of the present application, which can be used to execute the above-mentioned embodiment of the method for intercepting instant messaging messages of the present application. For the details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method for intercepting instant messaging messages of the present application.

[0084] Figure 6 It is a block diagram of an instant messaging message interception device shown in an embodiment of the present application. As Figure 6 shown, the device includes: a script loading module 610, a script calling module 620, a message obtaining module 630, and a message sending module 640.

[0085] The script loading module 610 is used to load the message interception script file of the instant messaging software.

[0086] The script calling module 620 is used to call the message interception script file when the instant messaging software sends a message.

[0087] The message obtaining module 630 is used to obtain the window message of the instant messaging software by running the message interception script file.

[0088] The message sending module 640 is used to send the window message to the scanning program for detection by running the message interception script file, and determine whether to transmit the window message externally according to the detection result.

[0089] For the implementation processes of the functions and roles of each module in the above device, please refer to the implementation processes of the corresponding steps in the above instant messaging message interception method for details, which will not be elaborated here.

[0090] In one embodiment, the above script loading module includes:

[0091] A script checking unit, configured to check whether the instant messaging software has the message interception script file externally attached.

[0092] A script externally attaching unit, configured to, if the message interception script file is not externally attached, externally attach the message interception script file to the instant messaging software and load the message interception script file.

[0093] In one embodiment, the above script loading module further includes:

[0094] A script loading unit, configured to, if the message interception script file has been externally attached, load the message interception script file.

[0095] In one embodiment, the script externally attaching unit is specifically configured to change the address pointing to the original message sending script to the address where the message interception script file is located.

[0096] In one embodiment, the above script loading module includes:

[0097] A script replacing unit, configured to replace the original message sending script of the instant messaging software with the message interception script file and load the message interception script file.

[0098] In one embodiment, the above message sending module 640 includes:

[0099] A message forwarding unit, configured to send the window message to the scanner by running the message interception script file.

[0100] A message checking unit, configured to obtain the detection result of the window message by running the scanner and return the detected result to the message interception script file.

[0101] A message external sending unit, configured to determine whether to externally transmit the window message according to the detection result by running the message interception script file.

[0102] In one embodiment, the message forwarding unit is specifically configured to: send the window message to the scanner through the Hypertext Transfer Protocol by running the message interception script file.

[0103] In several embodiments provided in this application, the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of this application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and a module, a program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0104] In addition, in each embodiment of this application, the various functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0105] If the function is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of this application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

Claims

1. A method for intercepting instant messaging messages, characterized in that: include: Load the message interception script file of the instant messaging software; The instant messaging software is based on the Chromium engine; The message interception script text is a JS script file; When the instant messaging software sends a message, the message interception script file is called; Obtaining the window message of the instant messaging software by running the message interception script file; The window message is in plain text at the JS layer; The window message is sent to a scanning program for detection by running the message interception script file, and whether to transmit the window message externally is determined according to the detection result; wherein the window message is sent to the scanning program via a hypertext transfer protocol.

2. The method according to claim 1, characterized in that The message interception script file loaded into the instant messaging software includes: Check whether the instant messaging software has the message interception script file installed externally; If the message interception script file is not plugged in, the message interception script file is plugged in to the instant messaging software, and the message interception script file is loaded.

3. The method according to claim 2, characterized in that After checking whether the instant messaging software is the message interception script file, the method further comprises: If the message interception script file has been installed externally, load the message interception script file.

4. The method according to claim 2, characterized in that: The step of plugging the message interception script file into the instant messaging software includes: The address pointing to the original message sending script is changed to point to the address of the message interception script file.

5. The method according to claim 1, characterized in that The message interception script file loaded into the instant messaging software includes: The original message sending script of the instant messaging software is replaced with the message interception script file, and the message interception script file is loaded.

6. The method according to claim 1, characterized in that The step of sending the window message to a scanning program for detection by running the message interception script file, and determining whether to transmit the window message externally according to the detection result, includes: By running the message interception script file, the window message is sent to the scanning program; By running the scanning program, the detection result of the window message is obtained and the detection result is returned to the message interception script file; By running the message interception script file, it is determined whether to transmit the window message externally according to the detection result.

7. An instant messaging message interception device, characterized in that: include: A script loading module is used to load the message interception script file of the instant messaging software; The instant messaging software is based on the Chromium engine; The message interception script text is a JS script file; A script calling module, used to call the message interception script file when the instant messaging software sends a message; A message acquisition module, used for acquiring the window message of the instant messaging software by running the message interception script file; The window message is in plain text at the JS layer; The message sending module is used to send the window message to the scanning program for detection by running the message interception script file, and determine whether to transmit the window message externally according to the detection result; wherein, the window message is sent to the scanning program via the Hypertext Transfer Protocol.

8. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the instant communication message interception method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program can be executed by a processor to complete the instant messaging message interception method according to any one of claims 1 to 6.

Images