A security detection method and apparatus

Abstract

The application discloses a security detection method and device, electronic equipment and a storage medium. The method can include: detecting that a terminal performs a preset operation on a target application, scanning a preset file directory to obtain first security detection information; performing device information detection processing on the terminal to obtain multiple types of device information; obtaining security detection configuration information, performing security detection processing on the multiple types of device information according to the security detection configuration information to obtain second security detection information; and performing corresponding security processing on the preset operation according to the first security detection information and the second security detection information. According to the technical scheme provided by the application, the single security detection mode is avoided, the detection accuracy is improved, the attack of malicious software on a mobile device can be timely blocked, the risk of user information and data leakage is effectively reduced, and the security of the running environment is improved.

Description

Technical Field

[0001] This disclosure relates to the field of system security, and in particular to a security detection method and apparatus. Background Technology

[0002] With the widespread adoption of mobile internet, mobile devices, as indispensable tools for daily life and business operations, have gradually become a major target of cyberattacks.

[0003] In related technologies, existing security detection methods for Android mobile devices generally rely on basic user device information, comparison with malware blacklists, and scanning of critical system files for simple decision-making. For example, using emulators, multi-instance assistants, or virtual machines to forge basic user device information can deceive the detection team, leading to detection errors. Furthermore, the detection is not comprehensive enough, with potential omissions of dangerous operations, resulting in a high risk of terminal information and data leakage. Summary of the Invention

[0004] This disclosure provides a security detection method and apparatus to at least address the problem in related technologies of how to overcome the reliance on single security detection methods for terminal systems and improve detection accuracy. The technical solution of this disclosure is as follows:

[0005] According to a first aspect of the present disclosure, a security detection method is provided, comprising:

[0006] In one possible implementation, when a preset operation is detected on the target application in the terminal, a preset file directory is scanned to obtain the first security detection information.

[0007] The terminal is processed to detect device information, resulting in various types of device information. These various types of device information represent the terminal's device attribute information, hardware information, and software information.

[0008] Obtain security detection configuration information, and perform security detection processing on the various device information according to the security detection configuration information to obtain second security detection information;

[0009] Based on the first security detection information and the second security detection information, the preset operation is subjected to corresponding security processing.

[0010] According to a second aspect of the present disclosure, a security detection device is provided, comprising:

[0011] The first security detection information acquisition module is used to scan a preset file directory to obtain the first security detection information when a preset operation is performed on a target application in the terminal.

[0012] The device information acquisition module is used to detect and process device information of the terminal to obtain various types of device information, which represent the device attribute information, hardware information and software information of the terminal.

[0013] The second security detection information acquisition module is used to acquire security detection configuration information and perform security detection processing on the various device information according to the security detection configuration information to obtain the second security detection information.

[0014] The security processing module is used to perform corresponding security processing on the preset operation based on the first security detection information and the second security detection information.

[0015] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the method as described in any one of the first aspects above.

[0016] To achieve the above objectives, a fourth aspect of the present invention provides a non-volatile computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the various steps of the attack protection method provided in the first aspect of the present invention.

[0017] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0018] By acquiring information from multiple devices for security testing, the detection is more comprehensive, avoiding errors caused by emulators, multi-instance assistants, or other means that can falsify device information. This layered security testing approach, which involves acquiring first-level security information and then acquiring second-level security information for security processing, avoids the limitations of a single testing method, improves detection accuracy, and thus enhances the security of the operating environment.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0021] Figure 1 This is a schematic diagram illustrating an application environment according to an exemplary embodiment.

[0022] Figure 2 This is a flowchart illustrating a security detection method according to an exemplary embodiment.

[0023] Figure 3 This is a flowchart illustrating a security detection method according to another exemplary embodiment.

[0024] Figure 4 This is a flowchart illustrating, according to an exemplary embodiment, how to obtain third security detection information based on terminal operating environment information.

[0025] Figure 5 This is a flowchart illustrating the corresponding security processing of a preset operation according to an exemplary embodiment;

[0026] Figure 6 This is a flowchart illustrating a system application scenario according to an exemplary embodiment;

[0027] Figure 7 This is a flowchart illustrating another system application scenario according to an exemplary embodiment;

[0028] Figure 8 This is a block diagram of an apparatus according to an exemplary embodiment.

[0029] Figure 9 This is a schematic diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0030] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0031] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0032] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an application environment according to an exemplary embodiment, such as... Figure 1 As shown, the application environment may include server 01 and terminal 02.

[0033] In an optional embodiment, server 01 can be used to collect and store data, and continuously update and adjust security detection configuration information. Specifically, server 01 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0034] In an optional embodiment, terminal 02 can perform dynamic security detection in conjunction with server 01, improving the flexibility of the security detection method. Specifically, terminal 02 can be, but is not limited to, electronic devices such as smartphones, desktop computers, tablets, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices. Optionally, the operating system running on the electronic device can be, but is not limited to, Android, iOS, Linux, and Windows.

[0035] In addition, it should be noted that, Figure 1 The methods and systems shown are merely those for detecting the security of the Android system operating environment provided in this disclosure.

[0036] In the embodiments described in this specification, the server 01 and the terminal 02 can be directly or indirectly connected through wired or wireless communication, and this application does not impose any restrictions on this.

[0037] It should be noted that the following diagram shows one possible sequence of steps, and it is not strictly required to follow this order. Some steps can be executed in parallel without interdependence. The first security detection information (including but not limited to terminal root permission second state information, installation information of preset software, etc.), various device information (terminal device attribute information, sensor information, flash information, Bluetooth information, emulator file information, system process controller information, etc.), the second security detection information (including but not limited to emulator security detection information or virtual machine security detection information, etc.), and the third security detection information (including but not limited to target application repeated startup information, framework usage information, terminal root permission first state information, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0038] Figure 2 This is a flowchart illustrating a security detection method according to an exemplary embodiment, which can be applied to a terminal. For example... Figure 2As shown, the steps may include the following.

[0039] In step S201, when a preset operation is detected on the target application in the terminal, a preset file directory is scanned to obtain the first security detection information.

[0040] In this embodiment, the target application can be any application software on the terminal. The preset file directory can be a pre-set file directory located on the terminal. The number of preset file directories can be one or more. As an example, a preset file directory can be set in advance, for example, based on the file directory associated with the first security detection information. In one example, the first security detection information can characterize the security information of the terminal, such as whether the terminal is secure or its security level. For example, the first security detection information can include at least one of the following: second status information corresponding to the terminal's root privileges, and installation information of preset software. The preset software can refer to preset software that affects the security of the terminal and the target application, such as malicious software like Magisk or AbstractEmu. Correspondingly, the preset file directory can include the terminal's permission information directory, the terminal application software installation directory, etc. This application is not limited to these; they can be set accordingly based on the first security detection information, as long as the precise execution of the first security detection information is satisfied.

[0041] Optionally, the preset file directory can be stored in advance for use during subsequent security checks.

[0042] In this embodiment, when a preset operation on a target application is detected on the terminal, a preset file directory can be scanned to obtain first security detection information. As an example, when a preset operation on a target application is detected on the terminal, a preset file directory can be retrieved from storage. Furthermore, the preset file directory can be scanned; for example, the terminal's permission information directory, the terminal application software installation directory, etc., can be scanned by calling a C language integrated in a dynamic link library to obtain the first security detection information.

[0043] As an example, the aforementioned preset operations may include a click-to-launch operation on the target application or a trigger operation on a preset service within the target application; this application does not impose any limitations on these operations.

[0044] Optionally, a security detection software development kit (SDK) can be integrated into the target application. When a preset operation is detected on the terminal that targets the application, the security detection software development kit can be called to perform a security detection method.

[0045] In one possible implementation, a predefined file directory can be scanned by calling a C language function integrated into a dynamic link library. This increases the difficulty of decompiling and cracking the application, thereby improving the operational security of the target application.

[0046] In step S203, the terminal is processed to detect device information, and various types of device information are obtained. These various types of device information represent the terminal's device attribute information, hardware information, and software information.

[0047] In this application embodiment, various device information represents the terminal's device attribute information, hardware information, and software information. For example, device attribute information may include at least one of the following: baseband information and motherboard information; hardware information may include at least one of the following: sensor information, flash information, and Bluetooth information; and software information may include at least one of the following: emulator file information and system process controller information. The emulator file information may be driver file information related to the virtual operating system emulator QEMU (Quick EMUlator) or Genymotion emulator file information; this application does not limit this to a specific type.

[0048] In this embodiment, the terminal undergoes device information detection processing to obtain various types of device information. For example, the terminal's system file directory is scanned to obtain the terminal's attribute information and system information. This avoids the problem of detection errors caused by obtaining only a single type of device information, which could be forged by emulators, virtual machines, or other means.

[0049] In step S205, security detection configuration information is obtained, and security detection processing is performed on the above-mentioned multiple device information according to the security detection configuration information to obtain second security detection information, thereby improving the accuracy of detection.

[0050] In this embodiment, security configuration information can refer to information used for security detection and processing of various device information. For example, security configuration information may include security detection thresholds and preset detection methods; or it may include security detection methods corresponding to each device information. The preset detection method can be considered a security detection and processing strategy used for security detection and processing of various device information.

[0051] The second security detection information can characterize the security information of objects associated with the terminal, that is, whether the objects associated with the terminal are secure. These objects associated with the terminal can be objects that simulate operations on the terminal, such as emulators or virtual machines. For example, the second security detection information may include at least one of the following: security detection information for emulators or security detection information for virtual machines.

[0052] In this embodiment, obtaining security detection configuration information allows for security detection processing of the various device information to obtain second security detection information. As an example, the security detection configuration information can be obtained through a server. For instance, the terminal uploads various device information to the server and receives security detection configuration information returned by the server in response to the various device information. Further, based on the obtained security detection configuration information, security detection processing is performed on the various device information. For example, the security detection configuration information may include the security detection method corresponding to each device information, thereby allowing security detection of the device information based on the corresponding security detection method, determining abnormal information of the various device information, and thus obtaining the second security detection information. This server-controlled and dynamic adjustment of the security detection configuration information avoids the problem of single-judgment affecting the normal use of the target application, improving the accuracy of security detection.

[0053] As an example, the security detection configuration information is determined based on historical security detection information, which consists of the second and third security detection information stored on the server during the previous security detection process. The previous security detection process can refer to the last time a preset operation was performed on the target application on the terminal to execute the security detection method.

[0054] In one possible implementation, the aforementioned preset detection method can refer to a method for handling abnormal information, where multiple device information represents the terminal's device attribute information, hardware information, and software information. The device attribute information can include at least one of the following: baseband information, motherboard information; and the hardware information can include at least one of the following: sensor information, flash information, Bluetooth information. As an example, for different device information, the aforementioned preset detection method can include several of the following:

[0055] When the device information is baseband information, the preset detection method can be a detection method based on comparing the baseband information with a baseband anomaly threshold. Specifically, if the terminal's baseband information is higher than the baseband anomaly threshold and the baseband information is empty, then the baseband anomaly value is updated, for example, by increasing the baseband anomaly value. As an example, when the baseband information is an anomaly value, a first preset baseband value can be added to the baseband anomaly value, and this preset baseband value can be 2; this disclosure does not limit this. If the terminal's baseband information is higher than the baseband anomaly threshold and the baseband information is not empty (for example, a value like 1.0.0.0), then the baseband anomaly value is updated, for example, by increasing the baseband anomaly value. As an example, when the baseband anomaly information is a baseband anomaly value, a second preset baseband value can be added to the baseband anomaly value, wherein the second preset baseband value is greater than the first preset baseband value. For example, this second preset baseband value can be 5; this disclosure does not limit this.

[0056] When the device information is motherboard information, the preset detection method can be a detection method based on comparing the motherboard information with a motherboard anomaly threshold. Specifically, if the terminal's motherboard information is higher than the motherboard anomaly threshold and the motherboard information is empty, then the motherboard anomaly value is updated, for example, by increasing the motherboard anomaly value. As an example, when the motherboard anomaly information is a motherboard anomaly value, a first preset motherboard value can be accumulated on the motherboard anomaly value. For example, the first preset motherboard value can be 1, and this disclosure does not limit this. If the terminal's motherboard information is higher than the motherboard anomaly threshold and the motherboard information is not empty (for example, information such as VBOX (VirtualBox) or Android Open Source Project AOSP), then the motherboard anomaly value is updated, for example, by increasing the motherboard anomaly value. As an example, when the motherboard anomaly information is a motherboard anomaly value, a second preset motherboard value can be accumulated on the motherboard anomaly value, wherein the second preset motherboard value is greater than the first preset motherboard value. For example, the second preset motherboard value can be 2, and this disclosure does not limit this.

[0057] When the device information is hardware information, the preset detection method can be a detection method based on comparing the hardware information with a baseband anomaly threshold. Specifically, if the terminal contains hardware information, such as a camera flash, light sensor, Bluetooth, etc., and if the terminal does not contain at least one of the aforementioned hardware information, then the hardware anomaly value is updated, for example, by increasing the hardware anomaly value. As an example, a preset hardware value is accumulated on the hardware anomaly value; for example, the preset hardware value can be 1, and this disclosure does not limit this.

[0058] When the device information is sensor information, the preset detection method can be a detection method based on comparing the sensor information with a baseband anomaly threshold. Specifically, if the ratio of devices with fewer than a first preset number of sensors to the total number of devices is less than a first preset ratio, the sensor anomaly value of that device is updated. As an example, the first preset number can be a value between 10 and 13, such as 12. The first preset ratio can be 0.1%. If the ratio of devices with more than 10 and less than 13 sensors to the total number of devices is less than 0.1%, the first preset sensor number anomaly value can be added to the sensor anomaly value. For example, the first preset sensor number anomaly value can be 1, which is not limited in this application. If the ratio of devices with fewer than a second preset number of sensors to the total number of devices is less than a second preset ratio, then the abnormal value of the number of sensors for that device is updated. As an example, the second preset number can be 10, and the second preset ratio can be 0.01%. When the ratio of devices with fewer than a second preset number of sensors to the total number of devices is less than 0.01%, a second preset abnormal value of the number of sensors can be added to the abnormal value of the number of sensors. The second preset abnormal value of the number of sensors is greater than the first preset abnormal value of the number of sensors. For example, the first preset abnormal value of the number of sensors can be 2. This application does not limit this.

[0059] The abnormal values ​​of the above-mentioned device information are summed to obtain the terminal abnormal value. If the terminal abnormal value is greater than the security detection threshold, it is determined to be the security detection information of the virtual machine or emulator. If the terminal abnormal value is less than the security detection threshold, the abnormal values ​​of the various information are uploaded to the server for storage as data records to provide data support for the security detection configuration information.

[0060] In one possible implementation, based on the aforementioned security detection thresholds and preset detection methods, different device information can be detected to obtain security detection information for the emulator or the virtual machine. The second security detection information is then determined based on the emulator's or virtual machine's security detection information.

[0061] In step S207, the preset operation is subjected to corresponding security processing based on the first security detection information and the second security detection information.

[0062] In this embodiment, based on the first security detection information and the second security detection information, corresponding security processing can be performed on the preset operation. As an example, based on the aforementioned first and second security detection information, security level information can be determined. For instance, the correspondence between the first security detection information, the second security detection information, and the security level information can be obtained, thereby acquiring the security level information corresponding to the first and second security detection information based on this correspondence. Further, based on the security level information, corresponding security processing is performed on the preset operation. The higher the security level information, the more secure the preset operation. Correspondingly, the security processing can be positively correlated with the security level information; for example, the higher the security level information, the simpler the corresponding security processing method.

[0063] It should be noted that security level information can be quantitative information or information on the degree of quantitative information, such as high, medium, and low. This application does not limit the number of security levels represented by the security level information.

[0064] Figure 3 This is illustrated according to an exemplary embodiment. Figure 2 A flowchart of another security detection method. (e.g.) Figure 3 As shown, the steps may include the following.

[0065] In step S301, the terminal's operating environment information is obtained.

[0066] In this embodiment, the terminal's runtime environment information is characterized as internal terminal information and external call information. For example, the terminal's runtime environment information may include at least one of the following: virtual machine stack information, preset file directory information, and dynamic link library file information. The virtual machine is the virtual machine corresponding to the terminal's development language; for example, in the Android system, the virtual machine may be a Java Virtual Machine, an Android Virtual Machine, etc., and this application does not impose any limitations.

[0067] As an example, information about the terminal's internal environment and external calls can be scanned, such as the virtual machine's stack information, default file directory information, and dynamic link library file information, to obtain the terminal's runtime environment information.

[0068] In step S303, third security detection information is obtained based on the terminal's operating environment information.

[0069] In this embodiment, the third security detection information can characterize the security information of the target application's file directory, i.e., whether the target application is secure. For example, the third security detection information may include at least one of the following: repeated launch information of the target application, usage information of a preset framework, and root permission first state information. The preset framework is a service framework corresponding to the operating system of the terminal. For example, in the Android system, this framework may be the Xposed framework, CydiaSubstrate, etc.

[0070] In this embodiment, third security detection information is obtained based on the terminal's operating environment information. For example, by scanning the terminal's operating environment information, the repeated startup information of the target application, the usage information of the preset framework, and the first root permission status information can be obtained. Based on the repeated startup information of the target application, the usage information of the preset framework, and the first root permission status information, the third security detection information is obtained.

[0071] In step S305, the preset operation is subjected to corresponding security processing based on the first security detection information, the second security detection information, and the third security detection information.

[0072] In this embodiment of the application, the preset operation is subjected to corresponding security processing based on the first security detection information, the second security detection information and the third security detection information. This is described in detail in step S207 above, and will not be elaborated here.

[0073] In one optional implementation, when a click-to-launch operation is performed on the target application or a preset service is triggered within the target application, three processes are created respectively. These three processes can be a pre-detection process, an independent detection process, and a client main process, which is not limited in this application. In the pre-detection process, the operation of obtaining first security detection information can be performed; in the independent detection process, the operations of obtaining second and third security detection information can be performed; and in the client main process, corresponding security processing is performed on the preset operation.

[0074] Figure 4 This is a flowchart illustrating how to obtain third security detection information based on terminal runtime environment information, according to an exemplary embodiment. In one possible implementation, such as... Figure 4 As shown, step S303 above may include the following steps:

[0075] In step S401, the repeated startup status of the target application is analyzed and processed based on software information to determine the repeated startup information of the target application.

[0076] In this application embodiment, the software information may include at least one of the following: emulator file information, system process controller information. For example, driver file information related to a virtual operating system emulator, Genymotion emulator file information, system source control group (cgroups) process controller information, etc. Specifically, it may be a device application file directory, a list of application package names, a list of system processes, etc., which are not limited in this application.

[0077] The duplicate launch information of the target application may include at least one of the following: the device application file directory contains file information that is the same as this application, the application package name list contains package name information that is the same as this application, and the system process list contains process information that is the same as the user identification (UID) part.

[0078] In this embodiment, based on the aforementioned software information, the repeated startup status of the target application can be analyzed and processed to determine the repeated startup information of the target application. As an example, based on this software information, the repeated startup status of the target application can be analyzed and processed. For instance, the repeated startup status of the target application can be analyzed and processed based on information such as the terminal's application file directory, application package name list, and system process list to obtain repeated startup status information. Further, the repeated startup information of the target application can be determined based on the obtained repeated startup status information. For example, based on the obtained repeated startup status information, information about files that are duplicated with the current application in the device's application file directory, package name information that is duplicated with the current application in the application package name list, and process information with duplicate UIDs in the system process list can be analyzed to determine the repeated startup information of the target application.

[0079] In step S403, the stack information is analyzed and processed to obtain the usage information of the preset framework.

[0080] In this embodiment, the preset framework is a service framework corresponding to the operating system of the terminal. For example, in the Android system, the framework can be the Xposed framework, CydiaSubstrate, etc.

[0081] As an example, the above stack trace information can be analyzed to obtain usage information of a preset framework. For instance, in an Android system, a security detection software development kit integrated into the target application might capture Java Virtual Machine (JVM) related stack trace information by throwing an exception containing the Xposed framework identifier. Based on the analysis of the JVM-related stack trace information, key Xposed framework classes can be identified, thereby determining the usage information of the Xposed framework.

[0082] Optionally, the security detection software development kit integrated into the target application can induce the Java Virtual Machine to throw an exception by obtaining key class information of the Xposed framework from the Java Virtual Machine class loader, and then determine the usage information of the Xposed framework through the preset exception. The preset exception can be an exception that occurs when the Xposed framework is used, a division operation exception, an input / output (I / O) exception, etc., and this application does not limit it.

[0083] In step S405, a preset file directory and dynamic link library files are scanned to determine the first status information corresponding to the root permissions of the terminal.

[0084] In this embodiment, scanning a preset file directory and calling dynamic link library files determines the first state information corresponding to the root permissions of the terminal. As an example, scanning the preset file directory and calling the dynamic link library files can be done by retrieving the preset file directory from storage and then scanning the preset file directory by calling a C language method integrated in the dynamic link library. For example, in the Android system, the security detection software development kit integrated into the target application can execute a preset shell command to call a C language method integrated in the dynamic link library to scan the preset file directory.

[0085] Specifically, the security detection software development kit integrated into the target application creates an independent service process by calling the ZygotePreload class provided by the Android system. Within this process, C language methods integrated into the dynamic link library scan a preset file directory to determine the terminal's root access information and the installation information of the preset software. The installation information of the preset software can include Magisk information and the installation information of its malicious software. Furthermore, the installation information of the preset software can be determined by the usage information of the preset Transmission Control Protocol (TCP) port. This method prevents malicious software from hiding its root traces and its own information, thus avoiding an increase in the risk to the target application.

[0086] In step S407, third security detection information is obtained based on the target application's repeated startup information, the usage information of the preset framework, and the root permission first status information.

[0087] In this embodiment of the application, third security detection information is obtained based on the repeated startup information of the target application, the usage information of the preset framework, and the first state information of the root permission. As an example, the startup information of the target application, the usage information of the preset framework, and the acquisition status information of the root permission can be analyzed to obtain the third security detection information.

[0088] In one possible implementation, steps S401 to S405 can be performed in parallel. By combining and progressively advancing multiple methods such as detecting repeated startup information of the target application, usage information of the preset framework, and root privilege first status information, the vulnerability that is not detected due to only using one detection method is avoided, making the security detection more comprehensive and improving the detection accuracy.

[0089] Figure 5 This is a flowchart illustrating appropriate security processing for a preset operation according to an exemplary embodiment. In one possible implementation, such as... Figure 5 As shown, step S305 above may include the following steps:

[0090] In step S501, if the security level information is higher than or equal to the first preset level, the preset operation is confirmed as a safe operation, and the process returns to the steps of obtaining the second and third security detection information to redetermine the security level information.

[0091] In this embodiment of the application, it should be noted that the re-determination of security level information is to periodically detect the second security detection information and the third security detection information, thereby re-determining the security level information.

[0092] As an example, if the security level information is higher than or equal to the first preset level, the preset operation is confirmed as a safe operation, and the process returns to the steps of obtaining the second and third security detection information to re-determine the security level information. For example, the correspondence between the first, second, and third security detection information and the security level information can be obtained, and the security level information can be determined based on this correspondence. If the security level information is higher than or equal to the first preset level, the preset operation is confirmed as a safe operation, and the process continues to obtain the second and third security detection information for security detection to re-determine the security level information. This avoids the problem of the terminal continuing to have security risks due to the non-permanence of dangerous behaviors on the terminal, avoids detection errors caused by simple judgments, improves the accuracy of detection, and thus enhances the security of the operating environment.

[0093] In step S503, if the security level information is lower than the first preset level but higher than the second preset level, a warning message is returned for the preset operation.

[0094] In this embodiment, as an example, the correspondence between the first security detection information, the second security detection information, the third security detection information, and the security level information can be obtained. Based on this correspondence, the security level information can be determined. If the security level information is lower than the first preset level but higher than the second preset level, a warning message is returned for the preset operation. For example, the warning message can be returned for the preset operation through pop-ups, warnings, or other methods; this application does not limit this approach.

[0095] In step S505, if the security level information is lower than or equal to the second preset level, the preset operation is rejected.

[0096] In this embodiment of the application, as an example, the correspondence between the first security detection information, the second security detection information, the third security detection information, and the security level information can be obtained. Based on this correspondence, the security level information can be determined. If the security level information is lower than or equal to the second preset level, the preset operation is rejected. For example, the preset operation can be rejected by prohibiting the operation or exiting the application; this application does not limit this approach.

[0097] To better understand the embodiments of the present invention, one possible implementation may be as follows: Figure 3 As shown, a security check process is performed. Optionally, it can also be performed as follows: Figure 6 As shown, in Figure 6 It can also be applied during execution. Figure 3 The process in progress. Please refer to [link / reference]. Figure 6 :

[0098] After step S305, the second security detection information and the third security detection information can be periodically detected.

[0099] In this embodiment of the application, periodic detection is performed because the detected operations and features that pose a security risk to the target application are not necessarily permanent. They may be operations that do not pose a security risk to the target application at present, but after a period of time, such as 5 seconds or 10 seconds, the dangerous operations to the target application may exist intermittently.

[0100] As an example, after step S305, the second security detection information and the third security detection information can be periodically detected. For example, a time interval (such as 5 seconds, 10 seconds, etc., which is not limited in this application) can be set to periodically detect the second security detection information and the third security detection information.

[0101] It should be noted that, in actual implementation, the acquisition of second and third security detection information is not limited to... Figure 6 The process in the illustrated embodiment can also be followed as follows: Figure 7Execution method:

[0102] After step S305, the third security detection information is periodically checked.

[0103] It should be noted that in this embodiment, the second security detection information is determined based on the security detection configuration information, and the third security detection information is determined based on the obtained operating environment information of the terminal. During the security detection process of launching the target application, the security detection configuration information remains unchanged; therefore, the second security detection information remains unchanged. The security detection process of launching the target application can refer to the process of detecting that a preset operation is performed on the target application in the terminal to execute the security detection method. As an example, the third security detection information can be periodically detected, for example, within a time interval (such as 5 seconds, 10 seconds, etc., this application is not limited), and only the third security detection information can be periodically detected without periodically detecting the second security detection information.

[0104] Figure 8 This is a block diagram illustrating a security device for detecting the Android system operating environment according to an exemplary embodiment. (Refer to...) Figure 8 The device 800 may include:

[0105] The first security detection acquisition module 801 is used to scan a preset file directory to obtain first security detection information when a preset operation is performed on a target application in the terminal.

[0106] The device information acquisition module 803 is used to detect and process device information of the terminal to obtain various types of device information, which represent the terminal's device attribute information, hardware information, and software information.

[0107] The second security detection information acquisition module 805 is used to acquire security detection configuration information and perform security detection processing on various device information based on the security detection configuration information to obtain the second security detection information.

[0108] The first security processing module 807 is used to perform corresponding security processing on preset operations based on the first security detection information and the second security detection information.

[0109] In one possible implementation, the above-mentioned apparatus may further include:

[0110] The runtime environment information acquisition module is used to acquire the runtime environment information of the terminal;

[0111] The third security detection information acquisition module is used to obtain third security detection information based on the terminal's operating environment information;

[0112] The second security processing module is used to perform corresponding security processing on preset operations based on the first security detection information, the second security detection information, and the third security detection information.

[0113] In one possible implementation, the security detection configuration information includes a security detection threshold and a preset detection method; the second security detection information acquisition module 805 mentioned above may include:

[0114] The security detection information acquisition unit is used to perform security detection processing on information from various devices based on security detection thresholds and preset detection methods to obtain security detection information for simulators or virtual machines.

[0115] The second security detection information acquisition unit is used to determine the second security detection information based on the security detection information of the simulator or the security detection information of the virtual machine.

[0116] In one possible implementation, the terminal's runtime environment information includes virtual machine stack information, preset file directory information, and dynamic link library file information; the virtual machine is the virtual machine corresponding to the terminal's development language; the aforementioned runtime environment information acquisition module may include:

[0117] Target application repeated startup information acquisition unit: used to analyze and process the repeated startup status of the target application based on software information, and determine the repeated startup information of the target application;

[0118] Preset framework usage information acquisition unit: used to analyze and process stack information to obtain the usage information of the preset framework, which is a service framework corresponding to the terminal's operating system;

[0119] Terminal root permission first status information acquisition unit: used to scan preset file directories and call dynamic link library files to determine the first status information corresponding to the terminal's root permissions;

[0120] The third security detection information acquisition unit is used to obtain third security detection information based on the repeated startup information of the target application, the usage information of the preset framework, and the first state information of the root permission.

[0121] In one possible implementation, the first security detection acquisition module 801 described above may include:

[0122] The calling unit is used to scan a preset file directory by calling the C language integrated in the dynamic link library to obtain the first security detection information.

[0123] In one possible implementation, the first security detection acquisition module 801 described above may include:

[0124] The first security detection information acquisition unit is used to acquire the second status information corresponding to the root privileges of the terminal; and the installation information of the preset software, which refers to the preset software that has an impact on the security of the terminal and the target application.

[0125] In one possible implementation, the device information acquisition module 803 described above may include:

[0126] The device information acquisition unit is used to acquire the hardware information and software information of the terminal. The hardware information includes sensor information, flash information or Bluetooth information; the software information includes simulator file information and system process controller information.

[0127] In one possible implementation, the second security processing module described above may include:

[0128] The security level information acquisition unit is used to determine the security level information based on the first security detection information, the second security detection information, and the third security detection information.

[0129] The security processing unit is used to perform corresponding security processing on preset operations based on security level information.

[0130] In one possible implementation, the security level information acquisition unit may include:

[0131] The safety operation subunit is used to confirm that the preset operation is a safe operation if the safety level information is higher than or equal to the first preset level, and return to the steps of obtaining the second and third safety detection information to re-determine the safety level information.

[0132] The warning information acquisition subunit is used to return warning information for preset operations if the security level information is lower than the first preset level and higher than the second preset level.

[0133] The rejection subunit is used to reject the preset operation if the security level information is lower than or equal to the second preset level.

[0134] In one possible implementation, the second security detection information acquisition module 805 may include:

[0135] The security detection configuration information acquisition unit is used to upload information about multiple devices to the server and receive security detection configuration information returned by the server in response to the information about multiple devices.

[0136] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0137] Figure 9This is a block diagram illustrating an electronic device for detecting the security of an Android system operating environment according to an exemplary embodiment. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 9 As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for detecting the security of the Android system operating environment. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0138] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the electronic device to which the present disclosure is applied. A specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0139] In an exemplary embodiment, a computer-readable storage medium is also provided, which, when executed by a processor of an electronic device, enables the electronic device to perform a method for detecting the security of an Android system operating environment according to an embodiment of this disclosure. The computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, or optical data storage device, etc.

[0140] In an exemplary embodiment, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute a method for detecting the security of an Android system operating environment according to an embodiment of the present disclosure.

[0141] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0142] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0143] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A security detection method, characterized in that, include: When a preset operation is detected on the terminal to target the application, a preset file directory is scanned to obtain first security detection information. The first security detection information includes at least one of the second status information corresponding to the root permission of the terminal and the installation information of preset software. The preset software refers to preset software that has an impact on the security of the terminal and the target application. The terminal is processed to detect device information, resulting in various types of device information. These various types of device information represent the terminal's device attribute information, hardware information, and software information. Obtain security detection configuration information, and perform security detection processing on the various device information according to the security detection configuration information to obtain second security detection information. The second security detection information includes at least one of the security detection information of the simulator and the security detection information of the virtual machine. Based on the first security detection information and the second security detection information, the preset operation is subjected to corresponding security processing.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the operating environment information of the terminal; Based on the terminal's operating environment information, third security detection information is obtained; The step of performing corresponding security processing on the preset operation based on the first security detection information and the second security detection information includes: Based on the first security detection information, the second security detection information, and the third security detection information, the preset operation is subjected to corresponding security processing.

3. The method according to claim 1 or 2, characterized in that, The security detection configuration information includes security detection thresholds and preset detection methods; the step of performing security detection processing on the various device information according to the security detection configuration information to obtain second security detection information includes: Based on the security detection threshold and the preset detection method, the security detection processing of the various device information is performed to obtain the security detection information of the simulator or the security detection information of the virtual machine. The second security detection information is determined based on the security detection information of the emulator or the security detection information of the virtual machine.

4. The method according to claim 2, characterized in that, The terminal's runtime environment information includes the virtual machine's stack information, the preset file directory information, and the dynamic link library file information; the virtual machine is the virtual machine corresponding to the terminal's development language. Based on the terminal's operating environment information, third security detection information is obtained, including: Based on the software information, the repeated startup status of the target application is analyzed and processed to determine the repeated startup information of the target application; The stack information is analyzed and processed to obtain the usage information of the preset framework, which is a service framework corresponding to the operating system of the terminal. Scan the preset file directory and call the dynamic link library file to determine the first status information corresponding to the root permissions of the terminal; The third security detection information is obtained based on the repeated startup information of the target application, the usage information of the preset framework, and the first root permission status information.

5. The method according to claim 1, characterized in that, The scanning of the preset file directory yields first security detection information, including: The first security detection information is obtained by scanning the preset file directory using the C language integrated in the dynamic link library.

6. The method according to claim 1, characterized in that, The hardware information includes sensor information, flash information, or Bluetooth information; the software information includes simulator file information and system process controller information.

7. The method according to claim 2, characterized in that, The step of performing corresponding security processing on the preset operation based on the first security detection information, the second security detection information, and the third security detection information includes: Based on the first security detection information, the second security detection information, and the third security detection information, the security level information is determined; Based on the security level information, the preset operation is subjected to corresponding security processing.

8. The method according to claim 7, characterized in that, The step of performing corresponding security processing on the preset operation based on the security level information includes: If the security level information is higher than or equal to the first preset level, the preset operation is confirmed as a safe operation, and the process returns to the steps of obtaining the second security detection information and the third security detection information to re-determine the security level information. If the security level information is lower than the first preset level but higher than the second preset level, a warning message is returned for the preset operation. If the security level information is lower than or equal to the second preset level, the preset operation is rejected.

9. The method according to claim 1 or 2, characterized in that, The acquisition of security detection configuration information includes: The information of the various devices is uploaded to the server, and the security detection configuration information returned by the server in response to the information of the various devices is received.

10. A safety detection device, characterized in that, include: The first security detection acquisition module is used to scan a preset file directory to obtain first security detection information when a preset operation is performed on a target application in the terminal. The first security detection information includes at least one of the second status information corresponding to the root permission of the terminal and the installation information of preset software. The preset software refers to preset software that has an impact on the security of the terminal and the target application. The device information acquisition module is used to detect and process device information of the terminal to obtain various device information, which represents the device attribute information, hardware information and software information of the terminal. The second security detection information acquisition module is used to acquire security detection configuration information and perform security detection processing on the various device information according to the security detection configuration information to obtain second security detection information. The second security detection information includes at least one of the security detection information of the simulator and the security detection information of the virtual machine. The security processing module performs corresponding security processing on the preset operation based on the first security detection information and the second security detection information.

11. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to execute the executable instructions to implement the method according to any one of claims 1 to 9.

12. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 9.

Images