Mobile application security detection method, device and electronic equipment

Abstract

The present application relates to the field of data detection technology, and specifically to a mobile application security detection method, device, and electronic device. The method comprises: obtaining a mobile application to be detected, wherein the mobile application comprises at least one installation package, and the installation package comprises at least one code file; detecting the at least one installation package, and if the same risk detection item is detected twice in a row, determining the code files corresponding to the same risk detection item in the two consecutive detections; wherein the risk detection item is a detection item that fails when the installation package is detected within a pre-set detection range; determining the difference information between the code files corresponding to the two consecutive detections, and outputting the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

Description

Technical Field

[0001] The present application relates to the field of data detection technology, and in particular to a mobile application security detection method, device and electronic device. Background Art

[0002] During mobile app development and testing, when static resource scanning is performed on the installation package, failed detection information often includes files with risks. Whether these risk defects have been corrected is typically determined by whether the problematic files reappear during a second scan. However, judging solely by the reappearance of problematic files is a completely black-box process, failing to reflect the rectification process and providing no guarantee that the risk content has been truly fixed.

[0003] Given the vast number of code projects and complex logic, manually reviewing every problematic file to determine if it should be rectified is extremely time-consuming and labor-intensive, and relies heavily on the technical expertise of the interpreter, making it prone to errors. This approach is particularly difficult to implement in the context of enterprise-level mobile application testing management. Summary of the Invention

[0004] The embodiments of the present application provide a mobile application security detection method, device, and electronic device, which can perceive the rectification process of the installation package by comparing the differences between two consecutive detected code files, thereby improving the reliability of static scanning detection.

[0005] In a first aspect, an embodiment of the present application provides a mobile application security detection method, the method comprising:

[0006] Acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file;

[0007] Testing the at least one installation package, and if the same risk detection item is detected twice consecutively, determining the code files corresponding to the same risk detection item in the two consecutive tests; wherein the risk detection item is a detection item that fails when the installation package is tested within a predetermined detection range;

[0008] Determine difference information between code files corresponding to two consecutive detections, output the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

[0009] In a possible embodiment, determining the code files corresponding to the same risk detection items in two consecutive detections includes:

[0010] Determining summary information of the installation packages corresponding to the same risk detection item in two consecutive detections, wherein the summary information is calculated on the installation packages using an information digest algorithm;

[0011] Determining the submission numbers corresponding to the summary information in two consecutive tests based on a pre-stored correspondence between summary information and submission numbers; wherein the submission numbers are determined based on snapshot information of the installation package when packaging and compilation are completed;

[0012] In the installation packages corresponding to the submission numbers in two consecutive detections, the code files corresponding to the same risk detection items are determined.

[0013] In a possible embodiment, the correspondence between the summary information and the submission number is determined in the following manner:

[0014] Determining summary information and a submission number corresponding to each installation package according to a packaging and compilation process of each installation package included in the mobile application;

[0015] According to the summary information and the submission number corresponding to each installation package, a corresponding relationship between the summary information and the submission number is determined.

[0016] In a possible embodiment, performing at least two detections on the at least one installation package further includes:

[0017] If the at least one installation package is detected for the first time and a risk detection item is detected, determining first summary information of the first installation package corresponding to the risk detection item, and determining a first submission number corresponding to the first summary information based on a pre-stored correspondence between summary information and submission numbers;

[0018] If the at least one installation package is subjected to a second inspection and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers;

[0019] Determine whether to process the risk detection item detected for the second time according to the first submission number and the second submission number.

[0020] In a possible embodiment, determining whether to process the second detected risk detection item according to the first submission number and the second submission number includes:

[0021] If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, determining difference information between the code files corresponding to the same risk detection items, and outputting the code files corresponding to the same risk detection items and the difference information; or

[0022] If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the risk detection item detected for the second time is not processed.

[0023] In a possible embodiment, the mobile application includes a first installation package and a second installation package; the code files corresponding to the same risk detection item include a first code file and a second code file;

[0024] When the same risk detection item is detected twice in a row, determining the code files corresponding to the same risk detection item in the two consecutive detections includes:

[0025] If the first installation package is first detected and a risk detection item is detected, determining a first code file corresponding to the risk detection item in the first installation package and performing a second detection;

[0026] If the second installation package is detected for the second time and the risk detection item is detected, a second code file corresponding to the risk detection item in the second installation package is determined.

[0027] In a possible embodiment, performing at least two detections on the at least one installation package further includes:

[0028] If a first detection is performed on the at least one installation package and a risk detection item is detected, determining a code file corresponding to the risk detection item and performing a second detection;

[0029] If the at least one installation package is tested a second time and the risk detection item is not detected, the code file corresponding to the risk detection item is marked as having passed the retest.

[0030] In a possible embodiment, after marking the code file corresponding to the risk detection item as passed the retest, the method further includes:

[0031] After the marked code file is manually inspected and determined to have passed, the code file is marked as rectified.

[0032] In a possible embodiment, detecting the at least one installation package further includes:

[0033] If the at least one installation package is detected for the first time and no risk detection item is detected, re-detecting the at least one installation package;

[0034] If the at least one installation package is tested a second time and a risk detection item is detected, a code file corresponding to the risk detection item is determined, and the at least one installation package is tested again.

[0035] In a possible embodiment, detecting the at least one installation package further includes:

[0036] If different risk detection items are detected twice in succession, the code files corresponding to the different risk detection items in the two successive detections are determined and re-detected.

[0037] In a second aspect, the present application provides a mobile application security detection device, the device comprising:

[0038] an acquiring unit, configured to acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file;

[0039] a detection and determination unit configured to detect the at least one installation package and, if the same risk detection item is detected twice consecutively, determine the code files corresponding to the same risk detection item in the two consecutive detections; wherein the risk detection item is a detection item that fails when the installation package is tested within a predetermined detection range;

[0040] The difference determination unit is used to determine the difference information between the code files corresponding to two consecutive detections, and output the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

[0041] In a possible embodiment, the detection and determination unit is specifically configured to:

[0042] Determining summary information of the installation packages corresponding to the same risk detection item in two consecutive detections, wherein the summary information is calculated on the installation packages using an information digest algorithm;

[0043] Determining the submission numbers corresponding to the summary information in two consecutive tests based on a pre-stored correspondence between summary information and submission numbers; wherein the submission numbers are determined based on snapshot information of the installation package when packaging and compilation are completed;

[0044] In the installation packages corresponding to the submission numbers in two consecutive detections, the code files corresponding to the same risk detection items are determined.

[0045] In a possible embodiment, the detection and determination unit is specifically configured to determine the correspondence between the summary information and the submission number in the following manner:

[0046] Determining summary information and a submission number corresponding to each installation package according to a packaging and compilation process of each installation package included in the mobile application;

[0047] According to the summary information and the submission number corresponding to each installation package, a corresponding relationship between the summary information and the submission number is determined.

[0048] In a possible embodiment, the at least one installation package is tested at least twice, and the judgment unit is further configured to:

[0049] If the at least one installation package is detected for the first time and a risk detection item is detected, determining first summary information of the first installation package corresponding to the risk detection item, and determining a first submission number corresponding to the first summary information based on a pre-stored correspondence between summary information and submission numbers;

[0050] If the at least one installation package is subjected to a second inspection and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers;

[0051] Determine whether to process the risk detection item detected for the second time according to the first submission number and the second submission number.

[0052] In a possible embodiment, the judging unit is specifically configured to:

[0053] If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, determining difference information between the code files corresponding to the same risk detection items, and outputting the code files corresponding to the same risk detection items and the difference information; or

[0054] If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the risk detection item detected for the second time is not processed.

[0055] In a possible embodiment, the mobile application includes a first installation package and a second installation package; the code files corresponding to the same risk detection item include a first code file and a second code file;

[0056] The detection and determination unit is specifically configured to:

[0057] If the first installation package is first detected and a risk detection item is detected, determining a first code file corresponding to the risk detection item in the first installation package and performing a second detection;

[0058] If the second installation package is detected for the second time and the risk detection item is detected, a second code file corresponding to the risk detection item in the second installation package is determined.

[0059] In a possible embodiment, the at least one installation package is tested at least twice, and the marking unit is further configured to:

[0060] If a first detection is performed on the at least one installation package and a risk detection item is detected, determining a code file corresponding to the risk detection item and performing a second detection;

[0061] If the at least one installation package is tested a second time and the risk detection item is not detected, the code file corresponding to the risk detection item is marked as having passed the retest.

[0062] In a possible embodiment, after marking the code file corresponding to the risk detection item as having passed the retest, the marking unit is further configured to:

[0063] After the marked code file is manually inspected and determined to have passed, the code file is marked as rectified.

[0064] In a possible embodiment, the detection and determination unit is further configured to:

[0065] If the at least one installation package is detected for the first time and no risk detection item is detected, re-detecting the at least one installation package;

[0066] If the at least one installation package is tested a second time and a risk detection item is detected, a code file corresponding to the risk detection item is determined, and the at least one installation package is tested again.

[0067] In a possible embodiment, the detection and determination unit is further configured to:

[0068] If different risk detection items are detected twice in succession, the code files corresponding to the different risk detection items in the two successive detections are determined and re-detected.

[0069] In a third aspect, the present application provides an electronic device, comprising:

[0070] a memory for storing program instructions;

[0071] The processor is configured to call the program instructions stored in the memory and execute the steps included in any one of the methods of the first aspect according to the obtained program instructions.

[0072] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods according to the first aspect.

[0073] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect.

[0074] The mobile application security detection method provided in the embodiments of the present application has at least the following beneficial effects:

[0075] In an embodiment of the present application, the installation package is tested multiple times, the code files corresponding to two consecutive risk detection items are recorded, and the difference information between the code files corresponding to the two risk detection items is determined, and the difference information and the code files are output to the user. The user can determine the rectification process based on the difference information between the code files, and rely on the difference information at the code level to make a rectification judgment, which provides an automated method for code judgment and greatly saves the labor cost of technical personnel.

[0076] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0078] Figure 1 A flowchart of a mobile application security detection method implementation provided in an embodiment of the present application;

[0079] Figure 2 A flowchart of a specific implementation of a mobile application security detection method provided in an embodiment of the present application;

[0080] Figure 3 A schematic diagram of a scanning detection process provided in an embodiment of the present application;

[0081] Figure 4 A flowchart of a mobile application security detection method provided in an embodiment of the present application;

[0082] Figure 5 A schematic diagram of a mobile application security detection device provided in an embodiment of the present application;

[0083] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0084] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. Unless there is a conflict, the embodiments in the present application and the features in the embodiments can be combined with each other in any way. In addition, although a logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in an order different from that here.

[0085] The terms "first" and "second" in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of its variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in this application can mean at least two, for example, two, three or more, and the embodiments of this application are not limited thereto.

[0086] The term "security scanning" as used in this application refers to automated scanning of static resources within mobile applications to identify potential security issues. This includes code, third-party controls, and residual information.

[0087] The term "version management" involved in this application is the process of recording, tracking, maintaining and controlling changes to a product or system series resulting from partial improvements and modifications to the same product or system to meet different needs.

[0088] The term "MD5 Message-Digest Algorithm" involved in this application can generate a 128-bit (16-byte) hash value to ensure the integrity and consistency of information transmission. MD5 calculations are performed on different files. When the MD5 values are consistent, the files are determined to be identical.

[0089] Before introducing the mobile application security detection method provided by the embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0090] With the rapid development of the mobile internet, the computing power of mobile terminals has steadily increased, their functionality has become increasingly complex, and mobile applications have become increasingly pervasive in every aspect of life. Due to the integration of open source systems, mobile networks, and various third-party tools and SDKs (Software Development Kits) involved in mobile terminals, mobile applications may harbor various security risks, bugs, vulnerabilities, and even artificial backdoors. If enterprises do not rigorously monitor the security of these programs and services, they can be easily cracked using third-party cracking tools, revealing the core code and logic of the programs. These security vulnerabilities and risks are often exploited to steal user personal information, illegally subscribe to various value-added services, infringe on personal privacy, and cause direct financial losses to users. Therefore, conducting effective security testing and analysis of mobile applications, monitoring security vulnerabilities and risks from the development and testing stages, and promptly remediating and rectifying them, is crucial to the healthy development of the mobile internet industry and the vital interests of mobile terminal users.

[0091] During the development and testing phases of mobile applications, security scanning of installation packages has become a crucial testing method. This automated scanning process analyzes the static resources of mobile applications for potential vulnerabilities, categorizing and summarizing the relevant files and generating a report based on the scan results. Based on the report, mobile application developers and testers can modify the problematic files to address potential vulnerabilities, ensuring application quality and protecting user information.

[0092] During mobile app development and testing, when static resource scanning is performed on the installation package, failed test results often include files with risky issues. Whether these risky defects have been remediated is typically determined by whether the problematic files reappear during a second scan. However, simply determining whether the problematic files reappear is a completely black-box process, obscuring the rectification process and providing no guarantee that the risky content has been truly fixed. It's even possible to simply delete the problematic files or the problematic code within them, or submit a previously issue-free test version, in order to mark the problematic files as rectified. Given the vast number of code projects and complex logic, manually reviewing each problematic file to determine whether it has been rectified is extremely time-consuming and labor-intensive, and relies heavily on the technical expertise of the interpreter, making it prone to errors. This approach is particularly challenging in the context of enterprise-level mobile application testing management.

[0093] Based on the fact that mobile application testers currently judge whether the problems in the initial scan have been rectified based only on the results of the second static security scan, they cannot perceive the rectification process and cannot truly determine whether the problem files have been rectified and repaired. In view of this, the present application provides a mobile application security detection method, which performs multiple detections on the installation package in an automated manner, and clearly reflects the modification process by comparing the difference information of the code files corresponding to the risk detection items detected twice in a row, and can exclude the behavior of evading rectification by deletion, so that testers can determine the code modification process through the difference information of the code files and determine whether to repair and rectify. Through the automated method, a process basis is provided for the rectification process of static security scanning, which greatly improves the reliability of static scanning detection and saves the labor cost of technical personnel.

[0094] The following describes a mobile application security detection method according to an embodiment of the present application in conjunction with the accompanying drawings and specific implementation methods.

[0095] like Figure 1 As shown, the embodiment of the present application provides a mobile application security detection method, which specifically includes the following steps:

[0096] Step 100: Acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file;

[0097] During implementation, the mobile application to be tested in this embodiment includes one or more installation packages, where different installation packages are obtained by multiple packaging and compilation during the development and testing phase of the mobile application. An installation package is obtained after each packaging and compilation. During the security testing of the mobile application, each installation package contained in the mobile application will be traversed and scanned to perceive the rectification process of the mobile application.

[0098] The installation package in this embodiment can be in apk format or other formats, which is not limited in this embodiment. The installation package in this embodiment includes one or more code files, and the code files include relevant information such as source code.

[0099] Step 101: Testing the at least one installation package. If the same risk detection item is detected twice consecutively, determining the code files corresponding to the same risk detection item in the two consecutive tests; wherein the risk detection item is a detection item that fails when the installation package is tested within a pre-set detection range;

[0100] During implementation, a traversal scan is performed on each installation package of the mobile application to be tested. Based on the results of two consecutive detections of the same risk detection item, the code file corresponding to the risk detection item is determined. During the detection, a detection range is pre-set, including one or more detection items, such as whether sensitive words are included and whether the permission settings are reasonable. Within the detection range, each installation package of the mobile application is traversed and tested, and any detection items that fail are treated as detected risk detection items. For example, the inclusion of sensitive words is treated as a detected risk detection item, and the code file containing the sensitive words is determined.

[0101] It should be noted that the mobile application in this embodiment includes one or more installation packages, each of which includes one or more code files. Each installation package corresponds to a unique summary information and submission number, wherein the summary information is calculated using an information digest algorithm for the installation package. During each detection process, the summary information of the currently detected installation package, such as MD5, can be calculated. The submission number is determined based on the snapshot information of the installation package when the packaging and compilation are completed. The submission number can be regarded as a code version, and different submission numbers correspond to installation packages with different code versions.

[0102] Optionally, the packaging and compilation process of mobile applications can be managed in a unified manner. Each time the packaging and compilation process of the installation package is generated, the code management version system (such as git) is used to record the project name, branch name, commit number (Commit ID) and MD5 of the generated installation package. In this way, each installation package can be identified by the correspondence between MD5 and commit number. Since the MD5 of the currently tested installation package can be calculated when the installation package is tested, the corresponding installation package can be obtained by using the correspondence between MD5 and commit number. In addition, the branch name, project name, etc. corresponding to the MD5 can be used to facilitate developers to locate problems and save development time.

[0103] During implementation, during the process of detecting the installation package, the summary information of the currently detected installation package can be calculated, and the currently detected installation package can be determined based on the submission number corresponding to the summary information. Then, the code file corresponding to the risk detection item can be determined from the installation package, thereby providing users with a basis for whether rectification is needed.

[0104] In some embodiments, this embodiment locates the code file corresponding to the risk detection item through the following steps:

[0105] Step 1a: Determine summary information of the installation packages corresponding to the same risk detection item in two consecutive detections, wherein the summary information is calculated by using an information digest algorithm on the installation packages;

[0106] During implementation, when scanning and detecting mobile applications, the same one or more risk detection items are detected twice in a row, and the information summary algorithm is first used to determine the summary information of the installation packages detected twice to obtain two summary information, wherein the two summary information can be the same or different, and this embodiment does not impose too many restrictions on this.

[0107] Step 1b: Determine the submission numbers corresponding to the summary information in two consecutive tests based on the pre-stored correspondence between the summary information and the submission numbers; wherein the submission numbers are determined based on the snapshot information of the installation package when the package compilation is completed;

[0108] Optionally, the summary information in this embodiment is an MD5 value.

[0109] It should be noted that the pre-stored correspondence between summary information and commit numbers is specific to a specific mobile application. This pre-stored correspondence between summary information and commit numbers for a specific mobile application can also include additional elements, such as the project name, branch name, commit number, and summary information for a specific mobile application. The project name identifies the code project, and the branch name facilitates code version management and tracking. The correspondence varies for different mobile applications.

[0110] In some embodiments, the correspondence between the summary information and the submission number is determined as follows:

[0111] According to the packaging and compilation process of each installation package included in the mobile application, the summary information and submission number corresponding to each installation package are determined; according to the summary information and submission number corresponding to each installation package, the corresponding relationship between the summary information and the submission number is determined.

[0112] In practice, each installation package corresponds to unique summary information and submission number. Therefore, a correspondence between the summary information and the submission number can be established to locate the installation package to be detected.

[0113] Step 1c: Determine the code file corresponding to the same risk detection item in the installation packages corresponding to the submission numbers in two consecutive detections.

[0114] Since the submission number is determined based on the snapshot information of the installation package when the packaging and compilation are completed, the code files in the installation package can be determined based on the submission number, and the code files involved in the risk detection items in the installation package can be further located, that is, the code files corresponding to the risk detection items.

[0115] In some embodiments, the mobile application includes a first installation package and a second installation package; the code files corresponding to the same risk detection item include a first code file and a second code file;

[0116] In implementation, when the same risk detection item is detected twice consecutively, determining the code files corresponding to the same risk detection item in the two consecutive detections specifically includes:

[0117] If the first installation package is first detected and a risk detection item is detected, determining a first code file corresponding to the risk detection item in the first installation package and performing a second detection;

[0118] If the second installation package is detected for the second time and the risk detection item is detected, that is, the same risk detection item as the first detection is detected, a second code file corresponding to the risk detection item in the second installation package is determined.

[0119] Optionally, the first code file corresponding to the risk detection item in the first installation package is determined in the following manner:

[0120] Determine the summary information of the first installation package detected for the first time; determine the corresponding submission number based on the correspondence between the summary information and the submission number, determine the code file in the first installation package based on the corresponding submission number, and filter out the first code file corresponding to the risk detection item.

[0121] Optionally, the second code file corresponding to the risk detection item in the second installation package is determined in the following manner:

[0122] Determine the summary information of the second installation package for the second detection; determine the corresponding submission number based on the correspondence between the summary information and the submission number, determine the code file in the second installation package based on the corresponding submission number, and filter out the second code file corresponding to the risk detection item.

[0123] It should be noted that the "first" and "second" in this implementation are only used to distinguish different installation packages or code files.

[0124] Step 102: Determine the difference information between the code files corresponding to the two consecutive tests, and output the difference information and the code files corresponding to the two consecutive tests, so that the user can use the difference information and the code files to rectify the installation package.

[0125] In some embodiments, the difference information includes but is not limited to deletion, addition, reduction, modification, etc. of the code.

[0126] In some embodiments, the at least one installation package is detected at least twice, and whether to process the risk detection items detected twice can be determined by the following steps:

[0127] If the at least one installation package is detected for the first time and a risk detection item is detected, determining first summary information of the first installation package corresponding to the risk detection item, and determining a first submission number corresponding to the first summary information based on a pre-stored correspondence between summary information and submission numbers;

[0128] If the at least one installation package is subjected to a second inspection and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers;

[0129] Determine whether to process the risk detection item detected for the second time according to the first submission number and the second submission number.

[0130] In some embodiments, whether to process the risk detection item detected for the second time is determined by:

[0131] If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, determining difference information between the code files corresponding to the same risk detection items, and outputting the code files corresponding to the same risk detection items and the difference information; or

[0132] If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the risk detection item detected for the second time is not processed.

[0133] During implementation, after the mobile application is tested twice, a sequence is first determined based on the submission number. If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the installation package at that time is not a rectified installation package and no further processing of the test results is required. If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, the installation package at that time is a rectified installation package. The risk detection item detected the second time is then processed, specifically determining and outputting the difference information and code files obtained from the two tests.

[0134] In some embodiments, the at least one installation package is tested at least twice, and specifically includes the following process:

[0135] 1) If a first detection is performed on the at least one installation package and a risk detection item is detected, a code file corresponding to the risk detection item is determined and a second detection is performed;

[0136] 2) If the at least one installation package is tested a second time and the risk detection item is not detected, the code file corresponding to the risk detection item is marked as having passed the retest.

[0137] In some embodiments, after marking the code file corresponding to the risk detection item as having passed retest, it may be determined that the marked code file has been manually inspected and passed, and then the code file is marked as having been rectified.

[0138] In some embodiments, the detecting of the at least one installation package further includes the following detection conditions:

[0139] If the at least one installation package is detected for the first time and no risk detection item is detected, re-detecting the at least one installation package;

[0140] If the at least one installation package is tested a second time and a risk detection item is detected, a code file corresponding to the risk detection item is determined, and the at least one installation package is tested again.

[0141] In some embodiments, the detecting of the at least one installation package further includes the following detection conditions:

[0142] If different risk detection items are detected twice in succession, the code files corresponding to the different risk detection items in the two successive detections are determined and re-detected.

[0143] During implementation, if no risk detection item is detected in two consecutive tests, no action is required. If, in two consecutive tests, the first test does not detect a risk detection item, but the second test detects a risk detection item, the code file corresponding to the risk detection item detected in the second test is stored, and the next test is performed. If the same risk detection item is detected in the next test, the code file corresponding to the same risk detection item in the next test is determined and stored, and the difference information of the code files obtained from the second test and the next test is compared, and the difference information and code file are output; if the same risk detection item is not detected in the next test, the code file corresponding to the risk detection item is marked as having passed the retest.

[0144] If multiple identical risk detection items are detected twice in succession, the code files corresponding to the risk detection items in each detection are stored, and the difference information between the code files detected are compared, and the difference information and the code files are output.

[0145] like Figure 2 As shown, the embodiment of the present application provides a specific implementation process of a mobile application security detection method, as shown below:

[0146] Step 200: Acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file;

[0147] Step 201: Pre-store a corresponding relationship related to the mobile application, wherein the corresponding relationship includes a corresponding relationship between summary information of each installation package in the mobile application and a submission number;

[0148] Step 202: If the at least one installation package is first detected and a risk detection item is detected, first summary information of the first installation package corresponding to the risk detection item is determined, and a first submission number corresponding to the first summary information is determined based on a pre-stored correspondence between summary information and submission numbers;

[0149] Step 203: If the second detection is performed on the at least one installation package and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers;

[0150] Step 204: Determine whether the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number. If yes, proceed to step 205; otherwise, proceed to step 208.

[0151] Step 205: Filter out a first code file corresponding to the risk detection item in the first installation package corresponding to the first submission number, and filter out a second code file corresponding to the risk detection item in the second installation package corresponding to the second submission number;

[0152] Optionally, the first code file and the second code file are stored.

[0153] Step 206: Determine the difference between the first code file and the second code file;

[0154] Step 207: Output the first code file, the second code file, and difference information;

[0155] Step 208: Do not process the risk detection item detected for the second time.

[0156] like Figure 3 As shown, this embodiment provides a flow chart of scanning detection, wherein after three detections, the risk detection item A is detected for the first time, and the summary information of the corresponding detected installation package is the first MD5, the submission number is 1, and the installation package includes file a, file b, etc.; the risk detection item A is detected for the second time, and the summary information of the corresponding detected installation package is the second MD5, the submission number is 2, and the installation package includes file a', file b', file c, etc.; the risk detection item A is not detected during the third detection, and the summary information of the corresponding detected installation package is the third MD5, the submission number is 3, and the installation package includes file a", file b", file c', etc.

[0157] like Figure 4 As shown, this embodiment takes a total of three detections as an example, where the digest information is represented by MD5. The implementation process of a mobile application security detection method provided by this application is as follows:

[0158] Step 400: Obtain the mobile application to be detected and the corresponding relationship related to the mobile application, wherein the corresponding relationship includes the corresponding relationship between the MD5 of the installation package of the mobile application and the submission number;

[0159] Step 401: Perform a first detection on a first installation package of a mobile application, and detect risk detection item A;

[0160] Step 402: Determine a first code file corresponding to a risk detection item in the first installation package based on a first submission number corresponding to a first MD5 of the first installation package;

[0161] The first code file may be stored.

[0162] Step 403: Perform a second detection on the second installation package of the mobile application, and detect risk detection item A;

[0163] Step 404: A second submission number corresponding to the second MD5 of the second installation package;

[0164] Step 405: Determine whether the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number. If yes, proceed to step 406; otherwise, proceed to step 408.

[0165] Step 406: Determine the second code file corresponding to the risk detection item in the second installation package, and calculate the difference information between the first code file and the second code file;

[0166] The second code file may be stored.

[0167] Step 407: Output the first code file, the second code file, and the difference information.

[0168] Step 408: No processing.

[0169] It should be noted that the installation packages detected at different times may be the same or different, and this embodiment does not impose any restrictions on this.

[0170] In this embodiment, the processing of two consecutive test results is divided into the following situations:

[0171] In the first case, if neither the first nor the second test detects any risk items, no action is required.

[0172] In the second case, if the risk detection item is not detected in the first test but is detected in the second test, the code file corresponding to the risk detection item in the current submission number will be recorded;

[0173] In the third case, if one or more risk detection items are detected during the first test and one or more risk detection items are also detected during the second test, the specific cases are as follows:

[0174] Scenario 1) If the risk item that appeared in the first test is not detected in the second test, the code file corresponding to the risk item in the second test is marked as retest passed. The user verifies the retested code file and marks it as rectified if it is confirmed to have passed.

[0175] Scenario 2) If the same one or more risk detection items are detected in both the first and second detections, the first code file corresponding to the risk detection item in the first detection and the second code file corresponding to the risk detection item in the second detection are recorded, the difference information between the first code file and the second code file is determined, and the difference information, the first code file and the second code file are output. The user can rectify and repair the installation package based on the difference information, the first code file and the second code file.

[0176] Scenario 3) In the second test, if a risk detection item that did not appear in the first test is detected, the code file of the risk detection item in the second test is recorded and waits for the next test.

[0177] This embodiment relies on modification evidence at the code level to perform scanning and rectification judgment, avoiding the mechanical shortcomings of the scanning engine, providing a tool-based and automated approach for code judgment, and greatly saving the labor cost of technical personnel.

[0178] Based on the same inventive concept, an embodiment of the present application provides a mobile application security detection device, as shown in FIG5 , which includes:

[0179] An acquiring unit 500 is configured to acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file;

[0180] A detection and determination unit 501 is configured to detect the at least one installation package and, if the same risk detection item is detected twice consecutively, determine the code files corresponding to the same risk detection item in the two consecutive detections; wherein the risk detection item is a detection item that fails when the installation package is tested within a predetermined detection range;

[0181] The difference determination unit 502 is used to determine the difference information between the code files corresponding to two consecutive detections, and output the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

[0182] In a possible embodiment, the detection and determination unit 501 is specifically configured to:

[0183] Determining summary information of the installation packages corresponding to the same risk detection item in two consecutive detections, wherein the summary information is calculated on the installation packages using an information digest algorithm;

[0184] Determining the submission numbers corresponding to the summary information in two consecutive tests based on a pre-stored correspondence between summary information and submission numbers; wherein the submission numbers are determined based on snapshot information of the installation package when packaging and compilation are completed;

[0185] In the installation packages corresponding to the submission numbers in two consecutive detections, the code files corresponding to the same risk detection items are determined.

[0186] In a possible embodiment, the detection and determination unit 501 is specifically configured to determine the correspondence between the summary information and the submission number in the following manner:

[0187] Determining summary information and a submission number corresponding to each installation package according to a packaging and compilation process of each installation package included in the mobile application;

[0188] According to the summary information and the submission number corresponding to each installation package, a corresponding relationship between the summary information and the submission number is determined.

[0189] In a possible embodiment, the at least one installation package is tested at least twice, and the judgment unit is further configured to:

[0190] If the at least one installation package is detected for the first time and a risk detection item is detected, determining first summary information of the first installation package corresponding to the risk detection item, and determining a first submission number corresponding to the first summary information based on a pre-stored correspondence between summary information and submission numbers;

[0191] If the at least one installation package is subjected to a second inspection and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers;

[0192] Determine whether to process the risk detection item detected for the second time according to the first submission number and the second submission number.

[0193] In a possible embodiment, the judging unit is specifically configured to:

[0194] If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, determining difference information between the code files corresponding to the same risk detection items, and outputting the code files corresponding to the same risk detection items and the difference information; or

[0195] If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the risk detection item detected for the second time is not processed.

[0196] In a possible embodiment, the mobile application includes a first installation package and a second installation package; the code files corresponding to the same risk detection item include a first code file and a second code file;

[0197] The detection and determination unit 501 is specifically configured to:

[0198] If the first installation package is first detected and a risk detection item is detected, determining a first code file corresponding to the risk detection item in the first installation package and performing a second detection;

[0199] If the second installation package is detected for the second time and the risk detection item is detected, a second code file corresponding to the risk detection item in the second installation package is determined.

[0200] In a possible embodiment, the at least one installation package is tested at least twice, and the marking unit is further configured to:

[0201] If a first detection is performed on the at least one installation package and a risk detection item is detected, determining a code file corresponding to the risk detection item and performing a second detection;

[0202] If the at least one installation package is tested a second time and the risk detection item is not detected, the code file corresponding to the risk detection item is marked as having passed the retest.

[0203] In a possible embodiment, after marking the code file corresponding to the risk detection item as having passed the retest, the marking unit is further configured to:

[0204] After the marked code file is manually inspected and determined to have passed, the code file is marked as rectified.

[0205] In a possible embodiment, the detection and determination unit 501 is further configured to:

[0206] If the at least one installation package is detected for the first time and no risk detection item is detected, re-detecting the at least one installation package;

[0207] If the at least one installation package is tested a second time and a risk detection item is detected, a code file corresponding to the risk detection item is determined, and the at least one installation package is tested again.

[0208] In a possible embodiment, the detection and determination unit 501 is further configured to:

[0209] If different risk detection items are detected twice in succession, the code files corresponding to the different risk detection items in the two successive detections are determined and re-detected.

[0210] Based on the same inventive concept, the present application embodiment provides an electronic device that can implement the mobile application security detection function discussed above. Please refer to Figure 6 The device includes a processor 601 and a memory 602, the memory 602 is used to store program instructions; the processor 601 is used to call the program instructions stored in the memory 602, and execute the steps included in any mobile application security detection method in the above embodiment according to the obtained program instructions.

[0211] The embodiment of the present application does not limit the specific connection medium between the memory 602 and the processor 601. For example, the memory 602 and the processor 601 are connected via a bus, which can be divided into an address bus, a data bus, a control bus, and the like.

[0212] The memory 602 may include a read-only memory (ROM) and a random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage. Alternatively, the memory may be at least one storage device located remotely from the processor.

[0213] The processor 601 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processing (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0214] Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium, a computer program product comprising: computer program code. When the computer program code is executed on a computer, it causes the computer to execute any of the mobile application security detection methods discussed above. Because the principles underlying the problems solved by the computer-readable storage medium are similar to those of the mobile application security detection method, the implementation of the computer-readable storage medium can be referred to as the implementation of the method, and any repetitions will not be repeated here.

[0215] In a specific implementation process, computer storage media may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk or optical disk, and other storage media that can store program code.

[0216] Based on the same inventive concept, embodiments of the present application further provide a computer program product comprising computer program code that, when executed on a computer, causes the computer to execute any of the mobile application security detection methods discussed above. Because the principles underlying the problems solved by the aforementioned computer program products are similar to those of the mobile application security detection methods, the implementation of the aforementioned computer program products can be referenced to the implementation of the methods, and any repetitions will not be repeated.

[0217] The computer program product can employ any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0218] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0219] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0220] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0221] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of user-operated steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0222] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A mobile application security detection method, characterized in that: include: Acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file; Testing the at least one installation package, and if the same risk detection item is detected twice in a row, determining the code files corresponding to the same risk detection item in the two consecutive detections; The risk detection items are detection items that fail when the installation package is tested within a pre-set detection range; The determining of the code files corresponding to the same risk detection items in two consecutive detections includes: determining summary information of the installation packages corresponding to the same risk detection items in the two consecutive detections, wherein the summary information is obtained by calculating the installation packages using an information summary algorithm; determining the submission numbers corresponding to the summary information in the two consecutive detections according to a pre-stored correspondence between the summary information and the submission number; wherein the submission number is determined based on snapshot information of the installation package when packaging and compilation are completed; and determining the code files corresponding to the same risk detection items in the installation packages corresponding to the submission numbers in the two consecutive detections; Determine difference information between code files corresponding to two consecutive detections, output the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

2. The method according to claim 1, characterized in that The correspondence between the summary information and the submission number is determined as follows: Determining summary information and a submission number corresponding to each installation package according to a packaging and compilation process of each installation package included in the mobile application; According to the summary information and the submission number corresponding to each installation package, a corresponding relationship between the summary information and the submission number is determined.

3. The method according to claim 1, characterized in that Testing the at least one installation package at least twice further includes: If the at least one installation package is detected for the first time and a risk detection item is detected, determining first summary information of the first installation package corresponding to the risk detection item, and determining a first submission number corresponding to the first summary information based on a pre-stored correspondence between summary information and submission numbers; If the at least one installation package is subjected to a second inspection and the risk detection item is detected, determining second summary information of a second installation package corresponding to the risk detection item, and determining a second submission number corresponding to the second summary information based on a pre-stored correspondence between summary information and submission numbers; Determine whether to process the risk detection item detected for the second time according to the first submission number and the second submission number.

4. The method according to claim 3, characterized in that The determining, based on the first submission number and the second submission number, whether to process the risk detection item detected for the second time includes: If the submission time corresponding to the second submission number is later than the submission time corresponding to the first submission number, determining difference information between the code files corresponding to the same risk detection items, and outputting the code files corresponding to the same risk detection items and the difference information; or If the submission time corresponding to the second submission number is equal to or earlier than the submission time corresponding to the first submission number, the risk detection item detected for the second time is not processed.

5. The method according to claim 1, wherein The mobile application includes a first installation package and a second installation package; the code files corresponding to the same risk detection item include a first code file and a second code file; When the same risk detection item is detected twice consecutively, determining the code files corresponding to the same risk detection item in the two consecutive detections includes: If the first installation package is first detected and a risk detection item is detected, determining a first code file corresponding to the risk detection item in the first installation package and performing a second detection; If the second installation package is detected for the second time and the risk detection item is detected, a second code file corresponding to the risk detection item in the second installation package is determined.

6. The method according to claim 1, characterized in that Performing at least two tests on the at least one installation package further includes: If a first detection is performed on the at least one installation package and a risk detection item is detected, determining a code file corresponding to the risk detection item and performing a second detection; If the at least one installation package is tested a second time and the risk detection item is not detected, the code file corresponding to the risk detection item is marked as having passed the retest.

7. The method according to claim 6, characterized in that After marking the code file corresponding to the risk detection item as passed the retest, the method further includes: After the marked code file is manually inspected and determined to have passed, the code file is marked as rectified.

8. The method according to claim 1, characterized in that The detecting of the at least one installation package further includes: If the at least one installation package is detected for the first time and no risk detection item is detected, re-detecting the at least one installation package; If the at least one installation package is tested a second time and a risk detection item is detected, a code file corresponding to the risk detection item is determined, and the at least one installation package is tested again.

9. The method according to claim 1, characterized in that The detecting of the at least one installation package further includes: If different risk detection items are detected twice in succession, the code files corresponding to the different risk detection items in the two successive detections are determined and re-detected.

10. A device for mobile application security detection, characterized in that: include: an acquiring unit, configured to acquire a mobile application to be detected, wherein the mobile application includes at least one installation package, and the installation package includes at least one code file; a detection and determination unit, configured to detect the at least one installation package, and if the same risk detection item is detected twice in a row, determine the code files corresponding to the same risk detection item in the two consecutive detections; The risk detection items are detection items that fail when the installation package is tested within a pre-set detection range; The determining of the code files corresponding to the same risk detection items in two consecutive detections includes: determining summary information of the installation packages corresponding to the same risk detection items in the two consecutive detections, wherein the summary information is obtained by calculating the installation packages using an information summary algorithm; determining the submission numbers corresponding to the summary information in the two consecutive detections according to a pre-stored correspondence between the summary information and the submission number; wherein the submission number is determined based on snapshot information of the installation package when packaging and compilation are completed; and determining the code files corresponding to the same risk detection items in the installation packages corresponding to the submission numbers in the two consecutive detections; The difference determination unit is used to determine the difference information between the code files corresponding to two consecutive detections, and output the difference information and the code files corresponding to the two consecutive detections, so that the user can use the difference information and the code files to rectify the installation package.

11. An electronic device, characterized in that: include: a memory for storing program instructions; A processor is configured to call program instructions stored in the memory and execute the steps of the method according to any one of claims 1 to 9 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a computer, the computer is caused to perform the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 9.

Images