Application file security detection method, device and server

Abstract

The application provides a security detection method and device of an application and a server, and is applied to the technical field of data security. Based on the method, after a target security detection request about a target application is acquired, a target installation package file and a target text attachment of the target application can be acquired simultaneously according to a target identifier carried by the target security detection request; then, effective information of the target text attachment is acquired by performing text recognition on the target text attachment; and the target application is detected in security based on two different dimensions by comprehensively utilizing the effective information of the target installation package file and the target text attachment. Thus, automatic detection of the security of the target application can be accurately and comprehensively realized, an application with security risks can be discovered in time, and the data security of a user is protected; meanwhile, the detection process can be effectively simplified, the detection efficiency can be improved, and detection errors can be reduced.

Description

Technical Field

[0001] This manual belongs to the field of data security technology, and in particular relates to methods, devices and servers for detecting the security of application files. Background Technology

[0002] With the development of technology, more and more users are using applications (such as mobile apps) to access various business services and functions. While applications provide convenience for people's work and life, issues such as excessive use of permissions and leakage of user information have gradually attracted attention.

[0003] Based on existing methods, most require technical personnel to manually check the security compliance of each application's information and operational methods according to a checklist to identify applications with security risks. However, in practice, these methods often suffer from low detection efficiency, incomplete detection, and susceptibility to errors.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This specification provides a method, apparatus, and server for security detection of application files, which can accurately and comprehensively perform automatic detection of the security of target applications, promptly identify applications with security risks, prevent the leakage of users' personal information data during use, and protect users' data security; at the same time, it can also effectively simplify the detection process, improve detection efficiency, and reduce detection errors.

[0006] This specification provides a method for security detection of application files, including:

[0007] Obtain a target security detection request for the target application; wherein the target security detection request carries at least a target identifier associated with the target application;

[0008] In response to the target security detection request, the target application's target installation package file and target text attachment are obtained based on the target identifier;

[0009] By performing text recognition on the target text attachment, valid information about the target text attachment can be obtained;

[0010] Based on the valid information in the target installation package file and the target text attachment, a security test is performed on the target application.

[0011] In one embodiment, the target text attachment includes at least one of the following: privacy agreement text, user agreement text, and data security policy text.

[0012] In one embodiment, obtaining a target security detection request for a target application includes:

[0013] Monitor whether the target application has undergone upgrades or updates;

[0014] If an upgrade or update to the target application is detected, a target security detection request for the target application is generated.

[0015] In one embodiment, valid information about the target text attachment is obtained by performing text recognition on the target text attachment, including:

[0016] The target text attachment is matched according to a preset text template to extract multiple key texts from the target text attachment;

[0017] The multiple key texts are processed using a preset text recognition model to obtain the corresponding target text recognition results;

[0018] Based on the target text recognition results, obtain valid information about the target text attachments.

[0019] In one embodiment, security detection of the target application is performed based on valid information from the target installation package file and the target text attachment, including:

[0020] The target installation package file is decompiled to obtain its source code.

[0021] Based on the source code of the target installation package file, obtain the protocol rules of the target installation package file;

[0022] The target application is subjected to security testing based on the protocol rules of the target installation package file and the valid information of the target text attachment.

[0023] In one embodiment, security detection of the target application is performed based on the protocol rules of the target installation package file and the valid information of the target text attachment, including:

[0024] The system utilizes a pre-defined semantic recognition model to process the valid information in the target text attachments and obtain key semantic content.

[0025] Based on the key semantic content, semantic matching is performed on the protocol rules of the target installation package file to obtain the corresponding semantic matching degree.

[0026] Based on semantic matching degree, determine whether the target application passes the security test.

[0027] In one embodiment, the preset semantic recognition model includes a neural network model based on natural language processing.

[0028] In one embodiment, determining whether a target application passes security testing based on semantic matching degree includes:

[0029] Detect whether the semantic matching degree is greater than or equal to the preset matching degree safety threshold;

[0030] If the semantic matching degree is greater than or equal to the preset matching degree security threshold, the target application is deemed to have passed the security test.

[0031] In one embodiment, if the semantic matching degree is determined to be greater than or equal to a preset matching degree security threshold, the method further includes:

[0032] The key semantic content and the key security information reference template are processed by a preset similarity algorithm to obtain the similarity parameter between the key semantic content and the corresponding security information items in the preset security information reference template.

[0033] Based on the similarity parameter, determine whether the target application passes the security test.

[0034] In one embodiment, after decompiling the target installation package file to obtain its source code, the method further includes:

[0035] Extract key code statements from the source code of the target installation package file;

[0036] Simulate the execution of key code statements and obtain the corresponding simulation results;

[0037] Based on the simulation results and valid information in the target text attachments, a security test is performed on the target application.

[0038] In one embodiment, after performing security checks on the target application based on valid information from the target installation package file and the target text attachment, the method further includes:

[0039] Once the target application passes the security test, the target installation package file of the target application is released to the public.

[0040] This specification also provides an application file security detection device, including:

[0041] The first acquisition module is used to acquire a target security detection request for the target application; wherein the target security detection request carries at least a target identifier associated with the target application;

[0042] The second acquisition module is used to respond to the target security detection request and acquire the target application's target installation package file and target text attachment based on the target identifier;

[0043] The recognition module is used to obtain valid information about the target text attachment by performing text recognition on the target text attachment;

[0044] The detection module is used to perform security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0045] This specification also provides a server, including a processor and a memory for storing processor-executable instructions, wherein the processor, when executing the instructions, implements the relevant steps of the security detection method for the application file.

[0046] This specification also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, perform the following steps: obtaining a target security detection request for a target application; wherein the target security detection request carries at least a target identifier associated with the target application; responding to the target security detection request, obtaining a target installation package file and a target text attachment of the target application based on the target identifier; obtaining valid information of the target text attachment by performing text recognition on the target text attachment; and performing security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0047] This specification also provides a computer program product comprising a computer program that, when executed by a processor, implements the relevant steps of the security detection method for the application file.

[0048] Based on the application file security detection method, apparatus, and server provided in this specification, after obtaining a target security detection request for a target application, the target installation package file and target text attachment of the target application can be obtained simultaneously based on the target identifier carried in the target security detection request. Then, text recognition is performed on the target text attachment to obtain its valid information. By comprehensively utilizing the valid information from the target installation package file and the target text attachment, the security of the target application is detected. This enables accurate and comprehensive automatic detection of the target application's security, timely identification of applications with security risks, and prevention of personal information data leakage when users subsequently use applications with security risks, thus protecting user data security. Simultaneously, it effectively simplifies the detection process, improves detection efficiency, and reduces detection errors. Attached Figure Description

[0049] To more clearly illustrate the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. The drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart illustrating an application file security detection method provided in one embodiment of this specification;

[0051] Figure 2 This is a schematic diagram illustrating one embodiment of the application file security detection method provided in the embodiments of this specification, within a scenario example.

[0052] Figure 3 This is a schematic diagram illustrating one embodiment of the application file security detection method provided in the embodiments of this specification, within a scenario example.

[0053] Figure 4 This is a schematic diagram illustrating one embodiment of the application file security detection method provided in the embodiments of this specification, within a scenario example.

[0054] Figure 5 This is a schematic diagram illustrating one embodiment of the application file security detection method provided in the embodiments of this specification, within a scenario example.

[0055] Figure 6 This is a schematic diagram illustrating one embodiment of the application file security detection method provided in the embodiments of this specification, within a scenario example.

[0056] Figure 7 This is a schematic diagram of the structural composition of a server provided in one embodiment of this specification;

[0057] Figure 8 This is a schematic diagram of the structural composition of an application file security detection device provided in one embodiment of this specification. Detailed Implementation

[0058] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0059] It should be noted that all user-related information and data mentioned in this manual were obtained and used with the user's knowledge and consent. Furthermore, the acquisition, storage, use, and processing of the aforementioned information and data comply with relevant national laws and regulations.

[0060] See Figure 1As shown in the embodiments of this specification, a method for security detection of application files is provided. Specifically, this method is applied to the server side. In specific implementation, the method may include the following:

[0061] S101: Obtain a target security detection request for the target application; wherein, the target security detection request carries at least a target identifier associated with the target application;

[0062] S102: In response to the target security detection request, obtain the target application's target installation package file and target text attachment based on the target identifier;

[0063] S103: Obtain valid information about the target text attachment by performing text recognition on the target text attachment;

[0064] S104: Perform security checks on the target application based on the valid information in the target installation package file and the target text attachment.

[0065] In some embodiments, see Figure 2 As shown, the aforementioned application file security detection method can be specifically applied to the server side. This server can specifically include a server deployed on a trading platform (e.g., XX Online Banking), responsible for performing security (or compliance) detection on applications published through that trading platform. The trading platform can publicly release applications offering different business services, such as XX Electronic Banking app, XX Payment app, or XX UnionPay app, etc. Furthermore, the trading platform can also publicly release applications provided by cooperating third parties.

[0066] Specifically, the aforementioned server can include a backend server capable of data transmission and data processing. Specifically, the server can be, for example, an electronic device with data processing, storage, and network interaction capabilities. Alternatively, the server can be a software program running on the electronic device that provides support for data processing, storage, and network interaction. In this embodiment, the number of servers is not specifically limited. The server can be a single server, several servers, or a server cluster formed by several servers.

[0067] In practice, when the trading platform receives the installation package file of an application to be released (e.g., the installation package file of a new application, or the upgrade and update installation package file of an old application), it can use the application file security detection method provided in this specification to simultaneously obtain the relevant application's installation package file and text attachments (e.g., the application's privacy agreement text, user agreement text, data usage instructions text, etc.) based on the corresponding identifiers; then, it can perform text recognition on the text attachments to obtain valid information; and then, it can comprehensively utilize the valid information from the installation package file and text attachments to conduct a comprehensive and accurate security detection of the application based on both the installation package file and text attachments.

[0068] Only after the application passes security testing and is confirmed to pose no security risks will the server publish the application on the trading platform and provide a download link for the application's installation package file on the trading platform.

[0069] At this point, if a user needs the business services provided by the relevant application, they can use their user terminal to download the application's installation package file through the download link provided by the trading platform; then, the user can install and run the application on their user terminal.

[0070] Specifically, the aforementioned user terminal may include a front-end applied to the user side, capable of data collection, data transmission, and other functions. Specifically, the user terminal may be, for example, an electronic device such as a desktop computer, tablet computer, laptop computer, or smartphone. Alternatively, the user terminal may also be a software application capable of running on the aforementioned electronic device.

[0071] In some embodiments, the target application can be specifically understood as the application to be subjected to security testing. For example, an upgraded or updated version of the XX e-banking application.

[0072] The aforementioned target identifier can be understood as identification information that can be used to indicate a target application. Specifically, it can be, for example, a combination of the target application's name and version number, the target application's application ID, or the target application's identifier, etc. This specification does not limit this aspect.

[0073] In some embodiments, the above-mentioned acquisition of a target security detection request for a target application may specifically include the following: monitoring whether the target application has undergone an upgrade or update; and generating a target security detection request for the target application if an upgrade or update is detected.

[0074] Accordingly, the target application for the upgrade and update can be identified as the target application to be subjected to security testing.

[0075] In addition, in specific implementation, the method may also include: monitoring whether new applications appear on the trading platform; if new applications are detected on the trading platform, identifying the new applications as target applications to be subjected to security testing; and generating a target security testing request for the target application.

[0076] In some embodiments, after receiving a target security detection request, the server can obtain the target identifier by parsing the data in the target security detection request; then, based on the target identifier, it can query the database of the application to be published on the trading platform to obtain the target installation package file and target text attachment of the target application.

[0077] In some embodiments, the aforementioned target text attachment may specifically include at least one of the following: privacy agreement text, user agreement text, data security policy text, etc.

[0078] Of course, it should be noted that the target text attachments listed above are merely illustrative. In actual implementation, depending on the specific circumstances and processing requirements, the target text attachments may also include other types of text attachments, such as data usage instructions, privacy and security policies, etc. This specification does not limit this.

[0079] In some embodiments, see Figure 3 As shown, the above method obtains valid information about the target text attachment by performing text recognition on the target text attachment. In specific implementation, it may include the following:

[0080] S1: Match the target text attachment according to the preset text template to extract multiple key texts from the target text attachment;

[0081] S2: Process the multiple key texts using a preset text recognition model to obtain the corresponding target text recognition results;

[0082] S3: Based on the target text recognition result, obtain the valid information of the target text attachment.

[0083] Specifically, the aforementioned preset text template can be obtained by summarizing and organizing the text formats of file attachments from a large number of sample applications. The aforementioned valid information can be understood as information related to user data security.

[0084] In practice, firstly, based on a preset text template, the text positions containing key text with valid information can be located in the target text attachment. Then, based on these text positions, the required key text can be extracted from the target text attachment. This way, subsequent processing only needs to be performed on the key text with a smaller amount of data, rather than processing all the text contained in the target text attachment, thereby effectively reducing data processing overhead and improving overall processing efficiency.

[0085] Next, a preset text recognition model can be used to further recognize the extracted key texts to obtain the corresponding target text recognition results; then, based on the above target text recognition results, the required effective information of the target text attachment can be obtained.

[0086] Specifically, the aforementioned preset text recognition model can be an algorithm model that integrates OCR (Optical Character Recognition) and CRNN (convolutional recurrent neural network).

[0087] In some embodiments, see Figure 4 As shown, the above-mentioned security detection of the target application based on the valid information of the target installation package file and the target text attachment may include the following in specific implementation:

[0088] S1: Decompile the target installation package file to obtain its source code;

[0089] S2: Obtain the protocol rules of the target installation package file based on its source code;

[0090] S3: Perform security checks on the target application based on the protocol rules of the target installation package file and the valid information of the target text attachment.

[0091] In some embodiments, during implementation, the file extension of the target installation package file can be modified first, followed by decompilation. For some high-security and complex installation package files, further unpacking is required to obtain the source code of the target installation package file. Further, the source code can be searched to extract definitions and descriptions of protocol rules such as user agreements, privacy policies, and operation protocols, which can then be used as the protocol rules for the target installation package file. Subsequently, the protocol rules of the target installation package file and the valid information in the target text attachments can be used simultaneously, combining the two different dimensions of the installation package file and the text attachments, to perform a more comprehensive and accurate security detection of the target application.

[0092] In some embodiments, see Figure 5 As shown, the above-mentioned security detection of the target application based on the protocol rules of the target installation package file and the valid information of the target text attachment can include the following in specific implementation:

[0093] S1: Use a pre-set semantic recognition model to process the effective information in the target text attachments and obtain key semantic content;

[0094] S2: Based on the key semantic content, perform semantic matching on the protocol rules of the target installation package file to obtain the corresponding semantic matching degree;

[0095] S3: Determine whether the target application passes the security test based on the semantic matching degree.

[0096] In some embodiments, the preset semantic recognition model includes a neural network model based on natural language processing (NLP).

[0097] Before implementation, a preset semantic recognition model can be trained in the following way: obtain valid information of the sample application as sample data; label the key semantic content in the sample data to obtain labeled sample data; construct an initial model based on NLP; and train the initial model using the labeled sample data to obtain a preset semantic recognition model that meets the accuracy requirements.

[0098] In some embodiments, the above-mentioned use of a preset semantic recognition model to process the effective information of the target text attachment and obtain key semantic content may include the following:

[0099] S1: Use a pre-defined semantic recognition model to process the valid information in the target text attachment and the contextual text related to the valid information in the target text attachment, to obtain the semantic recognition results of the valid information and the semantic recognition results of the contextual text.

[0100] S2: Determine the comprehensive semantic recognition result based on the semantic recognition results of the effective information and the semantic recognition results of the context-related text;

[0101] S3: Extract semantic content related to the operating environment and / or user information from the comprehensive semantic recognition results, and use it as the key semantic content.

[0102] In some embodiments, the above-mentioned semantic matching of the protocol rules of the target installation package file based on the key semantic content to obtain the corresponding semantic matching degree may specifically include: performing semantic retrieval on the protocol rules of the target installation package file based on the key semantic content to find the protocol content with the strongest semantic correlation with each key semantic content in the protocol rules; and then performing semantic matching between the protocol content and the key semantic content to obtain the corresponding semantic matching degree.

[0103] In some embodiments, determining whether a target application passes the security test based on semantic matching degree may include the following: detecting whether the semantic matching degree is greater than or equal to a preset matching degree security threshold; if the semantic matching degree is greater than or equal to the preset matching degree security threshold, determining that the target application passes the security test. Conversely, if the semantic matching degree is less than the preset matching degree security threshold, determining that the target application fails the security test.

[0104] Specifically, the preset matching degree security threshold can be determined in advance by clustering a large number of historical applications that meet security requirements.

[0105] Based on the above embodiments, security testing of target applications can be achieved relatively quickly.

[0106] In some embodiments, when the semantic matching degree is determined to be greater than or equal to a preset matching degree security threshold, the method may further include the following:

[0107] S1: Use a preset similarity algorithm to process key semantic content and preset security information reference templates to obtain similarity parameters between key semantic content and corresponding security information items in the preset security information reference templates;

[0108] S2: Determine whether the target application passes the security test based on the similarity parameter.

[0109] The aforementioned similarity parameter is used to characterize the semantic similarity between the key semantic content and the corresponding security information item in the preset security information reference template. The preset similarity algorithm may specifically include a cosine similarity algorithm or a simhash similarity algorithm, etc.

[0110] The aforementioned preset security information reference template can be obtained by studying and organizing the installation package files and text attachments of a large number of sample applications. The preset security information reference template contains at least several preset security information items. These preset security information items include information related to the operating environment and user information.

[0111] In some embodiments, after decompiling the target installation package file to obtain its source code, refer to... Figure 6 As shown, in specific implementations, the method may also include the following:

[0112] S1: Extract key code statements from the source code of the target installation package file;

[0113] S2: Simulate the execution of key code statements and obtain the corresponding simulation execution results;

[0114] S3: Based on the simulation execution results and the valid information in the target text attachment, perform security checks on the target application.

[0115] In some embodiments, during specific implementation, the required key code statements can be found and extracted by searching for key characters related to the runtime environment and / or user information in the source code of the target installation package file.

[0116] In some embodiments, the above-mentioned simulation execution of key code statements and obtaining corresponding simulation execution results may include: combining the preceding and following code statements of key code statements in the source code, simulating the execution of key code statements in a virtual environment, and obtaining change data of the operating environment and / or processing data of user information as the corresponding simulation execution results.

[0117] In some embodiments, the above-mentioned security detection of the target application based on the simulation execution result and the valid information of the target text attachment may specifically include: processing the valid information of the target text attachment using a preset semantic recognition model to obtain key semantic content; performing semantic matching between the key semantic content and the simulation execution result to obtain the corresponding semantic matching degree; and detecting whether the semantic matching degree is greater than or equal to a preset matching degree security threshold.

[0118] If the semantic matching degree is greater than or equal to the preset matching degree security threshold, it is possible to further determine whether the simulation execution result meets the specification requirements based on the preset security information reference template; if it is determined that it meets the specification requirements, it can be determined that the target application has passed the security test.

[0119] In addition, it can collect behavioral data when simulating the execution of critical code statements in a virtual environment; and check whether the behavioral operations comply with the specifications based on a preset security information reference template. If non-compliance with the specifications is detected, it is determined that the target application has failed the security test.

[0120] Based on the above embodiments, security testing of target applications can be achieved in a relatively precise and comprehensive manner.

[0121] In some embodiments, after simulating the execution of key code statements and obtaining the corresponding simulation execution results, the method may further include the following:

[0122] S1: Based on the preset security information reference template, check whether the simulation execution results meet the security specifications.

[0123] S2: If the simulation results meet the security requirements, determine that the target application passes the security test.

[0124] Based on the above embodiments, security detection of target applications can be achieved more accurately.

[0125] In some embodiments, after extracting key code statements, the method may further include the following in its specific implementation:

[0126] S1: Determine the corresponding key semantic instructions based on key code statements;

[0127] S2: Use a pre-set semantic recognition model to process the effective information in the target text attachments and obtain key semantic content;

[0128] S3: Based on the key semantic content, perform semantic matching on the key semantic instructions to obtain the corresponding semantic matching degree;

[0129] S4: Determine whether the target application passes the security test based on the semantic matching degree.

[0130] Based on the above embodiments, security detection of target applications can be efficiently achieved by semantically matching key code statements and valid information.

[0131] It should be noted that this manual provides several detection methods for performing security checks on target applications based on both the target installation package file and the target text attachments. In practice, any one of the above-listed detection methods, or any combination of multiple detection methods, can be flexibly used to achieve automatic security detection of the target application, depending on the specific application scenario and detection accuracy requirements.

[0132] In some embodiments, after performing security checks on the target application based on the valid information of the target installation package file and the target text attachment, the method may further include the following: if the security check of the target application is determined to be passed, the target installation package file of the target application is released to the public.

[0133] In some embodiments, after performing security checks on the target application based on the valid information of the target installation package file and the target text attachment, the method may further include the following: if it is determined that the security check of the target application fails, generating a security risk warning label; and setting a corresponding security risk warning label on the target application.

[0134] Furthermore, the server can refuse to release target applications carrying security risk warning labels to protect user data security. The server can also trace the source of target applications carrying security risk warning labels, conduct risk tracking on the providers of those applications, and take appropriate actions such as issuing warnings or canceling cooperation agreements based on the risk tracking results.

[0135] As can be seen from the above, based on the application file security detection method, apparatus, and server provided in the embodiments of this specification, after the server obtains a target security detection request for a target application, it can first obtain the target installation package file and target text attachment of the target application simultaneously based on the target identifier carried in the target security detection request; then, by performing text recognition on the target text attachment, it obtains the valid information of the target text attachment; and by comprehensively utilizing the valid information of the target installation package file and the target text attachment, it performs security detection on the target application. This enables accurate and comprehensive automatic detection of the security of the target application, timely discovery of applications with security risks, and protection of user data security; at the same time, it can also effectively simplify the detection process, improve detection efficiency, and reduce detection errors.

[0136] This specification also provides a server, including a processor and a memory for storing processor-executable instructions. Specifically, the processor can perform the following steps according to the instructions: obtaining a target security detection request for a target application; wherein the target security detection request carries at least a target identifier associated with the target application; responding to the target security detection request, obtaining a target installation package file and a target text attachment of the target application based on the target identifier; obtaining valid information of the target text attachment by performing text recognition on the target text attachment; and performing security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0137] To execute the above instructions more accurately, please refer to... Figure 7 As shown in the embodiments of this specification, another specific server is also provided, wherein the server includes a network communication port 701, a processor 702, and a memory 703. The above structures are connected by internal cables so that the various structures can perform specific data interaction.

[0138] Specifically, the network communication port 701 can be used to obtain a target security detection request for the target application; wherein the target security detection request carries at least a target identifier associated with the target application.

[0139] Specifically, the processor 702 can be used to respond to the target security detection request, obtain the target installation package file and target text attachment of the target application according to the target identifier; obtain the valid information of the target text attachment by performing text recognition on the target text attachment; and perform security detection on the target application according to the valid information of the target installation package file and target text attachment.

[0140] The memory 703 can be used to store the corresponding instruction program.

[0141] In this embodiment, the network communication port 701 can be a virtual port bound to different communication protocols, thereby enabling the sending or receiving of different data. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. Furthermore, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM or CDMA; it can also be a Wi-Fi chip; or it can be a Bluetooth chip.

[0142] In this embodiment, the processor 702 can be implemented in any suitable manner. For example, the processor can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc. This specification is not limiting.

[0143] In this embodiment, the memory 703 may include multiple layers. In a digital system, anything that can store binary data can be a memory. In an integrated circuit, a circuit with storage function but no physical form is also called a memory, such as RAM, FIFO, etc. In a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0144] This specification also provides a computer-readable storage medium based on the above-described application file security detection method. The computer-readable storage medium stores computer program instructions that, when executed, implement the following steps: obtaining a target security detection request for a target application; wherein the target security detection request carries at least a target identifier associated with the target application; responding to the target security detection request, obtaining a target installation package file and a target text attachment of the target application based on the target identifier; obtaining valid information of the target text attachment by performing text recognition on the target text attachment; and performing security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0145] In this embodiment, the storage medium includes, but is not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), cache, hard disk drive (HDD), or memory card. The memory can be used to store computer program instructions. The network communication unit can be an interface configured according to standards specified in the communication protocol for network connection communication.

[0146] In this embodiment, the specific functions and effects implemented by the program instructions stored in the computer-readable storage medium can be explained in comparison with other embodiments, and will not be repeated here.

[0147] This specification also provides a computer program product comprising a computer program that, when executed by a processor, performs the following steps: obtaining a target security detection request for a target application; wherein the target security detection request carries at least a target identifier associated with the target application; responding to the target security detection request, obtaining a target installation package file and a target text attachment of the target application based on the target identifier; obtaining valid information of the target text attachment by performing text recognition on the target text attachment; and performing security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0148] See Figure 8 As shown, at the software level, this specification also provides an application file security detection device, which may specifically include the following structural modules:

[0149] The first acquisition module 801 can be specifically used to acquire a target security detection request for a target application; wherein, the target security detection request carries at least a target identifier associated with the target application;

[0150] The second acquisition module 802 can be specifically used to respond to the target security detection request and acquire the target application's target installation package file and target text attachment based on the target identifier.

[0151] The recognition module 803 can be used to obtain valid information about the target text attachment by performing text recognition on the target text attachment;

[0152] The detection module 804 can be used to perform security detection on the target application based on the valid information of the target installation package file and the target text attachment.

[0153] In some embodiments, the target text attachment may specifically include at least one of the following: privacy agreement text, user agreement text, data security policy text, etc.

[0154] In some embodiments, when the first acquisition module 801 is specifically implemented, it can acquire the target security detection request for the target application in the following manner: monitor whether the target application has been upgraded or updated; if the target application has been upgraded or updated, generate the target security detection request for the target application.

[0155] In some embodiments, when the above-mentioned recognition module 803 is specifically implemented, it can obtain the effective information of the target text attachment by performing text recognition on the target text attachment in the following manner: matching the target text attachment according to a preset text template to extract multiple key texts from the target text attachment; processing the multiple key texts using a preset text recognition model to obtain the corresponding target text recognition result; and obtaining the effective information of the target text attachment based on the target text recognition result.

[0156] In some embodiments, when the detection module 804 is specifically implemented, it can perform security detection on the target application based on the valid information of the target installation package file and the target text attachment in the following manner: decompile the target installation package file to obtain the source code of the target installation package file; obtain the protocol rules of the target installation package file based on the source code of the target installation package file; and perform security detection on the target application based on the protocol rules of the target installation package file and the valid information of the target text attachment.

[0157] In some embodiments, when the detection module 804 is specifically implemented, it can perform security detection on the target application according to the protocol rules of the target installation package file and the valid information of the target text attachment in the following manner: using a preset semantic recognition model to process the valid information of the target text attachment to obtain key semantic content; performing semantic matching on the protocol rules of the target installation package file according to the key semantic content to obtain the corresponding semantic matching degree; and determining whether the target application passes the security detection based on the semantic matching degree.

[0158] In some embodiments, the preset semantic recognition model may specifically include a neural network model based on natural language processing.

[0159] In some embodiments, when the detection module 804 is specifically implemented, it can determine whether the target application passes the security detection based on the semantic matching degree in the following manner: detect whether the semantic matching degree is greater than or equal to a preset matching degree security threshold; if it is determined that the semantic matching degree is greater than or equal to the preset matching degree security threshold, determine that the target application passes the security detection.

[0160] In some embodiments, when the semantic matching degree is determined to be greater than or equal to a preset matching degree security threshold, the device can also be used to process key semantic content and a preset security information reference template using a preset similarity algorithm to obtain a similarity parameter between the key semantic content and the corresponding security information item in the preset security information reference template; and determine whether the target application passes the security detection based on the similarity parameter.

[0161] In some embodiments, after decompiling the target installation package file to obtain its source code, the device can also be used to extract key code statements from the source code of the target installation package file; simulate the execution of the key code statements and obtain the corresponding simulation execution results; and perform security detection on the target application based on the simulation execution results and valid information in the target text attachments.

[0162] In some embodiments, after performing security checks on the target application based on the valid information of the target installation package file and the target text attachment, the device may also be used to release the target installation package file of the target application to the public if the security check of the target application is determined to be passed.

[0163] It should be noted that the units, devices, or modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. For ease of description, the above devices are described by dividing them into various modules according to their functions. Of course, in implementing this specification, the functions of each module can be implemented in one or more software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection between the devices or units shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0164] As can be seen from the above, the application file security detection device provided in the embodiments of this specification, after obtaining a target security detection request for a target application, can first obtain the target installation package file and the target text attachment of the target application simultaneously based on the target identifier carried in the target security detection request; then, it can obtain the valid information of the target text attachment by performing text recognition on the target text attachment; and finally, it can comprehensively utilize the valid information of the target installation package file and the target text attachment to perform security detection on the target application. This enables accurate and comprehensive automatic detection of the security of the target application, timely discovery of applications with security risks, and protection of user data security; at the same time, it can also effectively simplify the detection process, improve detection efficiency, and reduce detection errors.

[0165] While this specification provides the steps of operation for the methods described in the embodiments or flowcharts, more or fewer steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or client product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. The terms "first," "second," etc., are used to denote names and do not indicate any particular order.

[0166] Those skilled in the art will also know that, besides implementing the controller using purely computer-readable program code, the same functions can be achieved by logically programming the method steps, making the controller function as logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers (PLCs), and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the devices within it used to implement various functions can also be considered structures within that hardware component. Alternatively, the devices used to implement various functions can be considered as both software modules implementing the method and structures within a hardware component.

[0167] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer-readable storage media, including storage devices.

[0168] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this specification can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of this specification can essentially be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, mobile terminal, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments of this specification.

[0169] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. This specification can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.

[0170] Although this specification has been described by way of examples, those skilled in the art will recognize that many variations and modifications are possible without departing from the spirit of this specification, and it is intended that the appended claims cover such variations and modifications without departing from the spirit of this specification.

Claims

1. A method for detecting the security of application files, characterized in that, include: Obtain a target security detection request for the target application; wherein the target security detection request carries at least a target identifier associated with the target application; In response to the target security detection request, the target application's target installation package file and target text attachment are obtained based on the target identifier; By performing text recognition on a target text attachment, valid information of the target text attachment is obtained. This includes: locating the text position of key text containing valid information in the target text attachment based on a preset text template; extracting multiple key texts from the target text attachment based on the text position; processing the multiple key texts using a preset text recognition model to obtain the target text recognition result; and obtaining the valid information of the target text attachment based on the target text recognition result. The valid information is related to the user's data security. The preset text template is obtained by summarizing and organizing the text formats of file attachments from a large number of sample applications. The preset text recognition model is an algorithm model that combines OCR recognition and CRNN. Based on the valid information in the target installation package file and the target text attachment, a security check is performed on the target application: The method further includes: finding and extracting key code statements by retrieving key characters related to the runtime environment and / or user information from the source code of the target installation package file; simulating the execution of key code statements in a virtual environment by combining the preceding and following code statements in the source code to obtain change data of the runtime environment and / or processing data for user information as the corresponding simulation execution results; performing security detection on the target application based on the simulation execution results and valid information in the target text attachments; and collecting and performing security detection on the target application based on the behavioral operation data when simulating the execution of key code statements in a virtual environment. The process involves performing security checks on the target application based on the simulation execution results and valid information from the target text attachments. This includes: processing the valid information from the target text attachments using a pre-defined semantic recognition model to obtain key semantic content; performing semantic matching between the key semantic content and the simulation execution results to obtain the corresponding semantic matching degree; detecting whether the semantic matching degree is greater than or equal to a pre-defined matching degree security threshold; if the semantic matching degree is determined to be greater than or equal to the pre-defined matching degree security threshold, determining whether the simulation execution results meet the specification requirements based on a pre-defined security information reference template; and if the results meet the specification requirements, determining that the target application has passed the security check.

2. The method according to claim 1, characterized in that, The target text attachments include at least one of the following: privacy agreement text, user agreement text, and data security policy text.

3. The method according to claim 1, characterized in that, Obtain a target security inspection request for the target application, including: Monitor whether the target application has undergone upgrades or updates; If an upgrade or update to the target application is detected, a target security detection request for the target application is generated.

4. The method according to claim 1, characterized in that, Based on the valid information in the target installation package file and the target text attachment, a security check is performed on the target application, including: The target installation package file is decompiled to obtain its source code. Based on the source code of the target installation package file, obtain the protocol rules of the target installation package file; The target application is subjected to security testing based on the protocol rules of the target installation package file and the valid information of the target text attachment.

5. The method according to claim 4, characterized in that, Based on the protocol rules of the target installation package file and the valid information of the target text attachments, a security check is performed on the target application, including: The system utilizes a pre-defined semantic recognition model to process the valid information in the target text attachments and obtain key semantic content. Based on the key semantic content, semantic matching is performed on the protocol rules of the target installation package file to obtain the corresponding semantic matching degree. Based on semantic matching degree, determine whether the target application passes the security test.

6. The method according to claim 5, characterized in that, The preset semantic recognition model includes a neural network model based on natural language processing.

7. The method according to claim 5, characterized in that, Based on semantic matching degree, determine whether the target application passes the security test, including: Detect whether the semantic matching degree is greater than or equal to the preset matching degree safety threshold; If the semantic matching degree is greater than or equal to the preset matching degree security threshold, the target application is deemed to have passed the security test.

8. The method according to claim 7, characterized in that, When the semantic matching degree is determined to be greater than or equal to a preset matching degree security threshold, the method further includes: The key semantic content and the key security information reference template are processed by a preset similarity algorithm to obtain the similarity parameter between the key semantic content and the corresponding security information items in the preset security information reference template. Based on the similarity parameter, determine whether the target application passes the security test.

9. The method according to claim 1, characterized in that, After performing security checks on the target application based on valid information from the target installation package file and the target text attachment, the method further includes: Once the target application passes the security test, the target installation package file of the target application is released to the public.

10. A security detection device for application files, characterized in that, include: The first acquisition module is used to acquire a target security detection request for the target application; wherein the target security detection request carries at least a target identifier associated with the target application; The second acquisition module is used to respond to the target security detection request and acquire the target application's target installation package file and target text attachment based on the target identifier; The recognition module is used to obtain valid information from a target text attachment by performing text recognition on the attachment. Specifically, the recognition module is used to: locate the text positions of key texts containing valid information within the target text attachment based on a preset text template; extract multiple key texts from the target text attachment based on the text positions; process the multiple key texts using a preset text recognition model to obtain the target text recognition result; and obtain the valid information from the target text attachment based on the target text recognition result. The valid information is related to the user's data security. The preset text template is obtained by summarizing and organizing the text formats of file attachments from a large number of sample applications. The preset text recognition model is an algorithm model that combines OCR recognition and CRNN. The detection module is used to perform security detection on the target application based on the valid information of the target installation package file and the target text attachment; The device is further configured to: find and extract key code statements by retrieving key characters related to the runtime environment and / or user information from the source code of the target installation package file; simulate the execution of key code statements in a virtual environment by combining the preceding and following code statements in the source code to obtain change data of the runtime environment and / or processing data for user information as the corresponding simulation execution result; perform security detection on the target application based on the simulation execution result and valid information in the target text attachment; and collect and perform security detection on the target application based on the behavioral operation data when simulating the execution of key code statements in a virtual environment. The process involves performing security checks on the target application based on the simulation execution results and valid information from the target text attachments. This includes: processing the valid information from the target text attachments using a pre-defined semantic recognition model to obtain key semantic content; performing semantic matching between the key semantic content and the simulation execution results to obtain the corresponding semantic matching degree; detecting whether the semantic matching degree is greater than or equal to a pre-defined matching degree security threshold; if the semantic matching degree is determined to be greater than or equal to the pre-defined matching degree security threshold, determining whether the simulation execution results meet the specification requirements based on a pre-defined security information reference template; and if the results meet the specification requirements, determining that the target application has passed the security check.

11. A server, characterized in that, It includes a processor and a memory for storing processor-executable instructions, wherein the processor, when executing the instructions, implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.

Images