Method, apparatus and device for detecting application program

Abstract

This application provides a method, apparatus, and device for detecting an application. The method includes: during the operation of a first application to be detected, acquiring M messages sent by a terminal device through the first application, determining the identification result of each message, wherein the identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message, and generating an application detection result corresponding to the first application based on the identification results of the M messages. In the above process, since the application detection result is obtained by analyzing the messages actually sent by the application during its operation, the accuracy of the application detection result is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, apparatus and device for detecting applications. Background Technology

[0002] With the rapid development of information technology, society is paying increasing attention to user privacy rights. Numerous laws and regulations require applications to protect user privacy. For example, some regulations restrict the cross-border transfer of user information.

[0003] To effectively monitor applications, a method is needed to detect whether they are transferring user information across borders. One related technique is to analyze the application's installation package. Specifically, this involves reverse engineering (e.g., decompiling) the application's installation package to obtain its source code. Static analysis of the source code then determines whether the application is transferring user data across borders.

[0004] However, the accuracy of the test results obtained by the above-mentioned detection methods is not high. Summary of the Invention

[0005] This application provides a method, apparatus, and device for detecting applications, so as to improve the accuracy of application detection results.

[0006] Firstly, embodiments of this application provide a method for detecting an application. This method can be executed by a terminal device, a processor or chip within the terminal device, a server, a processor or chip within the server, or through interaction between the terminal device and the server. The following description uses a server as the executing entity.

[0007] In the detection method for this application, the first application to be detected runs on a terminal device. During the operation of the first application to be detected, the server obtains M messages sent by the terminal device through the first application, where M is an integer greater than or equal to 1; each message corresponds to a network request sent by the first application to its corresponding application server. Each message indicates the target data to be transmitted by the first application and the target network address to which the target data is to be transmitted. The server determines the identification result of each message, which is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message; based on the identification results of the M messages, a program detection result corresponding to the first application is generated.

[0008] Optionally, the geographical region is the region corresponding to a country.

[0009] The identification results of M messages may fall into the following categories:

[0010] Scenario 1: The identification results of each of the M messages indicate that the sending and receiving locations of the messages are located in the same geographical area, and there is no user information in the messages. In other words, none of the M messages transmit user information across geographical areas. In this case, the program detection result corresponding to the first application can be determined to be normal.

[0011] Scenario 2: Among the M messages, the identification result of the first message indicates that the sending and receiving locations of the message are not located in the same geographical area. In other words, among the M messages, there is a message transmitted across geographical areas. In this case, the program detection result of the first application can be determined to be abnormal.

[0012] Scenario 3: The identification result of the first message among the M messages indicates that user information exists in the message. That is, a message transmitting user information exists among the M messages. In this case, the program detection result of the first application can be determined to be abnormal.

[0013] Scenario 4: Among the M messages, the identification result of the first message indicates that the sending and receiving locations of the message are not located in the same geographical area, and the message contains user information. In other words, among the M messages, there is a message transmitting user information across geographical areas. In this case, the program detection result of the first application can be determined to be abnormal.

[0014] In one possible implementation, when the program detection result is abnormal, the detection result may include an abnormality level. For example, the abnormality level corresponding to cases 2 and 3 above is a minor level. The abnormality level corresponding to case 4 above is a severe level.

[0015] In another possible implementation, if the program detection result is abnormal, the result can include the reason for the abnormality. For example, the reason for the abnormality in case 2 above is "transmission across geographical regions", the reason for the abnormality in case 3 above is "transmission of user information", and the reason for the abnormality in case 4 above is "transmission of user information across geographical regions". Optionally, the reasons for the abnormality can be represented by text or an identification code.

[0016] In this embodiment of the application, the accuracy of the program detection results is ensured by analyzing the messages actually sent by the application during its operation.

[0017] In one possible implementation, when the detection method of the application is applied to the server, the first application includes service interfaces corresponding to K geographical regions, and the server is configured with a proxy interface corresponding to each service interface, where K is an integer greater than or equal to 1; the server can obtain M messages in the following manner: for each service interface, through the proxy interface corresponding to the service interface, obtain at least one message sent by the terminal device through the service interface.

[0018] In real-world applications, terminal devices located in different countries send messages through different service interfaces. Therefore, when testing the first application, if it's necessary to test service interfaces for multiple countries, it's essential to obtain the messages sent through these multiple service interfaces. One approach is to use terminal devices located in different countries for testing. Another approach is to use a single terminal device and manipulate its location through methods like staking or embedding data points to simulate a scenario where the terminal device is in different countries, thus completing the testing process for multiple service interfaces. The second approach uses a single terminal device and doesn't require moving the device to a different country to complete the testing of all service interfaces of the first application, ensuring comprehensive coverage of service countries and improving testing efficiency.

[0019] In the above implementation, the terminal device sends messages through the first application in a way that can be triggered by the user operating the first application, or it can be controlled by an automatic test script to send messages. This embodiment does not limit this method.

[0020] In the above implementation method, when there are multiple geographical regions that the first application can serve, the service interface of each geographical region can be detected separately. On the one hand, this ensures the comprehensiveness of the detection results, and on the other hand, it improves the detection efficiency.

[0021] In one possible implementation, the server may generate the program detection result of the first application in the following manner: for each service interface, determine the interface detection result corresponding to the service interface based on the identification result of the at least one message sent through the service interface; generate the program detection result corresponding to the first application based on the interface detection results corresponding to the K service interfaces, wherein the program detection result corresponding to the first application includes the interface detection results corresponding to the K service interfaces.

[0022] In the above implementation, by determining the corresponding interface detection result for each service interface and including the corresponding interface detection result of each service interface in the application detection result, the detection result is more refined, so that users can intuitively understand which service interface is abnormal based on the program detection result.

[0023] In one possible implementation, the server can determine the interface detection result corresponding to the service interface in the following way: if the identification result of each of the at least one messages indicates that the sending location and receiving location of the message are located in the same geographical area, and there is no user information in the message, then the interface detection result indicates that the service interface is not abnormal; if the identification result of the first message in the at least one message indicates that the sending location and receiving location of the message are not located in the same geographical area, and / or, there is user information in the message, then the interface detection result indicates that the service interface is abnormal.

[0024] Optionally, in the event of an anomaly at a service interface, the interface detection result for that service interface may include: the anomaly level. Alternatively, in the event of an anomaly at a service interface, the interface detection result for that service interface may include: the cause of the anomaly. This allows for more granular analysis of the program's detection results.

[0025] In one possible implementation, the identification result of each message includes a first identification result, which indicates whether the sending location and receiving location of the message are located in the same geographical area. For any one of the M messages, the first identification result of the message can be determined as follows: determine the geographical area to which the sending location of the message belongs, and the geographical area to which the receiving location of the message belongs; if the geographical area to which the sending location belongs is the same as the geographical area to which the receiving location belongs, then the first identification result of the message indicates that the sending location and receiving location of the message are located in the same geographical area; if the geographical area to which the sending location belongs is different from the geographical area to which the receiving location belongs, then the first identification result of the message indicates that the sending location and receiving location of the message are not located in the same geographical area.

[0026] In one possible implementation, the first application includes service interfaces corresponding to K geographical regions, where K is an integer greater than or equal to 1; determining the geographical region to which the packet's sending location belongs and the geographical region to which the packet's receiving location belongs includes: determining a first service interface from the K service interfaces that sends the packet; using the geographical region corresponding to the first service interface as the geographical region to which the packet's sending location belongs; and parsing the packet to obtain the geographical region to which the packet's receiving location belongs.

[0027] In one possible implementation, parsing the message to obtain the geographical region to which the message is received includes: parsing the message to obtain the Internet Protocol (IP) address corresponding to the message's receiving location; obtaining a preset correspondence, which indicates the correspondence between different IP addresses and different geographical regions; and determining the geographical region corresponding to the IP address in the preset correspondence as the geographical region to which the message's receiving location belongs.

[0028] In the above implementation, the geographical region to which the message was sent is determined by the service interface of the message, and the geographical region to which the message was received is determined by parsing the IP address in the message. Then, the first identification result of the message is obtained by determining whether the geographical regions to which the message was sent and the geographical regions to which the message was received are the same, thus ensuring the accuracy of the first identification result. That is, it can accurately and comprehensively identify messages transmitted across geographical regions.

[0029] In one possible implementation, the identification result of each message includes a second identification result, which is used to indicate whether user information exists in the message. For any one of the M messages, the second identification result of the message can be determined as follows: parsing the target data to be transmitted from the message; decrypting the target data to obtain decrypted data; and matching the decrypted data with the user information corresponding to the first application to obtain the second identification result of the message.

[0030] In one possible implementation, the user information corresponding to the first application includes at least one information item; matching the decrypted data with the user information corresponding to the first application to obtain a second identification result of the message includes: matching each information item with the decrypted data to obtain a matching result for each information item; if the matching result of at least one information item is successful, then the second identification result of the message indicates that user information exists in the message; if the matching result of at least one information item is not successful, then the second identification result of the message indicates that user information does not exist in the message.

[0031] In the above implementation, the target data to be transmitted is obtained by parsing the message, and the target data is decrypted to obtain decrypted data. Then, based on the matching result of the decrypted data and the user information of the first application, the second identification result of the message is determined, which ensures the accuracy of the second identification result, that is, the message that transmits user information can be accurately and comprehensively identified.

[0032] In one possible implementation, before the server obtains the M messages sent by the terminal device through the first application, the method further includes: the server sending a control command to the terminal device, the control command being used to control the first application to start running.

[0033] In one possible implementation, the server may send control instructions to the terminal device in the following manner: receiving target information sent by the terminal device, the target information including resource information required for the first application to start and run; and sending the control instructions to the terminal device according to the target information.

[0034] In the above implementation, the server sends a startup control command to the terminal device. This command simulates a user manually clicking the icon of the first application on the terminal device to trigger its startup. By sending the startup control command to the terminal device, the first application can be run for subsequent detection processes, thus improving the automation of application detection.

[0035] In one possible implementation, after generating the program detection result corresponding to the first application based on the identification results of the M messages, the method further includes: displaying the program detection result; or, sending the program detection result. This allows relevant testing personnel to conveniently obtain the program detection result in a timely manner.

[0036] Secondly, embodiments of this application provide an application detection device, which includes:

[0037] The acquisition unit is used to acquire M messages sent by the terminal device through the first application during the operation of the first application to be detected, wherein M is an integer greater than or equal to 1;

[0038] The determining unit is used to determine the identification result of each message. The identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message.

[0039] The generation unit is used to generate the program detection result corresponding to the first application based on the identification results of the M messages.

[0040] In one possible implementation, the detection device of the application is applied to a server. The first application includes service interfaces corresponding to K geographical regions. The server is configured with a proxy interface corresponding to each service interface, where K is an integer greater than or equal to 1. The acquisition unit includes a traffic proxy module, used to acquire, for each service interface, at least one message sent by the terminal device through the service interface via the proxy interface corresponding to the service interface.

[0041] In one possible implementation, the generation unit includes: a detection result generation module, configured to, for each service interface, determine an interface detection result corresponding to the service interface based on the identification result of the at least one message sent through the service interface; and generate a program detection result corresponding to the first application based on the interface detection results corresponding to the K service interfaces, wherein the program detection result corresponding to the first application includes the interface detection results corresponding to the K service interfaces.

[0042] In one possible implementation, the detection result generation module is specifically used to: if the identification result of each message in the at least one message indicates that the sending location and receiving location of the message are located in the same geographical area, and there is no user information in the message, then determine that the interface detection result indicates that the service interface is not abnormal; or,

[0043] If the identification result of the first message in at least one message indicates that the sending location and receiving location of the message are not located in the same geographical area, and / or, the message contains user information, then it is determined that the interface detection result indicates that the service interface is abnormal.

[0044] In one possible implementation, the identification result of each message includes a first identification result, which indicates whether the sending location and receiving location of the message are located in the same geographical area. The determining unit includes a location analysis module. The location analysis module is used to determine the geographical area to which the sending location of the message belongs and the geographical area to which the receiving location of the message belongs. If the geographical area to which the sending location belongs is the same as the geographical area to which the receiving location belongs, then the first identification result of the message indicates that the sending location and receiving location of the message are located in the same geographical area; if the geographical area to which the sending location belongs is different from the geographical area to which the receiving location belongs, then the first identification result of the message indicates that the sending location and receiving location of the message are not located in the same geographical area.

[0045] In one possible implementation, the first application includes service interfaces corresponding to K geographical regions, where K is an integer greater than or equal to 1; the location analysis module is used to determine the first service interface for sending the message from the K service interfaces; the geographical region corresponding to the first service interface is taken as the geographical region to which the message is sent; and the message is parsed to obtain the geographical region to which the message is received.

[0046] In one possible implementation, the determining unit further includes: an IP resolution module, used to parse the packet to obtain the Internet Protocol (IP) address corresponding to the receiving location of the packet. A location analysis module is used to obtain a preset correspondence, indicating the correspondence between different IP addresses and different geographical regions; and to determine the geographical region corresponding to the IP address in the preset correspondence as the geographical region to which the receiving location of the packet belongs.

[0047] In one possible implementation, the identification result of each message includes a second identification result, which indicates whether user information exists in the message. For any one of the M messages, the determining unit includes an encrypted traffic cracking module and a user information matching module. The encrypted traffic cracking module is used to parse the target data to be transmitted from the message, decrypt the target data to obtain decrypted data, and the user information matching module is used to match the decrypted data with the user information corresponding to the first application to obtain the second identification result of the message.

[0048] In one possible implementation, the user information corresponding to the first application includes at least one information item; the user information matching module is specifically used to: match each information item with the decrypted data respectively to obtain a matching result for each information item; if the matching result of the at least one information item is successful, then the second identification result of the message indicates that user information exists in the message; if the matching result of the at least one information item is successful, then the second identification result of the message indicates that user information does not exist in the message.

[0049] In one possible implementation, the application detection device further includes a dynamic running module, which is used to send control commands to the terminal device, the control commands being used to control the first application to start running.

[0050] In one possible implementation, the dynamic operation module is used to receive target information sent by the terminal device, the target information including resource information required for the first application to start running; and to send the control command to the terminal device according to the target information.

[0051] In one possible implementation, the detection result generation module is also used to display the program detection results or send the program detection results.

[0052] In one possible implementation, the geographical region is the region corresponding to a country.

[0053] Thirdly, embodiments of this application provide an electronic device, which is a terminal device or a server. The electronic device includes a processor and a memory. The processor is coupled to the memory to read and execute instructions in the memory to implement the method described in the first aspect or various possible implementations of the first aspect.

[0054] Fourthly, embodiments of this application provide an application detection apparatus, including a unit, module, or circuit for performing the method provided in the first aspect or various possible implementations of the first aspect. This data processing apparatus can be a terminal device or a server, or it can be a module applied to a terminal device or a server.

[0055] Fifthly, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed, implement the method described in the first aspect or various possible implementations of the first aspect.

[0056] Sixthly, embodiments of this application provide a computer program product, the computer program product including a computer program, which, when executed, implements the method described in the first aspect or various possible implementations of the first aspect.

[0057] It should be understood that the beneficial effects of the second to sixth aspects in the embodiments of this application can be referred to the relevant description of the effective effects in the first aspect above.

[0058] This application provides an application detection method, apparatus, and device. The method includes: during the operation of a first application to be detected, acquiring M messages sent by a terminal device through the first application, determining the identification result of each message, wherein the identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message, and generating an application detection result corresponding to the first application based on the identification results of the M messages. In the above process, since the application detection result is obtained by analyzing the messages actually sent by the application during its operation, the accuracy of the application detection result is improved. Attached Figure Description

[0059] Figure 1This is a schematic diagram illustrating the process of detecting an application.

[0060] Figure 2 A schematic diagram of a system architecture provided for an embodiment of this application;

[0061] Figure 3 A flowchart illustrating an application detection method provided in this application embodiment;

[0062] Figure 4 A flowchart illustrating another application detection method provided in this application embodiment;

[0063] Figure 5 This is a schematic diagram illustrating a message identification and processing process provided in an embodiment of this application.

[0064] Figure 6 This is a schematic diagram illustrating another message identification and processing procedure provided in an embodiment of this application.

[0065] Figure 7A A schematic diagram of a display interface corresponding to a program detection result provided in an embodiment of this application;

[0066] Figure 7B A schematic diagram of the display interface corresponding to another program detection result provided in an embodiment of this application;

[0067] Figure 8A A schematic diagram of another system architecture provided for an embodiment of this application;

[0068] Figure 8B for Figure 8A The diagram shows the interaction flow of the detection method for the application corresponding to the system architecture shown.

[0069] Figure 9A A schematic diagram of yet another system architecture provided in an embodiment of this application;

[0070] Figure 9B for Figure 9A The diagram shows the interaction flow of the detection method for the application corresponding to the system architecture shown.

[0071] Figure 10 This is a schematic diagram illustrating the interface changes of the terminal device provided in the embodiments of this application;

[0072] Figure 11 A schematic diagram illustrating the application detection process provided in this application embodiment;

[0073] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0074] To facilitate understanding of the technical solution of this application, the nouns or terms involved in this application will be explained first.

[0075] Application: refers to a computer program designed to perform one or more specific tasks. Applications in this application include, but are not limited to, mobile applications, portal websites, and mini-programs.

[0076] User information: In a broad sense, it refers to various information recorded electronically or otherwise that can identify a specific natural person or reflect the activities of a specific natural person, either alone or in combination with other information, including but not limited to the natural person's name, date of birth, ID card number, personal biometric information, address, telephone number, email address, health information, and whereabouts information.

[0077] Cross-border transfer of user information: refers to the transfer of user information from one country to another.

[0078] As mentioned earlier, in order to regulate applications, a method is needed to detect whether applications are transferring user information across borders.

[0079] Figure 1 This is a schematic diagram illustrating an application detection process. In this technique, detection is achieved by parsing the application's installation package. Specifically, such as... Figure 1 As shown, the application's installation package is reverse-engineered (e.g., decompiled) to obtain the source code. Preset keywords are used to match the source code, detecting user information and the domain name to which the user information is sent. Then, the domain name is resolved to determine the target address to which the user information is sent, thereby determining whether the user information has been transmitted across borders and obtaining the program detection result.

[0080] For example, after reverse engineering the application's installation package, the application's source code is obtained. Using preset keywords such as "name," "identification," and "birthday," the source code is matched to retrieve user information. Furthermore, the domain name to which this user information was sent is found within the source code, and this domain name is resolved to obtain the target network address. If the target network address is located outside of China, it indicates that the application has transmitted user information across borders.

[0081] However, the aforementioned techniques employ static analysis of the installation package. "Static" here means that the analysis only needs to be performed on the application's installation package without the application running. The detection results of this method rely on the coding style of the source code, and different developers typically have different coding styles. For example, the variable corresponding to "user name" in the source code might be named "name" by some developers, "Nm" by others, "Nm01" by still others, "Nm_01", etc. This method of identifying user information from the source code using preset keywords leads to the possibility of false positives or false negatives. Furthermore, this method requires searching for domain names in the source code, but in practice, domain names may be dynamically generated during application runtime; therefore, the domain names obtained by this method are not comprehensive. In summary, the accuracy of the program detection results obtained by the above methods is not high.

[0082] To address the aforementioned technical problems, this application provides a method for detecting applications. Unlike the static analysis methods used in the related technologies, this application employs a dynamic analysis method. Specifically, during the operation of the application to be detected, multiple messages (i.e., dynamic traffic data) sent by the terminal device through the application can be acquired in real time. By identifying and processing these multiple messages, an identification result for each message is obtained. The identification result of each message indicates whether the sending and receiving locations of the message are located in the same geographical area, and / or whether user information exists in the message. Furthermore, based on the identification results of the multiple messages, the application detection result is determined. In this application's technical solution, since the application detection result is determined by analyzing the messages actually sent by the application during its operation, the accuracy of the application detection result is guaranteed.

[0083] Figure 2 This is a schematic diagram of a system architecture provided for an embodiment of this application. (For example...) Figure 2 As shown, the system architecture includes an application detection client (hereinafter referred to as the "detection client") and an application detection server (hereinafter referred to as the "detection server"). The detection client contains the application to be detected. The detection server provides the functionality to detect the application.

[0084] Figure 2In the system architecture shown, the detection client refers to the terminal device with the application to be detected installed, including but not limited to smartphones, smart wearable devices, smart home devices, personal computers (PCs), handheld devices with wireless communication capabilities, computing devices, in-vehicle devices or wearable devices, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, self-driving, remote medical, smart grid, transportation safety, smart city, and smart home applications. Personal computers can be, for example, tablets, laptops, desktop computers, super mobile PCs, and personal digital assistants. The detection server can be, for example, a router, switch, or server. Servers can be, for example, enterprise servers, carrier servers, or service provider servers. In some possible scenarios, the server can be a cloud server.

[0085] It should be noted that in some scenarios, the detection client and the detection server can be deployed on different electronic devices; for example, the detection client may be a terminal device, and the detection server may be a server. In other scenarios, the detection client and the detection server can be deployed on the same electronic device; for example, both may be deployed on an electronic device with the application to be detected installed. For ease of description, the following embodiments will use the example of the detection client being a terminal device and the detection server being a server.

[0086] Application detection can be achieved through interaction between terminal devices and servers. See also... Figure 2 The application to be tested runs on the terminal device. During the application's operation, the server can acquire the packets (i.e., traffic data) sent by the terminal device through the application in real time, and process the packets to obtain the program detection results.

[0087] It should be noted that, Figure 2The server shown refers to the server that provides application detection capabilities, which is different from the server that provides services to the application. For distinction, the server providing services to the application is called the application server, and the server providing application detection capabilities is called the detection server. During application execution, the terminal device sends messages to the application server through the application. The detection server can obtain these messages from the terminal device to the application server using certain techniques (such as traffic proxy technology, packet interception technology, etc.). Then, the detection server processes the obtained messages to obtain the program detection results.

[0088] Optionally, after receiving the program detection results, the server can send the program detection results to the terminal device. Optionally, the server can display the program detection results. In this embodiment, the application detection process can be automatically executed by the terminal device and the server, thereby achieving high detection efficiency.

[0089] The application detection method provided in this application embodiment can be applied to various application scenarios. Several possible scenarios are illustrated below.

[0090] In one example scenario, regulatory authorities can use the method described in this application to detect applications during security inspections and obtain program detection results. If the program detection results indicate that the application has an anomaly, the application is required to rectify the issue based on the program detection results. Since the program detection results are obtained by analyzing the actual messages sent by the application during its operation, the accuracy of the program detection results is guaranteed.

[0091] In another example scenario, application distribution platforms (such as app stores, app marketplaces, and mobile security apps) are responsible for providing download / installation entry points for various types of applications. Before an application is listed on the application distribution platform, or after an application is updated, the method described in this application embodiment can be used to detect the application and obtain the program detection results. If the program detection results indicate that the application has an anomaly, the application is required to be rectified before being listed.

[0092] Typically, application distribution platforms need to list a large number of applications. The method described in this application embodiment can automatically detect the applications, ensuring detection efficiency.

[0093] In another example scenario, during the development and testing of an application, the method described in this embodiment can be used to detect the application and obtain the program detection results. If the program detection results indicate that the application has an anomaly, it can be corrected in a timely manner during subsequent development, thereby avoiding the amount of rectification work required after the application is released.

[0094] It should be noted that the application scenarios for the application inspection method in this application embodiment are not limited, and the application detection method can also be used by third-party testing. It should also be noted that when users use websites or other system programs, cross-geographical information transmission may also be involved; therefore, this application embodiment can also be applied to the detection of websites or other system programs.

[0095] In some possible implementations, the application needs to provide a privacy statement to the user. This privacy statement explains how the terminal device uses user information during the user's use of the application. In this embodiment, after detecting the application's program detection results, the results can be compared with the application's privacy statement to determine whether the application transmits user information in accordance with the terms of the privacy statement.

[0096] The technical solutions of this application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0097] Figure 3 This is a flowchart illustrating an application detection method provided in an embodiment of this application. Figure 3 As shown, the method in this embodiment includes:

[0098] S301: During the operation of the first application to be detected, obtain M messages sent by the terminal device through the first application, where M is an integer greater than or equal to 1.

[0099] In this embodiment, the first application to be detected runs on a terminal device. During the operation of the first application, the executing entity of this embodiment acquires M messages sent by the terminal device through the first application. M is an integer greater than or equal to 1. Each message corresponds to a network request sent by the first application to its corresponding application server. Each message indicates the target data to be transmitted by the first application and the target network address to which the target data is to be transmitted.

[0100] The executing entity in this embodiment can be a terminal device or a server. It is understood that when the executing entity is a terminal device, the terminal device can obtain the M messages sent through the first application by listening to its own sending interface. When the executing entity is a server, the server can obtain the M messages sent by the terminal device through the first application using message interception technology, traffic proxy technology, etc.

[0101] S302: Determine the identification result of each message. The identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message.

[0102] In this embodiment, the identification result of each message can be obtained by performing identification processing on each message separately.

[0103] In one possible implementation, the identification result of each message is used to indicate whether the sending and receiving locations of the message are located in the same geographical area. In other words, this implementation can identify whether a message is transmitted across geographical areas.

[0104] The message sending location is typically the location of the terminal device, or the location of the user of the terminal device. The message receiving location refers to the location of the application server of the first application.

[0105] Optionally, the geographical region can be a geographical region divided according to the coverage of a country. The area covered by a country is called a geographical region. Accordingly, another way to express "the first identification result is used to indicate whether the sending location and receiving location of the message are located in the same geographical region" is "the first identification result is used to indicate whether the sending location and receiving location of the message are located in the same country", or "the first identification result is used to indicate whether the message is transmitted across national regions (cross borders)".

[0106] Typically, at least one of the sending and receiving locations is carried in the message as an Internet Protocol (IP) address. Therefore, the identification result can be obtained by parsing the IP address in the message.

[0107] In another possible implementation, the identification result of each message is used to indicate whether user information exists in the message. That is, this implementation can identify whether a message transmits user information.

[0108] Specifically, the identification result can be obtained by parsing the target data to be transmitted in the message to determine whether user information exists in the target data.

[0109] In another possible implementation, the identification result of each message is used to indicate whether the sending and receiving locations of the message are located in the same geographical area, and whether user information is contained in the message. In other words, this implementation can identify both whether a message is transmitted across geographical areas and whether the message contains user information.

[0110] S303: Based on the identification results of the M messages, generate the program detection result corresponding to the first application.

[0111] In practical applications, the identification results of M messages may fall into the following categories:

[0112] Scenario 1: The identification results of each of the M messages indicate that the sending and receiving locations of the messages are located in the same geographical area, and there is no user information in the messages. In other words, none of the M messages transmit user information across geographical areas. In this case, the program detection result corresponding to the first application can be determined to be normal.

[0113] Scenario 2: Among the M messages, the identification result of the first message indicates that the sending and receiving locations of the message are not located in the same geographical area. In other words, among the M messages, there is a message transmitted across geographical areas. In this case, the program detection result of the first application can be determined to be abnormal.

[0114] Scenario 3: The identification result of the first message among the M messages indicates that user information exists in the message. That is, a message transmitting user information exists among the M messages. In this case, the program detection result of the first application can be determined to be abnormal.

[0115] Scenario 4: Among the M messages, the identification result of the first message indicates that the sending and receiving locations of the message are not located in the same geographical area, and the message contains user information. In other words, among the M messages, there is a message transmitting user information across geographical areas. In this case, the program detection result of the first application can be determined to be abnormal.

[0116] In one possible implementation, when the program detection result is abnormal, the detection result may include an abnormality level. For example, the abnormality level corresponding to cases 2 and 3 above is a minor level. The abnormality level corresponding to case 4 above is a severe level.

[0117] In another possible implementation, if the program detection result is abnormal, the result can include the reason for the abnormality. For example, the reason for the abnormality in case 2 above is "transmission across geographical regions", the reason for the abnormality in case 3 above is "transmission of user information", and the reason for the abnormality in case 4 above is "transmission of user information across geographical regions". Optionally, the reasons for the abnormality can be represented by text or an identification code.

[0118] When the executing entity of this embodiment is a terminal device, after the terminal device generates the program detection result corresponding to the first application, it can display the program detection result so that relevant personnel can know the program detection result in a timely manner.

[0119] When the executing entity in this embodiment is a server, after the server generates the program detection result corresponding to the first application, it can display the program detection result or send the program detection result to the terminal device so that relevant personnel can know the program detection result in a timely manner.

[0120] The application detection method provided in this embodiment includes: during the operation of a first application to be detected, acquiring M messages sent by a terminal device through the first application, determining the identification result of each message, wherein the identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message, and generating a program detection result corresponding to the first application based on the identification results of the M messages. In the above process, since the program detection result of the application is obtained by analyzing the messages actually sent by the application during its operation, the accuracy of the program detection result is improved.

[0121] exist Figure 3 Based on the embodiments shown, the technical solution provided in this application will be described in more detail below with a more specific embodiment.

[0122] Figure 4 This is a flowchart illustrating another application detection method provided in an embodiment of this application. Figure 4 As shown, the method in this embodiment includes:

[0123] S401: Send a startup control command to the terminal device, the startup control command being used to control the startup and execution of the first application to be detected.

[0124] The method in this embodiment can be executed by a server. The server sends a startup control command to the terminal device. The startup control command simulates a user manually clicking the icon of the first application on the terminal device to trigger the first application to start running. By sending the startup control command to the terminal device, the first application can be run to perform subsequent detection processes, thus improving the automation level of application detection.

[0125] In one possible implementation, before sending the startup control command to the terminal device, the server may receive target information sent by the terminal device. This target information includes resource information required for the first application to start and run. For example, it may include at least one of the following resource information: routing configuration information, the terminal device's Application Programming Interface (API) information, and information about the software packages to be loaded. In this way, the server can send the startup control command to the terminal device based on the target information.

[0126] Optionally, the target information also includes user information corresponding to the first application. The user information corresponding to the first application can be used in the message identification processing of S403 to identify whether user information exists in the message. The user information corresponding to the first application includes, but is not limited to, at least one of the following: name, date of birth, ID card number, personal biometric information, address, telephone number, email address, health information, location information, etc.

[0127] S402: During the operation of the first application, for each geographical region of the first application, at least one message sent by the terminal device through the service interface is obtained through the proxy interface corresponding to the service interface.

[0128] In this embodiment, the first application includes service interfaces corresponding to K geographical regions. K is an integer greater than or equal to 1. For example, suppose the first application includes service interfaces corresponding to four countries: service interface A for country A, service interface B for country B, service interface C for country C, and service interface D for country D. The terminal device sends messages in country A through service interface A, in country B through service interface B, in country C through service interface C, and in country D through service interface D.

[0129] The server is configured with a corresponding proxy interface for each service interface. For example, proxy interface A corresponds to service interface A, proxy interface B corresponds to service interface B, proxy interface C corresponds to service interface C, and proxy interface D corresponds to service interface D. Each proxy interface is used to implement traffic proxying functionality. That is, proxy interface A can proxy and receive packets sent through service interface A, proxy interface B can proxy and receive packets sent through service interface B, proxy interface C can proxy and receive packets sent through service interface C, and proxy interface D can proxy and receive packets sent through service interface D.

[0130] In this way, the server can obtain at least one message sent by the terminal device through service interface A through proxy interface A, at least one message sent by the terminal device through service interface B through proxy interface B, at least one message sent by the terminal device through service interface C through proxy interface C, and at least one message sent by the terminal device through service interface D through proxy interface D.

[0131] S403: Determine the identification result of each message. The identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and / or whether user information exists in the message.

[0132] Specifically, the identification result for each message includes a first identification result and / or a second identification result. The first identification result indicates whether the sending and receiving locations of the message are located in the same geographical area. The second identification result indicates whether user information exists in the message.

[0133] In one possible implementation, the first identification result of each message can be determined in the following possible manner.

[0134] (1) Determine the geographical region to which the message is sent and the geographical region to which the message is received.

[0135] Assume the first application includes service interfaces corresponding to K geographical regions, where K is an integer greater than or equal to 1. When a terminal device sends a message through the first application, it does so through the service interface corresponding to the geographical region to which the terminal device's current location belongs. For example, if the terminal device's current location is in country A, it sends the message through service interface A; if the terminal device's current location is in country B, it sends the message through service interface B. Therefore, for each message, the geographical region corresponding to the service interface that sent the message can be considered as the geographical region to which the message originated.

[0136] The following is combined with Figure 5 Describe the process of identifying and processing messages. Figure 5 This is a schematic diagram illustrating a message identification and processing procedure provided in an embodiment of this application. Figure 5 As shown, for each message, firstly, from the K service interfaces, the first service interface that sent the message is determined, and the geographical region corresponding to the first service interface is taken as the geographical region to which the message's sending location belongs. Further, the message is parsed to obtain the geographical region to which the message's receiving location belongs.

[0137] Optionally, the geographical region to which the message is received can be obtained in the following way: such as... Figure 5 As shown, the IP address corresponding to the receiving location of the message is obtained by parsing the message. The IP address refers to the target network address to which the message is to be sent. Typically, the IP address is explicitly or implicitly carried in the message; it can be obtained by parsing the message according to the protocol format used. Further, a preset mapping relationship is obtained, indicating the correspondence between different IP addresses and different geographical regions. The geographical region corresponding to the IP address in the preset mapping relationship is determined as the geographical region to which the message's receiving location belongs. In other words, by querying the preset mapping relationship using the IP address, the geographical region to which the message's receiving location belongs can be obtained.

[0138] (2) If the geographical region to which the sending location belongs is the same as the geographical region to which the receiving location belongs, then the first identification result of the message indicates that the sending location and the receiving location of the message are located in the same geographical region; if the geographical region to which the sending location belongs is different from the geographical region to which the receiving location belongs, then the first identification result of the message indicates that the sending location and the receiving location of the message are not located in the same geographical region.

[0139] For example, if the sending location of a message belongs to country A and the receiving location belongs to country B, then the first identification result of the message indicates that the sending location and the receiving location are not located in the same geographical region. If the sending location of a message belongs to country C and the receiving location belongs to country C, then the first identification result of the message indicates that the sending location and the receiving location are located in the same geographical region.

[0140] In this embodiment, the geographical region to which the message is sent is determined by the service interface of the message, and the geographical region to which the message is received is determined by parsing the IP address in the message. Then, the first identification result of the message is obtained by determining whether the geographical regions to which the sending location and the receiving location are the same, thus ensuring the accuracy of the first identification result. That is, messages transmitted across geographical regions can be accurately and comprehensively identified.

[0141] One possible implementation is as follows: Figure 6 The method shown determines the second identification result for each message. Figure 6 This is a schematic diagram illustrating another message identification and processing procedure provided in an embodiment of this application. For example... Figure 6 As shown,

[0142] (1) Parse the target data to be transmitted from the message.

[0143] It is understandable that by parsing the message according to the protocol format used, the target data to be transmitted can be obtained from the message.

[0144] (2) Decrypt the target data to obtain decrypted data.

[0145] In practical applications, to ensure the security of data transmission, the sending end encrypts the target data in the message before sending it. That is, the target data parsed in step (1) above is encrypted data. Therefore, the encryption and decryption algorithm corresponding to the first application can be used to decrypt the target data, or the target data can be cracked to obtain decrypted data.

[0146] (3) The decrypted data is matched with the user information corresponding to the first application to obtain the second identification result of the message.

[0147] Optionally, the user information corresponding to the first application includes at least one information item. The second identification result of the message can be determined in the following way:

[0148] Each information item is matched against the decrypted data to obtain a matching result for each information item, which is either successful or unsuccessful. If at least one of the information items has a successful matching result, then the second identification result of the message indicates that user information exists in the message. If at least one of the information items does not have a successful matching result, then the second identification result of the message indicates that user information does not exist in the message.

[0149] For example, suppose the user information corresponding to the first application includes the following two information items: "56215467812" and "AAAaaa". Here, "56215467812" represents the user's location, and "AAAaaa" represents the device identifier. If the decrypted data corresponding to a message contains at least one of "56215467812" or "AAAaaa", it indicates that the second identification result of that message indicates the presence of user information. If the decrypted data of a message contains neither "56215467812" nor "AAAaaa", it indicates that the second identification result of that message indicates the absence of user information.

[0150] In this embodiment, the target data to be transmitted is obtained by parsing the message and decrypting the target data to obtain decrypted data. Then, based on the matching result of the decrypted data and the user information of the first application, the second identification result of the message is determined, which ensures the accuracy of the second identification result, that is, the message that transmits user information can be accurately and comprehensively identified.

[0151] S404: For each service interface, determine the interface detection result corresponding to the service interface based on the identification result of the at least one message sent through the service interface.

[0152] For example, if the identification result of each of the at least one messages indicates that the sending location and receiving location of the message are located in the same geographical area, and there is no user information in the message, then it is determined that the interface detection result indicates that the service interface is not abnormal.

[0153] If the identification result of the first message in at least one message indicates that the sending location and receiving location of the message are not located in the same geographical area, and / or, the message contains user information, then it is determined that the interface detection result indicates that the service interface is abnormal.

[0154] For example, suppose that among the N1 messages sent by the terminal device through service interface A, the identification result of each message indicates that the sending location and receiving location of the message are in the same geographical area, and there is no user information in the message. That is to say, none of the N1 messages transmit user information across geographical areas, then it means that there is no abnormality in service interface A.

[0155] If, among the N2 messages sent by the terminal device through service interface B, the identification result of one message indicates that the sending location and receiving location of the message are not located in the same geographical area, that is, there is a message that is transmitted across geographical regions among the N2 messages, then it means that there is an anomaly in service interface B.

[0156] If, among the N3 messages sent by the terminal device through service interface C, the identification result of one of the messages indicates that user information is present in the message, that is, if there is a message transmitting user information among the N3 messages, then it means that service interface C is abnormal.

[0157] If, among the N4 messages sent by the terminal device through service interface D, the identification result of one message indicates that the sending location and receiving location of the message are not located in the same geographical area, and the message contains user information, that is, there is a message among the N4 messages that transmits user information across geographical areas, then it indicates that service interface D is abnormal.

[0158] Optionally, in the event of an anomaly at a service interface, the interface detection result for that service interface may include the anomaly level. For example, the anomaly level for service interface B and service interface C is minor, while the anomaly level for service interface D is severe.

[0159] Optionally, in the event of an anomaly at a service interface, the interface detection result for that service interface may include the cause of the anomaly. For example, the cause of the anomaly for service interface B is "transmission across geographical regions," the cause of the anomaly for service interface C is "transmission of user information," and the cause of the anomaly for service interface D is "transmission of user information across geographical regions." Optionally, the cause of the anomaly may be represented by text or an identifier code.

[0160] S405: Based on the interface detection results corresponding to each service interface, generate the program detection results corresponding to the first application, wherein the program detection results corresponding to the first application include the interface detection results corresponding to each service interface.

[0161] As an example, the program detection results of the first application can be shown in Table 1:

[0162] Table 1

[0163] Normal / Abnormal Abnormal level abnormal reason Service Interface A normal / / Service Interface B abnormal slight Cross-geographical transmission Service Interface C abnormal slight Transmit user information Service Interface D abnormal serious Transmitting user information across geographical regions

[0164] As another example, Figure 7A This is a schematic diagram of a display interface corresponding to a program detection result provided in an embodiment of this application. For example... Figure 7A As shown in the image, the display interface indicates whether service interfaces A, B, C, and D are functioning correctly. If a service interface is malfunctioning, the corresponding malfunction level is also displayed.

[0165] As yet another example, Figure 7B This is a schematic diagram of the display interface corresponding to another program detection result provided in an embodiment of this application. For example... Figure 7B As shown in the image, the display interface indicates whether service interfaces A, B, C, and D are functioning correctly. If a service interface is malfunctioning, the interface also displays the specific reason for the malfunction.

[0166] In real-world applications, terminal devices located in different countries send messages through different service interfaces. Therefore, when detecting the first application, if it is necessary to detect service interfaces corresponding to multiple countries, it is necessary to obtain the messages sent through multiple service interfaces.

[0167] In one possible implementation, terminal devices located in different countries can be used for detection. For example, the server obtains messages sent by terminal device A (located in country A) through service interface A of the first application, and obtains the interface detection result of service interface A by analyzing the messages. The server obtains messages sent by terminal device B (located in country B) through service interface B of the first application, and obtains the interface detection result of service interface B by analyzing the messages. The server obtains messages sent by terminal device C (located in country C) through service interface C of the first application, and obtains the interface detection result of service interface C by analyzing the messages. The server obtains messages sent by terminal device D (located in country D) through service interface D of the first application, and obtains the interface detection result of service interface D by analyzing the messages. Then, by combining the interface detection results of the above service interfaces, the program detection result of the first application is obtained.

[0168] In another possible implementation, a single terminal device can be used to complete the detection process for multiple service interfaces. For example, by staking or embedding points on the terminal device, the location of the terminal device can be changed to simulate the following scenarios: (1) The terminal device is located in country A and sends a message through service interface A of the first application; (2) The terminal device is located in country B and sends a message through service interface B of the first application; (3) The terminal device is located in country C and sends a message through service interface C of the first application; (4) The terminal device is located in country D and sends a message through service interface D of the first application. In each of the above scenarios, the server obtains the message sent by the terminal device through the first application and analyzes the message to obtain the interface detection results corresponding to each service interface. Then, by combining the interface detection results of each service interface, the program detection result of the first application is obtained. In this implementation, a single terminal device can be used, and the country where the terminal device is located does not need to be moved, to complete the detection of all service interfaces of the first application, ensuring the comprehensive coverage of the service countries in the detection process and improving the detection efficiency.

[0169] In the above implementation methods, the terminal device sends messages through the first application in a way that can be triggered by the user operating the first application, or it can be controlled by an automatic test script to send messages. This embodiment does not limit this method.

[0170] In this embodiment, the accuracy of the application detection results is ensured by analyzing the messages actually sent by the first application during its operation. Furthermore, when the first application can serve multiple geographical regions, the service interfaces of each geographical region can be detected separately. This ensures both the comprehensiveness of the detection results and the efficiency of the detection process.

[0171] Figure 8A This is a schematic diagram of another system architecture provided for an embodiment of this application. (See diagram below.) Figure 8A As shown, the system architecture includes: terminal devices and servers. The server includes: a runtime system, a location analysis system, an interface positioning system, a data analysis system, and a detection result generation system. The terminal devices contain the first application to be detected.

[0172] Figure 8B for Figure 8A The diagram illustrates the interaction flow of the detection method for the application corresponding to the system architecture shown. Figure 8B As shown, the application detection method in this embodiment includes:

[0173] S801: The runtime system controls the startup and execution of the first application to be detected.

[0174] S802: The runtime system obtains the message sent by the terminal device through the first application.

[0175] In this embodiment, the runtime system provides a traffic proxy function to proxy the traffic data of the first application in various service geographic regions around the world in real time, thereby ensuring that traffic in all service geographic regions is detected and improving the comprehensiveness of detection.

[0176] S803: The runtime system sends messages to the location analysis system and the interface positioning system.

[0177] S804: The location analysis system identifies and processes the message to obtain the first identification result of the message. The first identification result is used to indicate whether the sending location and receiving location of the message are located in the same geographical area.

[0178] S805: The first identification result of the message sent by the location analysis system to the detection result generation system.

[0179] S806: The interface positioning system determines the service interface corresponding to the message.

[0180] The interface location system performs interface-level location for each packet, which facilitates obtaining interface-level detection results for each service interface.

[0181] S807: The interface positioning system sends the service interface corresponding to the message to the detection result generation module.

[0182] S808: The interface positioning system parses the target data to be transmitted from the message, decrypts the target data, and obtains the decrypted data.

[0183] S809: The interface positioning system sends decrypted data to the data analysis system.

[0184] S810: The data analysis system matches the decrypted data with the user information corresponding to the first application to obtain a second identification result of the message. The second identification result is used to indicate whether user information exists in the message.

[0185] S811: The second identification result is sent by the data analysis system to the detection result generation system.

[0186] S812: The detection result generation system generates the program detection result corresponding to the first application based on the service interface corresponding to the message and the first identification result and / or the second identification result of the message.

[0187] In this embodiment, S802 to S811 can be executed multiple times in a loop. S804-S805, S806-S809, and S810-S811 can be executed simultaneously, and there is no distinction in the order of execution.

[0188] Figure 9A This is a schematic diagram of yet another system architecture provided in an embodiment of this application. Figure 8A Based on the illustrated embodiments, as Figure 9A As shown, the terminal device includes: a static resolution module, a runtime plugin module, and a display module. The runtime system in the server includes: a dynamic operation module and a traffic proxy module; the location analysis system includes: an IP resolution module and a location analysis module; the interface positioning system includes: an encrypted traffic cracking module; the data analysis system includes: a user information matching module; and the detection result generation system includes: a detection result generation module.

[0189] Figure 9B for Figure 9A The diagram illustrates the interaction flow of the detection method for the application corresponding to the system architecture shown. Figure 9B As shown, the application detection method in this embodiment includes:

[0190] S901: The static parsing module performs reverse parsing on the installation package of the first application to be detected to obtain target information, which includes resource information required for the first application to start running.

[0191] S902: The static parsing module sends target information to the dynamic execution module.

[0192] Optionally, the target information may also include user information corresponding to the first application. When the target information includes user information corresponding to the first application, the static parsing module may also send the user information corresponding to the first application to the runtime system, so that the static parsing module can provide the data analysis system with the user information corresponding to the first application for user information matching processing.

[0193] S903: The dynamic running module interacts with the runtime plug-in module based on the target information to control the startup and operation of the first application.

[0194] For example, the dynamic runtime module sends control commands to the runtime plugin module, and the runtime plugin module sends event information to the dynamic runtime module. The runtime plugin module ensures the dynamic execution of the first application.

[0195] S904: The traffic proxy module obtains the messages sent by the terminal device through the first application.

[0196] S905: The traffic proxy module sends the message to the IP resolution module and the encrypted traffic cracking module.

[0197] S906: The IP resolution module parses the message to obtain the IP address corresponding to the message's receiving location.

[0198] S907: The location analysis module will determine the geographical region corresponding to the IP address in the preset correspondence as the geographical region to which the message is received.

[0199] S908: The location analysis module determines the geographical area corresponding to the first service interface that sends the message as the geographical area to which the message was sent.

[0200] S909: The location analysis module determines the first identification result of the message based on the geographical area to which the message's sending location belongs and the geographical area to which the receiving location belongs. The first identification result is used to indicate whether the message's sending location and receiving location are located in the same geographical area.

[0201] S910: The location analysis module sends the first identification result of the message to the detection result generation module.

[0202] S911: The encrypted traffic cracking module determines the service interface corresponding to the message.

[0203] S912: The encrypted traffic cracking module sends the corresponding service interface of the message to the detection result generation module.

[0204] S913: The encrypted traffic cracking module parses the target data to be transmitted from the message, decrypts the target data, and obtains the decrypted data.

[0205] S914: The encrypted traffic cracking module sends decrypted data to the user information matching module.

[0206] S915: The user information matching module matches the decrypted data with the user information corresponding to the first application to obtain the second identification result of the message. The second identification result is used to indicate whether there is user information in the message.

[0207] S916: The user information matching module sends the second identification result of the message to the detection result generation module.

[0208] It should be understood that S904 to S916 are executed multiple times in a loop, that is, multiple messages sent by the terminal device through the first application are detected and analyzed. When the detection is completed (for example, the number of detected messages reaches a preset number, or the detection time reaches a preset duration), the detection result generation module sends a termination command to the dynamic operation module.

[0209] S917: The detection result generation module generates the program detection result corresponding to the first application based on the service interface corresponding to the message and the first identification result and / or the second identification result of the message.

[0210] S918: The detection result generation module sends the program detection results to the display module.

[0211] S919: The display module shows the program's detection results.

[0212] In this embodiment, S906-S910, S911-S914, and S915-S916 can be executed simultaneously, and there is no distinction in the order of execution.

[0213] It should be understood that Figure 8B and Figure 9B The detection method for the application shown has the same technical effect as the above embodiments, and can be referred to the relevant descriptions of the above embodiments, which will not be repeated here.

[0214] Based on any of the above embodiments, the technical solution of this application will be illustrated below with a specific example. In this embodiment, the installation package of the application to be detected can be downloaded to the terminal device, thereby triggering the interaction process between the terminal device and the server to implement the application detection method in any of the above embodiments.

[0215] Figure 10 This is a schematic diagram illustrating the interface changes of a terminal device provided in an embodiment of this application. Figure 10 As shown, interface 1001 can display the identifier of the application to be tested. If the application to be tested is application X, the identifier can be the icon or name of application X. Interface 1001 can also display a "Detect" control. Clicking the "Detect" control can trigger the execution of the application detection method described in the above embodiment. When the terminal device receives the program detection result of application X from the server, interface 1001 can jump to interface 1002, which can be connected to the above... Figure 7A or Figure 7B The interface is similar and will not be described in detail here. Optionally, in one possible implementation, the above interface 1001 can first jump to interface 1003, and then jump to interface 1002. Interface 1003 can display the text message "Application detection in progress".

[0216] Figure 11 This is a schematic diagram illustrating the application detection process provided in an embodiment of this application. In this embodiment, it is assumed that the application X to be detected provides services in country A, country B, country C, and country D. Figure 11As shown, the detection process for application X is as follows:

[0217] (1) The terminal device uses a static parsing module to reverse-engineer the installation package of application X to obtain the resource information required for application X to start and run. As an example, such as... Figure 11 As shown in 1101, the parsed resource information may include:

[0218] Route list: en\ru\cn\eu

[0219] Library list: Library1\Library2

[0220] Device API interfaces: Device information interface (getImei), location information interface (getLocation), etc.

[0221] (2) The server interacts with the terminal device to control the startup and execution of application X. As an example, the interaction between the dynamic runtime module in the server and the runtime plugin module in the terminal device is as follows:

[0222] like Figure 11 As shown in 1102, the interactive commands corresponding to the dynamic running module in the server are as follows:

[0223] Send: Run APK

[0224] Send: Get webpage view text

[0225] Received: Updated location information "56215467812"

[0226] Receive: Retrieve device information "AAAaaa"

[0227] like Figure 11 As shown in 1103, the interaction instructions corresponding to the runtime plug-in module in the terminal device are as follows:

[0228] Receive: Run APK

[0229] Receive: Get the text of the webpage view

[0230] Send: Update location information "56215467812"

[0231] Send: Get device information "AAAaaa"

[0232] After the above interaction process, application X starts running, and, as Figure 11 As shown in 1113, the user information matching module of the server obtains the user information corresponding to application X, including:

[0233] Location information: 56215467812

[0234] Equipment Information: AAAaaa

[0235] (3) The server obtains the message sent by the terminal device through the first application.

[0236] For example, application X includes service interfaces corresponding to each service geographic region. The server proxies the traffic of each service interface through a traffic proxy module. As an example, such as... Figure 11 As shown in 1104, assume the service interfaces corresponding to each service geographic region are as follows:

[0237] Country A - Service Interface A: en.ttt.com / A

[0238] Country B - Service Interface B: eu.ttt.com / B

[0239] National C-Service Interface C: ru.ttt.com / C

[0240] National D-Service Interface D: cn.ttt.com / D

[0241] (4) The IP resolution module in the server parses the packet to obtain the IP address corresponding to the packet's receiving location. As an example, such as... Figure 11 As shown in 1105, assume the IP addresses resolved from the four packets are as follows:

[0242] Message 1: 199.60.4.20

[0243] Message 2: 154.12.1.3

[0244] Message 3: 163.43.9.4

[0245] Message 4: 172.78.45.45

[0246] (5) The location analysis module in the server maps IP addresses to geographical regions according to a preset mapping relationship, thus obtaining the geographical region to which the packet's receiving location belongs. As an example, such as... Figure 11 As shown in 1106, the geographical regions to which the receiving locations of the above four messages belong are as follows:

[0247] 199.60.4.20: National A

[0248] 154.12.1.3: National F

[0249] 163.43.9.4: Country D

[0250] 172.78.45.45: Country D

[0251] (6) The location analysis module in the server determines the geographical region to which the message was sent based on the service interface of the sent message. Assume the geographical regions to which the four messages were sent are as follows:

[0252] Message 1: Country A

[0253] Message 2: Country B

[0254] Message 3: Country C

[0255] Message 4: Country D

[0256] (7) The location analysis module in the server determines the first identification result of the message based on the geographical regions of the sending and receiving locations, namely: whether the message is transmitted across borders. As an example, such as... Figure 11 As shown in 1107, the first identification results of the above four messages are as follows:

[0257] Message 1: Country A -> Country D (Cross-border)

[0258] Message 2: Country B -> Country F cross-border

[0259] Message 3: Country C -> Country D cross-border

[0260] Message 4: Country D -> Country D not crosses borders

[0261] (8) The encrypted traffic cracking module in the server determines the service interface corresponding to the packet. As an example, such as... Figure 11 As shown in 1108, assume the geographical regions of the sending locations of the above four messages are as follows:

[0262] Message 1: Service Interface A

[0263] Message 2: Service Interface B

[0264] Message 3: Service Interface C

[0265] Message 4: Service Interface D

[0266] (9) The encrypted traffic cracking module in the server parses the target data to be transmitted from the message. As an example, such as Figure 11 As shown in 1109, the target data parsed from the above four messages is as follows:

[0267] Message 1:<dasdzxoiajs==>

[0268] Message 2: <8798797>

[0269] Message 3: <aaaaaa>

[0270] Message 4: <ssadasdasa>

[0271] (10) The encrypted traffic cracking module in the server decrypts the target data to obtain decrypted data. As an example, such as... Figure 11 As shown in 1110, the decrypted data corresponding to the above four messages is as follows:

[0272] Message 1: 56215467812

[0273] Message 2: 8798797

[0274] Message 3: AAAAaaa

[0275] Message 4: AAAAaaa

[0276] (11) The user information matching module in the server matches the decrypted data with the user information corresponding to the first application to determine the first identification result of the message, that is, whether user information exists in the message. Figure 11 As shown in 1111, the second identification results corresponding to the above four messages are as follows:

[0277] Message 1: 56215467812 contains user information.

[0278] Message 2: User information does not exist for 8798797

[0279] Message 3: AAAAaaa contains user information.

[0280] Message 4: AAAAaaa contains user information.

[0281] (12) The detection result generation module in the server integrates the service interface corresponding to each message, the first identification result, and the second identification result, such as Figure 11 As shown in 1112, we get:

[0282] Message 1: Service interface A contains user information across borders.

[0283] Message 2: Service interface B does not have user information across borders.

[0284] Message 3: Service interface C contains user information across borders.

[0285] Message 4: Service interface D does not contain user information across borders.

[0286] (13) The detection result generation module in the server generates the program detection result corresponding to application X based on the above integration results. For example... Figure 11 As shown in 1112, the program's detection results are as follows:

[0287] Service interface A is experiencing a critical error.

[0288] Service interface B is experiencing a minor error.

[0289] Service interface C encountered a critical error.

[0290] Service interface D is experiencing a minor error.

[0291] Alternatively, the program's detection results may look like this:

[0292] Service interface A encountered an error (cross-border transmission of user information).

[0293] Service interface B error (cross-border transmission)

[0294] Service interface C encountered an error (cross-border transmission of user information).

[0295] Service interface D encountered an error (user information exists).

[0296] Through the above process, the program detection result of application X is obtained, and the program detection result can be displayed on the terminal device.

[0297] Figure 12 This is a schematic diagram of an electronic device provided in an embodiment of this application. The electronic device can be a terminal device or a server as described in the above embodiments. Figure 12 As shown, the electronic device 1200 may include a processor 1201 (e.g., CPU), a memory 1202, and a transceiver 1203. The memory 1202 and transceiver 1203 may be coupled to the processor 1201. The processor 1201 controls the transceiver 1203 to perform the aforementioned sending and receiving operations of the terminal device or server, thereby enabling interaction between the terminal device and the server. The memory 1202 may include high-speed random-access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. The memory 1202 may store various instructions for performing various processing functions and implementing the method steps of this application. The transceiver 1203 may be integrated into the transceiver of the electronic device or may be a separately configured transceiver antenna on the electronic device. In this embodiment, the memory 1202 stores computer-executable program code, including instructions. When the processor 1201 executes the instructions, the instructions cause the processor 1201 of the electronic device to perform the actions described in the method embodiment above. The implementation principle and technical effects are similar and will not be repeated here. Optionally, the electronic device 1200 involved in this application may further include: a power supply 1204, a communication bus 1205, and a communication port 1206. The communication bus 1205 is used to realize communication connections between components. The communication port 1206 is used to realize communication connections between the electronic device and other peripherals.

[0298] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0299] The term "multiple" in this document refers to two or more. The term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Furthermore, the character " / " in this document generally indicates an "or" relationship between the preceding and following related objects; in formulas, the character " / " indicates a "division" relationship between the preceding and following related objects. Additionally, it should be understood that in the description of this application, words such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0300] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. It is also understood that in the embodiments of this application, the sequence number of each process does not imply the order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.< / ssadasdasa> < / aaaaaa>

Claims

1. A method for detecting an application, applied to a server, characterized in that, include: During the operation of the first application to be tested, for each service interface included in the first application, at least one message sent by the terminal device through the service interface is obtained through the proxy interface corresponding to the service interface; wherein, the first application includes service interfaces corresponding to K geographical regions, and the server is configured with a proxy interface corresponding to each service interface, where K is an integer greater than or equal to 1; the geographical region corresponding to each service interface is set as the geographical region to which the message sent through the service interface belongs; the geographical region is the region corresponding to a country. The identification result of each message is determined. The identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and whether user information exists in the message. For each service interface, based on the identification result of the at least one message sent through the service interface, the interface detection result corresponding to the service interface is determined; based on the interface detection results corresponding to the K service interfaces, the program detection result corresponding to the first application is generated, and the program detection result corresponding to the first application includes the interface detection results corresponding to the K service interfaces; Determining the interface detection result corresponding to the service interface based on the identification result of the at least one message sent through the service interface includes: If the identification result of each of the at least one messages indicates that the sending location and receiving location of the message are located in the same geographical area, and there is no user information in the message, then it is determined that the interface detection result indicates that the service interface is not abnormal; or, If the identification result of the first message in at least one message indicates that the sending location and receiving location of the message are not in the same geographical area, and the message contains user information, then it is determined that the interface detection result indicates that the service interface is abnormal.

2. The method according to claim 1, characterized in that, The identification result of each message includes a first identification result, which is used to indicate whether the sending location and receiving location of the message are located in the same geographical area; For any given message, determine the identification result of the message, including: Determine the geographical region to which the message was sent and the geographical region to which the message was received; If the geographical region to which the sending location belongs is the same as the geographical region to which the receiving location belongs, then the first identification result of the message indicates that the sending location and the receiving location of the message are located in the same geographical region; If the geographical region to which the sending location belongs is different from the geographical region to which the receiving location belongs, then the first identification result of the message indicates that the sending location and the receiving location of the message are not located in the same geographical region.

3. The method according to claim 2, characterized in that, The first application includes service interfaces corresponding to K geographical regions, where K is an integer greater than or equal to 1; determining the geographical region to which the message's sending location belongs, and the geographical region to which the message's receiving location belongs, includes: From the K service interfaces, determine the first service interface to send the message; The geographical region corresponding to the first service interface shall be taken as the geographical region to which the message is sent. The message is parsed to obtain the geographical region to which the message was received.

4. The method according to claim 3, characterized in that, The message is parsed to obtain the geographical region to which the message was received, including: The Internet Protocol (IP) address corresponding to the receiving location of the message is obtained by parsing the message. Obtain a preset mapping relationship, which indicates the mapping relationship between different IP addresses and different geographical regions; The geographical region corresponding to the IP address in the preset correspondence is determined as the geographical region to which the message is received.

5. The method according to any one of claims 1, 3-4, characterized in that, The identification result of each message includes a second identification result, which is used to indicate whether user information exists in the message; For any given message, determine the identification result of the message, including: The target data to be transmitted is obtained by parsing the message; The target data is decrypted to obtain decrypted data; The decrypted data is matched with the user information corresponding to the first application to obtain the second identification result of the message.

6. The method according to claim 5, characterized in that, The user information corresponding to the first application includes at least one information item; The decrypted data is matched with the user information corresponding to the first application to obtain a second identification result of the message, including: Each information item is matched with the decrypted data to obtain the matching result for each information item; If the matching result of at least one of the information items is successful, then the second identification result of the message indicates that user information exists in the message; If the matching result of the at least one information item is not successful, then the second identification result of the message indicates that there is no user information in the message.

7. The method according to any one of claims 1, 3-4, and 6, characterized in that, Before obtaining at least one message sent by the terminal device through the service interface via the proxy interface corresponding to each service interface included in the first application, the method further includes: A control command is sent to the terminal device, the control command being used to control the startup and execution of the first application.

8. The method according to claim 7, characterized in that, Sending control commands to the terminal device includes: Receive target information sent by the terminal device, the target information including resource information required for the first application to start running; Based on the target information, the control command is sent to the terminal device.

9. The method according to any one of claims 1, 3-4, 6, and 8, characterized in that, After generating the program detection result corresponding to the first application, the method further includes: Display the program's detection results; or... Send the detection results from the program.

10. An application detection device, applied to a server, characterized in that, include: The acquisition unit is configured to, during the operation of the first application to be detected, acquire at least one message sent by the terminal device through each service interface included in the first application, via a proxy interface corresponding to the service interface; wherein, the first application includes service interfaces corresponding to K geographical regions, and the server is configured with a proxy interface corresponding to each service interface, where K is an integer greater than or equal to 1; the geographical region corresponding to each service interface is set as the geographical region to which the message sent through that service interface belongs; the geographical region is the region corresponding to a country. The determining unit is used to determine the identification result of each message. The identification result of each message is used to indicate whether the sending location and receiving location of the message are located in the same geographical area, and whether user information exists in the message. The generation unit is configured to, for each service interface, determine the interface detection result corresponding to the service interface based on the identification result of the at least one message sent through the service interface; and generate the program detection result corresponding to the first application based on the interface detection results corresponding to the K service interfaces, wherein the program detection result corresponding to the first application includes the interface detection results corresponding to the K service interfaces. The generation unit is specifically configured to determine, if the identification result of each of the at least one messages indicates that the sending location and receiving location of the message are located in the same geographical area, and there is no user information in the message, then the interface detection result indicates that the service interface is not abnormal; or, If the identification result of the first message in at least one message indicates that the sending location and receiving location of the message are not in the same geographical area, and the message contains user information, then it is determined that the interface detection result indicates that the service interface is abnormal.

11. An electronic device, characterized in that, include: Memory and processor; The processor is configured to couple with the memory, read and execute instructions in the memory to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed, implement the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes a computer program that, when executed, implements the method described in any one of claims 1 to 9.

Images