Detecting method, medium, device and computing device for application mirroring state

Abstract

Embodiments of the present application provide a detection method, medium, device and computing equipment for application duplication state. The method comprises: obtaining a running feature of an application to be detected, the running feature being used to reflect a running condition of the application to be detected during running; determining whether the running feature matches a predetermined duplication feature, wherein the duplication feature is used to reflect a running condition of the application to be detected in a duplication state; and determining that the application to be detected is in the duplication state when the running feature matches the duplication feature. By determining the duplication feature of the application in the duplication state in advance, and comparing the running feature of the application during running, it can be determined whether the application is in the duplication state accurately.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and more specifically, the embodiments of the present invention relate to methods, media, apparatus and computing devices for detecting clone states. Background Technology

[0002] This section is intended to provide background or context for embodiments of the invention as set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section.

[0003] Normally, only one application can be installed on a single device. If the application has an account system, you need to switch accounts to use different accounts on the device. To enable multiple accounts for an application to run on a single device, a technology has been developed that allows applications to be cloned. This means that an application can be cloned, allowing multiple instances of the application to run simultaneously on the device, with different applications logging into different accounts. For example, after cloning an application, it can include a main application and one or more cloned applications, which can be used to log in to different accounts.

[0004] While app cloning technology brings convenience to users, it also attracts malicious actors who use it to perform illegal operations. Therefore, in some scenarios, it's necessary to detect whether a currently running application is in cloned form in order to take appropriate action based on the detection results. Summary of the Invention

[0005] Considering that some criminals may use app cloning technology to carry out illegal operations, it is necessary to detect whether an application is in a cloned state in certain scenarios. Currently, there is no accurate mechanism for detecting app cloning.

[0006] Therefore, there is a great need for an improved solution to detect when an application is in a cloned state, to meet the detection requirements for application cloned states in certain scenarios.

[0007] In a first aspect of the present invention, a method for detecting an application clone state is provided, the method comprising:

[0008] The operational characteristics of the application to be tested are obtained, and the operational characteristics are used to reflect the operational status of the application to be tested during its operation.

[0009] Determine whether the running characteristics match the pre-determined clone characteristics, wherein the clone characteristics are used to reflect the running status of the application to be detected when it is in clone state;

[0010] If the running characteristics match the clone characteristics, it is determined that the application to be detected is in a clone state.

[0011] In one embodiment of the present invention, the clone feature is determined based on the running data of the application to be detected running in multiple clone tools. The clone feature includes common features and / or proprietary features. The common features are features that the application to be detected has when running in all clone tools, and the proprietary features are features that the application to be detected is unique to when running in a single clone tool.

[0012] In another embodiment of the present invention, determining whether the operational characteristics match the predetermined clone characteristics includes:

[0013] If the running feature matches any of the common features, the running feature is determined to match the clone feature;

[0014] If it is determined that the running feature does not match any of the common features, it is determined whether the running feature matches the proprietary feature.

[0015] If the running feature matches any of the proprietary features, then the running feature is determined to match the clone feature.

[0016] In yet another embodiment of the present invention, the common features include one or more of the following:

[0017] The package name of the application to be detected has been modified;

[0018] The number of processes corresponding to the application to be detected is greater than 1;

[0019] The absolute location of the private file directory of the application to be detected has been modified;

[0020] The permissions of the parent directory of the private file directory of the application to be detected are set to readable.

[0021] The port corresponding to the application to be detected is in an occupied state. In another embodiment of the present invention, the proprietary feature includes one or more of the following:

[0022] The runtime library of the application to be detected includes runtime libraries in a preset blacklist;

[0023] The method call stack information of the application to be detected includes the package name in the preset blacklist;

[0024] The logs of the application to be detected include package names from a preset blacklist.

[0025] In another embodiment of the present invention, the method is performed by a terminal on which the application is installed, and the method further includes:

[0026] If it is determined that the application to be detected is in a cloned state, the user identifier and detection result corresponding to the application to be detected are sent to the server so that the server refuses to issue rewards to the user corresponding to the user identifier.

[0027] In another embodiment of the present invention, the method is performed by a terminal on which the application is installed, and the method further includes:

[0028] If it is determined that the application to be detected is in a cloned state, the user identifier corresponding to the application to be detected is sent to the server so that the server refuses to issue rewards to the user corresponding to the user identifier.

[0029] In another embodiment of the present invention, the method is executed by a server, and the step of obtaining the operational characteristics of the application to be detected includes:

[0030] The currently determined clone characteristics are sent to the terminal with the application to be detected installed, so that the terminal can collect running characteristics that match the type of the clone characteristics from the running data of the application.

[0031] Receive the operational characteristics sent by the terminal.

[0032] In another embodiment of the present invention, the method is executed by a server, the clone feature is determined based on runtime data of the application to be detected running in multiple clone tools, and the method further includes:

[0033] Monitor the version changes of the multiple clone tools;

[0034] When the version of any of the clone tools is updated, the latest version of the clone tool is obtained, and the clone feature is updated based on the running data of the application to be detected in the latest version of the clone tool.

[0035] In a second aspect of the present invention, a computer-readable storage medium is provided, wherein computer instructions are stored thereon, and when executed, the computer instructions implement the method mentioned in the first aspect above.

[0036] In a third aspect of the present invention, a detection device for clone applications is provided, the detection device comprising:

[0037] The acquisition module is used to acquire the running characteristics of the application to be detected, and the running characteristics are used to reflect the running status of the application to be detected during the running process;

[0038] A matching module is used to determine whether the running characteristics match the pre-determined clone characteristics, wherein the clone characteristics are used to reflect the running status of the application to be detected when it is in clone state;

[0039] The detection module is used to determine that the application to be detected is in a clone state when the running characteristics match the clone characteristics.

[0040] In a fourth aspect of the present invention, a computing device is provided, the computing device including a processor, a memory, and computer instructions stored in the memory that are executable by the processor, wherein the processor executes the computer instructions to implement the method mentioned in the first aspect above.

[0041] Considering the differences in an application's operation when it's in a cloned state and not in a cloned state, we can obtain cloned characteristics that definitively reflect the application's operation in cloned state. When detecting whether an application is in a cloned state, we can collect the application's operational characteristics and compare them with pre-defined cloned characteristics. If the operational characteristics match the cloned characteristics, the application is considered to be in a cloned state; otherwise, it is considered to be in a non-cloned state. In this way, we can accurately identify whether the current application is in a cloned state, and then perform subsequent processing based on the detection results. Attached Figure Description

[0042] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. Several embodiments of the invention are illustrated in the drawings by way of example and not limitation, wherein:

[0043] Figure 1(a) schematically illustrates an application scenario of an embodiment of the present invention;

[0044] Figure 1(b) schematically illustrates another application scenario of the embodiment of the present invention;

[0045] Figure 2 A flowchart illustrating an embodiment of the present invention for detecting clone status is shown.

[0046] Figure 3 This diagram illustrates, in accordance with an embodiment of the present invention, a method for determining whether operational features and clone features match.

[0047] Figure 4 A schematic diagram illustrating the clone feature of an embodiment of the present invention is shown.

[0048] Figure 5 A schematic diagram illustrating real-time updating of clone features according to an embodiment of the present invention is shown.

[0049] Figure 6 A schematic diagram of a computer-readable storage medium according to an embodiment of the present invention is shown.

[0050] Figure 7 A schematic diagram of an application of a clone status detection device according to an embodiment of the present invention is shown.

[0051] Figure 8 A schematic diagram of a computing device according to an embodiment of the present invention is shown.

[0052] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0053] The principles and spirit of the invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are given merely to enable those skilled in the art to better understand and implement the invention, and are not intended to limit the scope of the invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0054] Those skilled in the art will recognize that embodiments of the present invention can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0055] According to embodiments of the present invention, a method, medium, apparatus, and computing device for detecting the cloned state of an application are proposed.

[0056] In this document, it should be understood that any number of elements in the accompanying drawings is for illustrative purposes only and not for limitation, and any naming is for distinction only and has no limiting meaning. The principles and spirit of the invention are explained in detail below with reference to several representative embodiments. Invention Overview

[0058] App cloning technology allows multiple accounts for a single application to be logged into on a single device. For example, by cloning an application, multiple instances of the application can run simultaneously on the same device, each logging into a different account. Taking instant messaging applications as an example, after cloning an instant messaging application, the main application and one or more cloned applications can run concurrently on the device, and the main application and cloned applications can be used to log into different accounts.

[0059] While app cloning technology brings convenience to users, it also attracts many malicious actors who use it for illicit activities. For example, many app publishers offer rewards to attract users, such as cash rewards for registering an app. Malicious actors can use app cloning technology to register and run multiple instances of the same app on a single phone to fraudulently claim these rewards. Therefore, in certain scenarios, it's crucial to distinguish whether an app is in cloned form to promptly detect illegal activities using app cloning technology or to determine which subsequent actions to take based on whether an app is in cloned form.

[0060] The inventors have discovered that an application's operation differs when it is in a cloned state and not in a cloned state. For example, intermediate data and status data differ during operation. In other words, when an application is in a cloned state, it exhibits characteristics different from its non-cloned state. Therefore, it is possible to acquire operational data generated when an application is in a cloned state, and extract features reflecting the application's operation in this state, hereinafter referred to as cloned features. To detect whether an application is in a cloned state, the application's operational features can be collected and compared with the pre-extracted cloned features. If the operational features match the cloned features, the application is considered to be in a cloned state; otherwise, it is in a non-cloned state. In this way, it is possible to accurately identify whether the current application is in a cloned state, and further processing can be performed based on the detection results.

[0061] Considering that applications typically rely on cloning tools to implement clone functionality, and the number and variety of such tools on the market are relatively limited, we can allow the application to run on various cloning tools to acquire runtime data. Then, based on this data, we can extract the cloning characteristics of the application running in cloned mode. This method yields more comprehensive cloning characteristics, and the detection results based on these characteristics are more accurate.

[0062] After introducing the basic principles of the present invention, various non-limiting embodiments of the present invention will be described in detail below.

[0063] Application Scenarios Overview

[0064] First, referring to Figures 1(a) and 1(b), which are schematic diagrams of application scenarios according to embodiments of this disclosure. Typically, an application includes a client and a server. The client is usually installed on the mobile terminal 11, while the server is deployed on the server 12. Taking application A as an example, considering that the server 12 has more powerful computing resources, it can use the server 12 to determine the clone characteristics of application A when it is running in a cloned state. For example, the server 12 can obtain various types of clone tools (e.g., clone tool 1 to clone tool n) from the application market, allow application A to run in these clone tools, and extract clone characteristics based on the running data. Then, the server 12 can send the determined clone characteristics to the mobile terminal 11, or it can send a type identifier indicating the type to which the clone characteristics belong to the mobile terminal 11.

[0065] When a user runs application A on mobile terminal 11, due to the large amount of runtime data, mobile terminal 11 cannot collect all types of runtime features. Therefore, mobile terminal 11 can determine which types of features of application A need to be collected during runtime based on the clone feature or clone feature type identifier issued by server 12, and collect the corresponding types of runtime features.

[0066] In some scenarios, as shown in Figure 1(a), the server 12 can send the type identifier of the clone feature to the mobile terminal 11. After the mobile terminal 11 collects the running feature, it can send the running feature to the server 12. The server 12 compares the running feature with the pre-determined clone feature to determine whether the two match. If they match, the application A is considered to be in clone state.

[0067] In some scenarios, if the server 12 sends the clone feature to the mobile terminal 11, the mobile terminal 11 can directly compare the running feature with the clone feature received from the server 12 after collecting the running feature, and determine whether the two match. If they match, the application A is considered to be in clone state, and the detection result is fed back to the server 12.

[0068] Exemplary methods

[0069] The following section, in conjunction with the application scenarios shown in Figures 1(a) and 1(b), refers to... Figure 2 This description outlines a method for detecting application clone status according to an exemplary embodiment of the present invention. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of the invention, and the embodiments of the invention are not limited in any way. Rather, the embodiments of the invention can be applied to any applicable scenario.

[0070] As shown in Figures 1(a) and 1(b), the method for detecting the cloned state of an application provided in this embodiment can be executed by a terminal that has the application to be detected installed, such as a mobile phone, tablet, or laptop computer, or by a server or server cluster that has deployed the server-side application to be detected.

[0071] like Figure 2 The diagram shows a flowchart of the method for detecting the cloned state of an application, which may include the following steps:

[0072] S202. Obtain the running characteristics of the application, wherein the running characteristics are used to reflect the running status of the application during its operation;

[0073] In step S02, the operational characteristics of the application to be detected can be obtained. These operational characteristics can be collected during the operation of the application and can be various features that reflect the operational status of the application. For example, they can be some status parameters, operation results, dependent operating environment, log information, etc. during the operation of the application. This embodiment of the disclosure does not impose any limitations.

[0074] S204. Determine whether the running characteristics match the pre-determined clone characteristics, wherein the clone characteristics are used to reflect the running status of the application when it is in clone state;

[0075] Since applications typically exhibit different characteristics when running in cloned mode compared to their non-cloned mode, these characteristics can be extracted in advance and designated as cloned features. For example, users often need to use cloning tools to achieve clone functionality. Therefore, the application can be run in these tools beforehand, and runtime data can be collected. This data can then be compared with the application's runtime data in its non-cloned mode to identify differences. Based on these differences, the unique cloned features of the application when running in cloned mode can be extracted.

[0076] In step S204, after acquiring the operational features of the application to be detected, these operational features can be compared with pre-determined clone features to determine whether they match. For example, if one or more of the acquired operational features match clone features, they are considered to match. Specifically, a match is considered to have occurred when a certain operational feature is identical to a certain clone feature, or when a certain operational feature meets the conditions specified by the clone feature.

[0077] S206. If the running characteristics match the clone characteristics, determine that the application is in clone state.

[0078] In step S206, if the running characteristics and clone characteristics of the application to be detected match, the application is determined to be in a cloned state; otherwise, the application is determined to be in a non-cloned state. After obtaining the detection results, further processing can be performed based on the detection results.

[0079] In some embodiments, clone features can be determined based on runtime data of the application under test running in multiple clone tools. The clone features include common features and / or proprietary features, wherein common features are features that the application under test has when running in all clone tools, and proprietary features are features that are unique to the application when running in a single clone tool.

[0080] When implementing application cloning functionality, cloning tools are typically used. Current implementations can be divided into two categories: one utilizes the cloning function provided by the operating system, and the other utilizes third-party application tools on the operating system. Considering that most cloning tools are currently developed based on open-source projects, applications running within these tools exhibit similar characteristics. Therefore, these characteristics can be extracted as common features exhibited by applications running within cloning tools. Of course, since third-party cloning tools can be tools specifically developed by malicious actors to evade detection, they can hide certain features during operation to avoid detection, making the cloning features highly concealed. Typically, these cloning features are unique to applications running under a specific cloning tool. Therefore, it is necessary to further mine these unique features when applications run under such tools and collect them to form proprietary features.

[0081] By extracting the above two types of features from the running data of the application to be detected in the clone tool, the extracted clone features can be more comprehensive and accurate, thereby enabling the detection of the application to be detected being run using the vast majority of clone tools.

[0082] Since common features are those that exist across multiple clone tools, there is typically only one common feature data point for each type of feature. However, for proprietary features, each clone tool will have one corresponding data point for the same type of feature; that is, a proprietary feature is a collection of multiple data points. For example... Figure 3As shown, when matching the runtime features and clone features of the application to be detected, to improve matching efficiency, the runtime features can first be matched with common features of the corresponding type. As long as one runtime feature matches a common feature, the two are considered a match, and no further feature comparison is needed; the application to be detected can be determined to be in a clone state. If no match is found after matching all common features, then the specific features can be matched. If one runtime feature matches a specific feature, the two are considered a match, and the application to be detected can be determined to be in a clone state; otherwise, it is determined to be in a non-clone state. This method can greatly improve matching efficiency.

[0083] Of course, in some scenarios, to avoid misjudgment, the comparison results of common features and specific features can be combined to determine the final matching result, so as to ensure that the detection result is more reliable.

[0084] Common features are those that appear when the app is run across various app cloning tools. In some embodiments, such as... Figure 4As shown, common features may include one or more of the following: (1) The package name of the application to be tested has been modified; Generally speaking, the application installation package name of each application is unique, and its package name is named according to a fixed rule. When the application is not in a cloned state, its package name is usually fixed, for example, the application package name is com.abc. When in a cloned state, its package name is usually modified, for example, the package name will be modified to com.abc2. (2) The number of processes corresponding to the application to be tested is greater than 1; Normally, when an application is running, it corresponds to one process. Therefore, when the application is not in a cloned state, the number of processes corresponding to it is 1. When the application is in a cloned state, since multiple applications are running at the same time, the number of processes corresponding to it is often greater than 1. (3) The absolute location of the private file directory of the application to be tested has been modified. Generally speaking, when the application is not in a cloned state, the naming rule for the absolute location of its private file directory is: / data / data / package name, for example, / data / data / com.abc. Because the application's package name is modified in cloned state, the absolute location of the private file directory is also modified accordingly, for example, it is modified to: / data / data / com.abc2 / , or to data / data / com.aaa / virtual / com.abc2. (4) The permissions of the parent directory of the application's private file directory are set to readable; generally, when the application is not cloned, the permissions of the parent directory of its private file directory are set to unreadable, while when the application is cloned, the permissions of the parent directory of its private file directory are set to readable. (5) The port corresponding to the application is occupied. When the application is not cloned, its corresponding port is unoccupied, while when the application is cloned, the port corresponding to the application is occupied.

[0085] Of course, the common features listed above are merely exemplary examples, and other types of common features may also be included in the clone feature list. When the running characteristics of the application to be detected match any of the above common features, it can be determined that it is in a clone state.

[0086] A proprietary feature is a feature that changes as the application is run by a different clone tool. A proprietary feature is a feature unique to a particular clone tool. In some embodiments, the proprietary feature includes one or more of the following: (1) The application's runtime library includes runtime libraries in a preset blacklist; wherein, the runtime library is the environment dependency library for the application's runtime, which includes the application's own image resources, string resources, program libraries, etc., as well as the image resources, string resources, program libraries, etc. provided by the system. By statistically analyzing the running data of the application in different clone tools, it was found that the application's runtime library is different when running in different clone tools, that is, the runtime library changes with the clone tool. Therefore, the names of the runtime libraries of the application running in different clone tools can be collected to construct a blacklist. When the application's runtime library includes runtime libraries in the blacklist, it can be determined that it is in a clone state. (2) The application's call method stack information includes package names in a preset blacklist; the call method stack is a list of methods that saves the methods called by the application during its operation in the order of call.

[0087] Similarly, based on the collected runtime data, it was found that when an application runs in different clone tools, the package name in its call method stack information will also change with the change of clone tools. Therefore, it is also possible to collect the package names in the call method stack information when the application runs in different clone tools and build a blacklist. (3) The application logs include the package names in the preset blacklist. When an application runs in different clone tools, the package names in its recorded log data will also change with the change of clone tools. Therefore, it is also possible to collect the package names in the log data when the application runs in different clone tools and build a blacklist.

[0088] Once the runtime characteristics of the application to be detected are obtained, the runtime characteristics can be compared with the aforementioned proprietary characteristics of the corresponding type. If the runtime characteristics match any item in the blacklist of proprietary characteristics, then the two are considered to be a match.

[0089] Of course, the types of proprietary features are not limited to those listed above. As clone tools are updated and changed, the types of proprietary features will also change.

[0090] In some scenarios, this method can be executed on a terminal with the client of the application to be detected installed. When collecting the runtime characteristics of the application to be detected, the terminal considers that a large amount of runtime data is involved during operation. If all characteristics are collected, too many runtime characteristics need to be collected, and many of them are useless for clone status detection, which is wasteful of resources and not conducive to subsequent matching. Therefore, the terminal can be informed in advance which types of characteristics need to be obtained during the application's runtime. For example, the server can send certain clone characteristics to the terminal. Based on the types of clone characteristics sent by the server, the terminal can determine the types of runtime characteristics to be collected, and then collect runtime characteristics that match the above types from the runtime data of the application to be detected during its operation. In this way, the terminal can accurately collect characteristics related to clone status detection when collecting runtime characteristics.

[0091] After collecting the operational features, the matching process described above can be executed to obtain the detection result of whether the application is in a cloned state.

[0092] After receiving the cloned feature from the server, the terminal can store it locally and retrieve it directly during subsequent detection. Furthermore, considering that the cloned feature tool will be continuously updated, and consequently the cloned feature will also be updated, the server can also send the updated cloned feature to the terminal device. This ensures that the cloned feature used during the detection process is the latest version.

[0093] In some embodiments, the method for detecting app clone status can be used to detect scenarios where black and gray market operators use app cloning technology to register a large number of accounts to fraudulently obtain rewards from app publishers.

[0094] If a terminal determines that an application under test is in a cloned state, it can send the user identifier corresponding to that application and the detection result to the server. The server can then refuse to issue rewards to the user corresponding to that user identifier. This method can promptly detect illegal registration operations by black market actors, reducing losses for application publishers.

[0095] In some embodiments, the method can also be executed by a server, which can send the currently determined clone characteristics to terminals with the application to be detected installed. When a user runs the application on the terminal, the terminal can collect runtime characteristics matching the types of the received clone characteristics from the runtime data of the application to be detected. Of course, in some embodiments, to reduce data transmission volume, the server can also only send a type identifier indicating the type to which the clone characteristics belong to the terminal. The terminal can then collect runtime characteristics matching the type identifiers from the runtime data of the application to be detected.

[0096] After the terminal collects the running characteristics, it can send the running characteristics to the server, which will then perform the subsequent matching operation between the running characteristics and the clone characteristics.

[0097] To avoid detection that an application is in a cloned state, developers of cloning tools constantly update their tools to combat clone detection. When a cloning tool is updated, the runtime characteristics of the application being detected while running within the cloning tool also change accordingly. To ensure real-time updates to these cloned characteristics and obtain more accurate detection results, [further measures are needed]. Figure 5 As shown, the server can monitor the version changes of various clone tools in the application market. When it finds that a certain clone tool has been updated, it obtains the latest version of the clone tool and updates the clone features based on the application's running status in the latest version of the clone tool.

[0098] When the clone tool is updated, the updated clone features or clone feature types can be sent to the terminal so that the terminal can collect running features based on the latest clone feature types when running the application to be detected next time.

[0099] By updating the clone characteristics in real time via the server, we can cope with the ever-evolving anti-detection capabilities of clone tools and promptly detect the cloned status of the application.

[0100] Exemplary media

[0101] After introducing the method of exemplary embodiments of the present invention, the following references are made. Figure 6 A computer-readable storage medium provided in an exemplary embodiment of the present invention will be described. This storage medium stores a computer program, which, when executed, implements the application clone state detection method described in one or more of the above embodiments.

[0102] The specific details of the method for detecting the clone state of the above application can be found in the description in the above embodiments, and will not be repeated here.

[0103] Exemplary device

[0104] After introducing the medium of exemplary embodiments of the present invention, the following references are made. Figure 7 An apparatus for detecting application clone status according to an exemplary embodiment of the present invention will be described. The detection apparatus may include:

[0105] The acquisition module 71 is used to acquire the running characteristics of the application to be detected, the running characteristics being used to reflect the running status of the application to be detected during its operation.

[0106] The matching module is used to determine whether the running characteristics match the pre-determined clone characteristics, wherein the 72 clone characteristics are used to reflect the running status of the application to be detected when it is in clone state;

[0107] The detection module 73 is used to determine that the application to be detected is in a cloned state when the running characteristics match the cloned characteristics. Specific details of the method for detecting the cloned state of the application implemented by this device can be found in the description in the above embodiments, and will not be repeated here.

[0108] Exemplary computing device

[0109] After introducing the methods, media, and apparatus of exemplary embodiments of the present invention, the following references are made. Figure 8 This invention provides an exemplary embodiment of a computing device for detecting whether an application is in a cloned state.

[0110] Figure 8 The computing device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0111] like Figure 8 As shown, the computing device 800 is presented in the form of a general-purpose computing device. The components of the computing device 800 may include, but are not limited to: at least one processing unit 801, at least one storage unit 802, and a bus 803 connecting different system components (including the processing unit 801 and the storage unit 802).

[0112] The 803 bus includes a data bus, a control bus, and an address bus.

[0113] Storage unit 802 may include readable media in the form of volatile memory, such as random access memory (RAM) 8021 and / or cache memory 8022, and may further include readable media in the form of non-volatile memory, such as read-only memory (ROM) 8023.

[0114] Storage unit 802 may also include a program / utility 8025 having a set (at least one) program module 8024, such program module 8024 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0115] The computing device 800 can also communicate with one or more external devices 804 (such as a keyboard, pointing device, etc.).

[0116] This communication can be performed via input / output (I / O) interface 805. Furthermore, the computing device 800 can also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 806. Figure 8 As shown, network adapter 806 communicates with other modules of computing device 800 via bus 803. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with computing device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0117] The computing device can be a mobile terminal such as a mobile phone, computer, or tablet, or it can be a server or server cluster.

[0118] It should be noted that although several units / modules or sub-units / modules of the clone detection device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided and embodied by multiple units / modules.

[0119] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0120] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for detecting clone state, the method comprising: The operational characteristics of the application to be tested are obtained, and the operational characteristics are used to reflect the operational status of the application to be tested during its operation. Determine whether the running characteristics match the pre-determined clone characteristics, wherein the clone characteristics are used to reflect the running status of the application to be detected when it is in clone state; If the running characteristics match the clone characteristics, it is determined that the application to be detected is in a clone state; The clone feature is determined based on the running data of the application to be detected running in multiple clone tools. The clone feature includes common features and unique features. The common features are features that the application to be detected has when running in all clone tools. The unique features are features that the application to be detected has when running in a single clone tool. Determining whether the operational characteristics match the pre-determined clone characteristics includes: If the running feature matches any of the common features, the running feature is determined to match the clone feature; If it is determined that the running feature does not match any of the common features, it is determined whether the running feature matches the proprietary feature. If the running feature matches any of the proprietary features, then the running feature is determined to match the clone feature.

2. The method according to claim 1, wherein the common features include one or more of the following: The package name of the application to be detected has been modified; The number of processes corresponding to the application to be detected is greater than 1; The absolute location of the private file directory of the application to be detected has been modified; The permissions of the parent directory of the private file directory of the application to be detected are set to readable. The port corresponding to the application to be detected is in a state of being occupied.

3. The method according to claim 1, wherein the proprietary features include one or more of the following: The runtime library of the application to be detected includes runtime libraries in a preset blacklist; The method call stack information of the application to be detected includes the package name in the preset blacklist; The logs of the application to be detected include package names from a preset blacklist.

4. The method according to any one of claims 1-3, wherein the method is executed by a terminal on which the application to be tested is installed, and the step of obtaining the operational characteristics of the application to be tested includes: Receive the type identifier of the clone feature sent by the server; During the operation of the application to be tested, operational features that match the type identifier are collected from the operational data of the application to be tested.

5. The method according to any one of claims 1-3, wherein the method is performed by a terminal on which the application is installed, and the method further comprises: If it is determined that the application to be detected is in a cloned state, the user identifier corresponding to the application to be detected is sent to the server so that the server refuses to issue rewards to the user corresponding to the user identifier.

6. The method according to any one of claims 1-3, wherein the method is executed by a server, and the step of obtaining the operational characteristics of the application to be detected includes: The currently determined clone characteristics are sent to the terminal with the application to be detected installed, so that the terminal can collect running characteristics that match the type of the clone characteristics from the running data of the application. Receive the operational characteristics sent by the terminal.

7. The method according to any one of claims 1-3, wherein the method is executed by a server, the clone feature is determined based on runtime data of the application to be detected running in multiple clone tools, and the method further comprises: Monitor the version changes of the multiple clone tools; When any of the clone tools is updated, the latest version of the clone tool is obtained, and the clone feature is updated based on the running data of the application to be detected in the latest version of the clone tool.

8. A computer-readable storage medium storing computer instructions that, when executed, implement the method of any one of claims 1-7.

9. A detection device for a clone application, the detection device comprising: The acquisition module is used to acquire the running characteristics of the application to be detected, and the running characteristics are used to reflect the running status of the application to be detected during the running process; A matching module is used to determine whether the running characteristics match the pre-determined clone characteristics, wherein the clone characteristics are used to reflect the running status of the application to be detected when it is in clone state; The detection module is used to determine that the application to be detected is in a clone state when the running characteristics match the clone characteristics; The clone feature is determined based on the running data of the application to be detected running in multiple clone tools. The clone feature includes common features and unique features. The common features are features that the application to be detected has when running in all clone tools. The unique features are features that the application to be detected has when running in a single clone tool. When the matching module determines whether the running characteristics match the pre-determined clone characteristics, it is specifically used for: If the running feature matches any of the common features, the running feature is determined to match the clone feature; If it is determined that the running feature does not match any of the common features, it is determined whether the running feature matches the proprietary feature. If the running feature matches any of the proprietary features, then the running feature is determined to match the clone feature.

10. A computing device comprising a processor, a memory, and computer instructions stored in the memory executable by the processor, wherein the processor executes the computer instructions to implement the method of any one of claims 1-7.

Images