Application supervision method, system, electronic device and storage medium

Abstract

The present application discloses a method, system, electronic device and storage medium for supervising an application, wherein the method for supervising the application includes: obtaining an application tag; based on a firewall tool and the application tag, searching for and downloading an application installation package corresponding to the application tag; monitoring application operation data corresponding to the application installation package, obtaining a target application based on the application operation data, and generating a target application list; sending the target application list to a supervisory end so that the supervisory end can supervise the application; the method improves the security and reliability of the application installation process, and monitors the application operation data and sends the target application list to the supervisory end, thereby improving the timeliness, reliability and security of application supervision.

Description

Technical Field

[0001] The present application relates to the field of information security management, and in particular to a method, system, electronic device, and storage medium for supervising an application. Background Art

[0002] An application is a computer program developed to run on an operating system in order to complete one or several specific tasks.

[0003] As smart terminals such as smartphones and tablets become popular, the operating system of each smart terminal runs a variety of applications, such as entertainment applications, office applications, and learning applications. These applications bring a lot of convenience to users' lives.

[0004] However, due to some malicious behaviors during or after the installation of the application, such as bundling and virus intrusion during the installation process, and automatic acquisition of user information without the user's permission after installation, these problems may cause inconvenience to the user and even lead to serious economic losses.

[0005] Therefore, the above technical problems need to be solved urgently. Summary of the Invention

[0006] The embodiments of the present application provide an application supervision method, system, electronic device and storage medium to solve or partially solve the problems caused by malicious behaviors during or after the installation of the application, such as bundling and virus invasion during the installation process, and automatic acquisition of user information without user permission after installation. These problems may cause inconvenience to users and even lead to serious economic losses.

[0007] A method for regulating applications, comprising:

[0008] Get the application tag;

[0009] Based on the firewall tool and application tags, find and download the application installation package corresponding to the application tag;

[0010] Monitor application running data corresponding to the application installation package, obtain target applications based on the application running data, and use the data to generate a target application list;

[0011] The target application list is sent to the supervisory end so that the supervisory end can supervise the applications.

[0012] In a preferred example, the present application can be further configured to: search and download the application installation package corresponding to the application tag based on the firewall tool and the application tag, including:

[0013] Generate several groups of application lists based on the preset tag association model and application tags;

[0014] Obtain application ratings from several groups of application lists, filter out applications in the same category whose ratings are greater than or equal to the system application rating threshold based on the system application rating threshold and the application rating, and generate a target download application list based on the applications for downloading the application installation packages.

[0015] In a preferred example, the present application may be further configured to: after filtering out applications in the same category whose application scores are greater than or equal to the system application score threshold, further include:

[0016] Get the application name corresponding to the target application;

[0017] Based on the application database and the application name, determining whether the application name exists in a blacklist in the application database, and obtaining an application name confirmation result;

[0018] Based on the application name confirmation result, it is determined whether to add the application corresponding to the application name to the target download application list.

[0019] In a preferred example, the present application may be further configured to include: before sending the target application list to the supervisor, the following steps may be included:

[0020] Obtain the identity information of the supervisory party;

[0021] Based on the identity information, authenticate the supervisory end and obtain the authentication result;

[0022] If the authentication result is that the supervisory end passes the authentication, the target application list is sent to the supervisory end.

[0023] In a preferred example, the present application may be further configured as follows: the application running data includes running time;

[0024] After monitoring the application running data corresponding to the application installation package, it also includes:

[0025] Compare the running time threshold with the application running time to obtain a running time comparison result;

[0026] When the running time comparison result is that the application running time is greater than or equal to the running time threshold, the target application is determined and obtained, and the running information of the target application is sent to the supervisory end so that the supervisory end can confirm whether to close the target application.

[0027] In a preferred example, the present application may be further configured to: after monitoring the application running data corresponding to the application installation package, further include:

[0028] Mark abnormal data in application operation data;

[0029] Monitor and track abnormal data to determine whether the abnormal data is malicious behavior data.

[0030] In a preferred example, the present application may be further configured to: after sending the target application list to the supervisor, further include:

[0031] Use IPSec toolkit to transmit application access record information to the supervisory end. Application access record information includes application operation data and the number of access rights requested.

[0032] Compare the access permission request count threshold with the access permission request count to obtain an access permission request count comparison result;

[0033] If the comparison result of the number of access permission requests is that the number of access permission requests is greater than the access permission request threshold, the corresponding application name and running data are obtained, and the application name and running data are sent to the supervisory end to enable the supervisory end to confirm whether to uninstall the application.

[0034] The second purpose of this application is to provide an application supervision system.

[0035] The second object of the present application is achieved through the following technical solutions:

[0036] An application supervision system, comprising:

[0037] Get application tag module, used to get application tags;

[0038] A module for searching and downloading application installation packages is used to search and download application installation packages corresponding to application tags based on firewall tools and application tags;

[0039] A module for monitoring application running data and obtaining target application, which is used to monitor application running data corresponding to an application installation package, obtain target application based on the application running data, and generate a target application list;

[0040] The target application list sending module is used to send the target application list to the supervisory end so that the supervisory end can supervise the applications.

[0041] The third purpose of this application is to provide an electronic device.

[0042] The third object of the present application is achieved through the following technical solutions:

[0043] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for supervising the application program is implemented.

[0044] A computer-readable storage medium stores a computer program, which implements the above-mentioned supervision method of the application program when executed by a processor.

[0045] In summary, this application has the following beneficial technical effects:

[0046] The above-mentioned application supervision method, system, electronic device and storage medium, based on the firewall tool and the obtained application tag, searches for the application installation package corresponding to the application tag in the system and downloads the application installation package; then, monitors the application operation data obtained after the download to obtain the target application, and then sends the target application list generated according to the target application to the supervision end, so that the supervision end can supervise the installation and operation process of the application; this method improves the security and reliability of the application installation process, and monitors the application operation data and sends the target application list to the supervision end, thereby improving the timeliness, reliability and security of application supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A flowchart illustrating a method for supervising an application program according to an embodiment of the present application is shown;

[0049] Figure 2 A flowchart illustrating the overall method for supervising an application program in the first embodiment of the present application is shown;

[0050] Figure 3 A schematic diagram illustrating an application monitoring system according to an embodiment of the present application is shown;

[0051] Figure 4 A schematic diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0053] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0054] This embodiment of the present application provides a method for supervising an application program. The main process of the method is described as follows:

[0055] Reference Figure 1 , S10, obtain application tags.

[0056] Specifically, this embodiment extracts features of the application name and application function keywords in the application search field input on the display end, and labels these features to obtain an application tag.

[0057] The function of step S10 is to improve the accuracy and reliability of application search.

[0058] S20. Based on the firewall tool and the application tag, search and download the application installation package corresponding to the application tag.

[0059] Among them, a firewall refers to a defense system that isolates the local network from the external network. The firewall tool can isolate the connection between the risk area and the safe area, restrict others from entering the internal network, filter unsafe services and illegal users, and prevent intruders from approaching defense measures.

[0060] Specifically, this embodiment uses a firewall to filter illegal applications or applications with unsafe behaviors, then searches for the corresponding application installation package on the application download end based on the obtained application tag, and then uses the firewall tool to further detect the application installation package.

[0061] The function of step S20 is to improve the security and reliability of application search and download.

[0062] S30: Monitor application program running data corresponding to the application program installation package, and obtain target applications based on the application program running data to generate a target application list.

[0063] Specifically, after this embodiment completes downloading the application installation package, it uses the object application of the ServletContext class to monitor the application running data corresponding to the application installation package in real time, obtains the target application based on indicators such as running time, running status, and number of permission acquisitions contained in the application running data, and then presents the target application in the form of a list, that is, generates a target application list.

[0064] The target application includes an application that is currently running.

[0065] The purpose of step S30 is to improve the real-time performance of application monitoring by monitoring application operation data, thereby improving the reliability and timeliness of application supervision. In addition, the target application is presented in the form of a list, thereby realizing the visualization of the target application and improving the efficiency of application management.

[0066] S40: Send the target application list to the supervisory end so that the supervisory end can supervise the application.

[0067] Specifically, this embodiment sends a target application list to the supervisory end, which supervises the list after receiving it. For example, when an application runs for too long or obtains too many permissions, the application can be closed or uninstalled.

[0068] The role of step S40 is to improve the efficiency and accuracy of application supervision.

[0069] The above-mentioned application supervision method, system, electronic device and storage medium, based on the firewall tool and the obtained application tag, searches for the application installation package corresponding to the application tag in the system and downloads the application installation package; then, monitors the application operation data obtained after the download to obtain the target application, and then sends the target application list generated according to the target application to the supervision end, so that the supervision end can supervise the installation and operation process of the application; this method improves the security and reliability of the application installation process, and monitors the application operation data and sends the target application list to the supervision end, thereby improving the timeliness, reliability and security of application supervision.

[0070] In some possible embodiments, step S20, i.e., searching and downloading the application installation package corresponding to the application tag based on the firewall tool and the application tag, includes:

[0071] S201: Generate several groups of application lists based on a preset tag association model and application tags.

[0072] Among them, the preset tag association model refers to the application tag query obtained after feature extraction based on the application name in the application search field and the application's functional keywords, and the application is associated with the application tag, wherein the correlation between applications can be determined by the correlation coefficient obtained through correlation analysis.

[0073] S202. Obtain application scores from several groups of application lists, and based on the system application score threshold and the application score, filter out applications in the same category whose application scores are greater than or equal to the system application score threshold, and generate a target download application list based on the applications for downloading the application installation packages.

[0074] The application rating is the existing rating data of the application in the application download terminal.

[0075] Specifically, this embodiment obtains application scores through the application download end, compares the system application score threshold pre-set by the system with the obtained application score, filters out applications in the same category whose application scores are greater than or equal to the system application score threshold, and combines the obtained applications to generate a target download application list, so that the system terminal downloads the application installation package according to the list.

[0076] The role of step S201 and step S202 is to improve the reliability and accuracy of application downloading.

[0077] In some possible embodiments, after step S202, that is, after filtering out applications in the same category whose application scores are greater than or equal to the system application score threshold, the method further includes:

[0078] S203: Obtain the application name corresponding to the target application.

[0079] S204: Based on the application database and the application name, determine whether the application name exists in the blacklist in the application database, and obtain an application name confirmation result.

[0080] S205: Based on the application name confirmation result, determine whether to add the application corresponding to the application name to the target download application list.

[0081] The blacklist is data information that is obtained in real time based on the public application blacklist and updated in the system database.

[0082] Specifically, this embodiment matches the application name corresponding to the acquired target application with an application database pre-stored in the system to determine whether the application name exists in the blacklist, and obtains an application name confirmation result. If the application name confirmation result indicates that the application exists in the blacklist, the application corresponding to the application name is marked as an abnormal application and deleted from the target download application list. If the application name confirmation result indicates that the application does not exist in the blacklist, the application is added to the target download application list.

[0083] Specifically, steps S203 to S205 are used to improve the security of application downloading and the efficiency of application management.

[0084] In some possible embodiments, the application running data includes the running time. After step S30, that is, after monitoring the application running data corresponding to the application installation package, the following steps are further included:

[0085] S31. Compare the running time threshold with the application running time to obtain a running time comparison result.

[0086] S32. When the running time comparison result shows that the application running time is greater than or equal to the running time threshold, determine and obtain the target application, and send the running information of the target application to the supervisory end so that the supervisory end can confirm whether to close the target application.

[0087] The role of step S31 and step S32 is to improve the reliability of target application management.

[0088] In some possible embodiments, after step S30, that is, after monitoring the application running data corresponding to the application installation package, the following steps are further included:

[0089] S33. Mark abnormal data in the application program running data.

[0090] S34. Monitor and track abnormal data to determine whether the abnormal data is malicious behavior data.

[0091] The abnormal data refers to Trojan data, or the application running data is compared with the system data to analyze the data with differences, and the data is temporarily determined to be abnormal data.

[0092] Specifically, this embodiment marks the abnormal data in the application running data, monitors and tracks the abnormal data, and further determines whether the abnormal data is malicious behavior data. If the abnormal data is malicious behavior data, the application corresponding to the abnormal data is directly uninstalled and cleaned.

[0093] The role of step S33 and step S34 is to improve the security of the application supervision system.

[0094] In some possible embodiments, before step S40, that is, before sending the target application list to the supervisor, the following steps may be further included:

[0095] S41. Obtain the identity information of the supervisor.

[0096] S42. Based on the identity information, the supervisory end is authenticated and an authentication result is obtained.

[0097] S43. If the identity authentication result is that the supervisory end passes the identity authentication, a target application list is sent to the supervisory end.

[0098] Specifically, this embodiment obtains identity information such as the IP address and password of the supervisory end, verifies the supervisory end based on the identity information, and obtains an identity authentication result. When the identity authentication result is that the supervisory end passes the identity authentication, the target application list is sent to the supervisory end. Otherwise, the target application list is refused to be sent to the supervisory end and a prompt message indicating that the identity authentication match failed is sent to the supervisory end.

[0099] The purpose of steps S41 to S43 is to improve the security and reliability of application supervision.

[0100] In some possible embodiments, after step S40, that is, after sending the target application list to the supervisor, the following steps are further included:

[0101] S44. Use the IPSec toolkit to transmit application access record information to the supervisory end. The application access record information includes the application's operating data and the number of times access rights are requested.

[0102] The IPSec toolkit is a standard security technology that ensures the security of OSI upper-layer protocol data by inserting a predefined header into packets. IPSec primarily protects network layer (IP) data, thus providing network layer security. IKE-IKE within the IPSec toolkit is specifically designed for key security, ensuring secure key transmission, exchange, and storage, primarily operating on keys.

[0103] S45: Compare the access permission request times threshold with the access permission request times to obtain a comparison result of the access permission request times.

[0104] S46. If the comparison result of the number of access permission requests is that the number of access permission requests is greater than the access permission request threshold, obtain the corresponding application name and running data, and send the application name and running data to the supervisory end to enable the supervisory end to confirm whether to uninstall the application.

[0105] The purpose of steps S44 to S46 is to use the IPSec toolkit to transmit application access record information to the supervisory end, thereby improving the security of information data transmission and protecting data integrity; comparing the threshold of the number of access rights requested and the number of access rights requested, and sending the application name and operation data to the supervisory end. After receiving the application name and operation data, the supervisory end confirms whether to uninstall the application, thereby improving the accuracy and reliability of the application.

[0106] The application supervision method provided in this embodiment is as follows: Figure 2 As shown, by screening out applications in the same category whose application scores are greater than or equal to the system application score threshold, generating a target download application, and then downloading the application installation package corresponding to the application, the reliability and accuracy of application downloads are improved; by matching the application name with the application database, it is determined whether the application is in the blacklist, and then it is determined whether the application corresponding to the application name is added to the target download application list, which improves the security of application downloads and the efficiency of application management; using the IPSec toolkit to transmit application access record information to the supervisory end, the security of information data transmission is improved.

[0107] Another embodiment of the present application discloses an application supervision system.

[0108] Reference Figure 3 , the application supervision system includes:

[0109] The application tag acquisition module 10 is used to acquire the application tag.

[0110] The application installation package search and download module 20 is used to search and download the application installation package corresponding to the application tag based on the firewall tool and the application tag.

[0111] The module 30 for monitoring application running data and obtaining target application is used to monitor application running data corresponding to the application installation package, obtain target application based on the application running data, and generate a target application list.

[0112] The target application list sending module 40 is used to send the target application list to the supervisory end so that the supervisory end can supervise the applications.

[0113] The application supervision system provided in this embodiment can implement the various steps of the aforementioned embodiments due to the functions of its modules themselves and the logical connections between each other, and thus can achieve the same technical effects as the aforementioned embodiments. The principle analysis can be found in the relevant description of the steps of the aforementioned application supervision method, which will not be repeated here.

[0114] For the specific definition of the application supervision system, please refer to the definition of the application supervision method above, which will not be repeated here. The various modules in the above-mentioned application supervision system can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the device in hardware form, or can be stored in the memory of the device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0115] In one embodiment, an electronic device is provided. The electronic device may be a monitoring terminal, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The electronic device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile medium and an internal memory. The non-volatile medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile medium. The database of the electronic device is used to store data to be saved in the method for supervising an application. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for supervising an application is implemented.

[0116] In one embodiment, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for supervising the application program of the above embodiment is implemented, for example Figure 1 Alternatively, when the processor executes the computer program, the functions of the modules / units of the monitoring system for the application in the above embodiment are realized, for example Figure 3 The functions of modules 10 to 40 are shown in FIG. 1 and will not be described in detail here to avoid repetition.

[0117] In one embodiment, a computer-readable storage medium is provided, which stores a computer program. When executed by a processor, the computer program implements the method for supervising an application program according to the above-described embodiment. Alternatively, when executed by a processor, the computer program implements the functions of each module / unit in the system for supervising an application program according to the above-described system embodiment. To avoid repetition, further description is omitted here.

[0118] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the various embodiments provided herein may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0119] Those skilled in the art will clearly understand that for the sake of convenience and brevity in description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0120] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for supervising an application, characterized in that: include: Get the application tag; Based on the firewall tool and the application tag, searching and downloading the application installation package corresponding to the application tag includes: generating a plurality of application lists based on a preset tag association model and the application tags; obtaining application scores of several groups of the application lists, filtering out applications in the same category whose application scores are greater than or equal to the system application score threshold based on a system application score threshold and the application scores, and generating a target download application list based on the applications for downloading the application installation packages; monitoring application running data corresponding to the application installation package, obtaining a target application based on the application running data for generating a target application list, wherein the application running data includes running time; After monitoring the application running data corresponding to the application installation package, the method further includes: Comparing the runtime threshold with the application runtime to obtain a runtime comparison result; When the running time comparison result shows that the running time of the application is greater than or equal to the running time threshold, determining and obtaining the target application, and sending the running information of the target application to the supervisory end, so that the supervisory end confirms whether to close the target application; Sending the target application list to the supervisory end so that the supervisory end supervises the applications; After sending the target application list to the supervisory terminal, the method further includes: Using an IPSec toolkit to transmit application access record information to the supervisory end, the application access record information including the application's operating data and the number of times access rights were requested; Comparing the access permission request count threshold with the access permission request count to obtain a comparison result of the access permission request count; If the comparison result of the number of access permission requests is that the number of access permission requests is greater than the threshold number of access permission requests, the corresponding application name and the running data are obtained, and the application name and the running data are sent to the supervisory end so that the supervisory end can confirm whether to uninstall the application.

2. The method for supervising an application according to claim 1, characterized in that: After filtering out the applications in the same category whose application scores are greater than or equal to the system application score threshold, the method further includes: Obtain the application name corresponding to the target application; Based on the application database and the application name, determining whether the application name exists in a blacklist in the application database, and obtaining an application name confirmation result; Based on the application name confirmation result, it is determined whether to add the application corresponding to the application name to the target download application list.

3. The method for supervising an application according to claim 1, characterized in that: Before sending the target application list to the supervisory terminal, the method further includes: Obtaining identity information of the supervisory terminal; Based on the identity information, authenticate the supervisory terminal and obtain an identity authentication result; If the identity authentication result is that the supervisory terminal passes the identity authentication, the target application list is sent to the supervisory terminal.

4. The method for supervising an application according to claim 1, characterized in that: After monitoring the application running data corresponding to the application installation package, the method further includes: Marking abnormal data in the application program running data; The abnormal data is monitored and tracked to determine whether the abnormal data is malicious behavior data.

5. An application supervision system, characterized in that: include: Get application tag module, used to get application tags; a module for searching and downloading application installation packages, configured to search and download application installation packages corresponding to application tags based on a firewall tool and the application tags, including generating several groups of application lists based on a preset tag association model and the application tags, obtaining application scores in the several groups of application lists, screening out applications in the same category whose application scores are greater than or equal to the system application score threshold based on a system application score threshold and the application scores, and generating a target download application list based on the applications for downloading the application installation packages; A module for monitoring application running data and obtaining target application is used to monitor the application running data corresponding to the application installation package, obtain the target application based on the application running data, and generate a target application list, wherein the application running data includes running time. After monitoring the application running data corresponding to the application installation package, the module further includes comparing the running time threshold with the application running time to obtain a running time comparison result. When the running time comparison result shows that the application running time is greater than or equal to the running time threshold, the target application is determined and obtained, and the running information of the target application is sent to the supervisory end so that the supervisory end can confirm whether to close the target application. A module for sending a target application list is used to send the target application list to the supervisory end so that the supervisory end can supervise the applications. After sending the target application list to the supervisory end, it also includes using an IPSec toolkit to transmit application access record information to the supervisory end. The application access record information includes the running data of the application and the number of access rights requested. The access right request number threshold and the access right request number are compared to obtain a result of the comparison of the number of access rights requested. If the result of the comparison of the number of access rights requested is that the number of access rights requested is greater than the access right request number threshold, the corresponding application name and the running data are obtained, and the application name and the running data are sent to the supervisory end so that the supervisory end can confirm whether to uninstall the application.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for supervising the application program according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for supervising the application program according to any one of claims 1 to 4 is implemented.

Images