A method, apparatus and device for determining application security

Abstract

The application provides a method, device and equipment for determining application security, and relates to the field of data security. The method is applied to a terminal device, the terminal device is installed with an application, and the method comprises the following steps: acquiring information of a first function set related to the application, the first function set being functions in a first code package of the application, and the first code package being obtained by compiling a second code package of the application; determining whether a first code segment is successfully acquired from the second code package according to the first function set, the first code segment being used for cracking the second code package; and if the first code segment is successfully acquired from the second code package of the application, determining that the security of the application is unqualified.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security, and in particular, to a method, device and equipment for determining application security. BACKGROUND

[0002] A smart phone can support running multiple types of applications, such as shopping applications or social applications, which should provide corresponding services for users. Before providing services for users, the application itself needs to be considered for security. For example, some applications may be illegal programs, which may cause problems for the smart phone on which the application is installed. However, how to detect application security is an urgent problem to be solved. SUMMARY

[0003] The present application provides a method, device and equipment for determining application security, for detecting the security of an application.

[0004] In a first aspect, the present application provides a method for determining application security, applied to a terminal device, the terminal device being installed with an application, and the method comprising: obtaining information of a first function set related to the application, the first function set being functions in a first code package of the application, the first code package being obtained by compiling a second code package of the application; determining whether a first code segment is successfully obtained from the second code package according to the first function set, the first code segment being used to crack the second code package; and determining that the security of the application is unqualified if the first code segment is successfully obtained from the second code package of the application.

[0005] In the present application, the terminal device can attempt to obtain the first code segment in the second code package based on the first function set in the first code package of the application. If the terminal device can obtain the first code segment, it means that the terminal device can crack the second code package, and naturally can perform modification or deletion operations on the second code package. The terminal device can determine that the security of the application is unqualified. In this way, a method for detecting application security is provided. In the present application, the terminal device operates based on the code package of the application, without relying on additional data or human operation, which is beneficial to reduce the difficulty and cost of detecting the security of the application. In addition, the scheme in the present application does not rely on additional data, and analyzes the code of the application, which makes the scheme more applicable.

[0006] In a possible implementation, the method further includes: obtaining a first data packet inside the application, the first data packet being obtained by encrypting first data; determining a second function set according to the first code packet; determining a key and an encryption mode for encrypting the first data packet according to the second function set; and determining that the security of the application is unqualified if the first data is obtained by decrypting the first data packet according to the key and the encryption mode.

[0007] In this implementation, after obtaining the first data packet, the terminal device determines that the protection capability of the encryption algorithm of the application is low if the first data can be obtained by decrypting the first data packet based on the first code packet, and thus the terminal device determines that the security of the application is unqualified. The data packet inside the application can be a data packet containing sensitive information such as user information, and if the terminal device can decrypt the first data packet, it means that other devices can also decrypt the first data packet to obtain the data inside the application, that is, the security of the application is low. Therefore, detecting the data packet inside the application in the embodiment of the application is also conducive to reducing the risk of leakage of sensitive information of the application. Moreover, the implementation provides a method for detecting the security of the encryption algorithm inside the application.

[0008] In a possible implementation, the method further includes: determining that the security of the application is qualified if it is determined that the first code segment is not successfully obtained from the second code packet of the application, and the first data is not obtained by decrypting the first data packet according to the encryption algorithm.

[0009] In this implementation, the terminal device determines that the security of the application is qualified only when it is determined that the first code segment is not obtained and the first data is not obtained by decrypting the first data packet. This is equivalent to verifying the security of the code of the application itself and the security of the data packet stored inside the application, that is, verifying the security of multiple aspects of the application to more comprehensively detect the security of the application, so as to obtain a detection result of the security of the application that is more valuable for reference. Moreover, more comprehensive testing of the application can avoid security problems such as leakage of user information or virus intrusion during formal operation of the application.

[0010] In a possible implementation, the method further includes: obtaining a second data packet transmitted by the application and a server; determining a data transmission protocol of the application according to the second data packet; determining whether the transmission mode of the second data packet is encrypted transmission according to the data transmission protocol; and determining that the security of the application is unqualified if the transmission mode of the second data packet is not encrypted transmission.

[0011] In this embodiment, the terminal device determines the data transmission protocol used by the application by intercepting the second data packet transmitted by the application, determines whether the second data packet is encrypted by the application through the data transmission protocol, and determines that the application has a risk of data leakage if the application does not use encrypted transmission in the data transmission process, and thus determines that the data transmission process of the application is not secure. This embodiment provides a detection method for determining whether an application has a risk of data leakage in a transmission process, which is beneficial to reducing the security of data leakage of the application in the transmission process.

[0012] In a possible implementation, the method further includes: if the transmission mode of the second data packet is encrypted transmission, decrypting the second data packet to obtain the second data; adjusting the second data to obtain adjusted second data; encapsulating the adjusted second data according to the data transmission protocol to obtain a third data packet; and sending the third data packet to the server; and if a response message is received from the server, determining that the security of the application is unqualified, wherein the response message is used to respond to the third data packet.

[0013] In this embodiment, the terminal device can also decrypt the second data packet to obtain the second data, and send the adjusted second data to the server by using the same data transmission protocol. That is, the terminal device can intercept and modify the communication data. Moreover, if the server sends a response message to the terminal device, the terminal device can determine that the data transmission of the application is unqualified, and thus determine that the security of the application is unqualified. This embodiment verifies whether the application has the ability to prevent data from being tampered with on the basis of determining whether the second data is encrypted, and thus more comprehensively detects the security of the application.

[0014] In a possible implementation, the method further includes: running the first code packet in a virtual running environment; and intercepting the second data packet transmitted by the application.

[0015] In this embodiment, the terminal device runs the first code packet in a virtual running environment to simulate the scenario in which the application runs on the terminal device and transmits the second data packet to the server, and thus makes the process of security detection of the application closer to the scenario in the real running process of the application, and thus improves the accuracy of security detection of the application.

[0016] In a possible implementation, the method further includes: if business information is detected in the application, determining that the business information is obtained, and a business function is implemented according to the business information, determining that the security of the application is unqualified.

[0017] In the embodiment, when the terminal device detects the service information in the application, if the service information can be used to realize the service function, it is determined that the security of the application is unqualified. Therefore, the embodiment provides a method for detecting the service security of the application, so that when the service security is unqualified, it is determined that the security of the application is unqualified.

[0018] In a possible implementation, the method further includes: determining, according to the second code package, an address of a target file; and if the target file is acquired according to the address, determining that the security of the application is unqualified.

[0019] In the embodiment, the terminal device can determine the address of the target file in the second code package, and then acquire the target file. If the target file contains sensitive information, it is determined that the application may have a risk of data leakage, and it is determined that the security of the application is unqualified. The embodiment provides another method for detecting the security of the sensitive information of the application, increases the detection range of the risk of leakage of sensitive information, and further improves the security of the sensitive information of the application.

[0020] In a possible implementation, the method further includes: if the first code package is scanned by the first security tool, and it is detected that the first code package contains preset vulnerability information, it is determined that the security of the application is unqualified.

[0021] In the embodiment, the terminal device scans the first code package by using the security detection tool, detects whether the first code package contains preset vulnerability information, and further, the terminal device can also operate the application by using the vulnerability, and thus it is determined that the security of the application is unqualified.

[0022] In a possible implementation, the method further includes: if the second code package is detected, and it is determined that the second code package contains virus code, it is determined that the security of the application is unqualified.

[0023] In the embodiment, the terminal device further detects the code file in the second code package, to avoid the case that the second code package is replaced by other organizations and virus code is implanted, or the case that the second code package contains virus code. Therefore, when it is determined that the second code package contains virus code, it is determined that the security of the application is unqualified.

[0024] In a second aspect, an embodiment of the present application provides a device for determining security of an application, the device installs the application, and the device comprises: an obtaining module, configured to obtain information of a first function set related to the application, the first function set being functions in a first code package of the application, the first code package being obtained by compiling a second code package of the application; and a determining module, configured to determine, according to the first function set, whether a first code segment is successfully obtained from the second code package, the first code segment being used to crack the second code package, and determine that the security of the application is unqualified if the first code segment is successfully obtained from the second code package of the application.

[0025] In a possible implementation, the obtaining module is further configured to obtain a first data package inside the application, the first data package being obtained by encrypting first data; and the determining module is further configured to determine, according to the first code package, a second function set, determine, according to the second function set, a key and an encryption mode used to encrypt the first data package, and determine that the security of the application is unqualified if the first data is obtained by decrypting the first data package according to the key and the encryption mode.

[0026] In a possible implementation, the determining module is further configured to determine that the security of the application is qualified if it is determined that the first code segment is not successfully obtained from the second code package of the application, and the first data is not obtained by decrypting the first data package according to the encryption algorithm.

[0027] In a possible implementation, the determining module is further configured to obtain a second data package transmitted by the application and a server; determine, according to the second data package, a data transmission protocol of the application, determine whether the second data package is transmitted in an encrypted manner according to the data transmission protocol, and determine that the security of the application is unqualified if the second data package is not transmitted in an encrypted manner.

[0028] In a possible implementation, the determining module is further configured to, if the second data package is transmitted in an encrypted manner, decrypt the second data package to obtain second data, adjust the second data to obtain adjusted second data, and encapsulate the adjusted second data according to the data transmission protocol to obtain a third data package; the obtaining module is configured to send the third data package to the server, and determine that the security of the application is unqualified if a response message is received from the server, the response message being used to respond to the third data package.

[0029] In a possible implementation, the obtaining module is further configured to run the first code package in a virtual running environment, and intercept the second data package transmitted by the application.

[0030] In a possible implementation, the determining module is further configured to: if the service information is detected in the application, determine to acquire the service information, and implement a service function according to the service information, determine that the security of the application is unqualified.

[0031] In a possible implementation, the determining module is further configured to: according to the second code package, determine an address of a target file; and if the target file is acquired according to the address, determine that the security of the application is unqualified.

[0032] In a possible implementation, the determining module is further configured to: if the first code package is scanned by a first security tool, and it is detected that the first code package has preset vulnerability information, determine that the security of the application is unqualified.

[0033] In a possible implementation, the determining module is further configured to: if the second code package is detected, and it is determined that the second code package contains virus code, determine that the security of the application is unqualified.

[0034] In a third aspect, the present application provides a device for determining application security, comprising: at least one processor, and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method in any one of the preceding first aspect by executing the instructions stored in the memory.

[0035] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer instructions, when the computer instructions run on a computer, make the computer execute the method in any one of the preceding first aspect.

[0036] In a fifth aspect, the present application provides a computer program product, which contains computer instructions, and the computer instructions are used to make a computer execute the method in any one of the preceding first aspect.

[0037] The beneficial effects of the second aspect to the fifth aspect can be referred to the content discussed in the preceding first aspect, which will not be listed here. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 An application scenario diagram of a method for determining application security provided by the embodiment of the present application;

[0039] Figure 2 A flowchart of a method for determining application security provided by the embodiment of the present application Figure 1 ;

[0040] Figure 3 A flowchart illustrating a method for determining application security provided in this application embodiment. Figure 2 ;

[0041] Figure 4 A schematic diagram of a device for determining application security provided in an embodiment of this application;

[0042] Figure 5 This is a schematic diagram of the structure of a device for determining application security, provided as an embodiment of this application. Detailed Implementation

[0043] To better understand the technical solutions provided in this application, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0044] Please refer to Figure 1 This is an application scenario diagram illustrating a method for determining application security provided in an embodiment of this application. For example... Figure 1 As shown in the diagram, the terminal device 101, application 102, and server 103 are included. The terminal device 101 and server 103 can communicate wirelessly.

[0045] Terminal device 101 includes, but is not limited to, mobile phones, personal computers (PCs), tablets, laptops, PDAs, and mobile internet devices (MIDs). Application 102 can be installed on terminal device 101. Applications can also be called application programs, including applications that can run independently on terminal device 101, or sub-applications or applets embedded in applications.

[0046] The applications involved in the embodiments of this application can be of any type, such as social applications, office applications, or financial applications.

[0047] The terminal device 101 also has an operating system 105 installed, such as iOS.

[0048] In one possible implementation, the terminal device 101 may also have a virtual runtime environment 104 installed. The virtual runtime environment 104 may be, for example, a sandbox or a virtual machine. The virtual runtime environment 104 is isolated from the operating system 105. The system environment provided by the virtual runtime environment 104 may be the same as the system environment provided by the operating system 105 of the terminal device.

[0049] Optionally, when determining the security of application 102, terminal device 101 may run application 102 in a virtual runtime environment 104, thereby avoiding the impact of application 102 on the operating system 105 in terminal device 101. The specific process by which terminal device 101 determines the security of application 102 will be described below.

[0050] After the terminal device 101 determines that the application 102 is secure, the terminal device 101 may run the application 102 in the operating system 105.

[0051] Please refer to Figure 2 The following is a flowchart illustrating a method for determining application security, provided in an embodiment of this application. Figure 1 . Figure 2 The illustrated embodiments are applied, for example, to... Figure 1 In the application scenario shown, the method for determining application security can be executed by the terminal device. Figure 2 The terminal devices involved are, for example, Figure 1 The terminal device 101 shown, Figure 2 The applications involved are, for example, Figure 1 Application 102 is shown.

[0052] S201, Obtain information about the first function set related to the application. The first function set consists of functions in the first code package of the application. The first code package is obtained by compiling the second code package of the application.

[0053] For example, when a user needs to use an application or test its security, they can download the application to their device. This could be done by downloading the application from the device's app store or from its browser. The meaning of "application" can be found above.

[0054] An application can be implemented as a code package, meaning an application can be understood as including one or more code files. After an application is installed on a terminal device, the terminal device actually compiles the application's second code package to obtain the first code package. The second code package can be understood as the application's source code package, while the first code package can be understood as the code package that the terminal device can directly run.

[0055] In other words, the terminal device can decompile the first code package to obtain the second code package. For example, the terminal device can use a decompilation tool to decompile the first code package. Examples of decompilation tools include Hopper and Interactive Disassembler Professional (IDA Pro).

[0056] The terminal device determines information of the first function set according to first log information related to the first code package. The first log information can be understood as log information corresponding to a case where the first code package is not run, and thus the first log information can also be referred to as static log information. In other words, the terminal device can obtain the first function set from the first log information even if the first code package is not run.

[0057] The first function set belongs to the first code package. For example, the first function set is a function related to cracking the second code package. The first function set is, for example, a function related to log information of the first code package, that is, the first function set is, for example, a log function, and the log function is, for example, NSDebugLog, NSWarnFLog, and NSLog_printf_handler.

[0058] As an example, the terminal device can directly find the log function in the first code package through a log tool, for example, logcat and IOS log.

[0059] As another example, the terminal device scans the first log information related to the first code package through an analysis tool to obtain the first function set. In this case, the first function set can be understood as being extracted from the first log information related to the first code package. The analysis tool is, for example, IDA Pro.

[0060] In a possible implementation, the terminal device can determine whether sensitive information exists in second log information related to the first code package. If the terminal device determines that the second log information includes sensitive information, it is determined that the security of the application is unqualified. If the terminal device determines that the second log information does not include sensitive information, it is determined that the security of the second log information of the application is qualified. The sensitive information includes, but is not limited to, one or more of user information, communication data, or other sensitive information.

[0061] Specifically, the terminal device can run the first code package of the application in a virtual running environment. When the first code package is run, the terminal device can capture second log information generated by running the application to obtain the second log information. For example, the terminal device can obtain the second log information through a capture tool. The capture tool is, for example, brupsuite. The terminal device scans the second log information through an analysis tool to determine that sensitive information does not appear in the second log information.

[0062] S202, according to the first function set, determining whether the first code segment is successfully obtained from the second code package, the first code segment being used for cracking the second code package.

[0063] The terminal device determines, according to the first function set, whether the first code segment can be found from the second code package. The first code segment can be used to crack the second code package. If the terminal device can find the first code segment, S203 is performed, that is, if the first code segment is successfully obtained from the second code package, it is determined that the security of the application is unqualified. If the terminal device cannot find the first code segment, it is determined that the security of the code package of the application is qualified.

[0064] In a possible implementation, if the terminal device finds the first code segment, the terminal device can further determine, according to the first code segment, whether the code in the second code package can be cracked, for example, including a modification operation. If the terminal device can crack the second code package, it is determined that the security of the application is unqualified. If the terminal device does not obtain the first code segment from the second code package, or cannot successfully crack the second code segment, it is determined that the security of the code of the application is qualified.

[0065] Please refer to Figure 3 , a flowchart of a method for determining the security of an application provided by an embodiment of the present application Figure 2 . Figure 3 The embodiments shown, for example, are applied to Figure 1 the application scenarios shown. The method for determining the security of an application can be performed by a terminal device. Figure 3 The terminal device involved in the embodiments shown, for example, is Figure 1 the terminal device 101 shown, Figure 3 The application involved in the embodiments shown, for example, is Figure 1 the application 102 shown.

[0066] S301, obtaining information of a first function set related to an application.

[0067] The content of the first function set and the manner of obtaining the information of the first function set can refer to the content discussed above.

[0068] S302, determining, according to the first function set, that the first code segment is successfully obtained from the second code package. The first code segment is used to crack the second code package.

[0069] The terminal device determines, according to the first function set, whether the first code segment can be found from the second code package. The first code segment can be used to crack the second code package. If the terminal device can find the first code segment, S310 is performed, that is, it is determined that the security of the application is unqualified. If the terminal device cannot find the first code segment, it is determined that the security of the code package of the application is qualified.

[0070] The terminal device can acquire the content of the first code segment and the content of the second code package according to the content described above, and details are not described herein again.

[0071] S303, detecting the second code package to determine whether the second code package contains virus code.

[0072] Specifically, the terminal device detects the code file in the second code package by using the second security tool to determine whether the second code package contains virus code. The second security tool can be, for example, OClint and infer. If the terminal device determines that the second code package contains virus code, S310 is performed, that is, it is determined that the security of the application is unqualified. If the terminal device determines that the second code package does not contain virus code, it is determined that the security of the code package of the application is qualified.

[0073] The second security tool can pre-store information of virus code. The information of virus code can be, for example, sample characteristics of virus code. When the terminal device detects the second code package by using the second security tool, the terminal device can match the information of virus code with the second code package. If it is determined that the code in the second code package matches the pre-stored information of virus code, S310 is performed, that is, it is determined that the security of the application is unqualified. If it is determined that the code in the second code package does not match the pre-stored information of virus code, it is determined that the security of the code package of the application is qualified.

[0074] In a possible implementation, the terminal device can also detect the anti-debugging capability of the application.

[0075] Specifically, the terminal device debugs the code file in the second code package by using a debugging tool. If the terminal device can inject a program into the second code package by using the debugging tool, it is determined that the security of the application is unqualified. If the terminal device cannot inject a program into the second code package by using the debugging tool, it is determined that the anti-debugging capability of the application is qualified. The debugging tool can also be referred to as a debugger. The debugging tool can be, for example, Ollydbg.

[0076] S304, scanning the first code package by using the first security tool to determine whether the first code package contains preset vulnerability information.

[0077] If the terminal device detects the preset vulnerability information in the first code package, S310 is performed, that is, it is determined that the security of the application is unqualified. If the terminal device detects that the first code package does not contain the preset vulnerability information, it is determined that the application does not have a vulnerability risk.

[0078] For example, the terminal device scans the second code package by a first security tool, for example, openVAS. The first security tool pre-stores preset vulnerability information, which is used to indicate that the application has a risk of leaking user information.

[0079] S305, according to the second code package, determining the address of the target file, and according to the address, determining to obtain the target file.

[0080] The target file is, for example, a local file of the application, and the local file is, for example, a cache file, and the cache file is, for example, a Plist file, a SQLite database file, a Keychain file and a log file.

[0081] Specifically, the terminal device determines the address of the target file from the second code package by an analysis tool, finds the location of the target file according to the address of the target file, and then obtains the target file. If the terminal device successfully obtains the target file, S310 is executed, that is, it is determined that the security of the application is unqualified. If the terminal device does not obtain the target file, it is determined that the security of the storage function of the application is qualified.

[0082] Optionally, after obtaining the target file, the terminal device can also identify whether the target file includes sensitive information. If the terminal device determines that the target file includes sensitive information, it is determined that the security of the application is unqualified. If the terminal device determines that the target file does not include sensitive information, the terminal device determines that the security of the storage function of the application is qualified.

[0083] S306, detecting the business information in the application, determining to obtain the business information, and realizing the business function according to the business information.

[0084] Specifically, the terminal device runs the application in a virtual running environment, simulates a user to process the business, and uses a packet capturing tool to capture the business information in the business processing process, and then obtains the business information. After obtaining the business information, the terminal device determines whether the business function can be realized according to the business information. If the terminal device can realize the business function in the application according to the business information, S310 is executed, that is, it is determined that the security of the application is unqualified. If the terminal device cannot realize the business function in the application using the business information, it is determined that the business security of the application is qualified.

[0085] The business information is sensitive information such as user information and financial information, and the user information includes, for example, user-entered account information. The business function is one or more of functions including, but not limited to, user login, password management, payment security, identity authentication, timeout setting, or exception handling. The timeout setting means that if the application request response exceeds a preset threshold, it is determined that the request response fails. The exception handling means that when an application has an abnormal situation, the server can be fed back the abnormal situation.

[0086] In a possible implementation, the business information directly obtained by the terminal device can be an encrypted string. Therefore, the terminal device can also decrypt the business information. It should be noted that the business information can all be encrypted information, or the key information in the business information can be encrypted information.

[0087] For example, the terminal device can perform reverse analysis on the code file in the first code package to obtain a third function set. The third function set is used to indicate a code segment in the first code package for encrypting the business information. The terminal device determines a third code segment according to the third function set, and determines the decrypted business information according to the third code segment. The terminal device can implement the business function according to the decrypted business information.

[0088] S307, obtaining a first data package inside the application, and determining a second function set according to the first code package, a key and an encryption mode according to the second function set, and first data according to the key and the encryption mode.

[0089] The first data package is obtained by encrypting the first data by the application. The first data is, for example, cache data of the application.

[0090] After the terminal device obtains the first data package, the terminal device determines the second function set from the first code package. For example, the terminal device scans the first code package by using an analysis tool, and finds the second function set in the first code package. The second function set can be understood as a function of code in the first code package for implementing an encryption algorithm.

[0091] The terminal device can determine a fourth code segment from the second code package according to the second function set. The fourth code segment is used to indicate the key and the encryption mode used for encrypting the first data. Therefore, the terminal device can decrypt the first data package according to the key and the encryption mode to obtain the first data. The key and the encryption mode in the embodiments of the present application are the encryption algorithm in the foregoing, and since the first data is obtained by using the encryption algorithm, in the embodiments of the present application, the terminal device can also analyze the first data package to determine the key and the encryption mode corresponding to the encryption algorithm.

[0092] If the terminal device successfully decrypts the first data packet to obtain the first data, S310 is performed, that is, it is determined that the security of the application is unqualified. If the terminal device does not successfully decrypt the first data packet to obtain the first data, it is determined that the encryption algorithm security of the application is qualified.

[0093] For example, the terminal device obtains the first data in the virtual running environment. The first data is, for example, cache data generated by the application after running the application. Taking the application as a browser as an example, the first data may include, for example, cache data generated by the browser after the terminal device runs the browser in the virtual running environment. The application stores the first data in the storage area after encrypting the first data by calling the encryption algorithm and the encryption mode corresponding to the encryption algorithm. Each encryption mode corresponds to a different encryption method. The encryption algorithm is, for example, a symmetric encryption algorithm, and the symmetric encryption algorithm is, for example, an advanced encryption standard (AES) algorithm and a data encryption standard (DES) algorithm.

[0094] Taking the encryption algorithm as the AES algorithm as an example, when the application calls the AES algorithm to encrypt the first data, the application can also determine the encryption mode corresponding to the AES algorithm and encrypt the first data according to the encryption mode.

[0095] For example, the encryption mode of the AES algorithm is, for example, an electronic code book (ECB) mode, a cipher block chaining (CBC) mode, a cipher feedback mode (CFB), an output feedback mode (OFB), a counter mode (CTR), or a propagating cipher block chaining mode.

[0096] For example, if the application calls the ECB mode to encrypt the first data, the application can divide the first data into multiple data blocks of equal length, and encrypt each data block respectively. If the application calls the CBC mode, the application can divide the first data into multiple data blocks of equal length, perform an exclusive or operation on one data block in the multiple data blocks and another data block in the multiple data blocks, and then encrypt the result of the exclusive or operation according to a key, thereby obtaining the encrypted first data. The application can obtain the first data packet by encapsulating the encrypted first data according to the first format.

[0097] S308, obtaining the second data packet transmitted by the application to the server, determining the data transmission protocol of the application according to the second data packet, and determining that the transmission manner of the second data packet is not encrypted transmission according to the data transmission protocol.

[0098] The second data packet can be a result of encapsulating the service information according to the data transmission protocol. The specific content of the service information can refer to the content discussed above, which will not be repeated here. The data transmission protocol can be, for example, http and https.

[0099] When the terminal device detects that the application transmits the second data packet to the server, the terminal device obtains the second data packet. The terminal device determines the data transmission protocol used by the application according to the second data packet, and determines whether the transmission manner of the second data packet by the application is encrypted transmission according to the data transmission protocol of the second data packet. If the terminal device determines that the transmission manner of the second data packet by the application is not encrypted transmission, S310 is performed, that is, it is determined that the security of the application is unqualified. If the terminal device determines that the transmission manner of the second data packet by the application is encrypted transmission, it is determined that the security of the data transmission of the application is qualified.

[0100] For example, the terminal device obtains the second data packet through a packet capture tool, and further determines that the data transmission protocol corresponding to the second data packet is http or https according to the second data packet. If the terminal device determines that the data transmission protocol corresponding to the second data packet is http, it is determined that the transmission manner of the second data packet by the application is not encrypted transmission. If the terminal device determines that the data transmission protocol corresponding to the second data packet is https, it is determined that the transmission manner of the second data packet by the application is encrypted transmission.

[0101] S309, if the transmission manner of the second data packet is encrypted transmission, the second data packet is decrypted to obtain second data, and the second data is adjusted, encapsulated according to the data transmission protocol, and a third data packet is obtained. The third data packet is sent to the server, and it is determined whether a response message from the server is received.

[0102] The response message is used to respond to the third data packet.

[0103] After the terminal device obtains the second data packet, the second data packet is decrypted to obtain second data, and then the second data is adjusted and encapsulated according to the same data transmission protocol as the second data packet to obtain a third data packet. The third data packet is sent to the server, and it is determined whether a response message from the server is received. If the terminal device receives the response message from the server, S310 is performed, that is, it is determined that the security of the application is unqualified. If it is determined that the terminal device does not receive the response message from the server, it is determined that the security of the data transmission of the application is qualified.

[0104] Specifically, the terminal device determines the second code segment related to the encryption algorithm in the second code package through the analysis tool, where the second code segment is used to implement encryption of the second data. In other words, the second code segment includes the second data, the key, and the encryption manner. The terminal device further determines the encryption parameter according to the second code segment, where the encryption parameter includes the key, the second data, and the encryption manner. Furthermore, the terminal device can determine the second data in the encryption parameter.

[0105] After obtaining the second data, the terminal device adjusts the second data, encapsulates the adjusted second data according to a data transmission protocol used by the second data package, and obtains a third data package.

[0106] S310, determining that the security of the application is unqualified.

[0107] As an example, the terminal device can also determine that the security of the application is unqualified after S301-S309.

[0108] The processes of S301-S305 can be regarded as detection of the self-security of the application, S306 can be regarded as detection of the service security of the application, and S307-309 can be regarded as detection of the data transmission security of the application.

[0109] As an example, when the terminal device determines that the first code segment is not successfully obtained from the second code package, and the first data is not obtained by decrypting the first data package according to the encryption algorithm, in other words, the terminal device determines that the detection of the self-security of the application is qualified, the detection of the service security of the application is qualified, and the detection of the data transmission security of the application is qualified, the terminal device can determine that the security of the application is qualified. Optionally, the terminal device can run the application in an operating system of the terminal device.

[0110] As an example, when the terminal device determines that the first code segment is not successfully obtained from the second code package, and the target file is not successfully obtained according to the address, and determines that the preset vulnerability information does not exist in the first code package, and determines that the virus code does not exist in the second code package, and determines that the first data is not obtained by decrypting the first data package according to the encryption algorithm, and determines that the transmission manner of the first data package is encrypted transmission, and a response message from the server is not received, and the business function is not successfully implemented according to the business information, in other words, the terminal device determines that the detection of the self-security of the application is qualified, the detection of the service security of the application is qualified, and the detection of the data transmission security of the application is qualified, the terminal device can determine that the security of the application is qualified.

[0111] Optionally, after determining that the security of the application is qualified, the terminal device runs the application in an operating system in the terminal device.

[0112] Based on the same inventive concept, the embodiments of the present application provide a device for determining the security of an application. In addition, the device can also realize the functions of the terminal device described above.

[0113] Please refer to Figure 4 for a structural schematic diagram of a device for determining the security of an application provided by the embodiments of the present application. As Figure 4 shown, the device 400 for determining the security of an application includes an obtaining module 401 and a determining module 402. The device for determining the security of an application is installed with an application.

[0114] For example, the obtaining module 401 is configured to obtain information of a first function set of the application, the first function set being functions in a first code package of the application, the first code package being obtained by compiling a second code package of the application; and the determining module 402 is configured to determine whether a first code segment is successfully obtained from the second code package according to the first function set, the first code segment being used for cracking the second code package, and determine that the security of the application is unqualified if the first code segment is successfully obtained from the second code package of the application.

[0115] In a possible implementation, the obtaining module 401 is further configured to obtain a first data package in the application, the first data package being obtained by encrypting first data; and the determining module 402 is further configured to determine a second function set according to the first code package, determine a key and an encryption mode for encrypting the first data package according to the second function set, and determine that the security of the application is unqualified if the first data is obtained by decrypting the first data package according to the key and the encryption mode.

[0116] In a possible implementation, the determining module 402 is further configured to determine that the security of the application is qualified if it is determined that the first code segment is not successfully obtained from the second code package of the application, and the first data is not obtained by decrypting the first data package according to the encryption algorithm.

[0117] In a possible implementation, the determining module 402 is further configured to obtain a second data package transmitted between the application and a server; determine a data transmission protocol of the application according to the second data package, determine whether the second data package is transmitted in an encrypted manner according to the data transmission protocol, and determine that the security of the application is unqualified if the second data package is not transmitted in the encrypted manner.

[0118] In a possible implementation, the determining module 402 is further configured to: if the transmission mode of the second data packet is encrypted transmission, decrypt the second data packet to obtain second data, adjust the second data to obtain adjusted second data, and encapsulate the adjusted second data according to a data transmission protocol to obtain a third data packet; and the obtaining module 401 is configured to send the third data packet to the server, and if a response message is received from the server, determine that the security of the application is unqualified, the response message being used for responding to the third data packet.

[0119] In a possible implementation, the obtaining module 401 is further configured to: run the first code packet in a virtual running environment; and intercept a second data packet transmitted by the application.

[0120] In a possible implementation, the determining module 402 is further configured to: if the business information is detected in the application, determine that the business information is obtained, and the business function is implemented according to the business information, determine that the security of the application is unqualified.

[0121] In a possible implementation, the determining module 402 is further configured to: determine, according to the second code packet, an address of a target file; and if the target file is obtained according to the address, determine that the security of the application is unqualified.

[0122] In a possible implementation, the determining module 402 is further configured to: if the first code packet is scanned by the first security tool, and it is detected that the first code packet has preset vulnerability information, determine that the security of the application is unqualified.

[0123] In a possible implementation, the determining module 402 is further configured to: if the second code packet is detected, and it is determined that the second code packet contains virus code, determine that the security of the application is unqualified.

[0124] The embodiment of the application further provides a device for determining the security of an application, which is described in the following. Figure 5 FIG. 1 shows a structure diagram of a device for determining the security of an application according to an embodiment of the application. The device 500 for determining the security of an application includes at least one processor 501 and a memory 502 connected with the at least one processor 501.

[0125] The memory 502 stores instructions executable by the at least one processor 501, and the at least one processor 501 implements the method for determining the security of an application according to any of the preceding embodiments by executing the instructions stored in the memory 502.

[0126] As an example, Figure 5 The device for determining the security of an application shown in the figure can implement the functions of the device 400 for determining the security of an application.

[0127] The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores computer instructions. When the computer instructions run on a computer, the computer executes the method for determining application security as any one of the preceding.

[0128] The embodiment of the present application provides a computer program product, and the computer program product contains computer instructions. The computer instructions are used for making a computer execute the method for determining application security as any one of the preceding.

[0129] It should be noted that the collection, transmission, use and the like of data in the technical solutions of the embodiment of the present application all meet the requirements of relevant national laws and regulations.

[0130] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of being implemented on one or more computer usable storage media containing computer usable program codes (including but not limited to disk storage, CD-ROM, optical storage and the like).

[0131] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams and the combination of the flows and / or blocks can be realized by computer program instructions. These computer program instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device for realizing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks

[0132] These computer program instructions can also be stored in a computer readable storage medium which can guide the computer or other programmable data processing devices to work in a specific way, so that the instructions stored in the computer readable storage medium produce a product including instruction devices which realize the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks

[0133] These computer program instructions can also be loaded to the computer or other programmable data processing devices, so that a series of operation steps are executed on the computer or other programmable devices to produce a computer implemented process, so that the instructions executed on the computer or other programmable devices provide a process for realizing the functions specified in the flowcharts and / or block diagrams.Figure 1 one or more processes and / or functions specified in one or more blocks Figure 1 one or more processes and / or functions specified in one or more blocks

[0134] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A method for determining application security, characterized in that, Applied to a terminal device, wherein the terminal device has the application installed, the method includes: Obtain information about a first function set related to the application. The first function set consists of functions in a first code package of the application. The first code package is obtained by compiling a second code package of the application. The second code package is the source code package of the application. The first code package is a code package that can be directly run by the terminal device. The first function set consists of functions in the first code package related to first log information. The first log information is static log information. Based on the first function set, determine whether the first code fragment was successfully obtained from the second code package, wherein the first code fragment is used to crack the second code package; If the first code fragment is successfully obtained from the second code package of the application, then the application is determined to be unsafe. The method further includes: running the first code package in a virtual runtime environment and capturing second log information during the runtime of the first code package; if sensitive information is found in the second log information, the application is determined to be unsafe.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the first data packet inside the application, wherein the first data packet is obtained by encrypting the first data; Based on the first code package, determine the second function set; Based on the second function set, determine the key and encryption mode for encrypting the first data packet; If the first data packet is decrypted according to the key and the encryption mode to obtain the first data, then the application is determined to be unsafe.

3. The method according to claim 2, characterized in that, The method further includes: If it is determined that the first code fragment was not successfully obtained from the second code package of the application, and the first data packet was not decrypted according to the encryption algorithm, then the application is determined to be secure.

4. The method according to claim 1, characterized in that, The method further includes: Obtain the second data packet transmitted between the application and the server; Based on the second data packet, determine the data transmission protocol of the application; Based on the data transmission protocol, determine whether the transmission method of the second data packet is encrypted; If the second data packet is not transmitted in an encrypted manner, then the application is deemed to be unsafe.

5. The method according to claim 4, characterized in that, The method further includes: If the second data packet is transmitted in encrypted form, then the second data packet is decrypted to obtain the second data. The second data is adjusted to obtain the adjusted second data; According to the data transmission protocol, the adjusted second data is encapsulated to obtain a third data packet; Send the third data packet to the server; If a response message is received from the server, it is determined that the application's security is inadequate; the response message is used to respond to the third data packet.

6. The method according to claim 4 or 5, characterized in that, Acquiring the second data packet transmitted between the application and the external device includes: Run the first code package in a virtual runtime environment; The second data packet transmitted by the application is intercepted.

7. The method according to any one of claims 1-5, characterized in that, The method further includes: If business information is detected in the application, and it is determined that the business information is acquired and the business function is implemented based on the business information, then the application is determined to be unsafe.

8. The method according to claim 1, characterized in that, The method further includes: Based on the second code package, determine the address where the target file is stored; If the target file is obtained based on the address, then the application is determined to be unsafe.

9. The method according to any one of claims 1-5, characterized in that, If the first code package is scanned using the first security tool and a preset vulnerability is detected, then the application is determined to be unsafe.

10. The method according to any one of claims 1-5, characterized in that, The method further includes: If the second code package is detected and it is determined that the second code package contains virus code, then the application is deemed to be unsafe.

11. An apparatus for determining application security, characterized in that, The device is installed and applied, and the device includes: The acquisition module is used to acquire information about a first function set related to the application. The first function set consists of functions in a first code package of the application. The first code package is obtained by compiling a second code package of the application. The second code package is the source code package of the application. The first code package is a code package that can be directly run by a terminal device. The first function set consists of functions in the first code package related to first log information. The first log information is static log information. The determination module is configured to determine, based on the first function set, whether a first code fragment has been successfully obtained from the second code package, wherein the first code fragment is used to crack the second code package, and if the first code fragment has been successfully obtained from the second code package of the application, then the application is determined to be unsafe. The determining module is further configured to: run the first code package in a virtual runtime environment and capture second log information during the runtime of the first code package; if sensitive information is present in the second log information, then determine that the application is unsafe.

12. The apparatus according to claim 11, characterized in that, The acquisition module is further configured to acquire a first data packet within the application, wherein the first data packet is obtained by encrypting the first data; The determining module is further configured to determine a second function set based on the first code package, determine a key and encryption mode for encrypting the first data packet based on the second function set, and determine that the application is unsafe if the first data packet is decrypted based on the key and the encryption mode to obtain the first data.

13. A device for determining application security, characterized in that, include: At least one processor, and A memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the method as described in any one of claims 1-10 by executing the instructions stored in the memory.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-10.

15. A computer program product, characterized in that, It includes computer instructions for causing a computer to perform the method as described in any one of claims 1-10.

Images