Application security management method, system, server and storage medium

Abstract

The present invention provides an application security management method, system, server, and storage medium. The method includes: obtaining the current operation instruction at the current moment, and the current traffic value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword; determining whether the keyword is consistent with a preset keyword; if so, automatically superimposing the traffic values ​​generated by the executed historical operation instructions to obtain the historical traffic value; obtaining the sub-traffic value generated by completing the current operation instruction based on the historical traffic value and the current traffic value; determining whether the sub-traffic value is greater than the preset traffic value corresponding to the current moment; if so, generating an interception signal to intercept the current operation instruction. This application can reduce the workload of staff and achieve the effect of not over-relying on the database.

Description

Technical Field

[0001] The present application relates to the field of application security technology, and in particular to an application security management method, system, server, and storage medium. Background Art

[0002] With the development of internet technology, when processing tasks through computer applications, malicious programs may be introduced by malicious individuals, causing the application to perform operations that are detrimental to accurate work results or to perform additional operations unrelated to the work being processed. Therefore, when processing tasks through computer applications, malicious programs should be promptly detected and intercepted.

[0003] Currently, every application has a corresponding database that stores the instructions for certain operations that the application needs to perform. Each time a computer receives an instruction, it compares it with several preset instructions stored in the database. If the instruction matches one of the preset instructions in the database, it indicates that the instruction is not from a malicious program, and the application executes the instruction to obtain the corresponding sub-result. If the instruction does not match one of the preset instructions in the database, it indicates that the instruction is from a malicious program.

[0004] Since whether the current operation instructions will be executed depends entirely on the database, after updating the application, in order to avoid the situation where the operation instructions corresponding to the new functions will be considered malicious programs and not executed, it is necessary to manually update the database, which will undoubtedly increase the workload of the staff. Summary of the Invention

[0005] In order to reduce the workload of staff and avoid over-reliance on the database, the embodiments of the present application provide an application security management method, system, server and storage medium.

[0006] In a first aspect, this embodiment provides an application security management method, the method comprising:

[0007] Obtaining a current operation instruction at a current moment and a current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword;

[0008] Determine whether the keyword is consistent with a preset keyword. If consistent, automatically add traffic values ​​generated by executed historical operation instructions to obtain a historical traffic value, and obtain a sub-traffic value generated by completing the current operation instruction based on the historical traffic value and the current traffic value;

[0009] It is determined whether the sub-flow value is greater than the preset flow value corresponding to the current moment; if so, an interception signal is generated to intercept the current operation instruction.

[0010] In some embodiments, obtaining the current flow value corresponding to the current operation instruction includes:

[0011] Sending the current operation instruction to the virtual machine;

[0012] A flow value representing the flow generated by completing the current operation instruction sent by the virtual machine is received and recorded as the current flow value.

[0013] In some embodiments, determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment includes:

[0014] Get the progress value of the current operation instruction in the entire work, as well as the total flow value required to complete the entire work;

[0015] Determine whether each operation instruction in the entire work requires the same flow rate, and if so, multiply the progress value by the total flow rate value to obtain a preset flow rate value corresponding to the current stage;

[0016] If not, obtain the current theoretical flow value corresponding to the current operation instruction, and add the current theoretical flow value to the historical flow value to obtain the preset flow value corresponding to the current moment;

[0017] Subtracting the preset flow value from the sub-flow value to obtain a flow difference, and determining whether the flow difference is greater than zero; if so, the sub-flow value is greater than the preset flow value corresponding to the current moment;

[0018] If it is not greater than zero, the sub-flow value is not greater than the preset flow value corresponding to the current moment.

[0019] In some embodiments, the method further comprises:

[0020] If the sub-flow value is not greater than the preset flow value corresponding to the current moment, determining whether the current operation instruction is inconsistent with the executed historical operation instruction, and if so, generating an interception signal to intercept the current operation instruction;

[0021] If it does not exist, execute the current operation instruction.

[0022] In some embodiments, the method further comprises:

[0023] After each operation instruction is executed, the operation result corresponding to the operation instruction is obtained, and it is determined whether the operation result is the final result of the parameters corresponding to the operation instruction. If so, the operation instruction is marked as a fixed operation instruction;

[0024] Otherwise, the operation instruction is marked as an intermediate operation instruction.

[0025] In some embodiments, determining whether the current operation instruction is inconsistent with the executed historical operation instruction includes:

[0026] Obtaining fixed parameters corresponding to all fixed operation instructions, and determining whether the current operation instruction will modify the final result of the fixed parameters. If so, the current operation instruction is inconsistent with the executed historical operation instructions;

[0027] If not, obtain the intermediate parameters corresponding to all the intermediate operation instructions, and determine whether the current operation instruction will restore the values ​​corresponding to the intermediate parameters to the initial values. If so, the current operation instruction is inconsistent with the executed historical operation instructions;

[0028] If not, then there is no contradiction between the current operation instruction and the executed historical operation instructions.

[0029] In some embodiments, generating an interception signal to intercept the current operation instruction includes:

[0030] The number of interception signals generated is obtained, and it is determined whether the number exceeds a preset number. If so, an alarm signal indicating that there is a security problem with the application and a stop signal indicating that the application is in an inoperative state are generated, and the alarm signal is sent out.

[0031] In a second aspect, this embodiment provides an application security management system, the system comprising: an acquisition module, a judgment module, a processing module and an interception module; wherein,

[0032] The acquisition module is used to acquire a current operation instruction at a current moment and a current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword;

[0033] The judging module is used to judge whether the keyword is consistent with a preset keyword;

[0034] The processing module, if the keyword is consistent with the preset keyword, automatically adds the traffic values ​​generated by the executed historical operation instructions to obtain a historical traffic value, and obtains a sub-traffic value generated by completing the current operation instruction based on the historical traffic value and the current traffic value;

[0035] The judging module is further configured to judge whether the sub-flow value is greater than the preset flow value corresponding to the current moment;

[0036] The interception module is configured to generate an interception signal to intercept the current operation instruction if the sub-flow value is greater than the preset flow value corresponding to the current moment.

[0037] In a third aspect, an embodiment of the present application provides a server comprising a processor and a memory, wherein a computer program that can be run on the processor is stored on the server, and when the computer program is executed by the processor, an application security management method as described in the first aspect is implemented.

[0038] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program that can be run on a processor is stored. When the computer program is executed by the processor, an application security management method as described in the first aspect is implemented.

[0039] By adopting the above method, the present application compares the keywords in the current operation instruction with the preset keywords. When it is determined that the keywords in the current operation instruction are consistent with the preset keywords, it indicates that the current operation instruction is the operation instruction corresponding to the application in use. Then, by obtaining the flow value generated by the executed operation instruction and superimposing it, a historical flow value is obtained, and the historical flow value is superimposed with the current flow value corresponding to the current operation instruction to obtain a sub-flow value. Finally, the sub-flow value is compared with the preset flow value corresponding to the current moment. If the sub-flow value is greater than the preset flow value corresponding to the current moment, it indicates that the current operation instruction is not a safe execution operation instruction and the current operation instruction needs to be intercepted. In the entire process of determining whether the current operation instruction is a safe execution operation instruction, there is no need for the database to store the operation instructions of some operations that the application needs to execute, nor is there a need for staff to update the database, which can reduce the workload of staff and avoid over-reliance on the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a block diagram of an application security management method provided by this embodiment.

[0041] Figure 2 This is a flowchart of determining whether a sub-flow value is greater than a preset flow value corresponding to the current moment, provided by this embodiment.

[0042] Figure 3 This is a flowchart provided by this embodiment for determining whether there is a conflict between a current operation instruction and an executed historical operation instruction.

[0043] Figure 4 This is a framework diagram of an application security management system provided by this embodiment.

[0044] Figure 5 This is a structural block diagram of the server provided in this embodiment. DETAILED DESCRIPTION

[0045] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. However, it should be understood by those skilled in the art that the present application can be implemented without these details. It is obvious to those skilled in the art that various changes can be made to the embodiments disclosed in the present application, and the general principles defined in the present application can be applied to other embodiments and application scenarios without departing from the principles and scope of the present application. Therefore, the present application is not limited to the embodiments shown, but conforms to the broadest scope consistent with the scope claimed in the present application.

[0046] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0047] Figure 1 This is a block diagram of an application security management method provided by this embodiment. Figure 1 As shown, an application security management method includes the following steps:

[0048] Step S100: obtaining a current operation instruction at a current moment and a current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword.

[0049] The above-mentioned current operation instructions refer to those obtained by the staff through operations on mobile terminals such as laptops. Specifically, in order to obtain the final result with the help of the application, the staff needs to input some operation instructions into the application. The operation instructions can be a click operation, an information input operation, or a selection operation, etc.

[0050] Since each mobile terminal has several different applications installed, in order to ensure that the mobile terminal knows which application the operation instruction entered by the staff member through the mobile terminal corresponds to, each operation instruction entered by the staff member on the mobile terminal includes a keyword. After receiving the operation instruction, the mobile terminal can determine which application should perform the corresponding action based on the operation instruction by checking the keyword in the operation instruction. For example, if the staff member enters a click operation, the click operation specifically represents the current operation instruction for opening an application, and the current operation instruction includes the keyword corresponding to application A.

[0051] In addition, the above-mentioned current traffic value is the traffic value generated by the mobile terminal executing the current operation instruction. Obtaining the current traffic value corresponding to the current operation instruction includes: sending the current operation instruction to the virtual machine, receiving the traffic value sent by the virtual machine representing the completion of the current operation instruction, and recording it as the current traffic value.

[0052] At least two virtual machines are installed in the mobile terminal, and each virtual machine is installed with the same application as the mobile terminal. The number of virtual machines can be determined based on the physical hardware configuration of the mobile terminal itself, such as the CPU and memory. After each current operation instruction is obtained by the acquisition module of the mobile terminal, the current operation instruction is synchronously sent to one of the virtual machines. After the virtual machine receives the current operation instruction, the corresponding application in the virtual machine will automatically respond to the current operation instruction, thereby generating a traffic value corresponding to the current operation instruction, which is the current traffic value. After completing the current operation instruction, the virtual machine will automatically generate a virtual completion instruction, so that the virtual machine automatically sends the current traffic value to the acquisition module of the mobile terminal where the virtual machine is located according to the virtual completion instruction, thereby completing the acquisition of the current traffic value corresponding to the current operation instruction.

[0053] Step S200, determine whether the keyword is consistent with the preset keyword. If consistent, obtain the historical flow value by automatically superimposing the flow values ​​generated by the executed historical operation instructions, and obtain the sub-flow value generated by completing the current operation instruction based on the historical flow value and the current flow value.

[0054] Each application corresponds to a unique keyword, and the above-mentioned preset keyword refers to the keyword corresponding to the application being used in this embodiment. The application can only process operation instructions whose keywords contained in the operation instructions are the same as the preset keywords. Every time the judgment module of the mobile terminal receives a current operation instruction, the judgment module of the mobile terminal will compare the keywords in the current operation instruction with the preset keywords. If the keywords in the current operation instruction are inconsistent with the preset keywords, it indicates that the current operation instruction is not the operation instruction of the application being used in this embodiment. At this time, the judgment module of the mobile terminal will generate an error instruction and send the error instruction to the interception module of the mobile terminal. After receiving the error instruction, the interception module automatically generates an interception signal to intercept the current operation instruction, so that the application being used in this embodiment will not execute the current operation instruction.

[0055] If the keyword in the current operation instruction matches the preset keyword, it indicates that the current operation instruction is an operation instruction for the application currently being used in this embodiment. The mobile terminal's judgment module then generates a correct instruction and sends it to the mobile terminal's processing module. After receiving the correct instruction, the processing module retrieves the traffic values ​​generated by previously executed operation instructions and superimposes these traffic values ​​to obtain historical traffic values. These traffic values ​​are stored in a specific file on the mobile terminal. This specific file only stores the traffic values ​​generated by the mobile terminal's native operating system when executing each operation instruction belonging to the application, and does not store the traffic values ​​generated by the virtual machine's host operating system when executing the operation instructions belonging to the application. The mobile terminal has a native operating system and a number of host operating systems equal to the number of virtual machines. A host operating system refers to the operating system of the virtualized physical machine (referred to as a virtual machine).

[0056] Completing a task requires the application to execute several operation instructions. After completing each operation instruction in the task, the application will store the traffic value generated by the operation instruction in the above-mentioned specific file. However, after the application completes a task and obtains the historical traffic value, it will delete all the traffic values ​​stored in the specific file. On the one hand, when the application subsequently executes a task again and needs to obtain the historical traffic value, it can simply add up all the traffic values ​​in the specific file, without having to find the traffic value corresponding to the task among all the traffic values ​​stored in the specific file. This can reduce the operation process and facilitate faster acquisition of historical traffic values. On the other hand, the storage space of the specific file is fixed. If all the traffic values ​​stored in the specific file are not deleted in time, the specific file will no longer be able to store data when other tasks are subsequently executed.

[0057] The aforementioned sub-traffic value refers to the sum of all traffic values ​​within a specific file after the application within the mobile terminal's native operating system executes the current command. Once the historical traffic value is obtained, the historical traffic value is added to the current traffic value to obtain the sub-traffic value generated by completing the current command. As mentioned in the technical background, computers promptly detect and intercept malicious programs during processing. Therefore, only if the current command is not the one corresponding to a malicious program will the mobile terminal's native operating system execute it. Thus, the historical traffic value represents the traffic value generated by the application when the command was safely executed.

[0058] Step S300 , determining whether the sub-flow value is greater than a preset flow value corresponding to the current moment; if so, generating an interception signal to intercept the current operation instruction.

[0059] Figure 2This is a flowchart of the present embodiment for determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment. Figure 2 As shown, determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment includes the following steps:

[0060] Step S301: Obtain the progress value of the current operation instruction in all tasks, and the total flow value required to complete all tasks.

[0061] Step S302 , determining whether each operation instruction in all jobs requires the same flow rate, and if so, multiplying the progress value by the total flow rate value to obtain a preset flow rate value corresponding to the current stage.

[0062] Step S303: If not, obtain the preset sub-flow value corresponding to the current stage, add the preset sub-flow value to the historical flow value to obtain the preset flow value corresponding to the current moment.

[0063] Step S304: subtract the preset flow value from the sub-flow value to obtain a flow difference, and determine whether the flow difference is greater than zero. If it is greater than zero, the sub-flow value is greater than the preset flow value corresponding to the current moment.

[0064] Step S305: If it is not greater than zero, the sub-flow value is not greater than the preset flow value corresponding to the current moment.

[0065] The preset traffic value corresponding to the current moment mentioned above refers to the theoretical traffic value that should be generated when the application executes the current operation instruction. That is, all operation instructions of the application in the entire process from the first operation instruction of this task to the current operation instruction are operation instructions with normal security attributes, rather than operation instructions with malicious attributes such as destructive behavior. Then the traffic value generated by all operation instructions in this process is the preset traffic value.

[0066] Each task has a fixed number of operational instructions. Each time a worker enters an operational instruction, the mobile terminal sequentially numbers the operational instructions belonging to the same application, thus providing the number corresponding to the current operational instruction. The number of the operational instruction required to complete the task is also pre-set. By dividing the number corresponding to the current operational instruction by the number of operational instructions required to complete the task, the current operational instruction's progress in the overall task can be calculated. Furthermore, the total flow rate required to complete the entire task is also pre-set in a storage module within the mobile terminal. By viewing this storage module, the total flow rate required to complete the entire task can be obtained.

[0067] Tasks with different attributes will generate different flow values. These are mainly categorized into the case where each operation in the same task requires the same flow, which corresponds to the average attribute; and the case where not every operation in the same task requires the same flow, which corresponds to the random attribute. These two different cases correspond to different task attributes. By examining the attributes of the task, you can determine whether each operation instruction in the entire task requires the same flow value. If it is determined that each operation instruction in the entire task requires the same flow, then multiplying the progress value by the total flow value will give you the preset flow value for the current stage.

[0068] If it is determined that not every operation instruction in the entire work requires the same flow rate, it is also necessary to obtain the current theoretical flow rate value corresponding to the current operation instruction that has been stored in the storage module of the mobile terminal. Among them, since the historical flow rate value is equivalent to the flow rate value that should be generated in theory in a safe environment during the process from the start of the execution of the first operation instruction of this task to the execution of the operation instruction before the current operation instruction, the current theoretical flow rate value is added to the historical flow rate value to obtain the preset flow rate value corresponding to the current moment. In addition, by adding the current theoretical flow rate value to the historical flow rate value to obtain the preset flow rate value corresponding to the current moment, the mobile terminal can delete the current theoretical flow rate value corresponding to the current moment stored in the storage module after executing the operation instruction at the current moment, thereby increasing the storage space available for the storage module.

[0069] After subtracting the preset flow value from the subflow value to obtain a flow difference, the flow difference can be compared with zero to determine whether the subflow value is greater than the preset flow value corresponding to the current moment. If the flow difference is greater than zero, the sign of the flow difference is positive, and the subflow value is greater than the preset flow value corresponding to the current moment. If the flow difference is not greater than zero, the sign of the flow difference is not zero, and the subflow value is not greater than the preset flow value corresponding to the current moment. If the subflow value is greater than the preset flow value corresponding to the current moment, it indicates that the current operation instruction is not a safe execution instruction. Executing the current operation instruction will not only complete the result that the current operation instruction should theoretically produce, but also produce additional results. Specifically, the additional results may include installing new software, mini-programs, or accessing other applications on the mobile terminal. To implement application security management, the mobile terminal generates an error instruction and sends the error instruction to the mobile terminal's interception module. Upon receiving the error instruction, the interception module automatically generates an interception signal to intercept the current operation instruction, thereby preventing the application currently in use in this embodiment from executing the current operation instruction.

[0070] This embodiment compares the keywords in the current operation instruction with preset keywords. If the keywords in the current operation instruction are consistent with the preset keywords, it indicates that the current operation instruction is the operation instruction corresponding to the application in use. Then, by obtaining the traffic values ​​generated by the executed operation instructions and superimposing them, a historical traffic value is obtained. The historical traffic value is superimposed with the current traffic value corresponding to the current operation instruction to obtain a sub-traffic value. Finally, the sub-traffic value is compared with the preset traffic value corresponding to the current moment. If the sub-traffic value is greater than the preset traffic value corresponding to the current moment, it indicates that the current operation instruction is not a safe execution operation instruction and needs to be intercepted. During the entire process of determining whether the current operation instruction is a safe execution operation instruction, there is no need for a database to store the operation instructions of some operations that the application needs to execute, nor is there a need for staff to update the database, which can reduce the workload of staff and avoid over-reliance on the database.

[0071] If the operation instruction is not a safe execution operation, it may be an additional operation that is irrelevant to the current processing work, or it may be not conducive to obtaining accurate working operation results. Since the current operation instruction is to add an operation that is irrelevant to the current processing work, it will require more flow values. Therefore, the above scheme can filter out the additional operations that are not related to the current processing work. For operations that are not conducive to obtaining accurate working results, they will not be filtered by judging the flow value. Therefore, if the sub-flow value is not greater than the preset flow value corresponding to the current moment, it is also necessary to determine whether the current operation instruction is inconsistent with the historical operation instruction that has been executed. If so, an interception signal is generated to intercept the current operation instruction; if not, the current operation instruction is executed.

[0072] Among them, an application security management method also includes: after each operation instruction is executed, obtaining the operation result corresponding to the operation instruction, judging whether the operation result is the final result of the parameters corresponding to the operation instruction, if so, marking the operation instruction as a fixed operation instruction; otherwise, marking the operation instruction as an intermediate operation instruction.

[0073] After each operation instruction is executed by the operating system originally provided by the mobile terminal, a corresponding operation result will be generated. The operation result is the operation result of the parameter corresponding to the operation instruction. If the operation result needs to be output as the final result of the parameter in the entire operation, then the operation result is the final result of the parameter corresponding to the operation instruction, and the operation instruction is marked as a fixed operation instruction by marking a keyword to indicate that the result of the parameter corresponding to the fixed operation instruction is the final result. If the operation result obtained by the subsequent operation instruction conflicts with the result, it indicates that the operation instruction should not be executed and should be intercepted. If the operation result does not need to be output as the final result of the parameter in the entire operation, then the operation result is not the final result of the parameter corresponding to the operation instruction, and the operation instruction is marked as an intermediate operation instruction by marking a keyword to indicate that the result of the parameter corresponding to the fixed operation instruction is not the final result. This application defaults to the first operation instruction obtained by the application as a safe execution operation instruction. Fixed operation instructions and intermediate operation instructions are both operation instructions that have been executed by the operating system originally provided by the mobile terminal, that is, historical operation instructions that have been executed. If the operation instruction is determined to be safe to execute, the mobile terminal's native operating system will execute the operation instruction. If it is not determined whether the operation instruction is safe to execute, the operation instruction will first be executed by the host operating system in the virtual machine. The virtual machine corresponds to the mobile terminal.

[0074] Figure 3 This is a flowchart of determining whether there is a conflict between the current operation instruction and the executed historical operation instruction provided by this embodiment. Figure 3 As shown, determining whether there is a conflict between the current operation instruction and the executed historical operation instruction includes the following steps:

[0075] Step S401: Obtain fixed parameters corresponding to all fixed operation instructions, and determine whether the current operation instruction will modify the final result of the fixed parameters. If so, the current operation instruction is inconsistent with the executed historical operation instructions.

[0076] Step S402: If not, obtain the intermediate parameters corresponding to all intermediate operation instructions, and determine whether the current operation instruction will restore the values ​​corresponding to the intermediate parameters to the initial values. If so, there is a contradiction between the current operation instruction and the executed historical operation instructions.

[0077] Step S403: If the value corresponding to the intermediate parameter is not restored to the initial value, then there is no contradiction between the current operation instruction and the executed historical operation instructions.

[0078] There are mainly two situations in which there is a contradiction between the current operation instruction and the executed historical operation instructions. One is that the current operation instruction will modify the final result of the fixed parameter corresponding to the fixed operation instruction; the other is that the current operation instruction will restore the value of the intermediate parameter corresponding to the intermediate operation instruction to the initial value.

[0079] Among them, every time a current operation instruction is obtained, the acquisition module of the mobile terminal will send the current operation instruction to the virtual machine to execute the operation instruction in the virtual machine to obtain the corresponding operation result. The virtual machine will then send the obtained operation result to the acquisition module in the operating system originally provided by the mobile terminal. Therefore, the operating system originally provided by the mobile terminal will first determine whether the received operation result involves the parameter corresponding to the final result. If it does, it will further determine whether the value of the parameter in the operation result is consistent with the value of the final result. If it is consistent, it indicates that the current operation instruction will not modify the final result of the fixed parameter; if it is inconsistent, it indicates that the current operation instruction will modify the final result of the fixed parameter. If it is not involved, it also indicates that the current operation instruction will not modify the final result of the fixed parameter. Through the above technical solution, the current operation instruction and the executed historical operation instruction can be determined, and there is no situation where the current operation instruction will modify the final result of the fixed parameter corresponding to the fixed operation instruction.

[0080] The mobile terminal's native operating system first determines whether the received operation result involves an intermediate parameter. If so, it further determines whether the value of the parameter in the operation result is consistent with the initial value. If consistent, it indicates that the current operation instruction will restore the value corresponding to the intermediate parameter to the initial value; if inconsistent, it indicates that the current operation instruction will not restore the value corresponding to the intermediate parameter to the initial value. If not, it also indicates that the current operation instruction will not restore the value corresponding to the intermediate parameter to the initial value.

[0081] If the current operation instruction will not modify the final result of the fixed parameter, and the current operation instruction will not restore the numerical value corresponding to the intermediate parameter to the initial value, it can be determined that there is no contradiction between the current operation instruction and the executed historical operation instruction; otherwise, other situations indicate that there is a contradiction between the current operation instruction and the executed historical operation instruction.

[0082] In addition, after generating interception information to intercept the current operation instruction, it includes: obtaining the number of times the interception signal is generated, judging whether it exceeds the preset number at this time, and if so, generating an alarm signal indicating that there is a security problem with the application, and a stop signal indicating that the application is in an inoperative state, and sending the alarm signal.

[0083] The preset number of times is pre-set and stored in the mobile terminal's storage module, and can be modified based on actual circumstances. If the number of times exceeds the preset number, it indicates a security vulnerability in the application and that all operations should be stopped. Specifically, the mobile terminal's instruction generation module generates a stop signal that deactivates the application, causing it to cease executing any instructions. To ensure that personnel are promptly informed of the mobile terminal's actual operating status, the mobile terminal's alarm module also generates an alarm signal indicating a security issue with the application.

[0084] Figure 4 This is a framework diagram of an application security management system provided by this embodiment. Figure 4 As shown, an application security management system includes an acquisition module, a judgment module, a processing module and an interception module.

[0085] The acquisition module is used to obtain the current operation instruction at the current moment and the current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword. The judgment module is used to determine whether the keyword is consistent with a preset keyword. If the keyword is consistent with the preset keyword, the processing module automatically superimposes the flow values ​​generated by the executed historical operation instructions to obtain the historical flow value, and obtains the sub-flow value generated by completing the current operation instruction based on the historical flow value and the current flow value. The judgment module is also used to determine whether the sub-flow value is greater than the preset flow value corresponding to the current moment. The interception module is used to generate an interception signal to intercept the current operation instruction if the sub-flow value is greater than the preset flow value corresponding to the current moment.

[0086] Figure 5 This is a structural block diagram of the server provided in this embodiment. Figure 5 As shown, the server includes a processor 51 and a memory 52, wherein the memory 52 stores a computer program 53 that can run on the processor 51. When the computer program 53 is executed by the processor, an application security management method provided in an embodiment of the present application is implemented.

[0087] The memory 52 may be a ROM or other type of static storage device capable of storing static information and instructions, a random access memory or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory, a read-only optical disc or other optical disc storage, an optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. In some embodiments, the memory 52 may be an internal storage unit.

[0088] The processor 51 may be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof, and is used to run program codes stored in the memory 52 or process data.

[0089] The processor 51 and the memory 52 are connected via a bus. The bus may include a path for transmitting information between the above components. The bus may be a peripheral component interconnect standard bus or an extended industry standard architecture bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0090] Figure 5 Only a server having a memory 52, a processor 51, and a bus is shown. It is understood in this field that Figure 5 The illustrated structure does not limit the server; it can be a bus or star structure. The server may also include more or fewer components than shown, or combine certain components, or deploy components differently. Other existing or future electronic device usage scenarios should also be included within the scope of protection and are incorporated herein by reference.

[0091] An embodiment of the present application provides a computer-readable medium having a computer program stored thereon. When the computer-readable medium is run on a computer, the computer can execute the relevant contents of the aforementioned method embodiment.

[0092] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps and they may be executed in other orders.

[0093] The above description is only part of the implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An application security management method, characterized in that: The method comprises: Obtaining a current operation instruction at a current moment and a current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword; Determine whether the keyword is consistent with a preset keyword. If consistent, automatically add traffic values ​​generated by executed historical operation instructions to obtain a historical traffic value, and obtain a sub-traffic value generated by completing the current operation instruction based on the historical traffic value and the current traffic value; determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment, and if so, generating an interception signal to intercept the current operation instruction; Obtaining the current flow value corresponding to the current operation instruction includes: Sending the current operation instruction to the virtual machine; receiving a flow value sent by the virtual machine indicating completion of the current operation instruction and recording the flow value as the current flow value; Determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment includes: Get the progress value of the current operation instruction in the entire work, as well as the total flow value required to complete the entire work; Determine whether each operation instruction in the entire work requires the same flow rate, and if so, multiply the progress value by the total flow rate value to obtain a preset flow rate value corresponding to the current stage; If not, obtain the current theoretical flow value corresponding to the current operation instruction, and add the current theoretical flow value to the historical flow value to obtain the preset flow value corresponding to the current moment; Subtracting the preset flow value from the sub-flow value to obtain a flow difference, and determining whether the flow difference is greater than zero; if so, the sub-flow value is greater than the preset flow value corresponding to the current moment; If it is not greater than zero, the sub-flow value is not greater than the preset flow value corresponding to the current moment.

2. The method according to claim 1, characterized in that The method further comprises: If the sub-flow value is not greater than the preset flow value corresponding to the current moment, determining whether the current operation instruction is inconsistent with the executed historical operation instruction, and if so, generating an interception signal to intercept the current operation instruction; If it does not exist, execute the current operation instruction.

3. The method according to claim 2, characterized in that The method further comprises: After each operation instruction is executed, the operation result corresponding to the operation instruction is obtained, and it is determined whether the operation result is the final result of the parameters corresponding to the operation instruction. If so, the operation instruction is marked as a fixed operation instruction; Otherwise, the operation instruction is marked as an intermediate operation instruction.

4. The method according to claim 3, characterized in that Determining whether the current operation instruction conflicts with the executed historical operation instruction includes: Obtaining fixed parameters corresponding to all fixed operation instructions, and determining whether the current operation instruction will modify the final result of the fixed parameters. If so, the current operation instruction is inconsistent with the executed historical operation instructions; If not, obtain the intermediate parameters corresponding to all the intermediate operation instructions, and determine whether the current operation instruction will restore the values ​​corresponding to the intermediate parameters to the initial values. If so, the current operation instruction is inconsistent with the executed historical operation instructions; If not, then there is no contradiction between the current operation instruction and the executed historical operation instructions.

5. The method according to claim 2, characterized in that The generating of the interception signal to intercept the current operation instruction comprises: The number of interception signals generated is obtained, and it is determined whether the number exceeds a preset number. If so, an alarm signal indicating that there is a security problem with the application and a stop signal indicating that the application is in an inoperative state are generated, and the alarm signal is sent out.

6. An application security management system, characterized in that: The system includes: an acquisition module, a judgment module, a processing module and an interception module; wherein, The acquisition module is used to acquire a current operation instruction at a current moment and a current flow value corresponding to the current operation instruction, wherein the current operation instruction includes a keyword; The judging module is used to judge whether the keyword is consistent with a preset keyword; The processing module, if the keyword is consistent with the preset keyword, automatically adds the traffic values ​​generated by the executed historical operation instructions to obtain a historical traffic value, and obtains a sub-traffic value generated by completing the current operation instruction based on the historical traffic value and the current traffic value; The judging module is further configured to judge whether the sub-flow value is greater than the preset flow value corresponding to the current moment; The interception module is configured to generate an interception signal to intercept the current operation instruction if the sub-flow value is greater than the preset flow value corresponding to the current moment; Wherein, obtaining the current flow value corresponding to the current operation instruction includes: Sending the current operation instruction to the virtual machine; receiving a flow value sent by the virtual machine indicating completion of the current operation instruction and recording the flow value as the current flow value; Determining whether the sub-flow value is greater than the preset flow value corresponding to the current moment includes: Get the progress value of the current operation instruction in the entire work, as well as the total flow value required to complete the entire work; Determine whether each operation instruction in the entire work requires the same flow rate, and if so, multiply the progress value by the total flow rate value to obtain a preset flow rate value corresponding to the current stage; If not, obtain the current theoretical flow value corresponding to the current operation instruction, and add the current theoretical flow value to the historical flow value to obtain the preset flow value corresponding to the current moment; Subtracting the preset flow value from the sub-flow value to obtain a flow difference, and determining whether the flow difference is greater than zero; if so, the sub-flow value is greater than the preset flow value corresponding to the current moment; If it is not greater than zero, the sub-flow value is not greater than the preset flow value corresponding to the current moment.

7. A server, characterized in that: The server includes: a processor and a memory, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, an application security management method as described in any one of claims 1 to 5 is implemented.

8. A computer-readable medium having stored thereon a computer program capable of being executed on a processor, characterized in that: When the computer program is executed by the processor, the application security management method according to claims 1 to 5 is implemented.

Images