Cloud data acquisition method and device, electronic equipment and storage medium

Abstract

The application provides a cloud data acquisition method and device, electronic equipment and storage medium. The cloud data acquisition method comprises the following steps: acquiring network data from a non-application layer of a system running a target APP; searching for a link of cloud data corresponding to the target APP in the network data, the cloud data corresponding to the link being decrypted data; and acquiring the decrypted cloud data based on the link. Since the cloud data corresponding to the link is in a decrypted state, the acquired cloud data is not encrypted. Compared with the case of inputting a password when accessing the link acquired through the application layer, no password needs to be input when accessing the link acquired through the non-application layer, so that manual analysis of the source code of the APP to acquire the decrypted data is not needed, and the acquisition efficiency of the cloud data of the APP can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, electronic device and storage medium for acquiring cloud data. Background Technology

[0002] Currently, the main method for fixing audio and video files from an app's cloud is as follows: First, run the Fiddler packet capture tool in an emulator. Then, run the app in the emulator. Whenever the app involves audio or video during operation, such as playing music, Fiddler can retrieve the audio and video files from the app's cloud through the emulator's application layer. To prevent the app from accessing these files, apps typically set passwords, and the audio and video files captured by Fiddler are also encrypted. To obtain playable audio and video files, they need to be decrypted. Since different apps use different encryption passwords for their audio and video files, it's necessary to manually analyze the source code of each app individually to obtain the encryption password and then decrypt the acquired audio and video files. However, relying solely on manual decryption of audio and video files retrieved from the app's cloud is obviously very inefficient, resulting in low efficiency in fixing audio and video files from the app's cloud. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for acquiring cloud data, which eliminates the need to decrypt the acquired cloud data and improves the efficiency of securing cloud data in the APP.

[0004] To address the aforementioned technical problems, this application provides the following technical solutions:

[0005] The first aspect of this application provides a method for acquiring cloud data, the method comprising: acquiring network data from the non-application layer of a system running a target APP; searching for a link in the network data to cloud data corresponding to the target APP, wherein the cloud data corresponding to the link is decrypted data; and acquiring the decrypted cloud data based on the link.

[0006] A second aspect of this application provides a cloud data acquisition device, the device comprising: a first acquisition module for acquiring network data from a non-application layer of a system running a target APP; a search module for searching for a link to cloud data corresponding to the target APP in the network data; and a second acquisition module for acquiring decrypted cloud data based on the link.

[0007] A third aspect of this application provides an electronic device, the electronic device comprising: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method of the first aspect.

[0008] A fourth aspect of this application provides a computer-readable storage medium comprising: a stored program; wherein, when the program is executed, the device on which the storage medium is located executes the method of the first aspect.

[0009] Compared to existing technologies, the cloud data acquisition method provided in the first aspect of this application obtains network data through the non-application layer of the target APP's operating system, then obtains the link to the target APP's cloud data from the network data, and then obtains the APP's cloud data through the link. Since the cloud data corresponding to this link is in a decrypted state, the obtained cloud data is unencrypted. Compared to the need to enter a password when accessing a link obtained through the application layer, no password is required when accessing a link obtained through the non-application layer. Therefore, there is no need for manual analysis of the APP's source code to obtain decrypted data, which can improve the efficiency of APP cloud data acquisition.

[0010] The cloud data acquisition device provided in the second aspect of this application, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect have the same or similar beneficial effects as the cloud data acquisition method provided in the first aspect. Attached Figure Description

[0011] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein:

[0012] Figure 1 A schematic diagram of the architecture for acquiring cloud data from an app in existing technologies;

[0013] Figure 2 This is a schematic diagram of the architecture for obtaining cloud data from the APP in this application embodiment;

[0014] Figure 3 This is a flowchart illustrating the method for acquiring cloud data in an embodiment of this application;

[0015] Figure 4 This is a schematic diagram illustrating the process of obtaining audio and video files from the cloud in this application embodiment;

[0016] Figure 5 This is a schematic diagram of the structure of the cloud data acquisition device in the embodiments of this application;

[0017] Figure 6 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0018] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0019] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0020] Currently, obtaining cloud data from apps primarily involves using tools like Fiddler to capture data sent from cloud servers within the application layer of the app's system. This data is then decrypted using a password obtained through manual analysis of the app's source code. However, with a large number of apps, analyzing the source code of each app and decrypting the data individually is extremely inefficient, resulting in low efficiency in obtaining app cloud data.

[0021] Figure 1 This is a schematic diagram of the architecture for acquiring cloud data from an app in existing technologies. (See also...) Figure 1 As shown, when the system hosting the app client needs to obtain data from the app's cloud, the system first sends a request to the cloud. This request is encapsulated through various architectural layers (application layer, presentation layer, session layer, transport layer, network layer, data link layer, and physical layer, depending on the specific system architecture) before being sent to the cloud. Upon receiving the request, the cloud also parses it through its own architectural layers (physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer, depending on the specific cloud architecture) and returns a response to the system. This response is then sent from the cloud's application layer to the physical layer. Finally, the cloud obtains the response from the physical layer to the application layer, thus acquiring the cloud data. The Fiddler packet capture tool captures the response from the system's application layer and then decrypts it using passwords obtained through manual analysis of the app's source code, thereby obtaining the app's cloud data.

[0022] The inventors discovered through research that if cloud data is not retrieved from the application layer, but from other layers of the system architecture layer besides the application layer, the data in these other layers is richer and more deeply processed than the data in the application layer. This may result in decrypted data, thus allowing the acquisition of password-free data, skipping the decryption process, and improving the efficiency of cloud data retrieval for the APP.

[0023] In view of this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for acquiring cloud data. Data is acquired from the non-application layer of the APP's operating system, and then a link to cloud data is obtained from the data. The cloud data of the APP is then acquired through the link. The acquired cloud data is decrypted, eliminating the need for manual analysis of the APP's source code to obtain the password for decryption. This method can be applied to every APP that needs to acquire cloud data, thereby improving the efficiency of acquiring cloud data for APPs.

[0024] Figure 2 This is a schematic diagram of the architecture for obtaining cloud data from the APP in this application embodiment. See also... Figure 2 As shown, with Figure 1 The process of sending and receiving requests, returning and receiving responses between the system hosting the APP client and the APP cloud is the same. The only difference is that when fetching the response, it no longer fetches from the system's application layer, but from a non-application layer. In this case, the data corresponding to the fetched response is in a decrypted state; that is, it is not encrypted, and data from the APP cloud can be obtained directly.

[0025] Next, the method for acquiring cloud data provided in the embodiments of this application will be described in detail.

[0026] Figure 3 This is a flowchart illustrating the cloud data acquisition method in an embodiment of this application. See [link / reference] Figure 3 As shown, the method may include:

[0027] S301: Obtain network data from the non-application layer of the system running the target APP.

[0028] The target app here refers to the app whose cloud data needs to be accessed. In practical applications, the target app can be one or more illegal / non-compliant apps that require evidence collection. The specific type of target app is not limited here.

[0029] For an app to be used by users, its client must be installed on the user's device. For a device to run an app, it needs an operating system; this operating system is the system that runs the target app. The system has an architecture, meaning it has multiple layers. The application layer interfaces with the app client. All other layers in the architecture are non-application layers, which obtain network data, primarily data received from the cloud. The data obtained through these non-application layers is always in a decrypted state.

[0030] In the process of obtaining network data from the non-application layer, any tool that can capture data from the non-application layer can be used, and there are no restrictions on the specific type of tool.

[0031] S302: Locate the link to the cloud data corresponding to the target APP in the network data. The cloud data corresponding to the link is the decrypted data.

[0032] After obtaining network data from the non-application layer, the cloud data you want to obtain is not the network data itself. The cloud data is stored in a certain location in the cloud. The network data contains the storage location of the cloud data, i.e., the link. Therefore, by obtaining the link from the network data, you can find the cloud data in the decrypted state.

[0033] In the process of searching for links in online data, the system can automatically identify links to cloud data requested by the target app based on the characteristics or identifiers of the links and the target app, and then open the links to obtain the cloud data. Alternatively, each sub-data item in the online data can be treated as a link to be opened. If it can be opened, it is considered a link, and the cloud data of the app within it is obtained; if it cannot be opened, it is considered not a link. The specific method for searching for links in online data is not limited here.

[0034] S303: Obtain decrypted cloud data based on the link.

[0035] After finding the link to the APP's cloud data, opening the link means the APP client is ready and can access the data. At this point, the cloud data is already in a decrypted state, so the obtained cloud data is unencrypted.

[0036] When retrieving cloud data via a link, the link can be used to open the corresponding page, which will display the cloud data. The cloud data can then be saved locally by taking screenshots, recording, or downloading.

[0037] As can be seen from the above, the cloud data acquisition method provided in this application embodiment obtains network data through the non-application layer of the target APP's running system, then obtains the link to the target APP's cloud data from the network data, and then obtains the APP's cloud data through the link. Since the cloud data corresponding to this link is in a decrypted state, the obtained cloud data is unencrypted. Compared with the need to enter a password when accessing the link obtained through the application layer, no password is required when accessing the link obtained through the non-application layer. Therefore, there is no need for manual analysis of the APP's source code to obtain decrypted data, which can improve the efficiency of APP cloud data acquisition.

[0038] Furthermore, in addition to the application layer, there are many other layers in the system architecture layer. The specific layers from which network data is obtained, and in what order, need to be predetermined.

[0039] Specifically, step S301 above may include:

[0040] Step A1: Identify at least one target layer from the non-application layer.

[0041] In the system architecture layer, besides the application layer, there are several other layers, namely non-application layers. In the non-application layers, one or more layers, namely target layers, need to be identified first to extract network data.

[0042] Step A2: Determine the query order of at least one target layer based on the reverse order of the hierarchical order in which the system processes the received data.

[0043] The hierarchical order in which a system processes received data refers to the order in which layers process the data first, then next, and finally last after the system receives data from the cloud. Generally, after receiving data, the physical layer processes it first, followed by the data link layer, network layer, transport layer, session layer, presentation layer, etc., with the application layer processing it last. The identified target layers are then ordered in reverse order.

[0044] For example, suppose the system processes received data in the following order: layer a, layer b, layer c, layer d, layer e, and the target layers are layer b and layer c. Then, the query order would be layer c first, then layer b.

[0045] It should be noted that when there is only one target layer, the sorting will not be performed in step A2, and the process will proceed directly to step A3.

[0046] Step A3: Determine whether the data in each target layer contains links according to the query order. If it does, proceed to step A4; if none of the target layers contain links, proceed to step A5.

[0047] When there is only one target layer, directly check if that layer contains a link. When there are two or more target layers, check if the data in the first layer contains a link, following the query order. If it does (finding just one link is sufficient), the data in that layer is treated as network data. If it does not contain a link, continue checking if the data in the second layer contains a link. If no link is found in the data of the last layer in the query order, output a message indicating that no cloud data is available for this target app.

[0048] Step A4: Use the data from the corresponding layer as network data.

[0049] In other words, the data in the layer where a link is first identified is considered network data. For example, if the target layers are C and B, first check if there is a link in the data of layer C. If there is, the data of layer C is considered network data. If not, continue to check if there is a link in the data of layer B. If there is, the data of layer B is considered network data.

[0050] Step A5: Output a message indicating that no cloud data is available.

[0051] If no links exist in the data of any of the target layers, it means that unencrypted cloud data cannot be obtained through the links. In this case, a message can be sent to the user informing them that no cloud data is currently available. If the target layer is not one of the layers in the architecture except for the application layer, the user can add layers that are not present in the target layer from all layers except the application layer and continue the evaluation.

[0052] As can be seen from the above, the system checks whether there are links in the data of the target layer layer by layer in the reverse order of the system's processing of received data. The data of the layer where the first link is found is taken as network data. Since the later layers in the system's processing of received data have a larger amount of data, taking the data of the layer where the first link is found as network data minimizes the amount of network data and improves the efficiency of extracting links from the target APP's cloud data from the network data.

[0053] Furthermore, when determining the target layer from the non-application layer, it is not determined randomly, but needs to be determined according to pre-set rules, or the user can specify it during this extraction process.

[0054] Specifically, step A1 above may include:

[0055] Step A11: Determine if a configuration instruction for setting the target layer exists. If it exists, proceed to step A12; otherwise, proceed to step A13.

[0056] Because the hierarchical architecture of the various systems on which the app runs is not entirely the same—some systems have certain layers while others do not—or the same function may be set in different layers on different systems, configuring the target layer can determine which layers to extract network data from during the process of acquiring cloud data for the target app, based on the actual hierarchical architecture of the system on which the target app runs.

[0057] Step A12: Determine the target layer according to the configuration instructions.

[0058] When a configuration directive exists, the target layer is determined from the system's architecture layer according to the configuration directive.

[0059] Step A13: Determine the target layer based on the preset configuration information.

[0060] When no configuration command is specified, the target layer is determined based on the default preset configuration information. In other words, if the user does not specify a target layer during this cloud data acquisition process, the target layer is determined based on the default preset configuration information. This preset configuration information can be all layers in the system architecture except the application layer, or one or more specified layers, or it can be the network layer or transport layer.

[0061] As can be seen from the above, by determining whether a configuration instruction exists, and then determining the target layer according to the configuration instruction when the configuration instruction is found, the flexibility of target layer determination can be improved, thereby ensuring that the target APP's cloud data can be obtained in every cloud data acquisition process.

[0062] Furthermore, the system may not only run one app; multiple apps may run simultaneously. This means the system may receive data from multiple apps at the same time. Therefore, it is necessary to filter the data of the target app from the data of multiple apps and then extract the links.

[0063] Specifically, step S301 above may include:

[0064] Step B1: Obtain the data received by each APP from the non-application layer of the system running the target APP.

[0065] Regardless of how many apps are currently running on the system, all data outside the application layer is first acquired, and then the data received by the system is extracted from it. What you get is the data received by each app outside the application layer.

[0066] Step B2: Filter the data received by the target APP from the data received by each APP and use it as network data.

[0067] In the process of filtering data received from various apps to extract data received by the target app, all data bearing the target app's identifier can be extracted, or data corresponding to information pointing to the target app's port can be extracted and treated as data received by the target app, thus serving as network data. The specific method for filtering data received from various apps to extract data received by the target app is not limited here.

[0068] As can be seen from the above, filtering the data received by the target app from the data received by various apps outside the application layer and using it as network data can avoid extracting links from the data received by non-target apps, reduce the workload of link extraction, and improve the efficiency of cloud data acquisition.

[0069] Furthermore, when multiple apps are running simultaneously in the system, the data received by each app can be considered a data packet, and the collection of these data packets constitutes network data. If the acquired cloud data consists of audio and video files, these data packets can be filtered based on audio and video characteristics, eliminating data packets without these characteristics—that is, eliminating data received by apps without audio or video—thereby improving the efficiency of extracting links from the data and thus improving the efficiency of acquiring audio and video files.

[0070] Specifically, step S302 above may include:

[0071] Step C1: Search for target data packets with audio and video characteristics among multiple data packets.

[0072] Since the target app is an audio and video related app, and the cloud data of the app to be acquired is an audio and video file, it is evident that the data packets corresponding to the target app in the non-application layer of the system must have audio and video characteristics. Therefore, audio and video characteristics are judged for each data packet in the non-application layer, and the data packets that are judged to have audio and video characteristics are taken as the target data packets.

[0073] In practical applications, audio and video features can be preset data formats, such as MP4 and FLV. Audio and video features can also be a condition exceeding a preset data size. Because audio and video files are generally large, if the data packet size exceeds the preset size, it indicates a large data packet, and the corresponding app might be an audio / video app.

[0074] Step C2: Locate the links to the audio and video files corresponding to the target APP in the target data package.

[0075] Although the target app is an audio / video app, other audio / video apps may also be running on the system. After identifying the target data packet, if there is only one target data packet, it means that the data packet belongs to the target app, and the link can be directly obtained from the target data packet. If there are multiple target data packets, it is necessary to delete the data packets in the target data packet that do not have the app's identifier, and then obtain the link from the deleted target data packets.

[0076] Once the target data packet is identified, all links contained within it can be searched, and audio / video file links can be filtered out from all links based on their audio / video formats, thus serving as the links for the audio / video files corresponding to the target app.

[0077] As can be seen from the above, by using audio and video features to identify the target data packet from multiple data packets outside the application layer, and then using the target data packet to find the link to the audio and video file corresponding to the target APP, we can avoid searching for useless links from other non-video APPs, improve the efficiency of link search, and thus improve the efficiency of APP cloud data acquisition.

[0078] Furthermore, once the link is obtained, the corresponding cloud data is in a decrypted state, which can be directly viewed and accessed using appropriate methods.

[0079] Specifically, step S303 above may include:

[0080] Step D1: Open the link using a computer browser.

[0081] Generally, links can be opened through a computer browser. Specifically, the link is entered into the address bar of the computer browser, allowing the browser to access the target app's cloud data and display it.

[0082] Of course, in addition to opening the link through a computer browser, you can also open it through a mobile browser. There are no specific restrictions on the browser platform used here.

[0083] Step D2: Locate the cloud data in the opened link.

[0084] After accessing the link in your computer's browser, the browser will display the corresponding content. Some of this content may not be the cloud data you need to retrieve. Therefore, you will need to search for the required cloud data within the displayed content.

[0085] During the search process, you can manually select data on the browser's display page, and then find the desired cloud data within the browser's content based on your selections. Alternatively, you can directly find the desired cloud data within the browser's display content according to pre-set selection rules. The specific method for finding the desired cloud data within the browser's display page is not specified here.

[0086] Step D3: Download the found cloud data to your local machine.

[0087] After locating the required cloud data on the browser's display page, if the browser has a download function, you can directly download the data to your local device using this function. If the browser does not have a download function, you can download the data by taking a screenshot or recording the screen. The specific method for saving cloud data is not specified here.

[0088] As can be seen from the above, opening the link through a computer browser and downloading the content to the local device can permanently store the target app's cloud data.

[0089] Finally, a specific example will be used to further illustrate the cloud data acquisition method provided in the embodiments of this application.

[0090] Figure 4 This is a schematic diagram illustrating the process of obtaining audio and video files from the cloud in this application embodiment. See also... Figure 4 As shown, first, configure and run the Fiddler packet capture tool. Then, run a music player in the LDPlayer emulator, select a song to play, and pause after a few seconds. Next, configure the port forwarding policy (who to send the captured data to) and application filtering policy (selecting data from the target app from the captured data) of the Drony packet capture tool and run it. Then, the network data at the network layer or transport layer of the simulated mobile system will be forwarded by the Drony packet capture tool to the Fiddler packet capture tool via VPN. By analyzing the network packets with the Fiddler packet capture tool, the link to the audio file is found. Then, the link is opened using a computer browser, and the music playback file is obtained by choosing to download or save it locally. It can then be directly opened and played using a multimedia player. Ultimately, this achieves passwordless retrieval of audio and video files from the app's cloud, improving the efficiency of fixing audio and video files in the app's cloud.

[0091] Based on the same inventive concept, as an implementation of the above method, this application also provides a cloud data acquisition device. Figure 5 This is a schematic diagram of the cloud data acquisition device in an embodiment of this application. See also... Figure 5 As shown, the device may include:

[0092] The first acquisition module 501 is used to acquire network data from the non-application layer of the system running the target APP;

[0093] The search module 502 is used to search for a link to the cloud data corresponding to the target APP in the network data, wherein the cloud data corresponding to the link is decrypted data;

[0094] The second acquisition module 503 is used to acquire decrypted cloud data based on the link.

[0095] In other embodiments of this application, the first acquisition module is specifically used to determine at least one target layer from the non-application layer; determine the query order of the at least one target layer according to the reverse order of the hierarchical order of the system processing the received data; determine whether the data of each target layer contains links layer by layer according to the query order; if it contains links, then the data of the corresponding layer is taken as network data; if none of the target layers contain links, then a prompt message indicating that no cloud data can be obtained is output.

[0096] In other embodiments of this application, the first acquisition module is specifically used to determine whether there is a configuration instruction for setting the target layer; if there is, the target layer is determined according to the configuration instruction; if there is no, the target layer is determined according to preset configuration information.

[0097] In other embodiments of this application, the first acquisition module is specifically used to acquire data received by each APP from the non-application layer of the system running the target APP; filter out the data received by the target APP from the data received by each APP, and use it as network data.

[0098] In other embodiments of this application, the network data includes multiple data packets, each data packet being data received by an APP running in the system, and the cloud data being audio and video files; the search module is specifically used to search for target data packets with audio and video characteristics among the multiple data packets; and to search for links to audio and video files corresponding to the target APP from the target data packets.

[0099] In other embodiments of this application, the second acquisition module is specifically used to open the link through a computer browser; search for cloud data in the opened link; and download the found cloud data to the local machine.

[0100] In other embodiments of this application, the first acquisition module is specifically used to acquire network data from the non-application layer of the system running the target APP using the Drony packet capture tool; the search module is specifically used to search for the link of the cloud data corresponding to the target APP in the network data using the Fiddler packet capture tool, wherein the cloud data corresponding to the link is decrypted data.

[0101] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0102] Based on the same inventive concept, embodiments of this application also provide an electronic device. Figure 6 This is a schematic diagram of the electronic device in an embodiment of this application. See also: Figure 6 As shown, the electronic device may include: a processor 601, a memory 602, and a bus 603; wherein the processor 601 and the memory 602 communicate with each other through the bus 603; the processor 601 is used to call program instructions in the memory 602 to execute the methods in one or more of the above embodiments.

[0103] It should be noted that the descriptions of the above electronic device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the electronic device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0104] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium, which may include: a stored program; wherein, when the program is running, it controls the device where the storage medium is located to execute the methods in one or more of the above embodiments.

[0105] It should be noted that the descriptions of the storage medium embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0106] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for acquiring cloud data, characterized in that, The method includes: The Drony packet capture tool is used to identify at least one target layer from the non-application layer of the system running the target APP; the query order of the at least one target layer is determined according to the reverse order of the hierarchical order of the system's processing of received data; the data of each target layer is checked layer by layer according to the query order to see if it contains links; if it does, the data of the corresponding layer is treated as network data. The Drony packet capture tool is used to capture data packets from the transport layer or network layer of the system. The target APP is one or more illegal / non-compliant APPs that need to be investigated for evidence. The network data is analyzed using the Fiddler packet capture tool to find target data packets with audio and video characteristics among multiple data packets; the link to the audio and video file corresponding to the target APP is found from the target data packet; the network data includes multiple data packets, each data packet is data received by an APP running in the system; the cloud data is audio and video file; the cloud data corresponding to the link is decrypted data; the audio and video characteristics include a preset data format and a condition of being greater than a preset data volume; Obtain the decrypted cloud data based on the link.

2. The method according to claim 1, characterized in that, The acquisition of network data from the non-application layer of the system running the target APP includes: If none of the target layers contain the data, a message indicating that no cloud data is available will be output.

3. The method according to claim 2, characterized in that, Determining at least one target layer from the non-application layer includes: Determine if a configuration instruction for setting the target layer exists; If it exists, the target layer is determined according to the configuration instructions; If it does not exist, the target layer is determined according to the preset configuration information.

4. The method according to claim 1, characterized in that, The acquisition of network data from the non-application layer of the system running the target APP includes: Obtain data received by each app from the non-application layer of the system running the target app; The data received by the target APP is filtered out from the data received by each of the APPs and used as network data.

5. The method according to claim 1, characterized in that, The process of obtaining the decrypted cloud data based on the link includes: Open the link using a computer browser; Search for cloud data in the opened link; Download the found cloud data to your local machine.

6. A cloud data acquisition device, characterized in that, The device includes: The first acquisition module is used to determine at least one target layer from the non-application layer of the system running the target APP using the Drony packet capture tool; determine the query order of the at least one target layer according to the reverse order of the layer order in which the system processes the received data; determine whether the data of each target layer contains links according to the query order; if it does, the data of the corresponding layer is taken as network data. The Drony packet capture tool is used to capture data packets from the transport layer or network layer of the system. The target APP is one or more illegal / non-compliant APPs that need to be verified. The search module is used to parse the network data using the Fiddler packet capture tool to find target data packets with audio and video characteristics among multiple data packets; and to find the link to the audio and video file corresponding to the target APP from the target data packets. The network data includes multiple data packets, each data packet being data received by an APP running in the system. The cloud data is the audio and video file, and the cloud data corresponding to the link is the decrypted data. The audio and video characteristics include a preset data format and a condition that the data size is greater than a preset data size. The second acquisition module is used to acquire decrypted cloud data based on the link.

7. An electronic device, characterized in that, The electronic device includes: a processor, a memory, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium includes: a stored program; wherein, when the program is executed, it controls the device where the storage medium is located to perform the method as described in any one of claims 1 to 5.

Images