A risk data processing method and terminal

Abstract

The application discloses a risk data processing method and a terminal, wherein after receiving device end data, the device end data is processed according to a preset format to obtain a data type and current application data content; the device end data is distributed to a processing block according to the data type; and the processing block matches a processing rule according to the current application data content, and controls the device end according to the processing rule. Compared with a traditional signature verification mode, the application can more accurately locate specific problems, and can directly adjust the processing rule in the corresponding processing block when it is necessary to add or delete monitoring content, can dynamically adjust the data monitoring mode, and improves the security.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of device security, in particular to a risk data processing method and terminal. BACKGROUND

[0002] Since similar instant messaging applications and mailbox, short message and other applications provide a platform for users to freely send content, the receiver of the content and the platform itself will usually monitor and filter the content sent by the user, that is, to determine whether it is risk data. The existing technology usually automatically judges whether the received data is malicious by using existing filtering plug-ins, such as various built-in housekeeping applications or antivirus applications.

[0003] And the filtering is usually performed for a single application, and the existing technology determines whether the application is malicious according to the signature of the application, or filters the content in the application according to the preset rules, and cannot dynamically determine the behavior between applications, for example, a friend in an instant messaging application requires to view the interface of a conference software through screen sharing. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a risk data processing method and terminal to realize monitoring and interception of dynamic risk data.

[0005] In order to solve the above technical problems, one technical solution adopted by the present application is:

[0006] A risk data processing method, comprising the steps of:

[0007] After receiving device end data, processing the device end data according to a preset format to obtain a data type and a current application data content;

[0008] According to the data type, the device end data is allocated to a processing block;

[0009] According to the current application data content, the processing block matches a processing rule, and controls the device end according to the processing rule.

[0010] In order to solve the above technical problems, another technical solution adopted by the present application is:

[0011] A risk data processing terminal, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to realize the following steps:

[0012] After receiving device end data, processing the device end data according to a preset format to obtain a data type and a current application data content;

[0013] allocating the device end data into processing blocks according to the data type;

[0014] controlling the device end according to the processing rule by the processing block according to the current application data content matching the processing rule.

[0015] The application has the beneficial effect that: special processing blocks are set for different data types, processing rules are set in the data processing blocks, after the device end collects the device end data, the device end data is arranged into data types and current application data content according to the preset format, then different processing blocks can process their corresponding data types independently, which improves the data processing efficiency, and through the way of obtaining the current application data content and matching the processing rule to verify the data, compared with the traditional signature verification method, the specific problem can be located more accurately, and when it is necessary to add or delete monitoring content, the processing rules in the corresponding processing block can be directly adjusted, the data monitoring method can be dynamically adjusted, and the security is improved. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A risk data processing method according to an embodiment of the application;

[0017] Figure 2 A line-of-sight architecture schematic diagram of a risk data processing method according to an embodiment of the application;

[0018] Figure 3 A virtual device construction schematic diagram according to an embodiment of the application;

[0019] Figure 4 A structure schematic diagram of a risk data processing terminal according to an embodiment of the application;

[0020] LABEL EXPLANATION:

[0021] 1, a risk data processing terminal; 2, a processor; 3, a memory. DETAILED DESCRIPTION

[0022] To explain the technical content, the achieved purposes and effects of the application in detail, the following will be explained in combination with the embodiments and the drawings.

[0023] Please refer to Figure 1 A risk data processing method, comprising the steps of:

[0024] After receiving the device end data, processing the device end data according to the preset format to obtain the data type and the current application data content;

[0025] allocating the device end data into processing blocks according to the data type;

[0026] The processing block matches a processing rule according to the current application data content, and controls the device end according to the processing rule.

[0027] From the above description, the beneficial effects of the present application are that a processing block special for different data types is set, the processing block is provided with a processing rule, after the device end collects device end data, the data is arranged into a data type and current application data content according to a preset format, different processing blocks can process their corresponding data types independently, the data processing efficiency is improved, and the data is verified by acquiring the current application data content and matching the processing rule, compared with the traditional signature verification mode, the specific problem can be located more accurately, and when it is necessary to add or delete monitoring content, the processing rule in the corresponding processing block can be directly adjusted, the data monitoring mode can be dynamically adjusted, and the security is improved.

[0028] Further, before the device end data is processed according to the preset format to obtain the data type and the current application data content, the method further includes:

[0029] A virtual device is generated, the virtual device includes a virtual interface corresponding to a device interface of an entity device one by one;

[0030] The virtual interface is replaced with the device interface, so that an application in the entity device runs on the virtual device.

[0031] From the above description, the virtual device is set, the virtual device is created, and the data sent by the application to the entity device is transferred to the virtual device through the recreated interface, so that when the device end data is intercepted, the hardware in the entity device does not need to be changed, only the interface in the virtual device needs to be modified, and the application data content corresponding to the application can be ensured to be completely acquired and directly processed, without damaging the original device, but adjusting the original device to temporarily be in an unused state, and the function is taken over by the new device, if the original device is directly used to implement the interception of the data, the device needs to be modified, and a large amount of hard coding is used.

[0032] Further, after the device end data is received, the device end data is processed according to the preset format to obtain the data type and the current application data content, and the method further includes:

[0033] The device end data is processed according to the preset format to obtain a current application version number;

[0034] The processing block matches a processing rule according to the current application data content, and controls the device end according to the processing rule.

[0035] determining whether the processing block stores a processing rule set corresponding to the current application version number, and if so, matching a processing rule in the processing rule set according to the current application data content.

[0036] As can be seen from the above description, for the sent application, there may be an increase or decrease in function for different versions of the same application, so at this time, the current application version number is matched first, and if the matching is successful, the current application data content and the processing rule are matched, thereby avoiding the problem that different versions of the application cannot adapt to the processing rule due to different functions.

[0037] Further, the matching of the processing rule by the processing block according to the current application data content further comprises:

[0038] If the processing block does not store the current application version number, the operation confirmation information is sent according to the current application data content;

[0039] The operation is performed according to the return information corresponding to the operation confirmation information.

[0040] As can be seen from the above description, if there is a processing block corresponding to the data type, but the corresponding application version number does not exist in the processing block, the application data content is sent to the user for operation confirmation, and the corresponding operation is performed according to the application data content only after the user confirms that it is a safe operation, thereby avoiding the case that the application performs a sensitive operation without the user's knowledge.

[0041] Further, the operation performed according to the return information corresponding to the operation confirmation information further comprises:

[0042] The current application version number is saved, and the current application data content and the return information are saved as a processing rule corresponding to the current application version number.

[0043] As can be seen from the above description, after receiving the return information, the current application version number is saved, and the current application data content and the return information are stored as a processing rule corresponding to the current application version number, so that after receiving the user's selection, i.e., the return information, the return information can be learned autonomously, the current application version number and the corresponding processing rule are expanded, the longer the scheme runs, the fewer the number of times that the user needs to confirm, and ultimately the malicious information processing is realized without the user's awareness.

[0044] Further, the allocation of the device-side data to the processing block according to the data type comprises:

[0045] All processing blocks corresponding to the data type are obtained;

[0046] The device-side data corresponding to the data type is sent to the processing blocks in sequence, and when sent to a target processing block, the target processing block matches a processing rule according to the current application data content, and if the matching is successful, the device-side is controlled according to the processing rule; otherwise, the iteration continues.

[0047] As can be seen from the above description, for the same type of data, there can be multiple different processing methods, and then multiple different processing blocks are corresponded, and when there are multiple processing blocks for the data type, each processing block is iterated until a matching processing rule is found, thereby avoiding omission in the matching process.

[0048] Further, the device-side data is distributed to the processing blocks according to the data type, including:

[0049] If there is no target processing block matched with the data type, it is determined whether the current application data content triggers a key operation, and if yes, an abnormal alarm is sent.

[0050] As can be seen from the above description, if there is no target processing block matched with the data type, the current application data is directly analyzed, and if it belongs to data triggering a key operation, an abnormal alarm is sent, the key operation refers to an operation involving sensitive permission, such as obtaining camera data, accessing other applications, intercepting screen, etc., that is, if a new data type appears, a warning for access to sensitive information can be made before the processing rule for the data type is established, thereby avoiding the problem that sensitive operation is directly executed when no corresponding data type is matched, and the security is further improved.

[0051] Further, the data type includes a text data type, an image data type, a communication data type, and a custom data type.

[0052] As can be seen from the above description, the data type is divided into different data types such as text, image, and communication, and then the processing rule can be set for the processing block according to different processing methods corresponding to different types, and a custom data type is also provided, and when the existing data type cannot meet the demand, the user can realize further function expansion through the custom type.

[0053] Further, the current application data content includes current foreground application data content and current background application data content.

[0054] As can be seen from the above description, when the current application data content is obtained, not only the application data content of the current foreground running application is obtained, but also the application data content of the background at this time is obtained, and then the interaction possibly occurring between the foreground and background applications can be dynamically obtained for analysis, and the sensitive analysis is not limited to the analysis of a single application, but also the interaction possibly existing between the applications can be analyzed.

[0055] The risk data processing method and terminal described above are applicable to applications that require data processing, especially for ensuring data security, such as mobile terminals or web applications. Specific embodiments are described below.

[0056] Please refer to Figures 1-3 Embodiment 1 of the present invention is as follows:

[0057] A risk data processing method includes the following steps:

[0058] Please refer to Figure 3 S0. Generate a virtual device to replace the current physical device, which is the device running various applications, including:

[0059] S01. Generate a virtual device, wherein the virtual device includes virtual interfaces that correspond one-to-one with the device interfaces of the physical device;

[0060] S02. Replace the device interface with the virtual interface so that the application in the physical device runs on the virtual device;

[0061] In one alternative implementation, generation is performed in a virtual device:

[0062] (1) Communication equipment interfaces: related to information and data, browsers;

[0063] (2) Generate device service interfaces: screen-related;

[0064] (3) Information data interfaces include: SMS messages, chat messages, and link information (HTTP, HTTPS, etc.);

[0065] (4) Screen-related interfaces: screen recording, screen capture; used to trigger rules in an application with existing processing rules in a processing block or to launch a screen recording software or download a screen recording software during screen recording.

[0066] (5) Record active application information: installed applications and running applications;

[0067] The generated virtual device takes over the original physical device, and then uses the virtual device to intercept data and take over various behaviors of the application, and performs operations based on the returned information to ensure the security of the user process;

[0068] S1. After receiving data from the device, process the data according to a preset format to obtain the data type (N), the current application version number (P), and the current application data content (D);

[0069] In one optional implementation, a trigger condition is set so that the device will only report data when the data content in the device meets the trigger condition, thereby reducing the amount of data processing and saving the computing resources and bandwidth of the server.

[0070] In particular, if the current application version number usually has a corresponding digital signature, if it is modified, it will not be able to match the corresponding version number stored in the processing block, thus ensuring security.

[0071] In one optional implementation, the data types include text data types, image data types, communication data types, and custom data types; the custom data types are set to have the highest priority, that is, if the data type matches both the custom data type and the text data type, it is marked as the custom data type first; for example, for commonly used instant messaging software, the type of the instant messaging software can be set as a custom data type, so that processing rules can be set specifically for the instant messaging software, and the processing rules can be directly matched with the adapted scenario, making it convenient to add, delete, and modify the processing rules later;

[0072] In one optional implementation, the current application data content includes the current foreground application data content and the current background application data content; it may also include installed application data, which can not only record the relationship between foreground and background applications, but also record whether there is mutual wake-up between applications;

[0073] S2. Allocate the device-side data to processing blocks according to the data type;

[0074] In one optional implementation, if there is no processing block that matches the data type, it is determined whether the current application data content triggers a critical operation. If so, an exception alarm is sent; otherwise, the data type, the current application version number, and the current application data content are saved, and S33 is executed.

[0075] For example, if the data type is text, the key operations include sensitive data such as transfer or account information contained in the text.

[0076] S3. Matching processing rules based on the current application data content through the processing block, and controlling the device according to the processing rules, including:

[0077] S31. Determine whether the processing block stores a set of processing rules corresponding to the current application version number. If yes, execute S32; otherwise, execute S33-S34.

[0078] In one optional implementation, the processing block stores version numbers, and each version number corresponds to a data library. The data library stores a set of processing rules for easy management. The target version number, which matches the current application version number, is represented by a set of processing rules in the data library corresponding to that target version number.

[0079] S32. Match the processing rules in the set of processing rules according to the current application data content. If the match is successful, control the device according to the processing rules. If the match is unsuccessful, execute S33.

[0080] S33. Send operation confirmation information according to the current application data content, and perform the operation according to the return information corresponding to the operation confirmation information;

[0081] In an optional implementation, S33 includes: if the current application data content triggers a critical operation, an operation confirmation message is also sent according to the current application data content; that is, if the application confirms security, the user confirms whether a sensitive operation is required, so as to avoid the inability to use the corresponding function when the user needs to use it.

[0082] In an optional implementation, after S31, it further includes determining whether a version number with the same version number as the current application is stored. If so, S33 is executed; otherwise, an abnormal alarm is issued. That is, if the version number cannot be matched, it means that the digital signature may have been tampered with, and an insecure warning is issued. If a matching version number is stored, but the corresponding processing rules have not yet been set, it is sent to the user for confirmation.

[0083] S34. Save the current application version number, and save the current application data content and the return information as a processing rule corresponding to the current application version number;

[0084] For example, if the data request data type is WeChat (custom data type), the current application data content includes: contact X inviting video communication, and the current chat interface content; the current background application data content includes: the background application type is financial product (such as payment application, etc.), and the processing rule is: if a financial product is running in the background and the foreground application requests video communication, a mask is created when the video communication is connected; then the device creates a mask to cover the screen and camera data according to this processing rule to prevent facial information from being obtained for remote operation;

[0085] In one optional implementation, the server executes steps S1 and S2; and receives processing rules and sends the processing rules to the device so that the device can perform corresponding operations according to the processing rules.

[0086] In one optional implementation, the processing block in this application is a member of the blockchain, meaning that the security of the processing block can be guaranteed by the characteristics of the blockchain, thereby ensuring the security of the data processing process.

[0087] Embodiment 2 of the present invention is as follows:

[0088] A risk data processing method, which differs from Embodiment 1 in that:

[0089] Step S2 includes:

[0090] Obtain all processing blocks corresponding to the data type;

[0091] Step S3 includes:

[0092] S301. The device-side data corresponding to the data type is sequentially traversed and sent to the processing block. When sent to the target processing block, the target processing block matches the processing rules according to the current application data content. If the match is successful, S302 is executed; otherwise, the traversal continues.

[0093] In one optional implementation, when sending to the target processing block, it is determined whether the target processing block stores a set of processing rules corresponding to the current application version number. If so, S3011 is executed; otherwise, the traversal continues.

[0094] S3011. Match the processing rule in the processing rule set according to the current application data content. If the match is successful, execute S302. If the match is unsuccessful, continue to traverse.

[0095] S302. Control the device according to the processing rules;

[0096] S303. If no match is found after traversing all the processing blocks, an operation confirmation message is sent according to the current application data content, and the operation is performed according to the return information corresponding to the operation confirmation message.

[0097] S304. Save the current application version number, and save the current application data content and the return information as a processing rule corresponding to the current application version number;

[0098] It can be saved in an existing processing block or in a newly created processing block.

[0099] In summary, when there are multiple application versions and corresponding processing rules, distributing them across multiple different processing blocks can improve processing efficiency by leveraging a parallel environment and reduce the matching time in each processing block.

[0100] Please refer toFigure 4 Embodiment 3 of the present invention is as follows:

[0101] A risk data processing terminal 1 includes a processor 2, a memory 3, and a computer program stored in the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, it implements the steps in Embodiment 1.

[0102] In summary, this invention provides a risk data processing method and terminal. By setting up a virtual device to take over various operations of a physical device, modifications to each device are unnecessary, and the virtual device can be reused for similar devices. It acquires device-side data sent by the device and processes it according to a preset format to obtain the data type, current application version number, and current application data content. Matching different processing blocks based on the data type allows for a more detailed processing procedure. Different processing blocks can simultaneously process different types of device-side data, thereby improving processing efficiency. Furthermore, by matching processing rules based on the current application version number and current application data content, if the current application version number cannot be matched, it indicates that the signature comes from an unknown application or the signature data has been tampered with, enabling rapid detection of potentially sensitive operations. The processing rules refine the processing methods corresponding to different application data content, and users can configure them themselves. Even if the user has not configured them, the current application data content can still be sent to the user for confirmation, and user behavior can be learned as processing rules. This allows for the processing of dynamically occurring sensitive data and also possesses self-learning capabilities.

[0103] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A risk data processing method, characterized by, The method comprises the steps of: receiving device-side data, processing the device-side data according to a preset format to obtain a data type and current application data content; allocating the device-side data to a processing block according to the data type; controlling a device end according to a processing rule matched by the processing block according to the current application data content; the step of processing the device-side data according to the preset format to obtain the data type and the current application data content further comprises: processing the device-side data according to the preset format to obtain a current application version number; the step of controlling the device end according to the processing rule matched by the processing block according to the current application data content comprises: judging whether a processing rule set corresponding to the current application version number is stored in the processing block, and if so, matching a processing rule in the processing rule set according to the current application data content; the step of controlling the device end according to the processing rule matched by the processing block according to the current application data content further comprises: if the current application version number is not stored in the processing block, sending operation confirmation information according to the current application data content; performing an operation according to return information corresponding to the operation confirmation information.

2. The risk data processing method of claim 1, wherein, the step of processing the device-side data according to the preset format to obtain the data type and the current application data content further comprises: generating a virtual device, the virtual device comprising a virtual interface corresponding to a device interface of a physical device; replacing the device interface with the virtual interface, so that an application in the physical device runs on the virtual device.

3. The risk data processing method of claim 1, wherein, the step of performing the operation according to the return information corresponding to the operation confirmation information further comprises: saving the current application version number, and saving the current application data content and the return information as a processing rule corresponding to the current application version number.

4. The risk data processing method of claim 1, wherein, the step of allocating the device-side data to the processing block according to the data type comprises: obtaining all the processing blocks corresponding to the data type; the step of controlling the device end according to the processing rule matched by the processing block according to the current application data content comprises: sequentially sending the device-side data corresponding to the data type to the processing blocks, and when sending to a target processing block, matching a processing rule by the target processing block according to the current application data content, and if the matching is successful, controlling the device end according to the processing rule; otherwise, continuing the traversal.

5. The risk data processing method of claim 1, wherein, the step of allocating the device-side data to the processing block according to the data type comprises: if there is no target processing block matching the data type, judging whether the current application data content triggers a key operation, and if so, sending an abnormal alarm.

6. The risk data processing method of claim 1, wherein, The data type comprises a text data type, an image data type, a communication data type, and a custom data type.

7. The risk data processing method of claim 1, wherein, The current application data content comprises current foreground application data content and current background application data content.

8. A risk data processing terminal comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement each step of the risk data processing method according to any one of claims 1-7.

Images