A driver-side safety protection implementation method

Abstract

The present invention relates to the field of file management, and discloses a method for implementing driver-side security protection, which is used to solve the problem of data leakage when the driver-side performs interactive behaviors. The method comprises: obtaining data from the driver-side, classifying and weighting the data, extracting data information of the interactive behaviors and evaluating the sensitivity of the interactive information, collecting abnormal access behaviors, obtaining abnormal access degrees, obtaining firewall security degrees according to firewall data, and calculating network insecurity coefficients, obtaining a required protection index according to the sensitivity of the interactive information and the network insecurity coefficient, judging security protection according to the required protection index, obfuscating, compressing and encrypting system resource files according to the judgment results, extracting key codes from DEX files and performing shell processing, and encrypting and compressing So files, thereby effectively improving the confidentiality of data and ensuring the security of personal information.

Description

Technical Field

[0001] The present invention relates to the field of file management, and more specifically to a method for implementing driver-side safety protection. Background Art

[0002] With the development of technology and the improvement of people's living standards, online ride-hailing has become one of the important choices for public transportation.

[0003] The driver side is a platform for drivers to receive orders, so its safety is very important for drivers and passengers.

[0004] Existing protection technologies mostly include signature verification and code obfuscation, anti-debugging, application packing, and memory dump. Some of these protection technologies are introduced below.

[0005] Signature verification, a signature refers to the new data generated by the signer through some cryptographic operation to indicate his or her identity. The recipient can confirm the signer by verifying the digital signature. The Android system requires that all applications must have digital signatures, and applications without digital signatures cannot be installed. Signature verification technology refers to adding a section of code to the startup code to verify the current application signature information when the program starts. When the program is running, it detects whether the signature of the current application is consistent with the signature at the time of release. If so, it continues to run. Otherwise, it means that the application has been maliciously modified and the signature has changed, and the program is terminated directly.

[0006] Introduction to obfuscation: obfuscation strategy is a protection strategy that must be added to every application. Using obfuscation is not only for protection, but also to reduce the size of the application installation package, so it is a function that must be added before each application is released. Currently, obfuscation strategies are generally divided into two types: one is code obfuscation, and the other is resource file obfuscation.

[0007] Application shelling is a widely used, rapidly developing and highly secure protection technology in the market. The core of this technology is to hide the code of the apk (source apk) that needs to be encrypted, so that reverse engineers cannot directly obtain the relevant code after decompiling the apk, thereby protecting the source apk code. After generations of development, application shelling has evolved into shelling technologies such as dex overall encryption, dex method extraction, and vmp.

[0008] These technologies can prevent applications from being maliciously cracked to a certain extent, increasing the security of the code. However, the security of obfuscation and signature verification is relatively low, and the shortcomings of shelling cannot be ignored. There are relatively large compatibility issues. At the same time, because the application itself needs to decrypt the source program dex or restore the method before running the application, the running efficiency is low. At the same time, the code for decrypting the source application or restoring the method is still saved in the released apk, and the cracker can still remove the shell by reverse analysis of the decryption code.

[0009] In view of the above problems, the present invention proposes a solution. Summary of the invention

[0010] In order to overcome the above-mentioned defects of the prior art, the present invention provides a method for implementing driver-side safety protection to solve the problems existing in the above-mentioned background technology.

[0011] To achieve the above object, the present invention provides the following technical solutions:

[0012] A method for implementing driver-side safety protection includes the following steps:

[0013] S001: The online ride-hailing platform can obtain driver-side data through development documents and API documents, and classify the data to obtain driver-side information categories, including driver information, vehicle information, location information, order information, payment information, and device information, and assign weights to each information category based on information sensitivity;

[0014] S002: Monitor the interaction between the driver and the external system in real time, collect the data information of the interaction between the driver and the external system, extract the key information, and classify the key information according to the driver's information category, and evaluate the sensitivity of the interaction information based on the extracted key information and the classification results;

[0015] S003: Collect access logs of network devices and servers connected to the network when the driver interacts with external systems, record the access behaviors of devices and users, and collect abnormal access requests or unauthorized access behaviors in the access logs to calculate the abnormal access degree;

[0016] S004: Obtain the firewall data of the network connected when the driver interacts with the external system, and evaluate the firewall security based on the firewall data. The network insecurity coefficient is evaluated based on the abnormal access degree and the firewall security degree. The calculation formula is NS=AB×(1-FS), where NS represents the network insecurity coefficient, AB represents the abnormal access degree, and FS represents the firewall security degree;

[0017] S005: Calculate the protection requirement index according to the interaction information sensitivity and the network insecurity coefficient. The calculation formula is IS = a1 × IE + a2 × NS, where IS represents the protection requirement index, IE represents the interaction information sensitivity, and NS represents the network insecurity coefficient;

[0018] S006: Detect the current interaction data in real time and obtain the current protection requirement index, and make a judgment on the implementation of driver-side safety protection according to the current protection requirement index;

[0019] S007: When the interactive behavior is determined to be risky, the system resource files are obfuscated, compressed and encrypted;

[0020] S008: Extract key codes from DEX files and perform shell processing;

[0021] S009: Encrypt and compress the So file.

[0022] Preferably, the step of collecting the data information interacting between the driver end and the external system and extracting the key information therein is:

[0023] Use Wi reshark network traffic capture tools to monitor network communications between the driver and external systems. These tools can capture network packets, including request and response data;

[0024] Analyze the captured network data packets, identify the communication traffic between the driver end and the external system, and extract key information based on the communication protocol and data format;

[0025] Based on business needs, key information is extracted from the captured data, including user identity, order information, geographic location data, and payment information.

[0026] Preferably, the step of evaluating the interactive information sensitivity based on the extracted key information and the classification results is to match the extracted key information with the driver-side information category, obtain the driver-side information category of each key information, and obtain the corresponding weight, and add the weight of each key information to obtain the interactive information sensitivity.

[0027] Preferably, the abnormal access degree calculation step is:

[0028] Define abnormal or unauthorized access requests or behaviors as abnormal events, involving specific access patterns, IP addresses, and user identities;

[0029] Count the total number of visits during the detection period, and filter the access logs to count the number of abnormal events that occurred during the detection period;

[0030] According to the number of abnormal events that occur during the detection period, the abnormal access degree of the network is calculated. The number of abnormal events is divided by the total access volume to obtain the abnormal access degree. The calculation formula is: AB represents abnormal access degree, NUM 异常 Expressed as the number of abnormal events, NUM 总 Expressed as total visits.

[0031] Preferably, the firewall security calculation step is:

[0032] Obtain firewall rules through the firewall management interface and count the total number of firewall rules;

[0033] Obtain the network traffic covered by firewall rules through firewall logs, including total traffic and traffic covered by rules, and calculate the rule coverage rate. The calculation formula is: Where CG represents the rule coverage, TR represents the total traffic, and RT represents the traffic covered by the rule;

[0034] The firewall security is calculated based on the total number of firewall rules and rule coverage. The calculation formula is: FS represents the firewall security, AR represents the total number of rules, CG represents the rule coverage, and MAX represents the rule coverage. R Expressed as the maximum possible number of rules.

[0035] Preferably, the step of judging whether to implement driver-side safety protection based on the current protection necessity index is to compare the protection necessity index with a preset threshold value. If the protection necessity index is less than the preset threshold value, it is determined that the current interaction between the driver side and the external system is relatively safe, and driver-side safety protection is not performed. If the protection necessity index is greater than the preset threshold value, it is determined that the current interaction between the driver side and the external system is unsafe, and the driver-side safety protection is turned on.

[0036] Preferably, the steps of obfuscating, compressing and encrypting the system resource files are:

[0037] Use meaningless English letters to replace the directory names and file names at each level of the resource file;

[0038] Compress images and other files;

[0039] Parse the resoureces.arsc resource index file and modify its contents;

[0040] The HMAC algorithm is used to check the integrity of the apk. Let the hash function be H, the encryption key be K, and the file to be encrypted be F. Each information summary function groups the information, and the length of each information block is fixed, denoted by B; each information summary function outputs a fixed-length information summary, and the length of the information summary is denoted by L, where K is not less than the length of L.

[0041] Preferably, the steps of extracting key codes and performing shell processing on the DEX file are: first extracting key codes from the DEX file, the key codes extracted from the DEX file are non-Nativ functions, and dynamically loading and memory mapping the key codes on the DEX file.

[0042] Preferably, the steps of encrypting and compressing the So file are as follows: first encrypt the So file by section block, and then use UPX to compress the whole file. The shared target specifies the initialization function and the termination function through the DT_INIT and DT_FINI entries in the dynamic structure. The code of the initialization function is placed in the .init and .fini sections, that is:

[0043] (1).init: called before the main function to complete the process initialization;

[0044] (2).fini: called after the main function to complete the process termination operation;

[0045] Use the _attr i bute_((section(".mytext"))); attribute to dynamically add a custom encryption block .mytext to the So file and define the core Natural function in it;

[0046] Finally, use UPX to pack and compress the So file. The UPX decompression process is completely hidden and completed directly in the memory without the need for an additional decompression program. The packing and compression instruction is upx.out--android-sh lib**.so.

[0047] Technical effects and advantages of the present invention:

[0048] Acquire data from the driver's side, classify and weight the data, extract data information on interactive behaviors and evaluate the sensitivity of interactive information, collect abnormal access behaviors, obtain abnormal access degrees, obtain firewall security based on firewall data, and calculate the network insecurity coefficient, obtain the required protection index based on the interactive information sensitivity and the network insecurity coefficient, judge security protection based on the required protection index, obfuscate, compress and encrypt system resource files based on the judgment results, extract key codes from DEX files and perform shell processing, encrypt and compress So files, effectively improve data confidentiality, ensure the security of personal information, hide and encrypt resource files, key data and key codes, and protect encryption keys without consuming a lot of memory and increasing running speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is the overall flow chart of the present invention.

[0050] Figure 2 The following is a flow chart of the software reinforcement method of the present invention. DETAILED DESCRIPTION

[0051] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. In addition, the forms of the various structures recorded in the following embodiments are only examples. The implementation method of a driver-side safety protection involved in the present invention is not limited to the various structures recorded in the following embodiments. All other implementation methods obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0052] The present invention provides a method for implementing driver-side safety protection, comprising the following steps:

[0053] S001: The online ride-hailing platform can obtain driver-side data through development documents and API documents, and classify the data to obtain driver-side information categories, including driver information, vehicle information, location information, order information, payment information, and device information, and assign weights to each information category based on the sensitivity of the information.

[0054] The driver information is the driver's personal information, such as name, contact information, ID number, driver's license information, etc. The vehicle information is the information of the vehicle driven by the driver, including license plate number, vehicle model, vehicle photo, etc. The location information is the driver's real-time location information, including GPS positioning data, which is used to monitor the driver's location and driving trajectory in real time. The order information is the order information accepted by the driver, including order number, passenger information, boarding location, destination, order amount, etc. The payment information is the driver's payment information, including transaction amount, payment method, payment time, etc. The device information is the information of the driver-side device, including device model, operating system version, network connection information, etc.

[0055] S002: monitor the interaction between the driver and the external system in real time, collect the data information of the interaction between the driver and the external system, extract the key information, and classify the key information according to the driver information category, and evaluate the interaction information sensitivity based on the extracted key information and the classification results;

[0056] S003: Collect access logs of network devices and servers connected to the network when the driver interacts with external systems, record the access behaviors of devices and users, and collect abnormal access requests or unauthorized access behaviors in the access logs to calculate the abnormal access degree;

[0057] S004: Obtain the firewall data of the network connected when the driver interacts with the external system, and evaluate the firewall security based on the firewall data. The network insecurity coefficient is evaluated based on the abnormal access degree and the firewall security degree. The calculation formula is NS=AB×(1-FS), where NS represents the network insecurity coefficient, AB represents the abnormal access degree, and FS represents the firewall security degree;

[0058] S005: The protection must index is calculated based on the interactive information sensitivity and the network insecurity coefficient. The calculation formula is IS = a1 × IE + a2 × NS, where IS represents the protection must index and IE represents the interactive information sensitivity. Information with higher sensitivity has greater value and is therefore more likely to become an attack target. The leakage or tampering of sensitive information may bring greater threats and risks. Therefore, higher-level protection measures are required to deal with various threats. Therefore, the greater the interactive information sensitivity, the greater the protection must index. NS represents the network insecurity coefficient. As the network insecurity coefficient increases, the degree of threat to the network will also increase accordingly. Therefore, in order to deal with more complex and more serious threats, more and more effective protection measures need to be taken. In order to reduce risks and protect the security of key assets and sensitive information, protection measures must be strengthened to improve the security of the network. As the network insecurity coefficient increases, it may be necessary to meet more stringent laws, regulations, industry standards or contract requirements. These requirements usually require more and stricter security measures to protect network security. Therefore, the greater the network insecurity coefficient, the greater the protection index. a1 and a2 are weight coefficients of the interaction information sensitivity and the network insecurity coefficient. In this embodiment, the specific values ​​of a1 and a2 are not specifically calculated.

[0059] S006: Detect the current data in real time and obtain the current required protection index, and make a judgment on the implementation of driver-side safety protection according to the current required protection index;

[0060] S007: When the risk of interactive behavior is determined to be high, such as Figure 2 As shown, the system resource files are obfuscated, compressed and encrypted;

[0061] S008: Extract key codes from DEX files and perform shell processing;

[0062] S009: Encrypt and compress the So file;

[0063] Providing security protection for data information interacting between the driver side and external systems can effectively protect the user's privacy information. Strengthening security protection on the driver side can effectively prevent the risk of data leakage, avoid the theft, tampering or leakage of sensitive data during transmission, and ensure the confidentiality and integrity of the data. Providing security protection for data information interacting between the driver side and external systems can effectively prevent various security threats. Strengthening security protection on the driver side can enhance the user's trust and satisfaction with the platform. Users will be more confident in using the services provided by the platform, thereby promoting business development and the growth of the user base.

[0064] In this embodiment, it should be specifically explained that the steps of collecting the data information interacting between the driver end and the external system and extracting the key information therein are as follows:

[0065] Use Wi reshark network traffic capture tools to monitor network communications between the driver and external systems. These tools can capture network packets, including request and response data. Wi reshark is an open source network protocol analysis tool that can be used to capture and analyze network packets. Wi reshark can capture packets transmitted on the network in real time through the network interface. You can choose to capture specific network traffic for analysis. Wi reshark supports the use of various filters to select packets of interest for capture. Wi reshark can display captured packets in real time and provide detailed protocol parsing information. It can perform in-depth analysis and parsing of captured packets, including parsing of protocol headers and payloads, and layered display of protocol stacks.

[0066] Analyze the captured network data packets, identify the communication traffic between the driver side and the external system, and extract key information such as HTTP request parameters, API calls, database queries, etc. according to the communication protocol and data format;

[0067] Based on business needs, key information is extracted from the captured data, which may include user identity, order information, geographic location data, payment information, etc.

[0068] In this embodiment, it should be specifically explained that the steps of extracting key information according to the communication protocol and data format are as follows:

[0069] Understand the communication protocols and data formats between the driver side and external systems. Usually, the communication protocols can be HTTP, HTTPS, TCP, UDP, etc.;

[0070] Capture network traffic between the driver and external systems using network traffic capture tools. These tools can monitor network interfaces and record all packets sent and received.

[0071] Filter the communication traffic between the driver end and the external system based on the target system's IP address, port number, communication protocol and other information;

[0072] Parse the captured communication traffic and extract key information from the data packet based on the communication protocol and data format. This information may include request parameters, response content, status code, timestamp, etc.

[0073] Use regular expressions to extract key information from the parsed data based on business needs. This information may include user identity, order information, geographic location data, payment information, etc.

[0074] In this embodiment, it should be specifically explained that the step of evaluating the interactive information sensitivity based on the extracted key information and the classification results is to match the extracted key information with the driver-side information category, obtain the driver-side information category of each key information, and obtain the corresponding weight, and add the weight of each key information to obtain the interactive information sensitivity.

[0075] When abnormal access requests or unauthorized access behaviors are detected in the access log, sometimes employees or system administrators may make mistakes, resulting in abnormal access requests or unauthorized access behaviors appearing in the access log. This may be caused by configuration errors, operational errors, etc., rather than malicious attacks or security vulnerabilities; network equipment or servers may also fail, resulting in abnormal access requests or unauthorized access behaviors appearing in the access log. This may be caused by network interruptions, system crashes, etc., rather than security issues; abnormal access requests or unauthorized access behaviors may also be signs of malicious attacks or intrusions. This may be a network attack from an external hacker, or malicious behavior by an internal employee, etc.

[0076] In this embodiment, it should be specifically explained that the abnormal access degree calculation steps are:

[0077] Define abnormal or unauthorized access requests or behaviors as abnormal events, involving specific access patterns, IP addresses, user identities, etc.

[0078] Count the total number of visits during the detection period, and screen the access logs to count the number of abnormal events that occur during the detection period. The detection period can be one hour, two hours, or half an hour;

[0079] According to the number of abnormal events that occurred during the detection period, the abnormal access degree of the network is calculated. The number of abnormal events can be divided by the total access volume to obtain the abnormal access degree. The calculation formula is: AB represents abnormal access degree, NUM 异常 Expressed as the number of abnormal events, NUM 总 It is expressed as the total number of visits. When abnormal access requests or unauthorized access behaviors are detected in the access log, it does not necessarily mean that the network is unsafe. It may be caused by other reasons. Therefore, when abnormal access requests or unauthorized access behaviors are detected in the access log with a probability higher than a certain level, it can be preliminarily determined that the network may have security issues.

[0080] In this embodiment, it should be specifically explained that the firewall security degree calculation steps are:

[0081] Obtain firewall rules through the management interface and count the total number of firewall rules. Generally, the more rules there are, the more complex the firewall configuration is, and the higher the security may be;

[0082] Obtain the network traffic covered by firewall rules through firewall logs, including total traffic and traffic covered by rules, and calculate the rule coverage rate. The calculation formula is: CG stands for rule coverage, TR stands for total traffic, and RT stands for traffic covered by the rule. Traffic can be analyzed and counted based on the source address, destination address, port number, protocol, and other information in the log. The total traffic refers to the total amount of all network traffic passing through the firewall, including all packets entering and leaving the network, whether from the internal network to the external network or from the external network to the internal network.

[0083] The firewall security is calculated based on the total number of firewall rules and rule coverage. The calculation formula is: FS represents the security of the firewall, AR represents the total number of rules, CG represents the rule coverage, and MAX represents the rule coverage. R It is expressed as the maximum possible number of rules, which depends on factors such as the model, hardware performance, software version and configuration limitations of the firewall and can be obtained from the product specification sheet.

[0084] In this embodiment, it should be specifically explained that the step of judging the implementation of driver-side safety protection based on the current protection necessity index is to compare the protection necessity index with a preset threshold value. If the protection necessity index is less than the preset threshold value, it is determined that the current interaction between the driver side and the external system is relatively safe, and driver-side safety protection is not performed. If the protection necessity index is greater than the preset threshold value, it is determined that the current interaction between the driver side and the external system is unsafe, and the driver-side safety protection is turned on.

[0085] In this embodiment, it should be specifically explained that the steps of obfuscating, compressing and encrypting the system resource files are as follows:

[0086] Use meaningless English letters to replace the directory names and file names at each level of the resource file;

[0087] Compress images and other files;

[0088] Parse the resoureces.arsc resource index file and modify its contents;

[0089] The HMAC algorithm is used to check the integrity of the apk. Let the hash function be H, the encryption key be K, and the file to be encrypted be F. Each information summary function groups the information, and the length of each information block is fixed, denoted by B; each information summary function outputs a fixed-length information summary, and the length of the information summary is denoted by L, where K is not less than the length of L.

[0090] The HMAC algorithm is a cryptographic hash function algorithm for message authentication. It combines hash functions and keys for message authentication, and is used to verify the integrity and authenticity of messages. The HMAC algorithm uses hash functions to process messages, which has high security and can prevent tampering and forgery of messages. It uses keys for message authentication, and the keys are used for both hash calculation of messages and to prevent malicious forgers from tampering with messages using pre-calculated hash values. The authentication result of the HMAC algorithm is a fixed-length hash value that can be easily shared and compared with the recipient to ensure the integrity and authenticity of the message. The hash function is a function that maps data of any size to a fixed size. The hash function converts input data into a fixed-length output. Regardless of the size of the input data, the length of the output is fixed.

[0091] When checking the integrity of the APK, the HMAC algorithm can be used to first perform a hash calculation on the APK file, and then use the key to sign the hash value to generate an authentication code. After the receiver receives the APK file, it also performs a hash calculation and signs it with the same key, and then compares the generated authentication code with the authentication code provided by the sender to verify the integrity of the APK file.

[0092] The information digest function is an algorithm for mapping data of any size into an output of a fixed size, which is usually called a digest or hash value. The information digest function usually processes the input data in groups, then calculates each data block, and finally generates a unique hash value. When processing large amounts of data, the information digest function can compress the data into a fixed-length digest, which makes the digest more efficient in terms of storage and transmission.

[0093] In this embodiment, it should be specifically explained that the steps of extracting key codes and performing shell processing on the DEX file are: first, the key codes of the DEX file are extracted, the key codes extracted from the DEX file are non-Nat i ve functions, and the DEX file is dynamically loaded and the key codes are memory mapped.

[0094] The DEX file is a file format in Android applications, used to store compiled Java code, resources and other related information. The DEX file is an executable file format for the Dalvik virtual machine, which is the native application execution environment of the Android platform.

[0095] In this embodiment, it should be specifically explained that the steps of encrypting and compressing the So file are as follows: first encrypt the So file by section block, and then use UPX to compress the whole file. The shared target specifies the initialization function and termination function through the DT_INIT and DT_FINI entries in the dynamic structure. The code of the initialization function is placed in the .init and .fini sections, that is:

[0096] (1).init: called before the main function to complete the process initialization;

[0097] (2).fini: called after the main function to complete the process termination operation;

[0098] Use the _attr i bute_((section(".mytext"))); attribute to dynamically add a custom encryption block .mytext to the So file and define the core Natural function in it;

[0099] Finally, use UPX to pack and compress the So file. The UPX decompression process is completely hidden and is completed directly in the memory without the need for an additional decompression program. The packing and compression instruction is upx.out--andro id-sh l ib**.so.

[0100] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0101] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for implementing driver-side safety protection, characterized in that: The following steps are involved: S001: The online ride-hailing platform can obtain driver-side data through development documents and API documents, and classify the data to obtain driver-side information categories, including driver information, vehicle information, location information, order information, payment information, and device information, and assign weights to each information category based on information sensitivity; S002: Monitor the interaction between the driver and the external system in real time, collect the data information of the interaction between the driver and the external system, extract the key information, and classify the key information according to the driver's information category, and evaluate the sensitivity of the interaction information based on the extracted key information and the classification results; S003: Collect access logs of network devices and servers connected to the network when the driver interacts with external systems, record the access behaviors of devices and users, and collect abnormal access requests or unauthorized access behaviors in the access logs to calculate the abnormal access degree; S004: Obtain the firewall data of the network connected when the driver interacts with the external system, and evaluate the firewall security based on the firewall data. The network insecurity coefficient is evaluated based on the abnormal access degree and the firewall security degree. The calculation formula is NS=AB×(1-FS), where NS represents the network insecurity coefficient, AB represents the abnormal access degree, and FS represents the firewall security degree; S005: Calculate the protection requirement index according to the interaction information sensitivity and the network insecurity coefficient. The calculation formula is IS = a1 × IE + a2 × NS, where IS represents the protection requirement index, IE represents the interaction information sensitivity, and NS represents the network insecurity coefficient; S006: Detect the current interaction data in real time and obtain the current protection requirement index, and make a judgment on the implementation of driver-side safety protection according to the current protection requirement index; S007: When the interactive behavior is determined to be risky, the system resource files are obfuscated, compressed and encrypted; S008: Extract key codes from DEX files and perform shell processing; S009: Encrypt and compress the So file.

2. A method for implementing driver-side safety protection according to claim 1, characterized in that: The steps of collecting the data information interacting between the driver end and the external system and extracting the key information are as follows: Use Wireshark network traffic capture tools to monitor network communications between the driver and external systems. These tools can capture network packets, including request and response data. Analyze the captured network data packets, identify the communication traffic between the driver end and the external system, and extract key information based on the communication protocol and data format; Based on business needs, key information is extracted from the captured data, including user identity, order information, geographic location data, and payment information.

3. A method for implementing driver-side safety protection according to claim 1, characterized in that: The step of evaluating the interactive information sensitivity based on the extracted key information and the classification results is to match the extracted key information with the driver-side information category, obtain the driver-side information category of each key information, and obtain the corresponding weight, and add the weight of each key information to obtain the interactive information sensitivity.

4. A method for implementing driver-side safety protection according to claim 1, characterized in that: The abnormal access degree calculation steps are: Define abnormal or unauthorized access requests or behaviors as abnormal events, involving specific access patterns, IP addresses, and user identities; Count the total number of visits during the detection period, and filter the access logs to count the number of abnormal events that occurred during the detection period; According to the number of abnormal events that occur during the detection period, the abnormal access degree of the network is calculated. The number of abnormal events is divided by the total access volume to obtain the abnormal access degree. The calculation formula is: AB represents abnormal access degree, NUM 异常 Expressed as the number of abnormal events, NUM 总 Expressed as total visits.

5. A method for implementing driver-side safety protection according to claim 1, characterized in that: The firewall security calculation steps are as follows: Obtain firewall rules through the firewall management interface and count the total number of firewall rules; Obtain the network traffic covered by firewall rules through firewall logs, including total traffic and traffic covered by rules, and calculate the rule coverage rate. The calculation formula is: Where CG represents the rule coverage, TR represents the total traffic, and RT represents the traffic covered by the rule; The firewall security is calculated based on the total number of firewall rules and rule coverage. The calculation formula is: FS represents the security of the firewall, AR represents the total number of rules, CG represents the rule coverage, and MAX represents the rule coverage. R Expressed as the maximum possible number of rules.

6. A method for implementing driver-side safety protection according to claim 1, characterized in that: The step of judging whether to implement driver-side safety protection based on the current protection necessity index is to compare the protection necessity index with a preset threshold value. If the protection necessity index is less than the preset threshold value, it is determined that the current interaction between the driver side and the external system is relatively safe, and driver-side safety protection is not performed. If the protection necessity index is greater than the preset threshold value, it is determined that the current interaction between the driver side and the external system is unsafe, and driver-side safety protection is turned on.

7. A method for implementing driver-side safety protection according to claim 1, characterized in that: The steps of obfuscating, compressing and encrypting the system resource files are as follows: Use meaningless English letters to replace the directory names and file names at each level of the resource file; Compress images and other files; Parse the resoureces.arsc resource index file and modify its contents; The HMAC algorithm is used to check the integrity of the apk. Let the hash function be H, the encryption key be K, and the file to be encrypted be F. Each information summary function groups the information, and the length of each information block is fixed, denoted by B; each information summary function outputs a fixed-length information summary, and the length of the information summary is denoted by L, where K is not less than the length of L.

8. A method for implementing driver-side safety protection according to claim 1, characterized in that: The steps of extracting key codes and performing shell processing on the DEX file are as follows: firstly, the key codes of the DEX file are extracted, the key codes extracted from the DEX file are non-Native functions, and the DEX file is dynamically loaded and the key codes are memory mapped.

9. A method for implementing driver-side safety protection according to claim 1, characterized in that: The steps of encrypting and compressing the So file are as follows: first encrypt the So file by section block, and then use UPX to compress the whole file. The shared target specifies the initialization function and termination function through the DT_INIT and DT_FINI entries in the dynamic structure. The code of the initialization function is placed in the .init and .fini sections, that is: (1).init: called before the main function to complete the process initialization; (2).fini: called after the main function to complete the process termination operation; Use the _attribute_((section(".mytext"))); attribute to dynamically add a custom encryption block .mytext to the So file and define the core Native function in it; Finally, use UPX to pack and compress the So file. The UPX decompression process is completely hidden and is completed directly in the memory without the need for an additional decompression program. The packing and compression instruction is upx.out--android-shl ib**.so.

Images