A mobile terminal information security detection method

Abstract

The present invention discloses a method for detecting information security of a mobile terminal. The method obtains structured data of third-party APP data of a mobile terminal according to the barrier-free service of an Android system. Then, a risk identification model based on keyword recognition rules, expression recognition rules, customized recognition rules, and recognition rules based on a funnel model is used to identify the security risks of third-party APP data for the structured data. The present invention can collect user daily use-related data such as third-party application APP data on a mobile smart terminal, and identify security risks after converting multi-source heterogeneous and fragmented information into structured data. The method can detect all possible risks of a mobile terminal and a network during the user's use of the mobile terminal, thereby overcoming the problem that the information collected by traditional risk detection has limitations, and greatly improving the user's overall risk detection and discovery capabilities on the Internet.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a mobile terminal information security detection method. Background Art

[0002] With the advent of the digital age, the rapid development and popularization of information technology, smart terminals, mobile phones and other mobile devices have become an indispensable part of people's daily lives. However, while these devices bring convenience, they also face severe information security challenges. The new generation of information security risks are becoming increasingly prominent, and deep fakes, privacy theft, information leakage, AI attacks, information harassment and other means have become the most urgent problems we need to solve in the digital age.

[0003] Although many information security vendors have launched a variety of products and solutions to deal with the new generation of information security risks of mobile smart terminals. However, due to the heterogeneity and fragmentation of information from multiple sources of personal terminal devices, it is impossible to conduct risk detection and early warning for all user network behaviors. Only basic mobile phone information such as text messages, calls, and photos can be detected. Due to the limitations of information collection, the ability of big data and artificial intelligence technologies to identify and respond to new generation information security risk issues is greatly weakened. Integrating and uniformly accessing the usage data of major network platform vendors that are widely used in our daily lives faces extremely high technical challenges and complexity. Summary of the invention

[0004] The invention discloses a mobile terminal information security detection method to overcome the above technical problems.

[0005] In order to achieve the above object, the technical solution of the present invention is:

[0006] A method for detecting information security of a mobile terminal comprises the following steps:

[0007] S1: Obtain third-party APP data of the mobile terminal according to the accessibility service of the Android system to obtain structured data of the third-party APP data of the mobile terminal;

[0008] S2: Establish multiple risk identification models based on keyword-based identification rules, expression-based identification rules, customized identification rules, and a combination of identification rules based on a funnel model; to identify the security risks of third-party APP data based on the structured data;

[0009] S3: Based on the results of the identification of security risks of third-party APP data, a risk identification report is obtained to complete the detection of mobile terminal information security.

[0010] Furthermore, the method for obtaining structured data of third-party APP data of a mobile terminal is as follows:

[0011] S11: Enable the accessibility service permissions of the Android system: including enabling the canPerformGestures setting for simulating click operations on mobile terminals, and enabling the canRetrieveWindowContent setting for obtaining interface data;

[0012] S12: Open a floating window for collecting third-party APP data;

[0013] S13: Download a collection plug-in from the background server to obtain structured data of third-party APP data of the mobile terminal.

[0014] Further, the S13 includes:

[0015] S131: starting a third-party APP according to the third-party APP package name;

[0016] S132: Obtain the root node of the accessibility tree of the current active window through getRootInActiveWindow of the accessibility service, so as to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the third-party APP, and then determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the third-party APP; the expected setting interface of the final data interface of the third-party APP is an interface for providing an identification for the final data interface;

[0017] S133: If the current active window interface is an expected setting interface of the final data interface of the third-party APP of the mobile terminal, the next level function page of the current active window is the final data interface;

[0018] If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, enter the next level function page of the current active window, and repeat S132 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, and obtain the final data interface;

[0019] S134: If the data in the final data interface is displayed in a list or loaded in real time through the network, execute S135;

[0020] If the final data interface is displayed in the form of a picture, execute S136;

[0021] S135: scroll down and turn pages of the final data interface until there is no more new data or the data collection requirement is met; according to the getRootInActiveWindow method of the barrier-free service, traverse all node elements of the final data interface to obtain a large string of all text data of the final data interface;

[0022] S136: storing the pictures locally or in a remote server, and concatenating the picture paths to form a large character string of all picture paths of the final data interface;

[0023] S137: According to the large character string, based on a regular expression, final data interface structured data of the third-party APP of the mobile terminal is obtained.

[0024] Furthermore, the formula used to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the third-party APP is as follows:

[0025] ,

[0026] Where: TEDS Represents the currently active window node tree T a And the expected setting interface node tree of the final data interface of the third-party APP T b The similarity between T a Represents the currently active window node tree; T b Represents the expected setting interface node tree of the final data interface of the third-party APP; EditDist ( T a , T b ) means to move the current active window node tree T a Expected setting interface node tree converted to the final data interface of the third-party APP T b The minimum number of editing operations required, i.e., the tree editing distance; |Ta| and |Tb| represent the tree of the current active window node respectively. T a And the expected setting interface node tree of the final data interface of the third-party APP T b The number of node elements in .

[0027] Furthermore, it also includes: when the identification result of the security risk identification of the third-party APP data is that there is a risk, based on the risk type information in the risk identification model, obtaining the location of the risk information of the final interface of the data of the third-party APP with risk, so as to trace the risk information; the method adopted is as follows:

[0028] S41: starting the risky third-party APP according to the risky third-party APP package name;

[0029] S42: Obtain the root node of the accessibility tree in the current active window of the risky third-party APP through getRootInActiveWindow of the accessibility service, so as to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the risky third-party APP, and then determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the risky third-party APP; the expected setting interface of the final data interface of the risky third-party APP is an interface for providing an identification for the final data interface of the risky third-party APP;

[0030] S43: If the current active window interface is an expected setting interface of the final data interface of the third-party APP with risks, the next level function page of the current active window is the final data interface of the third-party APP with risks;

[0031] If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP at risk, enter the next-level function page of the current active window, and repeat S42 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP at risk, and obtain the final data interface of the third-party APP at risk; then, based on the risk type information in the risk identification model, obtain the location of the risk information in the final data interface of the third-party APP at risk, so as to trace the risk information.

[0032] Furthermore, the identification method of the risk identification model is:

[0033] First, based on the structured data of third-party APP data on mobile terminals, risk identification is performed using a combination of keyword-based identification rules, expression-based identification rules, and customized identification rules.

[0034] Secondly, the risk identification results are obtained based on the combination of keyword-based identification rules, expression-based identification rules, and customized identification rules, and the funnel model-based identification rules are used for risk identification.

[0035] Beneficial effects: A mobile terminal information security detection method of the present invention obtains third-party APP data of a mobile terminal according to the barrier-free service of the Android system, so as to obtain structured data of third-party APP data of the mobile terminal; and then adopts a risk identification model based on keyword recognition rules, expression recognition rules, customized recognition rules and identification rules based on a funnel model to identify the security risks of third-party APP data for the structured data. The present invention can conveniently, quickly and deeply collect user daily use-related data such as third-party application APP data on a mobile smart terminal, and identify security risks after converting multi-source heterogeneous and fragmented information into structured data. It can detect all possible risks of the mobile terminal and the network during the user's use of the mobile terminal, overcoming the problem that the information collected by traditional risk detection has limitations, and greatly improving the user's overall risk detection and discovery capabilities on the Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0037] Figure 1 is a flow chart of the safety detection method of the present invention;

[0038] Figure 2 The following is a flow chart of a task acquisition script synchronization method in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] This embodiment introduces a method for detecting information security of a mobile terminal. Figure 1 As shown,

[0041] S1: Acquire third-party APP data of a mobile terminal according to the accessibility service AccessibilityService of the Android system to acquire target application data, where the target application data is structured data of the third-party APP data of the mobile terminal.

[0042] Specifically, due to the heterogeneity and fragmentation of personal mobile terminal device information, it is impossible to conduct risk detection and early warning for all user network behaviors. Only basic mobile phone information such as text messages, calls, and photos can be detected, which forces the user to obtain basic device information from system open permissions, such as call records, text messages, and mobile phone album data. Comprehensive collection of mobile smart terminal system information data and local data and network data generated by third-party APPs is a key point in the identification and prevention of new-generation information security risks. This embodiment studies third-party APP data based on the barrier-free service function of the Android system.

[0043] Specifically, third-party APPs provide rich functions and application scenarios for smart mobile terminals, meeting the diverse needs of users. These applications cover multiple fields such as social, entertainment, shopping, payment, and office, greatly improving the practicality and user experience of smart terminals, and meeting our increasingly information-based, digital, and intelligent lifestyle needs. At the same time, this also causes our personal information and behavioral data to become vague and opaque throughout their entire life cycle from generation to destruction. As personal terminal information and network data become increasingly large in daily life, users' understanding, management, and use of these data are becoming increasingly difficult to control. Therefore, for the third-party application data management installed in the mobile terminal and covered by the Android system's barrier-free service inspection, all behavioral data of third-party applications are collected and aggregated, and risk identification and other data application management are unified.

[0044] Specifically, AccessibilityService is a special service provided by the Android system, which aims to expand the basic functions of the operating system to support a wider range of users, especially those who are physically disabled or temporarily unable to fully interact with the device. This service provides users with additional auxiliary information or performs specific operations by receiving and processing events (AccessibilityEvent) issued by the system, thereby greatly improving the barrier-free use experience of the device. By exploring the in-depth usage of this interface, it is possible to simulate human click operations and obtain data such as text on the page. Realize the collection of local data and network data of third-party apps. Using the system's barrier-free service function to collect third-party app data, there is no need for cumbersome operation steps, no need to root the system, no need to enable adb permissions, no need to crack and reverse third-party apps, and only need to enable system barrier-free permissions to quickly and deeply collect third-party app data.

[0045] Preferably, the method for obtaining structured data of third-party APP data of a mobile terminal is as follows:

[0046] S11: Enable the accessibility service permissions of the Android system:

[0047] Including enabling the canPerformGestures setting to simulate click operations on the phone, and enabling the canRetrieveWindowContent setting to obtain interface data;

[0048] Specifically, to use the accessibility service function, you need to enable the android.permission.BIND_ACCESSIBILITY_SERVICE permission in Accessibility Serivce and configure android.accessibilityservice. Among them, you need to enable the canPerformGestures setting for simulating click operations on the phone, and the canRetrieveWindowContent setting for obtaining interface data. When the collection task starts, determine whether the AccessibilityService permission is enabled. If the accessibility permission is not enabled, prompt the user to enable the accessibility permission and jump to the accessibility setting enablement page. When the user enables the accessibility permission, the onServiceConnected / onRebind / onAccessibilityEvent method of the AccessibilityService service will be triggered.

[0049] By executing the sending permission in the onServiceConnected / onRebind / onAccessibilityEvent method, the message can be delivered to the entire program through broadcasting. When the foreground interface detects that the sending permission is enabled, it can give user feedback in time and collect data immediately.

[0050] S12: Open a floating window for collecting third-party APP data;

[0051] Specifically, application data collection is a relatively time-consuming process, during which the screen needs to be kept on. And because the collection principle is to simulate human clicking behavior through barrier-free functions, it is necessary to gradually enter the different functional modules of the target application and wait for the relevant data to be loaded and displayed before successfully acquiring the required data. Therefore, it is necessary to provide the user with a prompt information about the progress and status. The prompt information interface covers the entire collection process operation interface screen, obstructs the system script's automatic click on the operation status of each function, and does not affect the automatic click and data acquisition functions of the collection task, so as to give the user a better sensory experience.

[0052] S13: Synchronize the task collection script, such as Figure 2As shown: download the collection plug-in from the background server to call the collection plug-in to perform the collection task, obtain the structured data of the third-party APP data of the mobile terminal, that is, the structured data of the data required for information security risk detection; wherein, the collection plug-in download initialization is completed, that is, the plug-in can be called to perform the collection task. The collection plug-in is a collection script plug-in that matches the third-party APP and version number that needs to be monitored for security;

[0053] Specifically, after the floating window is opened, the process of collecting data from third-party apps is executed. The terminal information security risk detection program synchronizes with the background of the terminal information security brain to timely update the data collection script plug-ins of major apps, so as to achieve real-time updates of the stability, comprehensiveness and accuracy of the collection of continuously updated and upgraded third-party apps. By collecting and processing key data of commonly used third-party apps such as browsers, WeChat, Alipay, Xiaohongshu, Douyin, Taobao, Dingding and other applications, the security risks of terminal information are analyzed, such as setting information, behavioral dynamics, friend relationships, message lists, financial bills, online shopping, electronic files and other data. In order to protect the information security risks during the detection process, the entire collection process and data analysis process are completely offline and fully encrypted using RSA. Users can also disable data collection and analysis of a third-party app or a certain type of data according to their needs.

[0054] Specifically, in this embodiment, by executing the synchronized collection plug-in, the structured data of the data required for information security risk detection is obtained, and the method is as follows:

[0055] S131: Start the target third-party APP through the target third-party APP package name;

[0056] S132: Get the root node of the accessibility tree in the current active window through getRootInActiveWindow of the accessibility service AccessibilityService to obtain the node tree of the current active window T a And the expected setting interface of the final data interface of the third-party APP T b The similarity between the two is used to determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the third-party APP; the expected setting interface of the final data interface of the third-party APP is an interface in the third-party APP for providing an identification for the final data interface;

[0057] Specifically, in the expected setting interface, there is an identifier of the final data interface. For example, if the final data interface is WeChat Moments, the expected setting interface is the "Discover" interface of WeChat. There is a "Friends Circle" identifier in the interface. Through the "Friends Circle" identifier, you can enter the main interface of the Friends Circle, which is the final data interface.

[0058] The Accessibility Tree is a tree structure that represents the current screen content, where each node represents an interface element on the screen (such as a button, text box, etc.).

[0059] Preferably, get the current active window node tree T a And the expected setting interface node tree of the final data interface of the third-party APP T b The formula used for the similarity between is as follows:

[0060] ,

[0061] Where: TEDS Represents the currently active window node tree T a And the expected setting interface node tree of the final data interface of the third-party APP T b The similarity between T a Represents the currently active window node tree; T b Represents the expected setting interface node tree of the final data interface of the third-party APP; EditDist ( T a , T b ) means to move the current active window node tree T a Expected setting interface node tree converted to the final data interface of the third-party APP T b The minimum number of editing operations required, i.e., the tree editing distance; |Ta| and |Tb| represent the tree of the current active window node respectively. T a And the expected setting interface node tree of the final data interface of the third-party APP T b The number of node elements in , where the Text, ResourceID, ClassName, Index, and Rect attribute features of the node elements are used to normalize the edit distance so that the similarity value is between 0 and 1.

[0062] Specifically, if the similarity is not less than the set threshold, it is considered that the expected set page has been reached. Otherwise, if the similarity is less than the set threshold, the operation is repeated after waiting for 0.5 seconds.

[0063] S133: If the current active window interface is an expected setting interface of the final data interface of the third-party APP of the mobile terminal, the next level function page of the current active window is the final data interface;

[0064] If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, then enter the next level function page of the current active window, and repeat S132 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, and then enter the final data interface of the target third-party APP. The specific method is to simulate clicks by presetting the node element features of the target application interface.

[0065] Specifically, after entering the final data interface of the target third-party APP, stay on the final data interface and wait for further data operation acquisition.

[0066] S134: If the data in the final data interface is displayed in a list or loaded in real time through the network, execute S135;

[0067] If the final data interface, i.e. the target collected data, is displayed in the form of a picture, then S136 is executed;

[0068] S135: In order to obtain the complete list data, it is necessary to scroll down and turn the pages of the final data interface until there is no new data or the user's customized collection requirements are reached; according to the getRootInActiveWindow method of AccessibilityService, all node elements of the final data interface are traversed and obtained, and the text data of the node elements are appended and spliced ​​using the custom delimiter, and the data of each node is continuously spliced ​​on a string with the delimiter to obtain a large string of all text data of the final data interface.

[0069] S136: storing the image locally or in a remote server by means of screenshots, and concatenating the image paths to form a large character string of all image paths of the final data interface;

[0070] S137: Acquire structured data according to the large character string based on a regular expression.

[0071] Specifically, conventional regular expressions are used to write expression statements according to the positional features of data fields and data segmentation to parse the large string data into structured data.

[0072] Implementation method 1: WeChat friend relationship

[0073] [Local path]; Flying penguin; 12345; Colleague; Dalian; Calm as still water, indifferent to fame and fortune; Add mobile phone number & [Local path]; Cold Prince; 54321; Friend; Dalian; Laugh at life, be positive and enterprising; Add nearby people

[0074]

[0075] Implementation method 2: Alipay transaction records

[0076] Transfer red envelope; Online transfer; Flying penguin; 200.00; 2024 / 7 / 28 13:22:11; Expenditure; Success&Daily necessities; Scan code payment; Happy convenience store; 18.20; 2024 / 7 / 28 15:22:11; Expenditure; Success

[0077]

[0078] S2: Establish multiple risk identification models based on keyword-based identification rules, expression-based identification rules, customized identification rules, and a combination of identification rules based on a funnel model; to identify the security risks of third-party APP data based on the structured data;

[0079] Preferably, the risk identification model is identified by:

[0080] First, based on the structured data of third-party APP data on mobile terminals, risk identification is performed using a combination of keyword-based identification rules, expression-based identification rules, and customized identification rules.

[0081] Secondly, the risk identification results are obtained based on the combination of keyword-based identification rules, expression-based identification rules, and customized identification rules, and the funnel model-based identification rules are used for risk identification.

[0082] Specifically, after all the data for the task is collected, data risk analysis begins. Since the daily usage data of major applications covers almost all the information we use on mobile smart terminals, it can help users solve potential information security risks as much as possible. Due to the fragmentation of mobile smart terminal devices, their computing performance also varies. Existing technologies such as large models cannot be well applied in mobile smart terminals. In order to ensure that users' personal data is not uploaded to the cloud to avoid leakage risks, local technology is used to identify information security risks in the data.

[0083] Specifically, for the structured data obtained by displaying the target collection data in the form of pictures, it is necessary to preprocess it: traverse the structured data items to obtain the fields with the picture path, load the pictures for semantic recognition and picture text extraction, and store them in the picture text remark field, so as to cover all risk identification scenarios of information as much as possible, and combine the text semantic recognition technology to further realize the risk identification and discovery of various types of information. Through the NeuralTalk tool, an open source image description generation (Image Captioning) technology based on deep learning, natural language text descriptions are generated from images. It uses technologies such as convolutional neural networks (CNN) and recurrent neural networks (RNN) or long short-term memory networks (LSTM) to achieve conversion from pictures to text by encoding and decoding the visual features of pictures. Preprocess unstructured data and convert them into natural language text.

[0084] Specifically, the keyword recognition rules, expression recognition rules, customized recognition rules and funnel model recognition rules in this embodiment are all conventional technologies in the field:

[0085] The keyword-based recognition rule, ACDAT (AhoCorasickDoubleArrayTrie), is an efficient text processing tool that combines the Aho-Corasick algorithm and the DoubleArrayTrie. Due to the large scale of the risk keyword library and the extremely large amount of data generated by the user's mobile smart terminal, the traditional keyword matching method has been difficult to meet the requirements of computing performance and efficiency. ACDAT can simultaneously search for multiple pattern strings in a text string. The AC automaton constructs a structure similar to the Trie tree (also known as a prefix tree or dictionary tree) and adds a mismatch pointer (fail pointer) to the structure, so that it can jump to the correct position to continue matching when the match fails. All the information of the Trie tree is stored in two arrays, thereby reducing memory usage and improving query efficiency. Storing the Trie tree in a double array greatly reduces memory usage, making ACDAT suitable for large-scale data processing.

[0086] The expression-based identification rules are as follows: In data processing and risk discovery, complex calculations and analyses are required on numeric data fields or the aggregated results of these fields to determine whether there are potential risks. This analysis process usually relies on a series of predefined expression rules that define how data should be processed and calculated, and judge whether the data reaches a specific risk threshold. Numeric data may require a series of complex aggregate calculations such as summation, grouping, and numeric judgment, and then judge whether there is a risk based on the calculation results.

[0087] Based on customized recognition rules: In addition to matching and identifying the data in the field based on keywords and expressions, customized rule plug-in recognition can be used to aggregate and analyze the entire data set, and provide extensions for matching data that requires further in-depth mining. For example, if you need to identify emotions in the data, you can use customized rule recognition, use NLP technology to obtain data emotions, and then use keyword-based or expression-based rules to determine whether the emotions are risky.

[0088] Identification rules based on the funnel model: The data results identified by the above three methods may contain false positives and false negatives. In order to further ensure the accuracy of data security analysis, the funnel model can gradually narrow the scope of risk identification and screen out the most critical risks that require immediate attention from a wide range of potential risks. Through the combination of various identification methods, a composite data security analysis model is formed.

[0089] Through existing methods in the field, multiple risk identification models are formed by combining keyword-based identification rules, expression-based identification rules, and customized identification rules, which are stored in JSON format to form a database. After the system is started, when data analysis is required, the database is read and all risk identification model rules are loaded. Each model rule includes risk type information, which includes the risk name, risk weight, maximum score, and model rule corresponding to the risk type.

[0090] By identifying the structured data one by one and using the data processing risk identification model established above, all the data processing risk identification models in the system are called for detection of each data. The structured data is matched through the model to detect whether the structured data of the third-party APP on the mobile terminal meets the conditions of the risk model. If the risk model is hit, that is, the security risk identification result of the third-party APP data is that there is a risk, the ID corresponding to the collected data and the ID corresponding to the analysis model are associated and stored in the database.

[0091] S3: Based on the results of the identification of security risks of third-party APP data, a risk identification report is obtained to generate security scanning results and complete the detection of mobile terminal information security.

[0092] Specifically, after completing the risk identification of the data, a detailed report is generated. According to the preset weight of each risk identification model in the system, the collected terminal information is divided into three levels of high risk, medium risk, and low risk through the risk identification results, and the specific risk types under each level are classified. A specific risk data list is displayed under each classification. Users can understand the specific reasons for data security risks based on the risk level and risk type, helping users to understand the risks of personal terminal information and network data in detail. A chart with an overall overview of the user's mobile smart terminal is also displayed.

[0093] At the same time, the entire device is scored: the system preset risk identification model weight is loaded, and the preset risk model weights of the hit risk identification model are added to obtain the overall risk coefficient. The scoring method of this embodiment is a conventional technology in the field and is not described in detail here.

[0094] To prevent a model rule in the risk identification model (i.e., keyword identification rule, expression identification rule, customized identification rule, and funnel model-based identification rule) from giving an excessively high score in a specific situation, such as too many harassing calls causing the overall risk factor to be too high, but the harm caused by the model rule is not serious. This problem is solved by setting a maximum score for the model rule and finally normalizing the calculation results. The specific score calculation formula is as follows:

[0095] set up W is a set of weights associated with the model rule combination corresponding to the mobile terminal device, M is the maximum score of the model rules in the risk identification model, and the score calculation formula is:

[0096] ,

[0097] Where: Indicates the final risk factor of the mobile terminal device; Represents a weight associated with a model rule combination corresponding to a mobile terminal device; Represents a weight set associated with a model rule combination corresponding to a mobile terminal device; It represents the sum of all model rules of the system, that is, the maximum value of the system risk coefficient; represents the maximum score of the model rule;

[0098] here, yes The maximum value that can be achieved is the maximum value that the score of the analysis model of the entire system can achieve. Representing a collection W The sum of all weights in . If the maximum score of a rule M If it is 0, the score is the sum of all weights; otherwise, the score is the maximum score of the rule and the sum of all weights.

[0099] When there is no maximum score limit (i.e. M =0): Directly calculate the sum of all weights as the comprehensive score. This means that under the model rules, no external restrictions are considered and the device is evaluated only based on the weight itself.

[0100] When there is a maximum score limit: Calculate the sum of all weights and compare this sum to the maximum score limit of the rule. Take the smaller of the two as the composite score. This ensures that even if the sum of weights is high, the composite score does not exceed the maximum allowed by the model rules.

[0101] Finally, the overall security score of the device information and network platform is calculated. If the score is 0, it means no security risk is found.

[0102] Preferably, it also includes: when the identification result of the security risk identification of the third-party APP data is that there is a risk, based on the risk type information in the risk identification model, obtaining the location of the risk information of the final interface of the data of the third-party APP with risk, so as to trace the risk information.

[0103] Specifically, users can customize the handling of relevant risk information based on the preset suggestions of the risk model, such as the location of privacy data leakage, the scope of involvement, and help optimize the visible range of management data. Help users quickly trace and handle risk information, and click on a specific risk issue with one click to automatically jump to a piece of data in the functional module under the APP of the information security risk item. The specific steps are as follows:

[0104] S41: starting the risky third-party APP according to the risky third-party APP package name;

[0105] S42: Get the root node of the accessibility tree in the current active window of the third-party app with risks through getRootInActiveWindow of the accessibility service AccessibilityService to obtain the node tree of the current active window T a The expected setting interface node tree of the final data interface of the third-party APP with risks T b The similarity between the two is used to determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the third-party APP with risks; the expected setting interface of the final data interface of the third-party APP with risks is an interface for providing an identification for the final data interface of the third-party APP with risks;

[0106] S43: If the current active window interface is the expected setting interface of the final data interface of the third-party APP with risks, the next level function page of the current active window is the final data interface of the third-party APP with risks, that is, the final data interface of risk information tracing;

[0107] If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP at risk, enter the next level function page of the current active window, and repeat S42 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP at risk (that is, the process is stopped when data or nodes matching the target risk information data appear), and obtain the final data interface of the third-party APP at risk, that is, the final data interface for risk information tracing; then based on the risk type information in the risk identification model, obtain the location of the risk information in the data final interface of the third-party APP at risk to trace the risk information; the risk type information includes risk name, risk weight, maximum score, etc. The specific method is to match the collected and identified data with the current interface data. The judgment method is a simple string matching, which is a conventional technology and is not described in detail here.

[0108] Specifically, after tracing the risk information, the user manually checks and further understands the risk information and sets or deletes it according to the risk model recommendations.

[0109] A mobile terminal information security detection method of this embodiment obtains third-party APP data of the mobile terminal according to the barrier-free service of the Android system to obtain structured data of the third-party APP data of the mobile terminal; and then adopts a risk identification model based on keyword recognition rules, expression recognition rules, customized recognition rules and funnel model recognition rules to identify the security risks of the third-party APP data for the structured data. The present invention can conveniently, quickly and deeply collect user daily use related data such as third-party application APP data on mobile smart terminals, convert multi-source heterogeneous and fragmented information into structured data, and then identify security risks. It can detect all possible risks of mobile terminals and networks during the user's use of mobile terminals, overcome the problem that the information collected by traditional risk detection has limitations, and greatly improve the user's overall risk detection and discovery capabilities on the Internet. And it can provide users with suggestions for handling personal Internet risk information. Help users better prevent and deal with information security risks generated by smart terminals.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A mobile terminal information security detection method, characterized in that: The steps include: S1: Obtain third-party APP data of the mobile terminal according to the accessibility service of the Android system to obtain structured data of the third-party APP data of the mobile terminal; The method for obtaining structured data of third-party APP data of mobile terminals is as follows: S11: Enable the accessibility service permissions of the Android system: including enabling the canPerformGestures setting for simulating click operations on mobile terminals, and enabling the canRetrieveWindowContent setting for obtaining interface data; S12: Open a floating window for collecting third-party APP data; S13: Downloading a collection plug-in from a backend server to obtain structured data of third-party APP data of a mobile terminal; The S13 includes: S131: starting a third-party APP according to the third-party APP package name; S132: Obtain the root node of the accessibility tree of the current active window through getRootInActiveWindow of the accessibility service, so as to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the third-party APP, and then determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the third-party APP; the expected setting interface of the final data interface of the third-party APP is an interface for providing an identification for the final data interface; The formula used to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the third-party APP is as follows: Where: TEDS represents the current active window node tree T a And the expected setting interface node tree T of the final data interface of the third-party APP b The similarity between a Represents the current active window node tree; T b Represents the expected setting interface node tree of the final data interface of the third-party APP; EditDist(T a ,T b ) indicates that the current active window node tree T a Expected setting interface node tree T converted to the final data interface of the third-party APP b The minimum number of editing operations required, i.e., the tree editing distance; |Ta| and |Tb| represent the current active window node tree T a And the expected setting interface node tree T of the final data interface of the third-party APP b The number of node elements in ; S133: If the current active window interface is an expected setting interface of the final data interface of the third-party APP of the mobile terminal, the next level function page of the current active window is the final data interface; If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, enter the next level function page of the current active window, and repeat S132 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP of the mobile terminal, and obtain the final data interface; S134: If the data in the final data interface is displayed in a list or loaded in real time through the network, execute S135; If the final data interface is displayed in the form of a picture, execute S136; S135: scroll down and turn pages of the final data interface until there is no more new data or the data collection requirement is met; according to the getRootInActiveWindow method of the barrier-free service, traverse all node elements of the final data interface to obtain a large string of all text data of the final data interface; S136: storing the pictures locally or in a remote server, and concatenating the picture paths to form a large character string of all picture paths of the final data interface; S137: Obtaining final data interface structured data of the third-party APP of the mobile terminal according to the large character string and based on a regular expression; S2: Establish multiple risk identification models based on keyword-based identification rules, expression-based identification rules, customized identification rules, and a combination of funnel-based identification rules to identify security risks of third-party APP data based on the structured data and the risk identification model; Wherein, the identification method of the risk identification model is: First, based on the structured data of third-party APP data on mobile terminals, risk identification is performed using a combination of keyword-based identification rules, expression-based identification rules, and customized identification rules. Secondly, according to the recognition results of risk identification based on the combination of keyword-based recognition rules, expression-based recognition rules, and customized recognition rules, risk identification is performed using the recognition rules based on the funnel model; S3: Based on the results of the identification of security risks of third-party APP data, a risk identification report is obtained to complete the detection of mobile terminal information security.

2. A mobile terminal information security detection method according to claim 1, characterized in that: Also includes: When the security risk identification result of the third-party APP data is that there is a risk, based on the risk type information in the risk identification model, the location of the risk information of the final interface of the data of the third-party APP with risk is obtained to trace the risk information; the method used is as follows: S41: starting the risky third-party APP according to the risky third-party APP package name; S42: Obtain the root node of the accessibility tree in the current active window of the risky third-party APP through getRootInActiveWindow of the accessibility service, so as to obtain the similarity between the node tree of the current active window and the node tree of the expected setting interface of the final data interface of the risky third-party APP, and then determine whether the current active window interface already belongs to the expected setting interface of the final data interface of the risky third-party APP; the expected setting interface of the final data interface of the risky third-party APP is an interface for providing an identification for the final data interface of the risky third-party APP; S43: If the current active window interface is an expected setting interface of the final data interface of the third-party APP with risks, the next level function page of the current active window is the final data interface of the third-party APP with risks; If the current active window interface does not belong to the expected setting interface of the final data interface of the third-party APP at risk, enter the next-level function page of the current active window, and repeat S42 until the current active window interface belongs to the expected setting interface of the final data interface of the third-party APP at risk, and obtain the final data interface of the third-party APP at risk; then, based on the risk type information in the risk identification model, obtain the location of the risk information in the final data interface of the third-party APP at risk, so as to trace the risk information.

Images