Security detection method, system and storage medium for application program

Abstract

The present application relates to the field of application detection technology, and in particular to a security detection method, system and storage medium for application programs. The detection method includes: S1, a first monitoring unit determines a number of suspicious first application modules, and a second monitoring unit determines a number of suspicious second application modules; S2, a determination module determines a number of suspicious final application modules; S3, a check module collects a number of feature statements from the feature document for each feature document, determines a number of feature information corresponding to the several feature statements, and the check module also generates a number of check standards; S4, the check module uses different check standards that have passed the correctness test process to check and process different application documents in the several suspicious final application modules to check out suspicious application documents. The present application can automatically check out application software with security issues and improve the security of the application.

Description

Technical Field

[0001] The present application relates to the technical field of application program detection, and in particular to a security detection method, system and storage medium for application programs. Background Art

[0002] With the continuous development of computer application technology, the security issues of application programs have attracted more and more attention. Therefore, a security detection method for application programs is needed to timely detect application programs that may have security defects to avoid data theft or tampering.

[0003] The Chinese patent application with publication number CN111382444A discloses a software security detection system and a software security detection method. The system includes a software detection device and an open data detection device. The software detection device is used to receive software, classify the software, and detect the source code of the software with a first program corresponding to the type of software, or the software detection device detects the relationship of at least one parameter transmission of the software with a second program corresponding to the type of software. If the source code of the software is abnormal or the relationship of at least one parameter transmission of the software is abnormal, the software detection device outputs an abnormal signal. The open data detection device is used to obtain multiple security vulnerabilities of multiple open data from a database, and detect whether the software contains one of these open data. If the software contains one of these open data, the open data detection device outputs an open source code reminder signal. In addition, the Chinese patent application with publication number CN111552967A discloses a method for detecting security vulnerabilities in application software, including the following steps: S1. Using hook technology to mount the method or function of the application software; S2. When the mounted method or function is called, trigger the vulnerability detection program; S3. The vulnerability detection program analyzes the transmission process of the user input data and detects the security vulnerabilities of the application software, which can perform imperceptible testing on the application software, does not generate dirty data, has stable testing capabilities, and has a low false negative rate. However, the detection method of the above patent application is based on the premise that the device that may have installed the problematic software has been determined, and there is a lack of a method for automatically checking for application software with security issues, which is still insufficient. Summary of the invention

[0004] The present application identifies a suspicious final application module in a network system including multiple application modules, generates different inspection standards, performs correctness verification processing on the different inspection standards, and uses several inspection standards that have passed the correctness verification processing to inspect and process different application documents in the suspicious final application module, with the aim of automatically detecting application software with security issues.

[0005] This application provides a security detection method for an application, which mainly includes the following steps:

[0006] S1, setting any two of the application modules to be connected to each other through the monitoring module, and the first monitoring unit continuously acquires communication data, and determines a number of suspicious first application modules based on the acquired different communication data, and the second monitoring unit continuously acquires communication data, and determines a number of suspicious second application modules based on the acquired different communication data;

[0007] S2, based on the plurality of suspicious first application modules determined by the first monitoring unit and the plurality of suspicious second application modules determined by the second monitoring unit, the determination module determines a plurality of suspicious final application modules;

[0008] S3, the inspection module stores different feature documents in advance, and for each feature document, the inspection module collects a number of feature sentences from the feature document, determines a number of feature information corresponding to the number of feature sentences respectively, and the inspection module further generates a number of inspection standards according to the total feature information composed of the number of feature information of different feature documents;

[0009] S4. The inspection module performs a correctness check on each generated inspection standard, and uses different inspection standards that have passed the correctness check to inspect different application documents in several suspicious final application modules to identify suspicious application documents.

[0010] As a preferred technical solution of the present application, in S1, the first monitoring unit continuously acquires communication data, and determines a plurality of suspicious first application modules based on the acquired different communication data, including the following steps:

[0011] S111, the first monitoring unit obtains a communication data, and the first monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the first monitoring unit stores and processes the obtained communication data and proceeds to the next step. If no, the first monitoring unit jumps to S113;

[0012] S112, based on all the stored communication data, the first monitoring unit counts the total number of different communication data with different corresponding communication starting points but the same corresponding communication end points, and determines whether the total number is greater than a preset first number threshold, and if so, treats the several application modules corresponding to the different communication data as several suspicious first application modules, and jumps to S114; if not, jumps to S111;

[0013] S113, the first monitoring unit determines whether the acquired communication data is used to end the communication connection, and if so, records the application module corresponding to the acquired communication data and jumps to S111; if not, directly jumps to S111;

[0014] S114. The first monitoring unit determines whether to stop processing. If yes, all steps are terminated. If not, the process jumps to S111.

[0015] As a preferred technical solution of the present application, in S1, the second monitoring unit continuously acquires communication data, and determines a number of suspicious second application modules according to different acquired communication data, including the following steps:

[0016] S121, the second monitoring unit obtains a communication data, and the second monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the obtained communication data is stored and processed, and the next step is continued. If no, this step is repeated;

[0017] S122, based on all the stored communication data, the second monitoring unit counts the total number of different communication data with the same corresponding communication starting point but different corresponding communication end points, and determines whether the total number is greater than a preset second number threshold, if yes, proceeding to the next step, if no, jumping to S121;

[0018] S123, the second monitoring unit determines whether all communication endpoints corresponding to different communication data are clear, and if so, deletes the stored different communication data and jumps to S121; if not, treats the several application modules corresponding to the different communication data as several suspicious second application modules and proceeds to the next step;

[0019] S124. The second monitoring unit determines whether to stop processing. If yes, all steps are terminated. If no, the process jumps to S121.

[0020] As a preferred technical solution of the present application, S2 comprises the following steps:

[0021] S21, the determination module selects a suspicious second application module from the plurality of suspicious second application modules determined by the second monitoring unit, and proceeds to the next step;

[0022] S22, the determination module determines whether the selected suspicious second application module also exists in the plurality of suspicious first application modules determined by the first monitoring unit. If yes, the selected suspicious second application module is determined to be a suspicious final application module and the next step is continued. If no, the next step is directly continued.

[0023] S23, the determination module determines whether to stop processing, and if so, ends all steps, and if not, jumps to S21.

[0024] As a preferred technical solution of the present application, in S3, each feature document includes different data records, each data record corresponds to a system event, and the inspection module collects a number of feature statements from a number of data records in the feature document corresponding to different preset system events for each feature document.

[0025] As a preferred technical solution of the present application, in S3, the inspection module determines, for each feature document, a number of feature information corresponding to a number of feature statements, wherein the feature information is used to express the occurrence of a corresponding feature statement when a system event occurs.

[0026] As a preferred technical solution of the present application, in S3, the inspection module also generates several inspection standards based on the total feature information composed of several feature information of different feature documents, wherein the inspection standards include cause feature information and result feature information.

[0027] As a preferred technical solution of the present application, in S3, after the inspection module generates several inspection standards based on all the feature information composed of several feature information of different feature documents, for each inspection standard, it first calculates a first ratio of the total number of specific events corresponding to the cause feature information and the result feature information together to the total number of specific events corresponding to the cause feature information alone, then calculates a second ratio of the first ratio to the total number of specific events corresponding to the result feature information alone, and stores the inspection standards whose corresponding second ratios are greater than a preset ratio threshold.

[0028] This application also provides a security detection system for application programs, which mainly includes the following modules:

[0029] The monitoring module is composed of a first monitoring unit and a second monitoring unit, wherein the first monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious first application modules based on different communication data obtained, and the second monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious second application modules based on different communication data obtained;

[0030] A determination module, configured to determine a plurality of suspicious final application modules based on a plurality of suspicious first application modules determined by the first monitoring unit and a plurality of suspicious second application modules determined by the second monitoring unit;

[0031] A check module is used to store different feature documents in advance, collect several feature statements from the feature documents for each feature document, determine several feature information corresponding to the several feature statements respectively, generate several check standards according to the whole feature information composed of several feature information of different feature documents, and perform correctness check processing on each generated check standard, use different check standards that have passed the correctness check processing to check different application documents in several suspicious final application modules, so as to check out suspicious application documents;

[0032] The application module is configured to be connected to communicate with other application modules through the monitoring module.

[0033] The present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer is enabled to execute the above-mentioned security detection method for an application program.

[0034] This application has at least the following beneficial effects:

[0035] In the technical solution provided in the present application, first, the first monitoring unit continuously obtains communication data, and determines several suspicious first application modules based on the different communication data obtained, and the second monitoring unit continuously obtains communication data, and determines several suspicious second application modules based on the different communication data obtained; secondly, based on the several suspicious first application modules determined by the first monitoring unit and the several suspicious second application modules determined by the second monitoring unit, the determination module determines several suspicious final application modules; thirdly, the inspection module collects several feature statements from the feature document for each feature document, and determines several feature information corresponding to the several feature statements respectively, and the inspection module also generates several inspection standards based on all the feature information composed of several feature information of different feature documents; finally, the inspection module uses different inspection standards that have passed the correctness verification process to inspect and process different application documents in several suspicious final application modules, so as to detect suspicious application documents, thereby detecting application software with security issues. The present application can not only accurately identify suspicious final application modules from a network system including multiple different application modules, but also automatically generate inspection standards with high correctness, and use the inspection standards that have passed the correctness verification process to inspect the application documents in the suspicious final application modules, thereby detecting application software with security issues and improving the security of the application program. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A schematic diagram of an embodiment of a security detection method for an application program in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of an embodiment of a security detection system for an application in an embodiment of the present application. DETAILED DESCRIPTION

[0039] For ease of understanding, the specific process of the embodiment of the present application is described below. Figure 1 The security detection method for an application in the embodiment of the present application mainly includes the following steps:

[0040] S1, setting any two application modules among a plurality of application modules to be connected to each other through a monitoring module, and at the same time, a first monitoring unit continuously acquires communication data, and determines a plurality of suspicious first application modules by means of different acquired communication data, and a second monitoring unit continuously acquires communication data, and determines a plurality of suspicious second application modules according to different acquired communication data;

[0041] S2, based on the several suspicious first application modules determined by the first monitoring unit and the several suspicious second application modules determined by the second monitoring unit, the determination module determines several suspicious final application modules;

[0042] S3, the inspection module stores different feature documents in advance, and for each feature document, the inspection module collects a number of feature sentences from the feature document, determines a number of feature information corresponding to the number of feature sentences respectively, and the inspection module also generates a number of inspection standards according to the total feature information composed of the number of feature information of different feature documents;

[0043] S4. The inspection module performs a correctness check on each generated inspection standard, and uses different inspection standards that have passed the correctness check to inspect different application documents in several suspicious final application modules to identify suspicious application documents.

[0044] Specifically, the present application considers first determining a suspicious final application module in a network system containing different application modules. The suspicious final application module refers to an application module that may have installed application software with security issues. Then, security checks are performed one by one on different application software in the suspicious final application module to determine the application software with security issues, thereby proposing S1 to S4.

[0045] In S1, any two application modules among several application modules are set to communicate through the monitoring module, that is, if any two application modules want to communicate data, the monitoring module must forward the communication data. On this basis, the first monitoring unit continuously obtains communication data, and determines several suspicious first application modules based on the different communication data obtained. The second monitoring unit continuously obtains communication data and determines several suspicious second application modules based on the different communication data obtained. The specific determination process will be described below. In S2, the determination module determines several suspicious final application modules based on the several suspicious first application modules determined by the first monitoring unit and the several suspicious second application modules determined by the second monitoring unit. The specific determination process will be described below. In S3, the inspection module stores different feature documents in advance. It should be noted that the feature documents are feature documents of application software with security issues. For example, the feature documents are log documents of application software with security issues. Then, the inspection module collects several feature statements from the feature documents for each feature document, and determines several feature information corresponding to the several feature statements respectively. The inspection module also generates several inspection standards based on all the feature information composed of several feature information of different feature documents. The details of S3 will be described below. In S4, the inspection module performs a correctness check on each generated inspection standard. Specifically, each inspection standard is used to inspect a large number of application documents, where the large number of application documents include multiple suspicious application documents and multiple normal application documents. Suspicious application documents refer to application documents of application software with security issues, and normal application documents refer to application documents of application software without security issues. For all suspicious application documents, a first ratio of the total number of application documents with suspicious inspection results to the total number of suspicious application documents is first calculated, and then a second ratio of the total number of application documents with suspicious inspection results to the total number of normal application documents is calculated for all normal application documents. It should be noted that if an application document meets any inspection standard, the application document is considered to be suspicious. If the first ratio is greater than a preset first ratio threshold and the second ratio is less than a preset second ratio threshold, the first ratio threshold and the second ratio threshold are set in the actual application scenario, then the corresponding inspection standard is considered to have passed the correctness check. Afterwards, the inspection module uses different inspection standards that have passed the correctness verification process to inspect and process different application documents in several suspicious final application modules to identify suspicious application documents. The application software corresponding to the suspicious application documents is the application software with security issues.

[0046] Furthermore, the first monitoring unit continuously acquires communication data, and determines a plurality of suspicious first application modules based on the acquired different communication data, including the following steps:

[0047] S111, the first monitoring unit obtains a communication data, and the first monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the first monitoring unit stores and processes the obtained communication data and proceeds to the next step. If no, the first monitoring unit jumps to S113;

[0048] S112, based on all the stored communication data, the first monitoring unit counts the total number of different communication data with different corresponding communication starting points but the same corresponding communication end points, and determines whether the total number is greater than a preset first number threshold. If yes, the application modules corresponding to the different communication data are regarded as several suspicious first application modules, and the process goes to S114; if no, the process goes to S111;

[0049] S113, the first monitoring unit determines whether the acquired communication data is used to end the communication connection. If yes, the first monitoring unit records the application module corresponding to the acquired communication data and jumps to S111. If no, the first monitoring unit directly jumps to S111.

[0050] S114. The first monitoring unit determines whether to stop processing. If yes, all steps are terminated. If not, jump to S111.

[0051] Specifically, the process of the first monitoring unit determining several suspicious first application modules is introduced here. In S111, the first monitoring unit obtains a communication data and determines whether the obtained communication data is used to establish a communication connection. Usually, the communication data contains different identification data, which are used to indicate the purpose of the communication data, the communication starting point, and the communication end point, etc. If yes, the obtained communication data is stored and the next step is continued. If not, jump to S113. In S112, the first monitoring unit counts the total number of different communication data with different corresponding communication starting points but the same corresponding communication end points based on all the stored communication data. For ease of understanding, for example, communication data A and communication data B are sent from application module A and application module B to application module C respectively, application module A and application module B are the communication starting points, and application module C is the communication end point, then the total number here is 2, and the first monitoring unit determines whether the total number is greater than a preset first number threshold, which is set in the actual application scenario. If yes, the several application modules corresponding to the different communication data are regarded as several The suspicious first application module, the correspondence here refers to the correspondence with the communication starting point in the communication data, jump to S114, if not, jump to S111, this is done considering that the application module installed with the application software with security issues usually initiates an application to establish a communication connection to a central module, the central module can be any application module except itself, waiting for the central module to send back confirmation information to it, if an application module receives a large amount of communication data for establishing a communication connection, then it is more likely to be the central module, and the different application modules that send the communication data for establishing a communication connection to it can be considered as suspicious application modules. In S113, the first monitoring unit determines whether the acquired communication data is used to end the communication connection, if so, record the application module corresponding to the acquired communication data, the role of the recorded application module will appear below, jump to S111, if not, directly jump to S111. In S114, the first monitoring unit determines whether to stop processing, if yes, end all steps, if not, jump to S111 to continue execution.

[0052] It should be noted that, by executing S111 to S114, the first monitoring unit has identified several suspicious first application modules, but the recorded application modules should also be removed from these suspicious first application modules. This is because the application module that has installed the application software with security issues usually needs to wait for the central module to send back confirmation information after initiating an application to establish a communication connection to a central module, so it will not actively end the communication connection with the central module.

[0053] Furthermore, in S1, the second monitoring unit continuously acquires communication data, and determines a number of suspicious second application modules according to the acquired different communication data, including the following steps:

[0054] S121, the second monitoring unit obtains a communication data, and the second monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the second monitoring unit stores the obtained communication data and proceeds to the next step. If no, the second monitoring unit repeats this step.

[0055] S122, based on all the stored communication data, the second monitoring unit counts the total number of different communication data with the same corresponding communication starting point but different corresponding communication end points, and determines whether the total number is greater than a preset second number threshold, if yes, proceeding to the next step, if no, jumping to S121;

[0056] S123, the second monitoring unit determines whether all communication endpoints corresponding to different communication data are clear, and if so, deletes the stored different communication data and jumps to S121; if not, treats the several application modules corresponding to the different communication data as several suspicious second application modules and proceeds to the next step;

[0057] S124. The second monitoring unit determines whether to stop processing. If yes, all steps are terminated. If not, jump to S121.

[0058] Specifically, the process of the second monitoring unit determining several suspicious second application modules is introduced here. In S121, the second monitoring unit obtains a communication data and determines whether the obtained communication data is used to establish a communication connection. If so, the obtained communication data is stored and processed and the next step is continued. If not, this step is repeated. In S122, the second monitoring unit counts the total number of different communication data with the same corresponding communication starting point but different corresponding communication end points based on all the stored communication data. For ease of understanding, for example, communication data D, communication data E, and communication data F are sent from application module D to application module E, application module F, and an unknown application module respectively, application module D is the communication starting point, application module E, application module F, and the unknown application module are the communication end points respectively, then the total number here is 3, and it is determined whether the total number is greater than a preset second number threshold, the second number threshold is set in an actual application scenario, if so, continue to the next step, if not, jump to S121, this is done considering that the application module installed with the application software with security issues will send communication data for establishing a communication connection to a large number of other application modules after receiving the confirmation message from the central module, in order to enable a large number of other application modules to receive the application software with security issues, so if an application module sends communication data to a large number of other application modules, then the possibility that it is a suspicious application module is higher. In S123, the second monitoring unit determines whether all the communication endpoints corresponding to different communication data are clear. If so, delete the stored different communication data and jump to S121. If not, treat the several application modules corresponding to the different communication data as several suspicious second application modules. The correspondence here refers to the correspondence with the communication starting point in the communication data and continue to the next step. This is because when the application module with the application software with security issues is installed, when sending the communication data for establishing a communication connection to other application modules, the other application modules are likely to be unknown, that is, it is unclear to which application module the communication data is to be sent. It can be understood that the communication endpoint in the communication data is a null value. Therefore, when there is an unclear communication endpoint among all the communication endpoints corresponding to different communication data, the possibility that the corresponding application module is a suspicious application module will increase. In S124, the second monitoring unit determines whether to stop processing. If so, end all steps. If not, jump to S121 to continue execution.

[0059] Further, S2 includes the following steps:

[0060] S21, the determination module selects a suspicious second application module from the plurality of suspicious second application modules determined by the second monitoring unit, and proceeds to the next step;

[0061] S22, the determination module determines whether the selected suspicious second application module also exists in the plurality of suspicious first application modules determined by the first monitoring unit. If yes, the selected suspicious second application module is determined to be a suspicious final application module and the next step is continued. If no, the next step is directly continued.

[0062] S23, the determination module determines whether to stop processing. If yes, all steps are terminated. If not, jump to S21.

[0063] Specifically, here is introduced how to determine several suspicious final application modules based on several suspicious second application modules determined by the second monitoring unit and several suspicious first application modules determined by the first monitoring unit. In S21, the determination module selects a suspicious second application module from the several suspicious second application modules determined by the second monitoring unit and proceeds to the next step. In S22, the determination module determines whether the selected suspicious second application module also exists in the several suspicious first application modules determined by the first monitoring unit. If so, the selected suspicious second application module is determined to be a suspicious final application module and the next step is continued. If not, the next step is directly continued. In S23, the determination module determines whether to stop processing. If so, all steps are terminated. If not, jump to S21 to continue execution. Through the above method, the application module determined to be suspicious by both the second monitoring unit and the first monitoring unit is used as a suspicious final application module, which can ensure the accuracy of the suspicious final application module. It should be noted that in the above method, a selection is first made from several suspicious second application modules determined by the second monitoring unit, and then it is determined whether the selected suspicious second application module also exists in several suspicious first application modules determined by the first monitoring unit. Because the application module installed with the application software with security issues always sends the communication data for establishing the communication connection to the central module first, and then sends the communication data for establishing the communication connection to a large number of other application modules, the above method is more efficient than the method of first selecting from several suspicious first application modules determined by the first monitoring unit, and then determining whether the selected suspicious first application module also exists in several suspicious second application modules determined by the second monitoring unit.

[0064] Furthermore, in S3, each feature document includes different data records, each data record corresponds to a system event, and the inspection module collects several feature statements from several data records in the feature document corresponding to different preset system events for each feature document.

[0065] Specifically, each feature document includes different data records, and each data record corresponds to a system event. For ease of understanding, for example, a data record is "copy file named data", and its corresponding system event is a copy event. On this basis, the inspection module collects several feature statements from several data records in the feature document corresponding to different preset system events for each feature document. The feature statement refers to the key data in the data record. Continuing with the above example, for example, the feature statement collected from the data record "copy file named data" is the file name "data". Different preset system events may include copy events, communication events, deletion events, etc.

[0066] Furthermore, in S3, the checking module determines, for each feature document, a number of feature information corresponding to a number of feature sentences respectively, wherein the feature information is used to express the occurrence of a corresponding feature sentence when a system event occurs.

[0067] Specifically, the inspection module determines, for each feature document, a number of feature information corresponding to a number of feature statements. The feature information is mainly used to express that the corresponding feature statements appear at the same time when a system event occurs. Continuing with the above example, for example, the feature information corresponding to the feature statement "data" is "the file name data appears when a copy event occurs."

[0068] Furthermore, in S3, the inspection module also generates several inspection standards according to the entire feature information composed of several feature information of different feature documents, wherein the inspection standards include cause feature information and result feature information.

[0069] Specifically, based on the total feature information composed of several feature information of different feature documents, the inspection module generates several inspection standards, which can be implemented by relying on the existing technology. The inspection standards are composed of cause feature information and result feature information. For ease of understanding, following the above example, suppose there is another data record "send a file to the communication destination with the communication address 172.16.254.1", the data record corresponds to a communication event, the feature sentence collected from the data record is the communication address "172.16.254.1", and the feature information corresponding to the feature sentence is "the communication address 172.16.254.1 appears when the communication event occurs". For example, a check standard generated by the inspection module can be formed by the above two feature information, including the cause feature information "the file name data appears when the copy event occurs", and the result feature information included is "the communication address 172.16.254.1 appears when the communication event occurs". This inspection standard represents that if the file name data appears when the copy event occurs as a premise, then the communication address 172.16.254.1 will appear when the communication event occurs.

[0070] Further, in S3, after the inspection module generates several inspection standards based on all the feature information composed of several feature information of different feature documents, for each inspection standard, it first calculates a first ratio of the total number of specific events corresponding to the cause feature information and the result feature information together to the total number of specific events corresponding to the cause feature information alone, and then calculates a second ratio of the first ratio to the total number of specific events corresponding to the result feature information alone, and stores the inspection standards whose corresponding second ratios are greater than a preset ratio threshold.

[0071] Specifically, after generating several inspection standards based on all feature information composed of several feature information of different feature documents, the inspection module also screens the generated several inspection standards. Specifically, for each inspection standard, a large number of suspicious application documents are inspected and processed using the inspection standard. Suspicious application documents refer to application documents of application software with security issues. If there are specific events corresponding to the inspection standard in the application document, then the application document is considered to meet the inspection standard. After all the inspection processes performed by the inspection module are completed, the first ratio of the total number of specific events corresponding to the cause feature information and the result feature information, that is, the total number of specific events corresponding to the inspection standard and the total number of specific events corresponding to the cause feature information alone is calculated, and then the second ratio of the first ratio to the total number of specific events corresponding to the result feature information alone is calculated. The inspection module stores and processes the inspection standards whose corresponding second ratios among the generated several inspection standards are greater than a preset ratio threshold, and the ratio threshold is set in the actual application scenario. Through the above method, the correctness of the inspection standard used to inspect suspicious application documents can be guaranteed.

[0072] The above describes the security detection method for the application in the embodiment of the present application. The following describes the security detection system for the application in the embodiment of the present application. Figure 2 The security detection system for application programs in the embodiment of the present application includes the following modules:

[0073] The monitoring module is composed of a first monitoring unit and a second monitoring unit, wherein the first monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious first application modules based on different communication data obtained, and the second monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious second application modules based on different communication data obtained;

[0074] A determination module, configured to determine a plurality of suspicious final application modules based on a plurality of suspicious first application modules determined by the first monitoring unit and a plurality of suspicious second application modules determined by the second monitoring unit;

[0075] A check module is used to store different feature documents in advance, collect several feature statements from the feature documents for each feature document, determine several feature information corresponding to the several feature statements respectively, generate several check standards according to the whole feature information composed of several feature information of different feature documents, and perform correctness check processing on each generated check standard, use different check standards that have passed the correctness check processing to check different application documents in several suspicious final application modules, so as to check out suspicious application documents;

[0076] The application module is configured to be connected to communicate with other application modules through the monitoring module.

[0077] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium, and when the instructions are executed on a computer, the computer executes the steps of a security detection method for an application.

[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the above-described system and specific working processes of the modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0079] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A security detection method for an application program, applied to a security detection system for an application program, the security detection system comprising a monitoring module, a determination module, an inspection module, and a plurality of application modules, the monitoring module further comprising a first monitoring unit and a second monitoring unit, characterized in that: The method comprises the following steps: S1, setting any two of the application modules to be connected to each other through the monitoring module, and the first monitoring unit continuously acquires communication data, and determines a number of suspicious first application modules based on the acquired different communication data, and the second monitoring unit continuously acquires communication data, and determines a number of suspicious second application modules based on the acquired different communication data; S2, based on the plurality of suspicious first application modules determined by the first monitoring unit and the plurality of suspicious second application modules determined by the second monitoring unit, the determination module determines a plurality of suspicious final application modules; S3, the inspection module stores different feature documents in advance, and for each feature document, the inspection module collects a number of feature sentences from the feature document, determines a number of feature information corresponding to the number of feature sentences respectively, and the inspection module further generates a number of inspection standards according to the total feature information composed of the number of feature information of different feature documents; S4, the inspection module performs a correctness inspection process on each generated inspection standard, and uses different inspection standards that have passed the correctness inspection process to inspect different application documents in several suspicious final application modules to detect suspicious application documents; In S1, the first monitoring unit continuously acquires communication data, and determines a plurality of suspicious first application modules based on the acquired different communication data, including the following steps: S111, the first monitoring unit obtains a communication data, and the first monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the first monitoring unit stores and processes the obtained communication data and proceeds to the next step. If no, the first monitoring unit jumps to S113; S112, based on all the stored communication data, the first monitoring unit counts the total number of different communication data with different corresponding communication starting points but the same corresponding communication end points, and determines whether the total number is greater than a preset first number threshold, and if so, treats the several application modules corresponding to the different communication data as several suspicious first application modules, and jumps to S114; if not, jumps to S111; S113, the first monitoring unit determines whether the acquired communication data is used to end the communication connection, and if so, records the application module corresponding to the acquired communication data and jumps to S111; if not, directly jumps to S111; S114, the first monitoring unit determines whether to stop processing, and if so, ends all steps, and if not, jumps to S111; In S1, the second monitoring unit continuously acquires communication data, and determines a number of suspicious second application modules according to different acquired communication data, including the following steps: S121, the second monitoring unit obtains a communication data, and the second monitoring unit determines whether the obtained communication data is used to establish a communication connection. If yes, the obtained communication data is stored and processed, and the next step is continued. If no, this step is repeated; S122, based on all the stored communication data, the second monitoring unit counts the total number of different communication data with the same corresponding communication starting point but different corresponding communication end points, and determines whether the total number is greater than a preset second number threshold, if yes, proceeding to the next step, if no, jumping to S121; S123, the second monitoring unit determines whether all communication endpoints corresponding to different communication data are clear, and if so, deletes the stored different communication data and jumps to S121; if not, treats the several application modules corresponding to the different communication data as several suspicious second application modules and proceeds to the next step; S124. The second monitoring unit determines whether to stop processing. If yes, all steps are terminated. If no, the process jumps to S121.

2. The security detection method for application according to claim 1, characterized in that: The S2 comprises the following steps: S21, the determination module selects a suspicious second application module from the plurality of suspicious second application modules determined by the second monitoring unit, and proceeds to the next step; S22, the determination module determines whether the selected suspicious second application module also exists in the plurality of suspicious first application modules determined by the first monitoring unit. If yes, the selected suspicious second application module is determined to be a suspicious final application module and the next step is continued. If no, the next step is directly continued. S23, the determination module determines whether to stop processing, and if so, ends all steps, and if not, jumps to S21.

3. The security detection method for application according to claim 1, characterized in that: In S3, each feature document includes different data records, each data record corresponds to a system event, and the inspection module collects a number of feature statements from a number of data records in the feature document corresponding to different preset system events for each feature document.

4. The security detection method for application according to claim 3, characterized in that: In S3, the checking module determines, for each feature document, a number of feature information corresponding to a number of feature sentences respectively, wherein the feature information is used to express the occurrence of a corresponding feature sentence when a system event occurs.

5. The security detection method for application according to claim 4, characterized in that: In S3, the inspection module further generates a plurality of inspection standards according to the entire feature information composed of a plurality of feature information of different feature documents, wherein the inspection standards include cause feature information and result feature information.

6. The security detection method for application program according to claim 5, characterized in that: In S3, after the inspection module generates several inspection standards based on all the feature information composed of several feature information of different feature documents, for each inspection standard, it first calculates a first ratio of the total number of specific events corresponding to the cause feature information and the result feature information together to the total number of specific events corresponding to the cause feature information alone, and then calculates a second ratio of the first ratio to the total number of specific events corresponding to the result feature information alone, and stores the inspection standards whose corresponding second ratios are greater than a preset ratio threshold.

7. A security detection system for an application, used to implement the method according to any one of claims 1 to 6, characterized in that: Includes the following modules: The monitoring module is composed of a first monitoring unit and a second monitoring unit, wherein the first monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious first application modules based on different communication data obtained, and the second monitoring unit is used to continuously obtain communication data and determine a plurality of suspicious second application modules based on different communication data obtained; A determination module, configured to determine a plurality of suspicious final application modules based on a plurality of suspicious first application modules determined by the first monitoring unit and a plurality of suspicious second application modules determined by the second monitoring unit; A check module is used to store different feature documents in advance, collect several feature statements from the feature documents for each feature document, determine several feature information corresponding to the several feature statements respectively, generate several check standards according to the whole feature information composed of several feature information of different feature documents, and perform correctness check processing on each generated check standard, use different check standards that have passed the correctness check processing to check different application documents in several suspicious final application modules, so as to check out suspicious application documents; The application module is configured to be connected to communicate with other application modules through the monitoring module.

8. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the security detection method for an application program according to any one of claims 1 to 6 is implemented.

Images