Data detection method and device, storage medium and electronic equipment

Abstract

The invention provides a data detection method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring operation data of a first type of application in the electronic equipment; forwarding the operation data to an equipment server through a second type of application in the electronic equipment, so that the equipment server determines the reliability of the first type of application based on the operation data; wherein the first type of application is not connected to the device server. According to the method provided by the embodiment of the invention, the problem that illegal personnel execute illegal operation by utilizing interaction between the three-party application and the system application is solved.

Description

Technical Field

[0001] The technical solution disclosed herein relates to the technical field of data transmission, and in particular to a data detection method, device, storage medium and electronic device. Background Art

[0002] Electronic devices are installed with system-provided applications (referred to as system applications). After users get electronic devices, they will also install some third-party applications according to their own usage needs. For example, when the electronic device is a mobile phone, common system applications include: mobile phone manager, application permission management, text messages, etc.; common third-party applications include: short video playback software, photo editing software, etc.

[0003] Since system applications are applications that come with electronic devices when they leave the factory, their reliability is higher, so system applications usually have higher permissions; third-party applications are provided by other manufacturers, their reliability is unknown, so third-party applications usually have lower permissions.

[0004] When users run third-party applications in electronic devices, they usually grant the third-party applications the permission to access system applications, such as the permission to access the address book, the permission to obtain the user's photo album, the permission to obtain the user's identity information, etc. This makes it easy for illegal personnel to exploit the interaction between third-party applications and system applications to perform some illegal operations after discovering system vulnerabilities. Based on this, a solution is needed. Summary of the invention

[0005] In view of this, the present disclosure provides a data detection method, device, storage medium and electronic device, which are helpful to solve the problem of illegal persons performing illegal operations by utilizing the interaction between third-party applications and system applications.

[0006] According to a first aspect of an embodiment of the present disclosure, a data detection method is provided, which is applied to an electronic device, and the method includes:

[0007] Acquire operation data of a first type of application in the electronic device;

[0008] The operation data is forwarded to a device server via a second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

[0009] According to a second aspect of an embodiment of the present disclosure, a data detection method is provided, which is applied to a device server, and the method includes:

[0010] Acquire operation data transmitted by a second type application in the electronic device; the operation data is data generated when the first type application in the electronic device performs a target operation;

[0011] Based on the operation data, reliability of the first type of application running on the electronic device is determined.

[0012] According to a third aspect of an embodiment of the present disclosure, a data detection device is provided, the device comprising:

[0013] An acquisition module, used to acquire operation data of a first type of application in an electronic device;

[0014] A forwarding module is used to forward the operation data to a device server through a second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

[0015] According to a fourth aspect of an embodiment of the present disclosure, a data detection device is provided, the device comprising:

[0016] A response module, configured to obtain operation data transmitted by a second type of application in the electronic device; the operation data is data generated when the first type of application in the electronic device performs a target operation;

[0017] A risk determination module is used to determine the reliability of the first type of application running on the electronic device based on the operation data.

[0018] According to a fifth aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0019] processor;

[0020] a memory for storing processor-executable instructions;

[0021] The processor is configured to implement the steps of any method described in the first aspect or the second aspect by running the executable instructions.

[0022] According to a sixth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in any one of the first aspect or the second aspect are implemented.

[0023] According to a seventh aspect of an embodiment of the present disclosure, a computer program is provided, which, when executed by a processor, implements the steps of the method described in any one of the first aspect or the second aspect.

[0024] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0025] In electronic devices, the operating system is like a basic platform, which is pre-installed and configured with a device server by the manufacturer. This device server is used to provide important services for electronic devices, such as operating system upgrades, account management, and security vulnerability repairs. There are usually two different types of applications installed in electronic devices: one is system applications, which are built-in applications by device manufacturers when they leave the factory, and they have the ability to communicate directly with the device server; the other is third-party applications, which are downloaded and installed by users from app stores or other channels, and they mainly communicate with their respective third-party servers rather than device servers.

[0026] Therefore, if an application (such as a second type of application) can establish communication with the device server, we can infer that it is a system application pre-installed at the factory; on the contrary, if an application cannot establish communication with the device server, it indicates that it is a third-party application installed by the user.

[0027] At this time, after obtaining the operation data of the first type application in the electronic device, the operation data can be forwarded to the device server through the second type application in the electronic device, so that the device server can determine whether the first type application can run reliably in the electronic device based on the operation data.

[0028] Through the above method, the device server can quickly discover suspicious behavior of the first type of application, which helps to solve the problem of illegal personnel exploiting system loopholes and the interaction between third-party applications and system applications to continuously perform illegal operations.

[0029] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] Figure 1 is a flow chart of a data detection method according to an exemplary embodiment of the present disclosure;

[0032] Figure 2 is an application framework diagram of a data detection method according to an exemplary embodiment of the present disclosure;

[0033] Figure 3 is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure;

[0034] Figure 4is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure;

[0035] Figure 5a is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure;

[0036] Figure 5b is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure;

[0037] Figure 6 is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure;

[0038] Figure 7 is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure;

[0039] Figure 8 is an application framework diagram of a data detection method according to an exemplary embodiment of the present disclosure;

[0040] Fig. 9 is a structural schematic diagram of a data detection device according to an exemplary embodiment of the present disclosure;

[0041] Fig.10 is a structural schematic diagram of a data detection device according to an exemplary embodiment of the present disclosure;

[0042] Fig.11 It is a schematic structural diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0044] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0045] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0046] Figure 1 is a flow chart of a data detection method according to an exemplary embodiment of the present disclosure. Figure 1 As shown, the method is applied to an electronic device (or an operating system of an electronic device), and comprises the following steps:

[0047] Step 101: Acquire operation data of a first type of application in an electronic device.

[0048] The first type of application usually refers to a third-party application installed in an electronic device (running in the operating system of the electronic device). The operation data of the first type of application is the data generated when the first type of application is running, which can be partial data or all data, and is mainly reflected in the data generated when the first type of application calls the system service of the electronic device, so as to timely discover the behavior of the first type of application attacking system vulnerabilities by calling the system service based on these operation data.

[0049] Exemplarily, obtaining the operation data of the first type of application includes, but is not limited to, at least one of the following:

[0050] Obtain interface call information of the first type of application, obtain system permission information of the first type of application, obtain running information of the first type of application, user interaction information, etc.

[0051] It can be reflected as: information about the interface to be called, frequency of calls, information about added desktop widgets (size, adding method), information about running floating windows, information about pulling up payment applications, length of time the power management wake-up lock (WakeLock lock) is held, length of time and mode of background operation, information about running in the system bar, information about pop-up pages, etc.

[0052] Step 102: forwarding the operation data to a device server via a second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

[0053] Among them, since the first type application and the second type application are actually installed in the same electronic device, after obtaining the operation data of the first type application, the operating system in the electronic device can directly forward the operation data of the first type application to the device server through the second type application.

[0054] The first type of application is not connected to the device server, which means that no matter what device the first type of application is installed on, the first type of application and the device server do not have direct communication capabilities (do not have the ability to directly exchange data), or the two have direct communication capabilities, but because the device server and the first type of application are produced by different manufacturers, the device server does not allow the first type of application to communicate directly with the device server in order to ensure its own security. At this time, the data of the first type of application must be transmitted via the second type of application that can directly exchange data with the device server.

[0055] Exemplarily, the operating system may read the operation data from the storage location of the first type of application and store the operation data in the storage location of the second type of application (the location to be uploaded to the device server).

[0056] In this way, after obtaining the operation data of the first type of application, the device server can identify whether the first type of application performs illegal operations. Illegal operations may include, for example, writing illegal files, pop-up advertisements, stealing data, and the like.

[0057] Figure 2 is an application framework diagram of a data detection method according to an exemplary embodiment of the present disclosure, such as Figure 2 As shown, the operating system provides core services (including core service components and / or core service interfaces). Core services are used to provide the most basic and critical functional support for the operating system, such as process management, file system management, self-processing, data storage, security authentication, account management, location services, etc. When the core services include interfaces to be called, the first type of application can call the second type of application by calling these interfaces, thereby illegally operating the second type of application or performing illegal operations after obtaining higher system permissions through the second type of application.

[0058] Therefore, after determining that its own interface or component is called by the first type application, the core service will transmit the corresponding operation data to the second type application and then to the device server.

[0059] On this basis, Figure 3 is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure, such as Figure 3 As shown:

[0060] The core services include: a first core service 301 and a second core service 302 .

[0061] Among them, multiple service components are shown in the first core service 301, namely: UriGrantsManagerService (Uniform Resource Identifier GrantsManager Service), WindowManagerService (Window Management Service), AppOpsService (Application Behavior Service, Application Operations Service), AppWidgetServiceImpl (Application Widget Service Implementation), BroadcastQueue (Broadcast Queue Management Service), ContentProviderHelper (Content Provider Management Service), ActivityStarter (Activity Startup Service), and ActiveServices (Service Management Service).

[0062] Among them, UriGrantsManagerService is responsible for managing the application's access rights to specific URI (UniformResource Identifier) ​​resources (such as data in Content Provider). It handles requests, grants, and revocations of access permissions to specific content or files to ensure system security and privacy protection. WindowManagerService is used to manage and control the layout, display, hiding, and interaction between all application windows. It is responsible for coordinating the arrangement, resizing, animation effects, etc. of each application window on the screen, and cooperates with SurfaceFlinger (surface synthesis service) to complete window synthesis display. AppOpsService is a component in the operating system that monitors and controls the access rights of each application to system functions and user data. Through AppOpsService, users or system administrators can manage the behavior of applications in a fine-grained manner, such as whether to allow an application to obtain location information, read contact lists, etc. AppWidgetServiceImpl is a service used to support and manage the life cycle of desktop widgets. It is responsible for creating, updating, and deleting desktop widgets provided by applications, as well as handling interaction events between users and widgets. BroadcastQueue is part of the message passing mechanism, mainly used to manage broadcast messages sent within the system and between applications. It puts the received broadcast events into the queue in order according to the priority, and then distributes them to the components registered with the corresponding receivers for processing, ensuring the safe and reliable delivery of broadcast messages. ContentProviderHelper refers to the relevant tool class or service module that assists developers or systems in calling Content Provider (content provider), which is used to simplify the access and management of shared data between systems or applications. ActivityStarter usually refers to the component that starts the logic related to a new Activity (a component). It is responsible for handling the parsing of Intent, finding the target Activity, and executing the corresponding startup process to ensure the correctness and security when switching from one Activity to another. ActiveServices is an important component in the operating system responsible for managing running background services (Background Services) and foreground services (Foreground Services). It assumes the life cycle management responsibilities such as starting, binding, and stopping services, as well as optimizing service scheduling according to system resource conditions to ensure efficient operation of services and effective use of system resources.

[0063] These service components will provide corresponding interfaces for the first type of application to call. At this time, the second core service 302 will monitor the components in the first core service 301. When these components are called by the first type of application, the operation data generated by the first type of application calling these components will be stored and transmitted to the second type of application.

[0064] As an example, the first core service 301 may be: a basic core service set (CoreServices), which includes all key basic services provided by the operating system, such as window management, resource management, permission control, etc. The second core service 302 may be: a core service extension (i.e., Core HyperOS Services) specific to a specific operating system (e.g., HyperOS operating system), which is a series of core services enhanced or customized for the HyperOS operating system based on the basic core services. In this case, the two may exist in the same system process or in different processes, and together constitute the core functional module of the entire operating system.

[0065] Optionally, when executing step 102 to forward the operation data to a device server through a second type application in the electronic device, the method includes:

[0066] The acquired operation data is classified and stored; the classified and stored operation data is transmitted to the second type application; and the second type application is controlled to transmit the classified and stored operation data to the device server.

[0067] The classification method may be: classification according to different called interfaces or components; classification according to different data storage forms; classification according to different first type applications, etc.

[0068] In an illustrative manner, the acquired operation data is classified and stored, including:

[0069] According to the type of the operation data, a specific identifier is marked for the operation data; according to the mapping relationship between the operation data and the identifier, the number of operations and the operation duration of each group of operation data are stored respectively.

[0070] The identification can match the classification, for example, the identification of the operation data generated by application A is: 1; the identification of the operation data generated by application A is: 2. Or, the identification of the operation data of the type of calling the floating window is: x1 (only for illustration); the identification of the operation data of the type of obtaining user information is: y1.

[0071] After the identification is determined, the operation data can also be stored separately according to the number of operations and the operation duration. In this way, it is convenient for the staff or the preset model to call the operation data of the corresponding storage location according to different identifications to determine whether the first type of application has risks, without having to search the entire database for the required data.

[0072] Afterwards, the classified and stored operation data is transmitted to the second type application, and then the operation data is transmitted to the device server through the second type application.

[0073] For example, Figure 4 is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure, such as Figure 4 As shown:

[0074] The second core service 302 includes the following four services:

[0075] 3021: AppDurationManager (Application Duration Manager), which is mainly used to monitor or manage the life cycle of an application or the execution time of a specific task. For example, it may be used to track service response time, record session activity duration, perform scheduled tasks, or optimize resource usage efficiency.

[0076] 3022: AppBehaviorService (application behavior service), mainly used to monitor and manage the behavior characteristics of applications, such as user behavior analysis, abnormal behavior detection, performance monitoring, business logic compliance checking, etc. This service can collect, analyze and process the behavior data of the application during operation to improve the user experience, optimize performance or implement more sophisticated control strategies.

[0077] 3023: DefenseChecker (defense module), used to store the operation data monitored by AppDurationManager3021 and AppBehaviorService3022, and transmit it to SecurityManagerService3024.

[0078] 3024: SecurityManagerService, a core service used to centrally manage the security policies and operations of the system. It usually implements authentication, authorization, and auditing functions to ensure that the user or service caller's access to resources complies with the preset security rules. In this solution, it is mainly used to transfer the operation data stored in DefenseChecker3023 to the second type of application.

[0079] Optional, Figure 5a is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure, wherein the classified stored operation data is transmitted to the second type application, comprising the following steps:

[0080] Step 501: for each set of operation data, determine the risk level of the operation data.

[0081] The risk level can be pre-set for different applications, or determined based on the detection results of a risk detection application or risk detection module in the electronic device, or determined based on the installation source of different applications, or based on whether the operation is a sensitive operation (such as obtaining user privacy data).

[0082] Step 502 : determining a target second type application from which the operation data is to be acquired from a plurality of second type applications; the higher the risk level of the operation data, the lower the system authority of the target second type application.

[0083] For example, it is assumed that there are two second-type applications, namely application 1 and application 2. The system permission of application 1 is higher than the system permission of application 2.

[0084] It is assumed that the risk levels of the operation data include: risk level 1 and risk level 2, and the risk level of risk level 1 is lower than that of risk level 2. The higher the risk level, the more dangerous the operation of the first type of application is.

[0085] When the risk level of the operation data of the first type of application is risk level one, it means that the operation is relatively safe, and application one is determined as the target second type of application; when the risk level of the operation data of the first type of application is risk level two, it means that the operation is relatively dangerous, and application two is determined as the target second type of application.

[0086] Step 503: Transmit the operation data to the target second type application.

[0087] In this way, operation data with a lower risk level can be transmitted to application one, and uploaded to the device server through application one; operation data with a higher risk level (more likely to carry viruses) can be transmitted to application two, and application two can transmit it to the device server. Even if there are viruses in the operation data, they will not attack application one and cause the virus to use the higher system permissions of application one to perform more serious illegal operations.

[0088] Figure 6 is an application framework diagram of another data detection method according to an exemplary embodiment of the present disclosure, such as Figure 6 As shown, the second type of application 601 includes:

[0089] 6011: SecurityCenter (security center module); 6012: AuthManager (authority management module), both of which are system applications and can communicate with the device server.

[0090] The security center module SecurityCenter6011 is used to obtain operation data through the (SecurityManagerService3024) interface according to a specific period, or actively transmit the security center module SecurityCenter6011 when the number in DefenseChecker3023 reaches the specified number (it can be transmitted through SecurityManagerService3024 or by itself, the figure is only schematic).

[0091] The permission management module AuthManager6012 is responsible for recording all permission behavior calls in the device, such as application software reading contacts, reading call records, reading text messages, recording, positioning, using the camera and other sensitive data transmission behaviors. It has higher system permissions.

[0092] Optional, Figure 5b is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure, such as Figure 5b As shown, the transferring of the classified stored operation data to the second type application further includes the following steps:

[0093] Step 504: in response to detecting that the target second type application has a risk, transmitting the operation data and the risk information of the target second type application to other second type applications; the multiple second type applications include the target second type application and the other second type applications.

[0094] Using the above example: when the risk level of the operation data of the first type of application is risk level 2, it means that this operation is relatively dangerous. After application 2 is determined as the target second type application, the operation data with a higher risk level is transferred to application 2. The virus performs some illegal operations through application 2. At this time, due to the risk of application 2 (for example, it cannot run, cannot communicate with the device server, etc.), the data cannot be transmitted to the device server through application 2. The risk information and operation data of application 2 can be transmitted to application 1, and then transmitted to the device server through application 1.

[0095] It should be noted that when transmitting the operation data, since it is known that it has risks, certain security measures can be taken to prevent the operation data from attacking the application before transmitting the operation data to the device server.

[0096] Optional, Figure 7 is a flow chart of another data detection method according to an exemplary embodiment of the present disclosure, such as Figure 7 As shown, the method is applied to a device server and comprises the following steps:

[0097] Step 701, obtaining operation data transmitted by a second type application in an electronic device; the operation data is data generated when a first type application in the electronic device performs a target operation.

[0098] Step 702: Determine the reliability of the first type of application running on the electronic device based on the operation data.

[0099] The contents involved in the above steps 701 and 702 have been described in the above embodiments and will not be repeated here.

[0100] Optionally, performing step 702 to determine the reliability of the first type of application running on the electronic device based on the operation data includes three methods:

[0101] Method 1:

[0102] Execution: determining a risk value of the operation data based on a preset model, where the risk value is used to indicate whether the first type of application has a risk.

[0103] Figure 8 is an application framework diagram of a data detection method according to an exemplary embodiment of the present disclosure, such as Figure 8 As shown:

[0104] After acquiring the operation data of the first type application forwarded by the second type application, the device server determines the risk value of the operation data through a preset model.

[0105] The preset model may be a pre-trained risk control model that can determine whether there is a risk based on the operation data, or the preset model may determine the risk value in the following manner:

[0106] The device server performs risk analysis on the operation of the first type of application based on the information of the first type of application disclosed in the application store. The analysis process is exemplified as follows:

[0107] The application call operation is scored from 1 to 10 based on the degree of danger, from low to high. The specific scores are shown in Table 1:

[0108] Table 1:

[0109]

[0110]

[0111] Under normal circumstances, when a first-type application enters the background running state, the operating system will end the background running of the first-type application after a certain period of time, and will restart it when the user opens it again. Therefore, if a first-type application survives in the background for too long, it means that it evades the operating system's operation of shutting down the background running, which can be regarded as a risky operation. At this time, 10 points will be recorded for each single background running of 1 hour in each cycle (for example, every day).

[0112] The first type of application obtains the Uri authorization of the system application (the second type of application). It can be simply understood as follows: when an application in your phone (such as the system photo album) wants to share a picture or file with another non-system third-party application (such as social software), it will not directly give the third-party application the file itself, but a special link (this link is called Uri). Due to user privacy and system security, not all applications can access these resources at will. Therefore, during the sharing process, the system photo album will first apply for authorization from the system to allow third-party applications to access specific pictures or files through this Uri. Only with this "Uri authorization" can third-party applications legally and safely obtain and use the resources selected by users in system applications. It can be seen that Uri authorization will have relatively high permissions, and the first type of application can easily use these permissions to implement illegal operations (such as stealing user images). Therefore, 8 points will be recorded for each Uri permission obtained.

[0113] Similarly, each time the first type of application controls the background to pop up an interface, 5 points will be recorded; each time a payment application is opened, 3 points will be recorded; each time a desktop widget information is added, 3 points will be recorded; each time the WakeLock lock is held for 1 hour, 5 points will be recorded; if the size of the floating window exceeds a certain screen ratio (for example, three quarters, there is suspicion of full-screen advertising at this time), 10 points will be recorded; if the size of the floating window is smaller than a certain size (for example, 10 pixels * 10 pixels, which is relatively small and considered to be of little harm), 5 points will be recorded; interacting with three of the four major components (obtaining the non-standard API interfaces of the three major services of Activity, Service, and Provider) will be recorded 2 points each time, and interacting with a component (non-standard API interface of Broadcast) will be recorded 1 point each time.

[0114] Each time you obtain accessibility service permissions, you will be awarded 10 points. Accessibility service permissions are intended to eliminate the digital divide and ensure that all users can enjoy the convenience of life brought by technology, including but not limited to: helping visually impaired users understand the content and operations on the screen through voice feedback, or operating electronic devices through voice; touch assistance: providing alternative input methods for users with limited finger movement, such as supporting gesture control, switch control, or custom button size, etc. Therefore, accessibility service permissions often require the device to automatically control electronic devices (such as voice control, eye control, etc.), which requires higher system permissions.

[0115] The daily foreground service time is recorded as 10 points per hour, among which, the foreground service time refers to the first type of application that is not displayed on the main interface, but runs, prompts, notifies, etc. in the status bar, system bar, etc.

[0116] Each time a contact is read, 1 point is recorded; each time a text message is read, 2 points are recorded; each time a call log is read, 1 point is recorded; each time a notification is displayed on the lock screen, 4 points are recorded; each time a user picture is deleted, 5 points are recorded.

[0117] It should be noted that the above method is mainly used to determine the risk of the first type of applications that do not need these permissions. For example, if the first type of application is a call application, then when reading information such as contacts and call records, points may be deducted or not deducted as appropriate.

[0118] Moreover, the above-mentioned scoring is mainly for the use of each first-type application on a single electronic device. In this way, when the first-type application has malicious behavior that does not meet its own demand scenario, it can be quickly identified.

[0119] Method 2: Execution: sending the information of the first type of application and the operation data to a background server, and the background server is used to determine whether the first type of application has risks.

[0120] By sending the information of the first type of application and the operation data to the background server, it is possible to directly determine whether the first type of application has risks through the staff of the background server.

[0121] For example, the third method may be:

[0122] First, execute the step of: determining the risk value of the operation data based on a preset model, and the risk value is used to indicate whether the first type of application is at risk; then execute the step of: sending the information of the first type of application and the operation data to a background server, and the background server is used to determine whether the first type of application is at risk.

[0123] At this time, the latter step can be further modified as follows: when it is determined based on the preset model that the risk value of the operation data reaches a preset value, the information of the first type of application and the operation data are sent to the background server; wherein the risk value reaches the preset value, including at least one of the following:

[0124] The risk value of the first type of application when running on a single electronic device is greater than or equal to a first value; the average value of the risk values ​​of the first type of application when running on multiple electronic devices is greater than or equal to a second value.

[0125] The first value and the second value may be the same or different.

[0126] Exemplarily, the second value may be set to be smaller than the first value. For example, the first value is 20 points and the second value is 10 points.

[0127] In this way, when the risk value of the first type of application on a single electronic device reaches 20 (greater than or equal to 20), this first type of application will be considered to be risky; when the device server finds that the risk value of this first application on multiple electronic devices reaches 10, this first type of application is considered to be risky.

[0128] At this time, in order to more accurately determine whether the first type of application has risks, or to determine how high the risk level is, it can be sent to the background server for verification by the background server staff, so as to obtain more complete protection measures as soon as possible.

[0129] For the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present disclosure is not limited by the described order of actions, because according to the present disclosure, certain steps can be performed in other orders or simultaneously.

[0130] Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0131] Corresponding to the aforementioned application function implementation method embodiment, the present disclosure also provides embodiments of a data transmission and data detection device and a corresponding terminal.

[0132] Fig. 9 is a structural diagram of a data detection device according to an exemplary embodiment of the present disclosure. Fig. 9 As shown, the device comprises:

[0133] The acquisition module 901 is used to acquire operation data of a first type of application in the electronic device.

[0134] The forwarding module 902 is used to forward the operation data to the device server through the second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

[0135] Optionally, when the forwarding module 902 is used to forward the operation data to the device server through the second type application in the electronic device, it is used to:

[0136] The acquired operation data is classified and stored.

[0137] The classified stored operation data is transmitted to the second type application.

[0138] The second type application is controlled to transmit the classified stored operation data to the device server.

[0139] Optionally, when the forwarding module 902 is used to classify and store the acquired operation data, it is used to:

[0140] According to the type of the operation data, a specific identifier is marked for the operation data.

[0141] According to the mapping relationship between the operation data and the identifier, the operation times and operation duration of each group of operation data are stored respectively.

[0142] Optionally, when the forwarding module 902 is used to transmit the classified stored operation data to the second type application, it is used to:

[0143] For each set of operation data, a risk level of the operation data is determined.

[0144] A target second type application for which the operation data is to be acquired is determined from a plurality of second type applications; the higher the risk level of the operation data, the lower the system authority of the target second type application.

[0145] The operation data is transmitted to the target second type application.

[0146] Optionally, when the forwarding module 902 is used to transmit the classified stored operation data to the second type application, it is further used to:

[0147] In response to detecting that the target second type application has a risk, the operation data and the risk information of the target second type application are transmitted to other second type applications; the multiple second type applications include the target second type application and the other second type applications.

[0148] Optionally, when the acquisition module 901 is used to acquire the operation data of the first type of application in the electronic device, it includes at least one of the following:

[0149] Obtain interface call information of the first type of application; obtain system permission information of the first type of application; obtain running information of the first type of application.

[0150] Fig.10 is a structural diagram of a data detection device according to an exemplary embodiment of the present disclosure. Fig.10 As shown, the device comprises:

[0151] The response module 1001 is used to obtain operation data transmitted by the second type application in the electronic device; the operation data is data generated when the first type application in the electronic device performs a target operation.

[0152] The risk determination module 1002 is used to determine the reliability of the first type of application running on the electronic device based on the operation data.

[0153] Optionally, when the risk determination module 1002 is used to determine the reliability of the first type of application running on the electronic device based on the operation data, it is used to:

[0154] A risk value of the operation data is determined based on a preset model, where the risk value is used to indicate whether the first type of application has a risk.

[0155] The information of the first type of application and the operation data are sent to a background server, and the background server is used to determine whether the first type of application has risks.

[0156] Optionally, when the risk determination module 1002 is used to send the information of the first type of application and the operation data to the background server, it is used to:

[0157] When it is determined based on the preset model that the risk value of the operation data reaches a preset value, the information of the first type of application and the operation data are sent to the background server.

[0158] The risk value reaches a preset value, including at least one of the following:

[0159] The risk value of the first type of application when running on a single electronic device is greater than or equal to the first value; the average value of the risk values ​​of the first type of application when running on multiple electronic devices is greater than or equal to the second value.

[0160] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art may understand and implement it without creative work.

[0161] Accordingly, an embodiment of the present disclosure provides a computer program, which implements the steps of any of the above methods when executed by a processor.

[0162] Accordingly, an embodiment of the present disclosure provides an electronic device, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the steps of any of the above methods by running the executable instructions.

[0163] Fig.11 1 is a schematic diagram of a structure of an electronic device according to an exemplary embodiment of the present disclosure. For example, the electronic device 1100 may be a user device, which may specifically be a mobile phone, a computer, a digital broadcast terminal, a message transceiver device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, a wearable device such as a smart watch, a smart glasses, a smart bracelet, a smart running shoe, etc.

[0164] Reference Fig.11 , the electronic device 1100 may include one or more of the following components: a processing component 1102 , a memory 1104 , a power component 1106 , a multimedia component 1108 , an audio component 1110 , an input / output (I / O) interface 1112 , a sensor component 1114 , and a communication component 1116 .

[0165] The processing component 1102 generally controls the overall operation of the electronic device 1100, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 1102 may include one or more processors 1120 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 1102 may include one or more modules to facilitate the interaction between the processing component 1102 and other components. For example, the processing component 1102 may include a multimedia module to facilitate the interaction between the multimedia component 1108 and the processing component 1102.

[0166] The memory 1104 is configured to store various types of data to support operations on the device 1100. Examples of such data include instructions for any application or method operating on the electronic device 1100, contact data, phone book data, messages, pictures, videos, etc. The memory 1104 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0167] The power supply component 1106 provides power to various components of the electronic device 1100. The power supply component 1106 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 1100.

[0168] The multimedia component 1108 includes a screen that provides an output interface between the electronic device 1100 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1108 includes a front camera and / or a rear camera. When the electronic device 1100 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0169] The audio component 1110 is configured to output and / or input audio signals. For example, the audio component 1110 includes a microphone (MIC), and when the electronic device 1100 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 1104 or sent via the communication component 1116. In some embodiments, the audio component 1110 also includes a speaker for outputting audio signals.

[0170] I / O interface 1112 provides an interface between processing component 1102 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0171] The sensor assembly 1114 includes one or more sensors for providing various aspects of status assessment for the electronic device 1100. For example, the sensor assembly 1114 can detect the open / closed state of the electronic device 1100, the relative positioning of the components, such as the display and keypad of the electronic device 1100, and the sensor assembly 1114 can also detect the position change of the electronic device 1100 or a component of the electronic device 1100, the presence or absence of user contact with the electronic device 1100, the orientation or acceleration / deceleration of the electronic device 1100, and the temperature change of the electronic device 1100. The sensor assembly 1114 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 1114 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1114 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0172] The communication component 1116 is configured to facilitate wired or wireless communication between the electronic device 1100 and other devices. The electronic device 1100 can access a wireless network based on a communication standard, such as WiFi, 4G or 5G, 4G LTE, 5G NR or a combination thereof. In an exemplary embodiment, the communication component 1116 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1116 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0173] In an exemplary embodiment, the electronic device 1100 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0174] In an exemplary embodiment, a non-temporary computer-readable storage medium is also provided, such as a memory 1104 including instructions, which, when executed by a processor 1120 of the electronic device 1100, enables the electronic device 1100 to perform the steps of any of the above methods.

[0175] The non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0176] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0177] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A data detection method, characterized in that: The method comprises: Acquire operation data of a first type of application in the electronic device; The operation data is forwarded to a device server via a second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

2. The method according to claim 1, characterized in that The forwarding of the operation data to the device server through the second type application in the electronic device includes: Classify and store the acquired operation data; transmitting the classified stored operation data to the second type of application; The second type application is controlled to transmit the classified stored operation data to the device server.

3. The method according to claim 2, characterized in that The classified storage of the acquired operation data includes: According to the type of the operation data, marking the operation data with a specific identifier; According to the mapping relationship between the operation data and the identifier, the operation times and operation duration of each group of operation data are stored respectively.

4. The method according to claim 2, characterized in that: The step of transmitting the classified and stored operation data to the second type of application comprises: For each set of operation data, determining a risk level of the operation data; determining a target second type application from among a plurality of second type applications for which the operation data is to be acquired; the higher the risk level of the operation data, the lower the system authority of the target second type application; The operation data is transmitted to the target second type application.

5. The method according to claim 4, characterized in that The step of transmitting the classified stored operation data to the second type application further includes: In response to detecting that the target second type application has a risk, the operation data and the risk information of the target second type application are transmitted to other second type applications; the multiple second type applications include the target second type application and the other second type applications.

6. The method according to claim 1, characterized in that The obtaining of the operation data of the first type of application includes at least one of the following: Obtaining interface call information of the first type of application; Obtaining system permission information of the first type of application; Obtaining the running information of the first type of application.

7. A data detection method, characterized in that: The method comprises: Acquire operation data transmitted by a second type application in the electronic device; the operation data is data generated when the first type application in the electronic device performs a target operation; Based on the operation data, reliability of the first type of application running on the electronic device is determined.

8. The method according to claim 7, characterized in that The determining, based on the operation data, the reliability of the first type of application running on the electronic device comprises at least one of the following: determining a risk value of the operation data based on a preset model, the risk value being used to indicate whether the first type of application has a risk; The information of the first type of application and the operation data are sent to a background server, and the background server is used to determine whether the first type of application has risks.

9. The method according to claim 8, characterized in that The sending the information of the first type of application and the operation data to the background server includes: When it is determined based on the preset model that the risk value of the operation data reaches a preset value, sending the information of the first type of application and the operation data to the background server; The risk value reaches a preset value, including at least one of the following: The risk value of the first type of application when running on a single electronic device is greater than or equal to the first value; An average value of the risk values ​​when the first type of application is run on multiple electronic devices is greater than or equal to the second value.

10. A data detection device, characterized in that: The device comprises: An acquisition module, used to acquire operation data of a first type of application in an electronic device; A forwarding module is used to forward the operation data to a device server through a second type application in the electronic device, so that the device server determines the reliability of the first type application based on the operation data; wherein the first type application is not connected to the device server.

11. A data detection device, characterized in that: The device comprises: A response module, configured to obtain operation data transmitted by a second type of application in the electronic device; the operation data is data generated when the first type of application in the electronic device performs a target operation; A risk determination module is used to determine the reliability of the first type of application running on the electronic device based on the operation data.

12. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the steps of any one of the methods of claims 1 to 9 by running the executable instructions.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of any method described in claims 1 to 9 are implemented.

Images