Detection method, detection device, terminal equipment and computer readable storage medium

Abstract

The invention discloses a detection method, a detection device, terminal equipment and a computer readable storage medium. The detection method comprises the steps that real-time data information is obtained, the real-time data information comprises state information of terminal equipment at the current moment, and the terminal equipment is used for running an application program; the real-time data information is processed to obtain a processing result, and the processing result comprises whether the application program has an abnormal condition or not and the abnormal type of the abnormal condition. According to the detection method, the processing result is obtained by processing the real-time data, a dynamic analysis method is adopted, the application program with the abnormal condition can be detected in real time, and the abnormal category of the abnormal condition can be obtained, so that a user can perform processing according to the processing result.

Description

Technical Field

[0001] The present application relates to the field of application detection technology, and more specifically, to a detection method, a detection apparatus, a terminal device, and a computer-readable storage medium. Background Art

[0002] In the related art, static analysis methods are often used to detect abnormal applications. The detection is performed based on the application code or related data without running the application, and it is not possible to perform real-time detection when the application is running. Summary of the invention

[0003] Embodiments of the present application provide a detection method, a detection apparatus, a terminal device, and a computer-readable storage medium.

[0004] An embodiment of the present application provides a detection method, which includes: acquiring real-time data information, wherein the real-time data information includes status information of a terminal device at a current moment, and the terminal device is used to run an application; processing the real-time data information to obtain a processing result, wherein the processing result includes whether an abnormal situation occurs in the application and the abnormal category of the abnormal situation that occurs.

[0005] An embodiment of the present application provides a detection device, which includes: a monitoring module and a detection module, the monitoring module is used to obtain real-time data information, the real-time data information includes the current state information of a terminal device, and the terminal device is used to run an application; the detection module is used to process the real-time data information to obtain a processing result, and the processing result includes whether an abnormal situation occurs in the application and the abnormal category of the abnormal situation that occurs.

[0006] An embodiment of the present application provides a terminal device, which includes a memory and a processor, wherein the processor is used to call and run a computer program stored in the memory, and when the processor executes the computer program, the detection method described in the above embodiment is implemented.

[0007] An embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and when the computer program is executed, the detection method described in the above embodiment is implemented.

[0008] In the detection method, detection apparatus, terminal device and computer-readable storage medium of the implementation mode of the present application, the processing result is obtained by processing real-time data, and a dynamic analysis method is adopted to detect the application program having abnormal situation in real time and obtain the abnormal category of the abnormal situation, so that the user can process it according to the processing result.

[0009] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0011] Figure 1 It is a schematic flow chart of the detection method of the embodiment of the present application;

[0012] Figure 2 is a schematic diagram of a detection device according to an embodiment of the present application;

[0013] Figure 3 It is a schematic flow chart of the detection method of the embodiment of the present application;

[0014] Figure 4 It is a schematic diagram of the process of the detection method according to the embodiment of the present application. DETAILED DESCRIPTION

[0015] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0016] In the related technology, the existing application detection technology mainly includes static analysis method and dynamic analysis method. The commonly used static analysis method detects abnormal applications, and performs detection based on the application code or related data without running the application, and cannot detect in real time when the application is running; the dynamic analysis method detects abnormal applications, which requires calling the behavior information of the application, and lacks protection for the privacy and security of users.

[0017] See also Figure 1 , the present application embodiment provides a detection method, the detection method comprising:

[0018] 01: Get real-time data information, which includes the current status information of the terminal device, which is used to run the application;

[0019] 02: Process the real-time data information to obtain the processing result, which includes whether the application has any abnormal situation and the abnormal category of the abnormal situation.

[0020] See also Figure 2Specifically, the detection method of the present application can be implemented by the detection device 100 of the present application. The detection device 100 of the embodiment of the present application includes: a monitoring module 10 and a detection module 20. Among them, step 01 can be implemented by the monitoring module 10, and step 02 can be implemented by the detection module 20, that is, the monitoring module 10 can be used to obtain real-time data information, and the real-time data information includes the current state information of the terminal device, and the terminal device is used to run the application; the detection module 20 can be used to process the real-time data information to obtain a processing result, and the processing result includes whether the application has an abnormal situation and the abnormal category of the abnormal situation.

[0021] In this way, by processing real-time data to obtain processing results, using dynamic analysis methods, it is possible to detect in real time the application program in which an abnormal situation occurs and obtain the abnormal category of the abnormal situation that occurs, so that the user can handle it according to the processing results.

[0022] In some embodiments, the status information includes performance indicators and resource usage of the terminal device, the performance indicators include the frame rate of the display screen of the terminal device and the component temperature of the terminal device, and the resource usage includes memory resource usage and CPU resource usage.

[0023] Specifically, the performance indicators and resource usage of the terminal device can be obtained through the status information, and the status of the terminal device at the current moment when the application is running can also be obtained through the status information.

[0024] In this way, the preset detection model can detect whether an abnormal situation occurs in the application and determine the abnormal category of the abnormal situation through the status information of the terminal device without the behavior information of the application.

[0025] In certain embodiments, the detection method further comprises:

[0026] 03: Collect data information in various scenarios, including normal operation of the application and abnormal conditions of the application. The data information includes the status information of the corresponding terminal device and the application information of the application in the scenario;

[0027] 04: Process data information to obtain a preset data set;

[0028] 05: Train the deep learning model based on the preset data set to obtain the preset detection model;

[0029] See also Figure 3 , step 02 includes:

[0030] 021: Use the preset detection model to process real-time data information to obtain processing results.

[0031] In some embodiments, the detection device 100 further includes: a collection module 30 , a processing module 40 and a training module 50 .

[0032] Specifically, step 03 can be implemented by the acquisition module 30 of the detection device 100, step 04 can be implemented by the processing module 40 of the detection device 100, step 05 can be implemented by the training module 50 of the detection device 100, and step 021 can be implemented by the detection module 20 of the detection device 100. That is to say, the acquisition module 30 can be used to collect data information in a variety of scenarios, including normal operation of the application and abnormal conditions of the application, and the data information includes the status information of the corresponding terminal device and the application information of the application in the scenario; the processing module 40 can be used to process the data information to obtain a preset data set; the training module 50 can be used to train the deep learning model according to the preset data set to obtain a preset detection model; the detection module 20 can be used to process the real-time data information using the preset detection model to obtain a processing result.

[0033] In addition, various scenarios include running different types of foreground applications, including game applications, shopping applications, social applications, and video applications; at the same time, running background applications with different resource usage conditions to collect data information in the corresponding scenarios. The data information includes the status information of the terminal device and the application information of the application. The application information can be read at the application layer of the Android system through AdbLib; the status information includes the performance indicators and resource usage of the terminal device. The performance indicators include the frame rate of the terminal device's display screen and the component temperature of the terminal device. The resource usage includes the memory resource usage and CPU resource usage in the corresponding scenario.

[0034] In this way, by collecting data information in a variety of scenarios, matching the data information with the scenarios, and training the deep learning model based on the data information to obtain a preset detection model, the preset detection model can obtain the corresponding scenario, that is, the processing result, by processing the real-time data information including the status information of the terminal device.

[0035] In some embodiments, the deep learning model training method selected in step 05 may be a machine learning method with a parameter amount that is less than a preset parameter amount.

[0036] In this way, the training process has lower computational requirements, and a preset detection model with a simpler structure is established, so that the preset detection model has lower computational overhead when used, and can be used to detect abnormal applications in scenarios where memory is limited and detection accuracy requirements are not high.

[0037] See also Figure 3 In some embodiments, step 04 includes:

[0038] 041: Preprocess data information, including data cleaning;

[0039] 042: Perform secondary processing on the preprocessed data information to obtain a preset data set, wherein the secondary processing includes dividing the preprocessed data information according to a time window and marking the preprocessed data information according to a scene.

[0040] Specifically, step 041 and step 042 can be implemented by the processing module 40 of the detection device 100, that is, the processing module 40 can be used to preprocess the data information, the preprocessing includes data cleaning, and secondary processing of the preprocessed data information to obtain a preset data set, the secondary processing includes dividing the preprocessed data information according to the time window, and marking the preprocessed data information according to the scene.

[0041] Data cleaning can find and correct errors in data information to improve the accuracy and reliability of data information. Preprocessing also includes data statistics and feature extraction. The preprocessed data information is divided according to the time window, and the preprocessed data information is marked according to the abnormal category of the abnormal situation, that is, the preprocessed data information is processed again to obtain a preset data set. Among them, the abnormal category includes the application memory resources occupied and / or the application CPU resources occupied.

[0042] In this way, preprocessing the data information can improve the accuracy and reliability of the data information, and the processed data information can be reprocessed to obtain a preset data set that can train a preset detection model.

[0043] See also Figure 4 In some embodiments, step 05 includes:

[0044] 051: On the server side, a deep learning model is trained according to a preset data set to obtain a preset detection model. The preset detection model after training can be deployed on the terminal device;

[0045] Step 021 includes:

[0046] 0211: Use the preset detection model deployed on the terminal device to process real-time data information to obtain processing results.

[0047] Specifically, step 051 can be implemented by the training module 50 of the detection device 100, and step 0211 can be implemented by the detection module 20 of the detection device 100. That is to say, the training module 50 can be used to train a deep learning model on the server side according to a preset data set to obtain a preset detection model, and the preset detection model after training can be deployed on the terminal device; the detection module 20 can be used to process real-time data information using the preset detection model deployed on the terminal device to obtain a processing result.

[0048] The process of training the preset detection model according to the preset data set is carried out on the server side. After the training is completed, the preset detection model is deployed to the terminal device, and the preset detection model is used on the terminal device to process the implementation data information to obtain the processing result, so that when the preset detection model is used to process the real-time data information, there is no need to upload the real-time data information to the server side, and the detection can be completed on the mobile terminal. Among them, step 0211 can be implemented by the detection module 20 of the detection device 100, that is, the detection module 20 can be used to process the real-time data information with the preset detection model deployed on the terminal device to obtain the processing result. In addition, the preset detection model can be formatted in the process of deploying the preset detection model on the terminal device.

[0049] In this way, by training the preset detection model on the server side and deploying the trained preset detection model to the terminal device, the preset detection model processes the real-time data information locally on the terminal device to protect the user's privacy and security.

[0050] In some embodiments, the preset detection model includes a first detection model and a second detection model, the first detection model is used to detect whether an abnormal situation occurs in the application, and the second detection model is used to determine the abnormal category of the abnormal situation that occurs.

[0051] Specifically, since the use of resources by applications fluctuates during operation, when the use of resources by applications changes, it is necessary to determine whether the change in resource use is caused by the operation of the application itself or the application is occupied by resources. The first detection model of the preset detection model is used to detect whether an abnormality occurs in the application and whether resources are occupied by the application, including memory resources and CPU resources. The second detection model is used to determine the abnormality category of the abnormality, that is, whether memory resources are occupied, CPU resources are occupied, or memory resources and CPU resources are occupied.

[0052] In this way, the first detection model and the second detection model can be used to detect whether resources are occupied by the application and further determine the category of the occupied resources.

[0053] In some embodiments, the application includes a foreground application, the first detection model is used to detect whether an abnormal situation occurs in the foreground application, and the second detection model is used to determine the abnormality category of the abnormal situation that occurs in the foreground application.

[0054] Specifically, the first detection model is used to detect whether the foreground application occupies memory resources and / or CPU resources. If the foreground application does not occupy memory resources and / or CPU resources, the first processing result obtained by the first detection model shows that no abnormality has occurred. If memory resources and / or CPU resources are occupied, the first processing result obtained by the first detection model is that an abnormality has occurred in the foreground application. The second detection model performs further processing to determine the specific resource category occupied by the foreground application. The second detection result obtained by the second detection model includes the resource category occupied by the foreground application, that is, memory resources are occupied, CPU resources are occupied, or memory resources and CPU resources are occupied.

[0055] In this way, the first detection model is used to detect whether there is any abnormality in the foreground application, and the second detection model is used to determine the list of background applications that cause the abnormality in the foreground application and the resource categories occupied, so as to provide the processing results to the user so that the user can process according to the processing results.

[0056] In some implementations, the processing result includes whether an abnormal situation occurs in the foreground application and the abnormality category of the abnormal situation that occurs in the foreground application.

[0057] Specifically, the preset detection model obtains whether the foreground application has occupied resources according to the first processing result of the first detection model, and obtains the abnormal category of the abnormal situation of the foreground application according to the second processing result of the second detection model, that is, the category of resources occupied by the foreground application, such as occupied memory resources or occupied CPU resources. In one embodiment, the processing result shows that the foreground application has occupied CPU resources.

[0058] In this way, the user can determine whether an abnormal situation occurs in the foreground application and the abnormality category of the abnormal situation through the processing result.

[0059] In some implementations, the application further includes a background application, and the detection method further includes:

[0060] 06: Output the detection results, which include the processing results and the list of background applications that caused the foreground application to have abnormal conditions.

[0061] In some embodiments, the detection model further includes an output module 60, which can be used to output detection results, including processing results and a list of background applications that cause abnormal conditions in the foreground application.

[0062] Specifically, step 06 can be implemented by the output module 60 of the detection device 100, that is, the output module 60 can be used to output the detection result, which includes the processing result and the list of background applications that caused the abnormal situation of the foreground application. The list of background applications is arranged in descending order according to the situation of the background application resources, that is, the background application that occupies more resources is before the background application that occupies less resources, so that the user can process according to the descending list of the background application resources occupied.

[0063] In this way, by outputting the processing results and the list of background applications that caused the foreground application to have abnormal conditions, the user can handle the problem according to the actual situation, thus avoiding the user from repeatedly closing and restarting the background applications.

[0064] In some embodiments, abnormal situations include situations where memory resources are occupied and / or CPU resources are occupied, and processing results include a first result, a second result, a third result, and a fourth result. The first result is used to indicate that there is no abnormal situation in the application; the second result is used to indicate that the application occupies CPU resources; the third result is used to indicate that the application occupies memory resources; and the fourth result is used to indicate that the application occupies CPU resources and memory resources.

[0065] Specifically, the preset detection model detects whether the application is occupied by resources based on the current state information of the terminal device. If the application is occupied by resources, the preset detection model continues to determine the type of resources occupied by the application, such as occupied memory resources and / or occupied CPU resources, to obtain a processing result. The processing result includes a first result, a second result, a third result, and a fourth result. The first result indicates that there is no abnormality in the application, that is, the application is not occupied by resources; the second result indicates that the application is occupied by CPU resources, and the memory resources are used normally; the third result indicates that the application is occupied by memory resources, and the CPU resources are used normally; the fourth result indicates that both the application's memory resources and CPU resources are occupied.

[0066] In this way, the user can determine whether the application has an abnormal situation and the type of abnormal situation through the processing results, and handle it according to the actual situation.

[0067] An embodiment of the present application provides a terminal device, which includes a memory and a processor. The processor is used to call and run a computer program stored in the memory. When the processor executes the computer program, the detection method of any of the above embodiments is implemented.

[0068] In this way, the terminal device obtains the processing result by processing the real-time data, and adopts the dynamic analysis method to detect the application program with abnormal situation in real time and obtain the abnormal category of the abnormal situation, so that the user can handle it according to the processing result.

[0069] An embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed, the detection method of any of the above embodiments is implemented.

[0070] In this way, the computer-readable storage medium obtains processing results by processing real-time data, and adopts a dynamic analysis method to detect applications with abnormal situations in real time and obtain the abnormal categories of the abnormal situations, so that users can process them according to the processing results.

[0071] In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, those skilled in the art may combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without contradiction.

[0072] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0073] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0074] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A detection method, characterized in that: The detection method comprises: Acquiring real-time data information, the real-time data information including current state information of a terminal device, the terminal device being used to run an application; The real-time data information is processed to obtain a processing result, wherein the processing result includes whether an abnormal situation occurs in the application and an abnormal category of the abnormal situation that occurs.

2. The detection method according to claim 1, characterized in that: The status information includes performance indicators and resource usage of the terminal device. The performance indicators include the frame rate of the display screen of the terminal device and the component temperature of the terminal device. The resource usage includes memory resource usage and CPU resource usage.

3. The detection method according to claim 1, characterized in that: The detection method further comprises: Collecting data information in multiple scenarios, the scenarios including normal operation of the application and the abnormal situation of the application, the data information including the status information of the terminal device and application information of the application corresponding to the scenario; Processing the data information to obtain a preset data set; Training a deep learning model according to the preset data set to obtain a preset detection model; The processing of the real-time data information to obtain a processing result includes: The preset detection model is used to process the real-time data information to obtain the processing result.

4. The detection method according to claim 3, characterized in that: The processing of the data information to obtain a preset data set includes: Preprocessing the data information, wherein the preprocessing includes data cleaning; The preprocessed data information is subjected to secondary processing to obtain the preset data set, wherein the secondary processing includes dividing the preprocessed data information according to time windows and marking the preprocessed data information according to the scenes.

5. The detection method according to claim 3, characterized in that: The step of training a deep learning model according to the preset data set to obtain a preset detection model includes: Training a deep learning model on the server side according to a preset data set to obtain the preset detection model, and the preset detection model after training can be deployed on the terminal device; The adopting the preset detection model to process the real-time data information to obtain the processing result includes: The preset detection model deployed on the terminal device is used to process the real-time data information to obtain the processing result.

6. The detection method according to claim 3, characterized in that: The preset detection model includes a first detection model and a second detection model, the first detection model is used to detect whether the abnormal situation occurs in the application, and the second detection model is used to determine the abnormal category of the abnormal situation that occurs.

7. The detection method according to claim 6, characterized in that: The application includes a foreground application, the first detection model is used to detect whether the foreground application has the abnormal situation, and the second detection model is used to determine the abnormal category of the abnormal situation that has occurred in the foreground application.

8. The detection method according to claim 7, characterized in that: The processing result includes whether the foreground application has the abnormal situation and the abnormal category of the abnormal situation that has occurred in the foreground application.

9. The detection method according to claim 8, characterized in that: The application further includes a background application, and the detection method further includes: Outputting a detection result, the detection result including the processing result and a list of the background applications that caused the foreground application to have the abnormal situation.

10. The detection method according to claim 1, characterized in that: The abnormal situation includes the situation of occupying memory resources and / or the situation of occupying CPU resources, and the processing result includes: a first result, wherein the first result is used to indicate that there is no abnormality in the application; A second result, wherein the second result is used to indicate that the application has the situation of occupying CPU resources; A third result, wherein the third result is used to indicate that the application has the situation of occupying memory resources; The fourth result is used to indicate that the application occupies CPU resources and memory resources.

11. A detection device, characterized in that: The detection device comprises: A monitoring module, the monitoring module is used to obtain real-time data information, the real-time data information includes the current state information of the terminal device, the terminal device is used to run the application; A detection module is used to process the real-time data information to obtain a processing result, wherein the processing result includes whether an abnormal situation occurs in the application and the abnormal category of the abnormal situation.

12. A terminal device, characterized in that: The terminal device includes a memory and a processor, the processor is used to call and run a computer program stored in the memory, and the processor implements the detection method described in any one of claims 1 to 10 when executing the computer program.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed, the detection method according to any one of claims 1 to 10 is implemented.

Images