Application detection method and device, readable medium and electronic equipment

Abstract

The embodiment of the invention relates to an application program detection method and device, a readable medium and electronic equipment. The method comprises the steps that a server obtains first signature information and first auxiliary verification information of an application program; and determining whether the application program is an abnormal application program or not according to the first signature information and the first auxiliary verification information. Wherein the application program is an application program deployed at the client. In this way, whether the application program is the abnormal application program or not can be determined based on the first signature information and the first auxiliary verification information, and therefore the accuracy of application program detection is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a method, device, readable medium and electronic device for detecting an application program. Background Art

[0002] With the continuous development of mobile Internet technology, more and more applications are being developed and released to the market, and the functions provided by applications to users are becoming more and more abundant. However, due to the open source characteristics of the operating system used by the application, the security issues of the application are becoming increasingly prominent. Among them, how to detect whether an application is an abnormal application has become an urgent problem to be solved. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] According to a first aspect of an embodiment of the present disclosure, a method for detecting an application program is provided, which is applied to a server, and the method includes:

[0005] Obtaining first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client;

[0006] Determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0007] According to a second aspect of an embodiment of the present disclosure, a method for detecting an application program is provided, which is applied to a client, and the method includes:

[0008] Obtaining first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client;

[0009] The first signature information and the first auxiliary verification information are sent to a server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0010] According to a third aspect of an embodiment of the present disclosure, there is provided a device for detecting an application program, which is applied to a server, and the device includes:

[0011] A first acquisition module is used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client;

[0012] The first detection module is used to determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0013] According to a fourth aspect of an embodiment of the present disclosure, there is provided a device for detecting an application program, which is applied to a client, and the device includes:

[0014] A second acquisition module is used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client;

[0015] The second sending module is used to send the first signature information and the first auxiliary verification information to the server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0016] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the computer program is executed by a processing device, the steps of the method described in the first aspect of the present disclosure are implemented.

[0017] According to a sixth aspect of an embodiment of the present disclosure, there is provided a computer-readable medium on which a computer program is stored, and when the computer program is executed by a processing device, the steps of the method described in the second aspect of the present disclosure are implemented.

[0018] According to a seventh aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0019] a storage device having a computer program stored thereon;

[0020] A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the first aspect of the present disclosure.

[0021] According to an eighth aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0022] a storage device having a computer program stored thereon;

[0023] A processing device is used to execute the computer program in the storage device to implement the steps of the method described in the second aspect of the present disclosure.

[0024] By adopting the above technical solution, the server obtains the first signature information and the first auxiliary verification information of the application; and determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information. The application is an application deployed on the client. In this way, it is possible to determine whether the application is an abnormal application based on the first signature information and the first auxiliary verification information, thereby improving the accuracy of application detection.

[0025] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0027] Figure 1 The present invention is a flowchart of a method for detecting an application program according to an embodiment of the present invention.

[0028] Figure 2 is based on Figure 1 The illustrated embodiment shows a flow chart of step S102.

[0029] Figure 3 The flowchart of another method for detecting an application program according to an embodiment of the present disclosure is shown.

[0030] Figure 4 It is a flowchart of another application detection method shown according to an embodiment of the present disclosure.

[0031] Figure 5 The flowchart of another method for detecting an application program according to an embodiment of the present disclosure is shown.

[0032] Figure 6 The flowchart of another method for detecting an application program according to an embodiment of the present disclosure is shown.

[0033] Figure 7 The flowchart of another method for detecting an application program according to an embodiment of the present disclosure is shown.

[0034] Figure 8 The invention is a block diagram of a detection device for an application program according to an embodiment of the present invention.

[0035] Fig. 9 It is a block diagram of another application detection device according to an embodiment of the present disclosure.

[0036] Fig.10 It is a block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0038] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0039] The term "including" and its variations used in the present disclosure are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0040] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0041] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise clearly indicated in the context, they should be understood as "one or more". In the description of the present disclosure, unless otherwise specified, "multiple" refers to two or more than two, and other quantifiers are similar; "at least one item", "one or more items" or similar expressions refer to any combination of these items, including any combination of single items or plural items. For example, at least one item a can represent any number of a; for another example, one or more items of a, b and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple; "and / or" is a kind of association relationship that describes the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character “ / ” indicates that the preceding and following objects are in an “or” relationship. The singular forms “a”, “an”, “an”, “said” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0042] Although operations or steps are described in a specific order in the drawings in the embodiments of the present disclosure, it should not be understood that it is required to perform these operations or steps in the specific order shown or in a serial order, or to perform all the operations or steps shown to obtain the desired results. In the embodiments of the present disclosure, these operations or steps can be performed in series; these operations or steps can also be performed in parallel; or some of these operations or steps can be performed.

[0043] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0044] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0045] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0046] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0047] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0048] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0049] The present disclosure is described below in conjunction with specific embodiments.

[0050] First, the application scenario of the present disclosure is described. The present disclosure can be applied to application detection scenarios. With the continuous development of mobile Internet technology, more and more applications are developed and released to the market, and the functions provided by applications to users are becoming more and more abundant. However, due to the open source characteristics of the operating system used by the application, the security issues of the application are becoming increasingly prominent. For example, some applications have been attacked, and their source code and other information will be tampered with, resulting in abnormal applications (also known as cracked programs), which will cause security risks to client devices using the application. Therefore, how to detect whether an application is an abnormal application has become a problem that needs to be solved urgently.

[0051] In order to solve the above problems, the present disclosure provides a method, device, readable medium and electronic device for detecting an application.

[0052] Figure 1 FIG. 1 is a flow chart of a method for detecting an application according to an embodiment of the present disclosure. The method can be applied to a server, such as a local server or a cloud server. Figure 1 As shown, the method may include:

[0053] S101. Obtain first signature information and first auxiliary verification information of an application.

[0054] The application may be an application deployed on a client. The client may be a terminal device, such as a smart phone, a smart wearable device, a smart speaker, a smart tablet, a PDA (Personal Digital Assistant), a CPE (Customer Premise Equipment), a personal computer, a vehicle-mounted terminal, etc. The connection between the client and the server may include a wired connection and / or a wireless connection.

[0055] It should be noted that the application may be an Android application package (Android Application Package, APK), that is, an application developed based on the Android operating system; the application may also be an application developed based on other operating systems.

[0056] In some embodiments, the server may receive the first signature information and the first auxiliary verification information sent by the client.

[0057] For example, the client may obtain the first signature information and the first auxiliary verification information of the application, and send the first signature information and the first auxiliary verification information to the server.

[0058] It should be noted that the client may report the first signature information and the first auxiliary verification information in one message, or may report the first signature information and the first auxiliary verification information in two messages respectively, and the present disclosure does not limit this.

[0059] In some embodiments, the first signature information may include an electronic signature of the application, for example, data in a file of the application used to identify the identity of the signatory and indicate that the signatory approves the content therein.

[0060] The first signature information may be a signature generated based on a preset signature mechanism, and the preset signature mechanism may include a V1 signature mechanism, a V2 signature mechanism, a V3 signature mechanism or other signature mechanisms based on the Android operating system.

[0061] In some embodiments, the first auxiliary verification information may be used to perform auxiliary verification on the application. For example, the first auxiliary verification information may be used to verify whether the operating environment of the application is abnormal. If the operating environment is abnormal, it may be determined that the application is abnormal.

[0062] In some embodiments, the first auxiliary verification information may include first permission information and / or first file information of the application.

[0063] Among them, the first permission information can be used to indicate whether the application has other permissions on the client besides the preset permissions. The preset permissions can be permissions pre-set by the application, such as storage permissions, photo taking permissions, call permissions, etc.

[0064] In one implementation, the client can obtain the first permission information according to the first permission function, and the first permission function can be an API function of the Android system, such as prctl

[0065] (PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0). If the value obtained by the first permission function is 1, it can be determined that the application has other permissions on the client side except the preset permissions; otherwise, if the value obtained by the first permission function is not 1 (for example, 0), it can be determined that the application does not have other permissions on the client side except the preset permissions.

[0066] In another implementation, the client can obtain the first permission information based on the first permission field in the first permission file. The first permission file can be a preset file, for example, it can be a "proc / self / status" file, and the first permission field can be the NoNewPrivs field in the "proc / self / status" file. For example, if the value of the first permission field is 1, it can be determined that the application has other permissions on the client besides the preset permissions; otherwise, if the value of the first permission field is not 1 (for example, it is 0), it can be determined that the application does not have other permissions on the client besides the preset permissions.

[0067] The first file information may be information about a program file of an application. For example, the first file information may include first file size information and / or first file path information, wherein the first file size information may be the size of the program file of the application stored on the client, and the first file path information may be the storage path of the program file of the application on the client.

[0068] In one implementation, the first file information may include first file size information. The client may obtain the file size of the program file of the application as the first file size information. For example, the " / proc / self / maps" file may be read to obtain the file size of the program file (APK file).

[0069] In one implementation, the first file information may include first file path information. The client may obtain the storage path of the program file of the application. For example, the file path of fd when opening the base.apk file in the " / proc / self / fd" directory may be read.

[0070] In another implementation, the first file information may include first file size information and first file path information.

[0071] S102: Determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0072] The abnormal application may be a tampered application, a cracked application, or an unofficial application.

[0073] Using the above method, the server obtains the first signature information and the first auxiliary verification information of the application; and determines whether the application is an abnormal application based on the first signature information and the first auxiliary verification information. The first auxiliary verification information includes the first permission information and / or the first file information of the application, and the application is an application deployed on the client. In this way, it is possible to determine whether the application is an abnormal application based on the first signature information and the first auxiliary verification information, thereby improving the accuracy of application detection.

[0074] In some embodiments of the present disclosure, when the server determines that the application is an abnormal application, the server may report the abnormal information to the operation and maintenance personnel of the application, or may stop providing services to the application.

[0075] In this way, abnormal application programs can be processed automatically.

[0076] Figure 2 is based on Figure 1 The embodiment shown is a flow chart of step S102. Figure 2 As shown, the step S102 may include the following sub-steps:

[0077] S1021. Perform signature verification on the application according to the first signature information to obtain a signature verification result.

[0078] For example, the server can perform signature verification on the first signature information according to the second signature information, and determine the signature verification result as verification failure when the signature verification fails. The second signature information is the signature information pre-set by the server for the application.

[0079] It should be noted that the specific method of signature verification can refer to the method in the relevant technology.

[0080] S1022. Perform auxiliary verification on the application program according to the first auxiliary verification information to obtain an auxiliary verification result.

[0081] For example, the server may determine that the auxiliary verification result is a verification failure when the first auxiliary verification information is different from the second auxiliary verification information; the second auxiliary verification information may be auxiliary verification information pre-set by the server for the application.

[0082] In some embodiments, the second auxiliary verification information may include second permission information and / or second file information pre-set by the server for the application. Similarly, the second file information may also include second file size information and / or second file path information. The second file size information may be the size of the program file of the application pre-set by the server, and the first file path information may be the default storage path of the program file of the application pre-set by the server.

[0083] The first auxiliary verification information and the second auxiliary verification information may differ from each other and may include at least one of the following:

[0084] The first authority information is different from the second authority information;

[0085] The first file size information is different from the second file size information;

[0086] The first file path information is different from the second file path information.

[0087] S1023. When the signature verification result is a verification failure or the auxiliary verification result is a verification failure, determine whether the application is an abnormal application.

[0088] In this way, it can be determined whether the application is an abnormal application based on the first signature information and the first auxiliary verification information.

[0089] Figure 3 FIG. 1 is a flow chart of another detection method for an application program according to an embodiment of the present disclosure. The method can also be applied to a server. Figure 3 As shown, the method may include:

[0090] S301: Receive statistical information sent by multiple clients.

[0091] In some embodiments, the statistical information may include version channel information and verification information corresponding to the application, the version channel information may include a version identifier and a release channel identifier, and the verification information may include file list information and / or file hash information of the application.

[0092] For example, the version identifier can be used to indicate a version of the application, such as version V3.1.0, and the release channel identifier can be used to indicate the release channel of the application, for example, the release channel identifier can be application market A or application market B. The file list information can be an APK file list, which is used to indicate all files and / or all directories of the application. The file hash information can be a hash value obtained by performing a hash operation on the APK file of the application.

[0093] S302: Determine whether there is an abnormal application program among the application programs of the multiple clients according to the statistical information reported by the multiple clients.

[0094] In some embodiments, the server may obtain a deduplication count value of verification information corresponding to each version of channel information based on statistical information statistics, and determine whether there is an abnormal application among the applications of multiple clients based on the deduplication count value.

[0095] In an implementation manner, when the deduplication count value of the version channel information is greater than a preset threshold, it can be determined that there is an abnormal application in the application of the version channel information.

[0096] The preset threshold may be any natural number, for example, 1 or 2.

[0097] In one implementation, the deduplication count value of the verification information corresponding to each version channel information is calculated by the following formula (1):

[0098] k = count(distinct(t))(v,c) (1);

[0099] Among them, k represents the deduplication count value, t represents verification information, which may include file list information and / or file hash information of the application, v represents the version identifier in the version channel, c represents the release channel identifier in the version channel, distinct represents removing duplicate values, and count represents count.

[0100] The above formula (1) can be used to query whether the value of k is greater than a preset threshold under the condition of a specific version of channel information (v+c). If it is greater, it is determined that there is an abnormal application in the application of the version of channel information.

[0101] In another implementation, the deduplication count values ​​of multiple version channel information can be sorted, and the top N version channel information with the largest deduplication count values ​​after sorting can be determined, and it can be determined that there are abnormal applications in the applications of the top N version channel information. Wherein, N can be any natural number. In this way, the version channels with the most abnormal applications can be detected first, so that these version channels can be processed.

[0102] By adopting the above method, it can be determined whether there are abnormal applications among the applications of multiple clients according to the statistical information reported by the multiple clients.

[0103] In some embodiments of the present disclosure, Figure 3 In the case where it is determined in the steps of the embodiment shown that there are abnormal applications in the applications of multiple clients, the abnormal application can be Figure 1The steps in the illustrated embodiment detect the application of each client to determine whether the application of the client is an abnormal application.

[0104] In other embodiments of the present disclosure, according to Figure 1 The steps in the embodiment shown detect the application of each client, and after determining whether the application of the client is an abnormal application, the abnormal application can be blocked, and then the abnormal application can be blocked according to the Figure 3 The steps in the illustrated embodiment determine whether there are abnormal applications among the applications of multiple clients or count the proportion of abnormal applications so as to analyze the effect of the blocking process.

[0105] Figure 4 FIG. 1 is a flow chart of another method for detecting an application according to an embodiment of the present disclosure. The method can also be applied to a server. Figure 4 As shown, the method may include:

[0106] S401: Obtaining behavior information of multiple users using an application program.

[0107] S402: Determine whether there is an abnormal application among the applications used by multiple users according to the behavior information.

[0108] The behavior information may include whether the user has watched an advertisement within a preset time period. The preset time period may be any preset time length, such as one day, two days, or one week. In one implementation, if the user has not watched an advertisement for a long time, it may be determined that there is an abnormal application among the applications used by the user.

[0109] The behavior information may also include whether the user uses a specified function of the application, and the specified function may be a function that a specified type of user can use, such as a member function that only paid member users can use, and ordinary non-member users cannot use the member function. In one implementation, if the user is a non-member user and the user uses the member function, it can be determined that there is an abnormal application in the application used by the user.

[0110] In some embodiments, the server may sense the above-mentioned behavior information, and count the number of specific users according to the behavior information as the sensed data, so as to determine whether there are abnormal applications among the applications used by multiple users.

[0111] In this way, the server can determine whether there is an abnormal application among the applications used by multiple users based on the behavior information of the multiple users using the applications.

[0112] In some embodiments of the present disclosure, Figure 4In the case where it is determined in the steps of the embodiment shown that there are abnormal applications in the applications of multiple clients, the abnormal application can be Figure 1 The steps in the illustrated embodiment detect the application of each client to determine whether the application of the client is an abnormal application.

[0113] In other embodiments of the present disclosure, according to Figure 1 The steps in the embodiment shown detect the application of each client, and after determining whether the application of the client is an abnormal application, the abnormal application can be blocked, and then the abnormal application can be blocked according to the Figure 4 The steps in the illustrated embodiment determine whether there are abnormal applications among the applications of multiple clients or count the proportion of abnormal applications so as to analyze the effect of the blocking process.

[0114] It should be noted that, in the absence of contradiction, this embodiment can be combined with the aforementioned embodiments or implementation methods of the present disclosure and their various optional schemes to further increase the accuracy of abnormal application detection.

[0115] Figure 5 1 is a flow chart of another detection method of an application according to an embodiment of the present disclosure. The method can be applied to a client. The client can be a terminal device, such as a smart phone, a smart wearable device, a smart speaker, a smart tablet, a PDA (Personal Digital Assistant), a CPE (Customer Premise Equipment), a personal computer, a vehicle-mounted terminal, etc. Figure 5 As shown, the method may include:

[0116] S501. Obtain first signature information and first auxiliary verification information of an application.

[0117] The application program may be deployed as an application program on the client. The connection between the client and the server may include a wired connection and / or a wireless connection.

[0118] It should be noted that the application may be an Android application package (Android Application Package, APK), that is, an application developed based on the Android operating system; the application may also be an application developed based on other operating systems.

[0119] In some embodiments, the client can read the program file of the application through the first function, and parse the program file through the local method to obtain the first signature information of the program file. The first function is not the operating system library function of the client.

[0120] By way of example, the first function may be a self-implemented file read and write function. For example, the self-implemented file read and write function does not call the operating system's library function (such as the function in libc.so), but directly uses the syscal method to read the application's program file (APK file), thereby avoiding the risk of being hijacked by hooks and improving security.

[0121] Furthermore, the client can also parse the program file through a native method, that is, a signature parsing method based on native implementation, bypassing the system API method to obtain the first signature information of the program file. The first signature information can be a signature generated based on a preset signature mechanism, and the preset signature mechanism can include a V1 signature mechanism, a V2 signature mechanism, a V3 signature mechanism, or other signature mechanisms based on the Android operating system.

[0122] In some embodiments, the first auxiliary verification information may be used to perform auxiliary verification on the application. For example, the first auxiliary verification information may be used to verify whether the operating environment of the application is abnormal. If the operating environment is abnormal, it may be determined that the application is abnormal.

[0123] In some embodiments, the first auxiliary verification information may include first permission information and / or first file information of the application.

[0124] Among them, the first permission information can be used to indicate whether the application has other permissions on the client besides the preset permissions. The preset permissions can be permissions pre-set by the application, such as storage permissions, photo taking permissions, call permissions, etc.

[0125] In one implementation, the client can obtain the first permission information according to the first permission function, and the first permission function can be an API function of the Android system, such as prctl

[0126] (PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0). If the value obtained by the first permission function is 1, it can be determined that the application has other permissions on the client side except the preset permissions; otherwise, if the value obtained by the first permission function is not 1 (for example, 0), it can be determined that the application does not have other permissions on the client side except the preset permissions.

[0127] In another implementation, the client can obtain the first permission information based on the first permission field in the first permission file. The first permission file can be a preset file, for example, it can be a "proc / self / status" file, and the first permission field can be the NoNewPrivs field in the "proc / self / status" file. For example, if the value of the first permission field is 1, it can be determined that the application has other permissions on the client besides the preset permissions; otherwise, if the value of the first permission field is not 1 (for example, it is 0), it can be determined that the application does not have other permissions on the client besides the preset permissions.

[0128] The first file information may be information about a program file of an application. For example, the first file information may include first file size information and / or first file path information, wherein the first file size information may be the size of the program file of the application stored on the client, and the first file path information may be the storage path of the program file of the application on the client.

[0129] In one implementation, the first file information may include first file size information. The client may obtain the file size of the program file of the application as the first file size information. For example, the " / proc / self / maps" file may be read to obtain the file size of the program file (APK file).

[0130] In one implementation, the first file information may include first file path information. The client may obtain the storage path of the program file of the application. For example, the file path of fd when opening the base.apk file in the " / proc / self / fd" directory may be read.

[0131] In another implementation, the first file information may include first file size information and first file path information.

[0132] S502: Send first signature information and first auxiliary verification information to a server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0133] The abnormal application may be a tampered application, a cracked application, or an unofficial application.

[0134] It should be noted that, in this embodiment, the specific implementation method in which the server determines whether the application is an abnormal application based on the first signature information and the first auxiliary verification information can also refer to the description in the previous embodiments of the present disclosure, and will not be repeated here.

[0135] By adopting the above method, the first signature information and the first auxiliary verification information of the application are obtained, and the first signature information and the first auxiliary verification information are sent to the server, so that the server can determine whether the application is an abnormal application based on the first signature information and the first auxiliary verification information, thereby improving the accuracy of application detection.

[0136] Figure 6 FIG. 1 is a flow chart of another method for detecting an application according to an embodiment of the present disclosure. The method can be applied to a client. Figure 6 As shown, the method may include:

[0137] S601. Obtain statistical information of an application.

[0138] In some embodiments, the statistical information may include version channel information and verification information corresponding to the application, the version channel information may include a version identifier and a release channel identifier, and the verification information may include file list information and / or file hash information of the application.

[0139] For example, the version identifier can be used to indicate a version of the application, such as version V3.1.0, and the release channel identifier can be used to indicate the release channel of the application, for example, the release channel identifier can be application market A or application market B. The file list information can be an APK file list, which is used to indicate all files and / or all directories of the application. The file hash information can be a hash value obtained by performing a hash operation on the APK file of the application.

[0140] S602: Send the statistical information to the server so that the server can determine whether there is an abnormal application program among the application programs of the multiple clients according to the statistical information reported by the multiple clients.

[0141] It should be noted that, unless there is any contradiction, this embodiment can be combined with the aforementioned embodiments or implementation methods of the present disclosure and their various optional schemes. The specific implementation methods of the above steps in this embodiment can also refer to the description in the aforementioned embodiments of the present disclosure, and will not be repeated here.

[0142] In this way, the client can report statistical information, so that the server can determine whether there is an abnormal application among the applications of the multiple clients according to the statistical information reported by the multiple clients.

[0143] Figure 7 The flowchart of another method for detecting an application program according to an embodiment of the present disclosure is shown. Figure 7 As shown, the method may include:

[0144] S701. The client sends first signature information and first auxiliary verification information of an application to a server.

[0145] S702: The server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0146] In some embodiments of the present disclosure, the client may also send statistical information to the server, and the server may determine whether there is an abnormal application among the applications of the multiple clients based on the statistical information reported by the multiple clients.

[0147] It should be noted that, in the absence of contradiction, this embodiment can be combined with the aforementioned embodiments or implementation methods of the present disclosure and their various optional schemes to further increase the accuracy of abnormal application detection.

[0148] In this way, the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information, thereby improving the accuracy of application detection.

[0149] Figure 8 FIG. 1 is a block diagram of a detection device 1100 for an application program according to an embodiment of the present disclosure, which is applied to a server. Figure 8 As shown, the device 1100 may include:

[0150] The first acquisition module 1101 is used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client, and the first auxiliary verification information includes first permission information and / or first file information of the application;

[0151] The first detection module 1102 is used to determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0152] According to one or more embodiments of the present disclosure, the first detection module 1102 is used to perform a signature verification on the application according to the first signature information to obtain a signature verification result; perform an auxiliary verification on the application according to the first auxiliary verification information to obtain an auxiliary verification result; and determine whether the application is the abnormal application when the signature verification result is a verification failure or the auxiliary verification result is a verification failure.

[0153] According to one or more embodiments of the present disclosure, the first detection module 1102 is used to perform signature verification on the first signature information according to second signature information, where the second signature information is signature information pre-set by the server for the application;

[0154] In the event that the signature verification fails, the signature verification result is determined to be a verification failure.

[0155] According to one or more embodiments of the present disclosure, the first detection module 1102 is used to determine that the auxiliary verification result is a verification failure when the first auxiliary verification information is different from the second auxiliary verification information; the second auxiliary verification information is the auxiliary verification information pre-set by the server for the application.

[0156] According to one or more embodiments of the present disclosure, the first acquisition module 1101 is used to receive the first signature information and the first auxiliary verification information sent by the client.

[0157] According to one or more embodiments of the present disclosure, the first acquisition module 1101 is further used to receive statistical information sent by multiple clients; and determine whether there is an abnormal application among the applications of the multiple clients based on the statistical information reported by the multiple clients.

[0158] According to one or more embodiments of the present disclosure, the statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application;

[0159] Determining whether there is an abnormal application among the applications of the multiple clients according to the statistical information reported by the multiple clients includes:

[0160] Obtaining a deduplication count value of the verification information corresponding to each version channel information according to the statistical information;

[0161] When the deduplication count value of the version channel information is greater than a preset threshold, it is determined that the abnormal application exists in the application programs of the version channel information.

[0162] According to one or more embodiments of the present disclosure, the first acquisition module 1101 is used to obtain behavior information of multiple users using the application; and determine whether there is an abnormal application among the applications used by the multiple users based on the behavior information.

[0163] Fig. 9 FIG. 1 is a block diagram of another application detection device 1200 according to an embodiment of the present disclosure, which is applied to a client. Fig. 9 As shown, the apparatus 1200 may include:

[0164] The second acquisition module 1201 is used to acquire first signature information and first auxiliary verification information of the application; wherein the first auxiliary verification information includes first permission information and / or first file information of the application, and the application is an application deployed on the client;

[0165] The second sending module 1202 is used to send the first signature information and the first auxiliary verification information to the server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0166] According to one or more embodiments of the present disclosure, the second acquisition module 1201 is used to read the program file of the application through a first function; the first function is not an operating system library function of the client; the program file is parsed through a local method to obtain the first signature information of the program file.

[0167] According to one or more embodiments of the present disclosure, the second acquisition module 1201 is further used to acquire statistical information of the application;

[0168] The second sending module 1202 is further configured to send the statistical information to the server, so that the server determines whether there is an abnormal application among the applications of the multiple clients according to the statistical information reported by the multiple clients.

[0169] According to one or more embodiments of the present disclosure, the statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application.

[0170] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0171] Reference below Fig.10 , which shows a schematic diagram of the structure of an electronic device 2000 (e.g., a client or a server) suitable for implementing the embodiment of the present disclosure. The client in the embodiment of the present disclosure may be a terminal device, which may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. The server in the embodiment of the present disclosure may include but is not limited to local servers, cloud servers, single servers, distributed servers, etc. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0172] like Fig.10As shown, the electronic device 2000 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 2001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 2002 or a program loaded from a storage device 2008 into a random access memory (RAM) 2003. In the RAM 2003, various programs and data required for the operation of the electronic device 2000 are also stored. The processing device 2001, the ROM 2002, and the RAM 2003 are connected to each other via a bus 2004. An input / output (I / O) interface 2005 is also connected to the bus 2004.

[0173] Typically, the following devices may be connected to the input / output interface 2005: an input device 2006 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 2007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 2008 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 2009. The communication device 2009 may allow the electronic device 2000 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 The electronic device 2000 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0174] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 2009, or installed from the storage device 2008, or installed from the ROM 2002. When the computer program is executed by the processing device 2001, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0175] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable storage media may include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0176] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0177] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0178] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the first signature information and first auxiliary verification information of the application; wherein, the application is an application deployed on the client, and the first auxiliary verification information includes the first permission information and / or first file information of the application; determines whether the application is an abnormal application based on the first signature information and the first auxiliary verification information.

[0179] Alternatively, the computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: obtains first signature information and first auxiliary verification information of an application; wherein the first auxiliary verification information includes first permission information and / or first file information of the application, and the application is an application deployed on the client; sends the first signature information and the first auxiliary verification information to a server, so that the server determines whether the application is an abnormal application based on the first signature information and the first auxiliary verification information.

[0180] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0181] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0182] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the first acquisition module may also be described as a "module for acquiring the first signature information and the first auxiliary verification information of the application."

[0183] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0184] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0185] According to one or more embodiments of the present disclosure, a method for detecting an application program is provided, which is applied to a server, and the method includes:

[0186] Obtaining first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client, and the first auxiliary verification information includes first permission information and / or first file information of the application;

[0187] Determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0188] According to one or more embodiments of the present disclosure, determining whether the application is an abnormal application according to the first signature information and the first auxiliary verification information includes:

[0189] Performing signature verification on the application according to the first signature information to obtain a signature verification result;

[0190] Performing auxiliary verification on the application according to the first auxiliary verification information to obtain an auxiliary verification result;

[0191] When the signature verification result is a verification failure or the auxiliary verification result is a verification failure, it is determined whether the application is the abnormal application.

[0192] According to one or more embodiments of the present disclosure, performing signature verification on the application according to the first signature information to obtain a signature verification result includes:

[0193] Performing signature verification on the first signature information according to second signature information, where the second signature information is signature information pre-set by the server for the application;

[0194] In the event that the signature verification fails, the signature verification result is determined to be a verification failure.

[0195] According to one or more embodiments of the present disclosure, performing auxiliary verification on the application according to the first auxiliary verification information to obtain an auxiliary verification result includes:

[0196] In the case where the first auxiliary verification information is different from the second auxiliary verification information, it is determined that the auxiliary verification result is a verification failure; the second auxiliary verification information is the auxiliary verification information pre-set by the server for the application.

[0197] According to one or more embodiments of the present disclosure, obtaining the first signature information and the first auxiliary verification information of the application includes:

[0198] Receive the first signature information and the first auxiliary verification information sent by the client.

[0199] According to one or more embodiments of the present disclosure, the method further includes:

[0200] Receive statistics sent by multiple clients;

[0201] It is determined whether there is an abnormal application program among the application programs of the multiple clients according to the statistical information reported by the multiple clients.

[0202] According to one or more embodiments of the present disclosure, the statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application;

[0203] Determining whether there is an abnormal application among the applications of the multiple clients according to the statistical information reported by the multiple clients includes:

[0204] Obtaining a deduplication count value of the verification information corresponding to each version channel information according to the statistical information;

[0205] When the deduplication count value of the version channel information is greater than a preset threshold, it is determined that the abnormal application exists in the application programs of the version channel information.

[0206] According to one or more embodiments of the present disclosure, the method further includes:

[0207] Obtaining behavioral information of multiple users using the application;

[0208] It is determined according to the behavior information whether there is an abnormal application program among the applications used by the multiple users.

[0209] According to one or more embodiments of the present disclosure, a method for detecting an application program is provided, which is applied to a client, and the method includes:

[0210] Obtaining first signature information and first auxiliary verification information of the application; wherein the first auxiliary verification information includes first permission information and / or first file information of the application, and the application is an application deployed on the client;

[0211] The first signature information and the first auxiliary verification information are sent to a server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0212] According to one or more embodiments of the present disclosure, obtaining the first signature information of the application includes:

[0213] Reading a program file of the application program through a first function; the first function is not an operating system library function of the client;

[0214] The program file is parsed by a local method to obtain the first signature information of the program file.

[0215] According to one or more embodiments of the present disclosure, the method further includes:

[0216] Obtaining statistics for said application;

[0217] The statistical information is sent to the server so that the server determines whether the abnormal application exists in the application programs of the multiple clients according to the statistical information reported by the multiple clients.

[0218] According to one or more embodiments of the present disclosure, the statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application.

[0219] According to one or more embodiments of the present disclosure, a device for detecting an application program is provided, which is applied to a server, and the device includes:

[0220] A first acquisition module, used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client, and the first auxiliary verification information includes first permission information and / or first file information of the application;

[0221] The first detection module is used to determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0222] According to one or more embodiments of the present disclosure, a device for detecting an application program is provided, which is applied to a client, and the device includes:

[0223] A second acquisition module is used to acquire first signature information and first auxiliary verification information of the application; wherein the first auxiliary verification information includes first permission information and / or first file information of the application, and the application is an application deployed on the client;

[0224] The second sending module is used to send the first signature information and the first auxiliary verification information to the server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

[0225] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0226] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0227] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A method for detecting an application, characterized in that: Applied to a server, the method comprises: Obtaining first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client; Determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

2. The method according to claim 1, characterized in that The determining whether the application is an abnormal application according to the first signature information and the first auxiliary verification information comprises: Performing signature verification on the application according to the first signature information to obtain a signature verification result; Performing auxiliary verification on the application according to the first auxiliary verification information to obtain an auxiliary verification result; When the signature verification result is a verification failure or the auxiliary verification result is a verification failure, it is determined that the application is the abnormal application.

3. The method according to claim 2, characterized in that The performing signature verification on the application according to the first signature information to obtain a signature verification result includes: Performing signature verification on the first signature information according to second signature information, where the second signature information is signature information pre-set by the server for the application; In the event that the signature verification fails, the signature verification result is determined to be a verification failure.

4. The method according to claim 3, characterized in that The performing auxiliary verification on the application according to the first auxiliary verification information to obtain an auxiliary verification result includes: In the case where the first auxiliary verification information is different from the second auxiliary verification information, it is determined that the auxiliary verification result is a verification failure; the second auxiliary verification information is the auxiliary verification information pre-set by the server for the application.

5. The method according to claim 1, characterized in that The obtaining of the first signature information and the first auxiliary verification information of the application comprises: Receive the first signature information and the first auxiliary verification information sent by the client.

6. The method according to any one of claims 1 to 5, characterized in that The first auxiliary verification information includes first permission information and / or first file information of the application.

7. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Receive statistics sent by multiple clients; It is determined whether there is an abnormal application program among the application programs of the multiple clients according to the statistical information reported by the multiple clients.

8. The method according to claim 7, characterized in that The statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application.

9. The method according to claim 8, characterized in that Determining whether there is an abnormal application among the applications of the multiple clients according to the statistical information reported by the multiple clients includes: Obtaining a deduplication count value of the verification information corresponding to each version channel information according to the statistical information; It is determined whether there is an abnormal application program among the application programs of the multiple clients according to the deduplication count value.

10. The method according to claim 9, characterized in that The determining whether there is an abnormal application among the applications of the multiple clients according to the deduplication count value comprises: When the deduplication count value of the version channel information is greater than a preset threshold, it is determined that the abnormal application exists in the application programs of the version channel information.

11. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Obtaining behavioral information of multiple users using the application; It is determined according to the behavior information whether there is an abnormal application program among the applications used by the multiple users.

12. A method for detecting an application, characterized in that: Applied to a client, the method comprises: Obtaining first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client; The first signature information and the first auxiliary verification information are sent to a server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

13. The method according to claim 12, characterized in that The obtaining of the first signature information of the application comprises: Reading a program file of the application program through a first function; the first function is not an operating system library function of the client; The program file is parsed by a local method to obtain the first signature information of the program file.

14. The method according to claim 12, characterized in that The method further comprises: Obtaining statistics for said application; The statistical information is sent to the server so that the server determines whether the abnormal application exists in the application programs of the multiple clients according to the statistical information reported by the multiple clients.

15. The method according to claim 14, characterized in that The statistical information includes version channel information and verification information corresponding to the application, the version channel information includes a version identifier and a release channel identifier, and the verification information includes file list information and / or file hash information of the application.

16. The method according to any one of claims 12 to 15, characterized in that The first auxiliary verification information includes first permission information and / or first file information of the application.

17. A device for detecting an application, characterized in that: Applied to a server, the device comprises: A first acquisition module is used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client; The first detection module is used to determine whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

18. A device for detecting an application, characterized in that: Applied to a client, the device comprises: A second acquisition module is used to acquire first signature information and first auxiliary verification information of an application; wherein the application is an application deployed on a client; The second sending module is used to send the first signature information and the first auxiliary verification information to the server, so that the server determines whether the application is an abnormal application according to the first signature information and the first auxiliary verification information.

19. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method described in any one of claims 1 to 11 are implemented; or, when the computer program is executed by a processing device, the steps of the method described in any one of claims 12 to 16 are implemented.

20. An electronic device, characterized in that: include: a storage device having a computer program stored thereon; A processing device, used to execute the computer program in the storage device to implement the steps of the method described in any one of claims 1 to 11, or to implement the steps of the method described in any one of claims 12 to 16.

Images