Method for triggering application program monitoring, electronic equipment and readable storage medium

Abstract

The invention relates to the technical field of electronics, and provides a method for triggering application program monitoring, electronic equipment and a readable storage medium. The method comprises the steps of obtaining records of a suspected behavior sequence, wherein the records of the suspected behavior sequence are used for representing behavior characteristics of suspected behaviors corresponding to the suspected behavior sequence; if the record of the suspected behavior sequence represents that the suspected behavior meets a preset monitoring condition, monitoring of the suspected behavior is started, and the monitoring condition is used for determining whether the behavior feature of the suspected behavior reaches the degree needing to be monitored on the terminal equipment or not. The method can reduce power consumption.

Description

Technical Field

[0001] The present application relates to the field of electronic technology, and in particular to a method for triggering application monitoring, an electronic device, and a readable storage medium. Background Art

[0002] With the rapid development of terminal devices, the types and number of applications installed on terminal devices are also increasing. Many applications have pop-up behaviors. Among these pop-up behaviors, some are pop-ups that users need to use normally, that is, pop-ups that users expect, such as chat software will pop up chat windows, taxi software will pop up windows with vehicle arrival information, etc. Some pop-ups are not pop-ups that users expect, such as advertising pop-ups. Usually we need to distinguish these pop-ups, intercept pop-ups that users do not expect, and allow pop-ups that users expect.

[0003] In traditional technology, people usually monitor the pop-up behavior of each application to identify the advertising pop-ups that appear on the terminal device, and then block the identified advertising pop-ups.

[0004] However, monitoring the pop-up behavior of applications installed on terminal devices will occupy a large amount of system resources, consume power, affect terminal device performance and shorten standby time, resulting in a poor user experience. Summary of the invention

[0005] The present application provides a method, device, chip, electronic device, computer-readable storage medium and computer program product for triggering application monitoring, which can reduce power consumption.

[0006] In a first aspect, a method for triggering application monitoring is provided, which is applied to a terminal device, and the method includes: obtaining a record of a suspected behavior sequence, the record of the suspected behavior sequence representing the behavioral characteristics of the suspected behavior corresponding to the suspected behavior sequence; if the record of the suspected behavior sequence represents that the suspected behavior meets a preset monitoring condition, then initiating monitoring of the suspected behavior, and the monitoring condition is used to determine whether the behavioral characteristics of the suspected behavior have reached a level that requires monitoring on the terminal device.

[0007] In some possible implementations, the method further includes: if the record of the suspected behavior sequence indicates that the suspected behavior sequence does not meet the monitoring condition, monitoring of the suspected behavior is not initiated, and the step of obtaining the record of the suspected behavior sequence is continued in the next monitoring cycle.

[0008] Since the monitoring conditions are used to determine whether the suspected behavior on the terminal device has reached the level that requires monitoring, the terminal device sets the monitoring conditions and then judges the behavioral characteristics of the collected behavior sequence according to the monitoring conditions. The monitoring of the behavior is initiated only when the monitoring conditions are met, making the monitoring process more effective. If the monitoring conditions are not met, the monitoring of the behavior will not be initiated. This can screen out some behaviors that do not need to be monitored, thereby reducing the number of monitored applications and saving system resources and power.

[0009] In some possible implementations, the monitoring conditions include a combination of one or more of the following conditions: the installation duration of the suspected application corresponding to the suspected behavior sequence is less than or equal to a preset day threshold, and the number of executions of the suspected behavior corresponding to the suspected behavior sequence within a first preset time period exceeds a first preset number threshold; the upgrade duration of the suspected application is less than or equal to a preset day threshold, and the number of executions of the suspected behavior within the first preset time period exceeds the first preset number threshold; the installation duration and / or upgrade duration of the suspected application is greater than the preset day threshold, and the number of executions of the suspected behavior within a second preset time period exceeds a second preset number threshold; the identifier of the suspected application exists in the list of applications to be monitored, and the device settings of the terminal device are The device identifier and the identifier of the suspected application match the corresponding device identifier in the list of monitored applications, the list of monitored applications includes multiple identifiers of monitored applications that need to be monitored, and the list of monitored applications is a list issued by Cloud Testing; the identifier of the suspected application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the suspected application, and the blacklist of identified illegal applications includes at least one identifier of an illegal application; the identifier of the suspected application exists in the blacklist of identified illegal applications, and there is no control path corresponding to the suspected behavior sequence in the existing control path corresponding to the suspected application; wherein, the first preset time period is a time period less than one day, and the second preset time period is a time period less than or equal to one day.

[0010] Among the above monitoring conditions, by setting different monitoring conditions for newly installed or newly upgraded applications and applications that have been installed or upgraded for a long time, it is possible to comprehensively and reasonably screen out suspected behaviors that need to be monitored and trigger application monitoring, as well as a list of applications to be monitored and a blacklist of identified illegal applications. This can help quickly and accurately screen out suspected behaviors that need to be monitored. This method avoids invalid monitoring processes and makes the monitoring triggering method of applications more reasonable and complete, thereby improving resource utilization.

[0011] In some possible implementations, the monitoring conditions also include: the temperature of the terminal device is lower than a preset temperature threshold, and / or the battery power of the terminal device in an uncharged state is greater than a preset power threshold.

[0012] By using the battery level as a monitoring condition, it is possible to avoid situations where the battery is too low and the battery is consumed too quickly due to suspected behaviors, thus shortening the standby time and giving priority to ensuring the standby time, thereby improving the user experience. By using the temperature as a monitoring condition, it is possible to avoid the consumption of the limited remaining power and to avoid damage to the device due to continuous overheating of the terminal device and the user feeling of being hot.

[0013] In some possible implementations, initiating monitoring of the suspected behavior sequence includes: using a behavior sequence collector to report the suspected behavior sequence to a system manager to initiate monitoring of the suspected behavior.

[0014] In some possible implementations, a behavior sequence collector is used to report suspected behavior sequences to a system manager, including: when a suspected behavior sequence meets a monitoring condition, the system manager generates a behavior sequence whitelist, and sends the behavior sequence whitelist to the behavior sequence collector, wherein the behavior sequence whitelist includes an identifier of a suspected application and an identifier of a suspected behavior sequence; a behavior sequence collector is used to receive behavior sequences to be identified reported by a logical function module; a behavior sequence collector is used to determine whether the behavior sequence to be identified matches the behavior sequence whitelist, wherein the behavior sequence whitelist includes identifiers of M behavior sequences that need to be monitored and identifiers of corresponding applications, where M is a non-negative integer; if so, a behavior sequence collector is used to determine that the behavior sequence to be identified is a suspected behavior sequence, and the suspected behavior sequence is reported to the system manager; if not, a behavior sequence collector is used to discard the behavior sequence to be identified.

[0015] When the system manager determines that the suspected behavior sequence meets the monitoring conditions, it adds the suspected behavior sequence to the behavior sequence whitelist and sends it to the behavior sequence collector. In this way, when the behavior sequence collector receives the suspected behavior reported by the logical function module, it can determine whether the suspected behavior is the behavior that needs to be monitored and realize the monitoring of the suspected behavior. At the same time, the behavior sequence collector also discards the suspected behavior sequence that is not in the behavior sequence whitelist, which can avoid reporting invalid suspected behavior sequences that do not need to be monitored, reduce invalid reporting operations, and avoid waste of resources.

[0016] In some possible implementations, after the behavior sequence collector reports the suspected behavior sequence to the system manager, it also includes: using the end-side AI model to identify the risk level of the suspected behavior sequence to obtain a target risk level, where the target risk level is used to characterize the degree of impact of the suspected application corresponding to the suspected behavior sequence on the user. The end-side AI model is an AI model trained on the cloud side, and the end-side AI model is used to identify the risk level corresponding to the application to which the behavior sequence belongs; according to the target risk level, determining the target control strategy corresponding to the suspected application, and the target control strategy is used to control the suspected application.

[0017] Through the end-side AI model, illegal applications that have illegal behaviors can be identified locally in a timely manner without waiting for the blacklist of illegal applications sent by the server, thus avoiding the omission of illegal applications due to untimely acquisition or update of the blacklist. When illegal applications are identified in a timely manner, the terminal device can implement the corresponding control strategy in a timely manner according to the risk level corresponding to the illegal application, improving the timeliness of illegal application control and thus improving the user experience.

[0018] In some possible implementations, the suspected behavior sequence includes a suspected dynamic behavior sequence and / or an illegal static behavior sequence, and a behavior sequence collector is used to report the suspected behavior sequence to the system manager, including: obtaining a suspected dynamic behavior sequence; if the identifier of the suspected dynamic behavior sequence exists in the behavior sequence whitelist, starting system event monitoring to obtain system events, and scanning illegal static behaviors to obtain illegal static behavior sequences, where the illegal static behavior sequences are used to characterize illegal static behaviors existing on the terminal device; and reporting the suspected dynamic behavior sequences and illegal static behavior sequences to the system manager.

[0019] The system manager does not need to scan all illegal static behavior sequences and system events at the beginning. Since system events can only be effectively used when illegal behaviors occur, the collection of system events and illegal static behaviors can be started when suspected dynamic behaviors that may be illegal behaviors occur, which can avoid the waste of resources caused by obtaining invalid system events and illegal static behaviors and save system resources.

[0020] In some possible implementations, an end-side AI model is used to identify the risk level of a suspected behavior sequence to obtain a target risk level, including: determining whether the suspected behavior sequence meets a trigger condition based on a system event, the trigger condition is used to characterize whether the suspected behavior sequence needs to be identified for risk level; if so, the end-side AI model is used to identify the risk level of the suspected behavior sequence to obtain a target risk level.

[0021] System events are used to screen whether it is necessary to identify the risk level of suspected behavior sequences. System events can be combined to clearly identify the scenarios that need to be identified and controlled, making the recognition rate and accuracy of illegal behavior sequences higher, thereby improving the control accuracy of illegal applications.

[0022] In some possible implementations, a trigger management module in an end-side AI model is used to determine whether a suspected behavior sequence meets the trigger conditions based on system events; if so, an identification module in the end-side AI model is used to identify the risk levels of the dynamic behavior sequence and the illegal static behavior sequence to obtain a target risk level; if not, the identification module is not used to identify the risk level of the suspected behavior sequence.

[0023] A trigger management module is set up in the end-side AI model, which can filter suspected behavior sequences that need to be identified in combination with system events, delete some suspected behavior sequences that do not need to be identified in the current state, retain suspected behavior sequences that need to be identified, and then use the identification module to identify the screened suspected behavior sequences, which can reduce the amount of data and save system resources.

[0024] In some possible implementations, after determining the target control strategy corresponding to the suspected application according to the target risk level, the following steps may be performed: stopping monitoring of the suspected behavior.

[0025] After determining the target control strategy corresponding to the suspected application, it means that the suspected application can be controlled. For example, the suspected behavior that needs to be intercepted can be intercepted. At this time, there is no need to monitor the suspected behavior, which can reduce the number of monitored behaviors and save system resources and power consumption.

[0026] In some possible implementations, stopping monitoring of the suspected behavior sequence includes: deleting an identifier of the suspected behavior sequence in a behavior sequence whitelist.

[0027] Stopping monitoring of suspected behaviors may be to delete the identifiers of suspected behavior sequences and / or all behavior sequence identifiers corresponding to the identifiers of suspected applications in the behavior sequence whitelist, and clear corresponding callbacks, which can save storage space when invalid monitoring is stopped.

[0028] In some possible implementations, obtaining a record of a suspected behavior sequence includes: when an installation event or an upgrade event of a suspected application corresponding to the suspected behavior sequence is monitored; if the identifier of the suspected application is not an identifier of an application in an identified illegal blacklist, and is not an identifier of an application in an identified illegal whitelist, then obtaining a record of the suspected behavior sequence; wherein the identified illegal blacklist includes the identifier of at least one application with an identified risk level, and the identified illegal whitelist includes the identifier of at least one application that is not an illegal application.

[0029] That is to say, if the suspected application corresponding to the suspected behavior sequence has not been identified as having a risk level before, it is necessary to execute the above method of triggering application monitoring and further determine the target risk level of the suspected application to obtain the target control strategy. It is not necessary to identify all suspected behavior sequences, which can avoid the waste of resources caused by repeated identification.

[0030] In some possible implementations, the method also includes: if the identifier of the suspected application is the identifier of an application in an identified illegal blacklist, determining a target control strategy corresponding to the suspected application based on the target risk level and preset control rules corresponding to the identifier of the suspected application in the identified illegal blacklist; controlling the suspected application according to the target control strategy, and the preset control rules include a set of control paths corresponding to different risk levels.

[0031] The need to identify the target risk level again can avoid the waste of resources caused by repeated identification and save time.

[0032] If the suspected application corresponding to the suspected behavior sequence has been identified and determined to be an illegal application, it can be controlled based on the results that have been identified, that is, the target control strategy corresponding to the suspected application is determined based on the target risk level and preset control rules corresponding to the identification of the suspected application in the identified illegal blacklist, and the suspected application is controlled based on the target control strategy. This method does not need to continue to repeatedly identify the suspected behavior sequence, but directly uses the existing identification results, which improves the control efficiency of the suspected application. Compared with the method of repeatedly identifying the risk level to obtain the control strategy, it saves system resources and power.

[0033] In some possible implementations, a target control strategy corresponding to the suspected application is determined based on the target risk level and preset control rules corresponding to the identification of the suspected application in the identified illegal blacklist, including: the system manager instantiates the control rules for the suspected application according to the target risk level and the preset control rules, and obtains a target control path set corresponding to the suspected application, the target control path set includes at least a control path corresponding to the behavior that needs to be intercepted; the system manager sends the target control path set to the control manager; the suspected application is controlled according to the target control strategy, including: using a logical function module to query whether there is a control path corresponding to the suspected behavior sequence in the control manager; if so, intercepting the suspected behavior.

[0034] This method can query the control manager first when a suspected behavior is executed. If the corresponding control path exists in the control manager, the suspected behavior can be directly intercepted. This process belongs to in-process query and consumes almost no power, thereby saving system resources and power.

[0035] In some possible implementations, the method further includes: if the suspected application is an application in an identified illegal whitelist, monitoring of the suspected behavior is not initiated.

[0036] This method does not need to continue to repeatedly identify the suspected behavior sequence, but directly adopts the existing identification results to release the suspected behaviors that have been determined not to be illegal applications, thereby improving the management efficiency of suspected applications. Compared with the method of repeatedly identifying the risk level to obtain the management strategy, it saves system resources and power.

[0037] In some possible implementations, before obtaining the record of the suspected behavior sequence, it also includes: when the terminal device is in Wi-Fi connection and / or charging state, receiving any one or more of the identified illegal blacklist, identified illegal whitelist, terminal-side AI model and preset control rules issued by the security cloud platform.

[0038] When the terminal device is idle, it can receive any one or more of the identified illegal blacklist, identified illegal whitelist, terminal-side AI model and preset control rules sent by the cloud side, which can avoid the consumption of invalid network resources, avoid power consumption and save resources.

[0039] In a second aspect, a device for triggering application monitoring is provided, comprising a unit composed of software and / or hardware, wherein the unit is used to execute any one of the methods in the technical solution of the first aspect.

[0040] In a third aspect, an electronic device is provided, comprising: a processor, a memory and an interface; the processor, the memory and the interface cooperate with each other so that the electronic device executes any one of the methods in the technical solution described in the first aspect.

[0041] In a fourth aspect, an embodiment of the present application provides a chip, comprising a processor; the processor is used to read and execute a computer program stored in a memory to execute any one of the methods in the technical solution described in the first aspect.

[0042] Optionally, the chip also includes a memory, and the memory is connected to the processor via a circuit or wire.

[0043] Further optionally, the chip also includes a communication interface.

[0044] In a fifth aspect, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the processor executes any one of the methods in the technical solution described in the first aspect.

[0045] In a sixth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on an electronic device, the electronic device executes any one of the methods in the technical solution described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1is a schematic diagram of the structure of a terminal device 100 provided in an embodiment of the present application;

[0047] Figure 2 is a software structure block diagram of the terminal device 100 provided in an embodiment of the present application;

[0048] Figure 3 It is a software architecture diagram of an application monitoring method provided in an embodiment of the present application;

[0049] Figure 4 This is a time sequence interaction diagram of a control method of a security application that is not an illegal application after installation, provided in an embodiment of the present application;

[0050] Figure 5 This is a flowchart of a method for triggering application monitoring provided in an embodiment of the present application;

[0051] Figure 6 This is another flowchart of a method for triggering application monitoring provided in an embodiment of the present application;

[0052] Figure 7 This is a software architecture diagram of another behavior sequence reporting process provided in an embodiment of the present application;

[0053] Figure 8 This is a risk details interface of an illegal application with a high risk level provided in an embodiment of the present application;

[0054] Fig. 9 This is a risk details interface of an illegal application with a medium risk level provided in an embodiment of the present application;

[0055] Fig.10 It is another example of a timing interaction diagram for triggering application monitoring provided in an embodiment of the present application;

[0056] Fig.11 It is an interactive diagram of triggering application monitoring at different stages provided by an embodiment of the present application;

[0057] Fig.12 This is a software architecture diagram of an example of end-cloud combined application management provided in an embodiment of the present application;

[0058] Fig.13 This is a schematic diagram of the structure of a device for triggering application monitoring provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0060] In the following, the terms "first", "second", and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", and "third" may explicitly or implicitly include one or more of the features.

[0061] With the rapid development of terminal devices, the types and number of applications installed on terminal devices are also increasing. Many applications have pop-up behaviors. Among these pop-up behaviors, some are pop-ups that users need to use normally, that is, pop-ups that users expect, such as chat software will pop up chat windows, taxi software will pop up windows with vehicle arrival information, etc. Some pop-ups are not pop-ups that users expect, such as advertising pop-ups. Usually we need to distinguish these pop-ups, intercept pop-ups that users do not expect, and allow pop-ups that users expect.

[0062] In traditional technology, people usually monitor the pop-up behavior of each application to identify the advertising pop-ups that appear on the terminal device, and then block the identified advertising pop-ups.

[0063] However, monitoring the pop-up behavior of applications installed on the terminal device will occupy system resources and consume power. If too many applications are monitored, some applications may not have pop-ups or the pop-up behavior is what the user expects, then the monitoring of these applications is invalid, affecting the performance of the terminal device and shortening the standby time, resulting in a poor user experience.

[0064] The method for triggering application monitoring provided in the embodiment of the present application sets monitoring conditions, and then judges the behavioral characteristics of the collected behavior sequence according to the monitoring conditions. The monitoring of the behavior is started only when the monitoring conditions are met. If the monitoring conditions are not met, the monitoring of the behavior will not be started. In this way, some behaviors that do not need to be monitored can be screened out, thereby reducing the number of monitored applications and saving system resources and power.

[0065] The method for triggering application monitoring provided in the embodiment of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiment of the present application does not impose any restrictions on the specific type of terminal devices.

[0066] For example, Figure 1 1 is a schematic diagram of the structure of an example of a terminal device 100 provided in an embodiment of the present application. The terminal device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0067] It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0068] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0069] The controller may be the nerve center and command center of the terminal device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0070] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0071] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0072] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the terminal device 100.

[0073] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0074] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0075] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0076] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the terminal device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the terminal device 100.

[0077] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0078] The USB interface 130 is an interface that complies with the USB standard specification, and specifically can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the terminal device 100, and can also be used to transmit data between the terminal device 100 and peripheral devices. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc.

[0079] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0080] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the terminal device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141.

[0081] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0082] The wireless communication function of the terminal device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0083] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Figure 1 The structures of antenna 1 and antenna 2 in the figure are only an example. Each antenna in the terminal device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0084] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the terminal device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0085] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be arranged in the same device as the mobile communication module 150 or other functional modules.

[0086] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the terminal device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0087] In some embodiments, the antenna 1 of the terminal device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the terminal device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-CDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a BeiDou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0088] The terminal device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.

[0089] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0090] The terminal device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0091] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0092] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the terminal device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0093] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the terminal device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0094] Video codecs are used to compress or decompress digital videos. The terminal device 100 may support one or more video codecs. Thus, the terminal device 100 may play or record videos in various coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0095] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of the terminal device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0096] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0097] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the terminal device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area can store data created during the use of the terminal device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0098] The terminal device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0099] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0100] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The terminal device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0101] The receiver 170B, also called a "handset", is used to convert audio electrical signals into sound signals. When the terminal device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the ear.

[0102] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to the microphone 170C to input the sound signal into the microphone 170C. The terminal device 100 can be provided with at least one microphone 170C. In other embodiments, the terminal device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the terminal device 100 can also be provided with three, four or more microphones 170C to realize the collection of sound signals, noise reduction, identification of sound sources, realization of directional recording function, etc.

[0103] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0104] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The terminal device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the terminal device 100 detects the touch operation intensity according to the pressure sensor 180A. The terminal device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0105] The gyroscope sensor 180B can be used to determine the motion posture of the terminal device 100. In some embodiments, the angular velocity of the terminal device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 180B. The gyroscope sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 180B detects the angle of the terminal device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the terminal device 100 through reverse movement to achieve anti-shake. The gyroscope sensor 180B can also be used for navigation and somatosensory game scenes.

[0106] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the terminal device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0107] The magnetic sensor 180D includes a Hall sensor. The terminal device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the terminal device 100 is a flip phone, the terminal device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover automatic unlocking and other features are set.

[0108] The acceleration sensor 180E can detect the magnitude of the acceleration of the terminal device 100 in various directions (generally three axes). When the terminal device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device and applied to applications such as horizontal and vertical screen switching and pedometers.

[0109] The distance sensor 180F is used to measure the distance. The terminal device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the terminal device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0110] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The terminal device 100 emits infrared light outward through the light emitting diode. The terminal device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal device 100. When insufficient reflected light is detected, the terminal device 100 can determine that there is no object near the terminal device 100. The terminal device 100 can use the proximity light sensor 180G to detect that the user holds the terminal device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode, and pocket mode automatically unlocks and locks the screen.

[0111] The ambient light sensor 180L is used to sense the ambient light brightness. The terminal device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the terminal device 100 is in a pocket to prevent accidental touch.

[0112] The fingerprint sensor 180H is used to collect fingerprints. The terminal device 100 can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0113] The temperature sensor 180J is used to detect temperature. In some embodiments, the terminal device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the terminal device 100 reduces the performance of the processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 heats the battery 142 to avoid abnormal shutdown of the terminal device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.

[0114] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the terminal device 100, which is different from the position of the display screen 194.

[0115] The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a vibrating bone block of the vocal part of the human body. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure beat signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vibrating bone block of the vocal part obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M to realize a heart rate detection function.

[0116] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The terminal device 100 may receive key input and generate key signal input related to user settings and function control of the terminal device 100.

[0117] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0118] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0119] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the terminal device 100 by inserting the SIM card interface 195 or pulling it out from the SIM card interface 195. The terminal device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The terminal device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the terminal device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the terminal device 100 and cannot be separated from the terminal device 100.

[0120] The software system of the terminal device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. The present application embodiment takes the Android system of the layered architecture as an example to exemplify the software structure of the terminal device 100.

[0121] like Figure 2 As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. The application package may also include a system manager, which is used to schedule and manage the system.

[0122] The application layer may also include an illegal application identification engine for identifying illegal applications.

[0123] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0124] like Figure 2 As shown, the application framework layer may include a window manager (Window Manager Service, WMS), a content provider, a view system, a phone manager, a resource manager, a notification manager (Notification), an activity manager (Activity Manager Service, AMS), a package manager (Package Manager Service, PMS), a power consumption manager (iAware), a behavior sequence collector (Behavior Collect Manager) and a control manager (AddView Manager), etc.

[0125] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0126] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0127] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0128] The phone manager is used to provide communication functions of the terminal device 100, such as management of call status (including connection, disconnection, etc.).

[0129] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0130] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, the terminal device vibrates, the indicator light flashes, etc.

[0131] The activity manager coordinates the management of the four major components of the system and centrally schedules each application process.

[0132] The power consumption manager is used to schedule and manage the power consumption of the whole machine to ensure the performance of the whole machine.

[0133] The package manager is used to manage the information of applications installed by the system, and to query the information of each installation package and the information of applications with hidden icons.

[0134] The behavior sequence collector is used to collect the behavior sequences of logical function modules such as WMS, AMS, PMS, Notification and iAware, and report the behavior sequences that need to be reported to the system manager of the application layer.

[0135] The control manager can cache control rules and provide an interface to query control rules.

[0136] Android runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0137] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0138] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0139] The system library may include multiple functional modules, such as surface manager, media libraries, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0140] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0141] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0142] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0143] A 2D graphics engine is a drawing engine for 2D drawings.

[0144] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0145] For ease of understanding, the following embodiments of the present application will be described in detail with Figure 1 and Figure 2 Taking the terminal device with the shown structure as an example, the method for triggering application monitoring provided by the embodiment of the present application is specifically explained in combination with the accompanying drawings and application scenarios.

[0146] In order to clearly describe the technical solution of the present application, illegal acts, illegal applications and other related concepts are explained here.

[0147] Illegal behavior (also called rogue behavior or abnormal behavior) refers to some behaviors that are not expected by users on terminal devices, such as pop-up advertisements on the interface of third-party applications, pop-up advertisements on the desktop, pop-up advertisements on the lock screen interface, application icons are transparent, application icons are hidden, application lock screen is disabled, third-party applications use system capabilities to achieve self-startup, third-party applications are pulled up again when running (not on the desktop), impersonating system applications, impersonating system contact data providers, setting for barrier-free startup, etc. The above illegal behaviors can be expressed in illegal behavior sequences.

[0148] Applications that exhibit the above illegal behaviors may be called illegal applications (for simplicity, they are all referred to as illegal applications in the following text, and may also be called rogue applications or abnormal applications). Generally, marking illegal applications may be recording the identifier of the illegal application, such as recording the package name of the illegal application.

[0149] Control path: Each control path corresponds to an illegal behavior. The terminal device can implement control over various illegal behaviors by managing multiple control paths. For example, if an illegal behavior needs to be intercepted or released (not intercepted), it can be achieved by defining interception or non-interception for the control path corresponding to the illegal behavior. Optionally, the control path can be represented by a control path identifier. For example, the control path identifiers of multiple control paths can be named using non-repeating positive integers.

[0150] The control rule is used to describe the way to control the behavior of illegal applications, that is, which illegal behaviors of the illegal application need to be intercepted. The control rule can be expressed by the control path set corresponding to the illegal application, and the control path set includes multiple control paths corresponding to the illegal behaviors that need to be intercepted.

[0151] The control information is information generated based on the results of the control rule query. When the logical function module needs to execute an illegal behavior, it first queries the control manager to see whether the control path corresponding to the illegal behavior exists. Regardless of whether it exists, the control information corresponding to the illegal behavior will be generated. The control information may include the identifier of the illegal application corresponding to the illegal behavior (such as the package name), the control path corresponding to the illegal behavior, and the control result obtained by the query. Among them, the control results include interception or non-interception. If it is found, it means that control is required, and the control result is interception. If it is not found, it means that control is not required, and the control result is non-interception.

[0152] Control rule instantiation is the process of generating control rules corresponding to an application, that is, the process of obtaining a control path set consisting of control paths that need to be controlled corresponding to the application. The result of control rule instantiation is a control path set corresponding to the generated application, which includes control paths corresponding to the behaviors that need to be intercepted.

[0153] For ease of understanding, we first introduce the functional deployment of the technical solution of this application. For details, please refer to Figure 3 As shown, the technical solution can be deployed on the cloud side and the terminal side, and the terminal and cloud are combined to achieve the management of illegal applications. Among them, the cloud side is the cloud side server, and the terminal side is the terminal device.

[0154] Among them, the cloud-side server can be set:

[0155] The big data analysis platform, which can also be called a dot database, is an example of the Hiview big data platform. The big data analysis platform can count the interception results, such as the number of successful interceptions and failed interceptions of illegal applications, and analyze the interception results to evaluate the interception success rate.

[0156] Security cloud platform: used to collect statistics on various behavior sequences reported by the end side, generate behavior sequence distribution rules for summarizing, formatting, distributing and filtering behavior sequences, and then send them to the system manager on the end side; it can also generate a preset illegal list based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, or the smart cloud platform can send the black and white lists of illegal applications and combine them with manual corrections to generate the final preset illegal list for storage, and finally send the final preset illegal list to the end side; it can also generate control rules for each illegal application based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, and store them on the security cloud platform. After that, the configuration file containing the control rules can be sent to the system manager on the end side to implement control. The security cloud platform extracts rules based on group data reported by multiple terminal devices, generates rules quickly, takes effect quickly, and has high accuracy.

[0157] Optionally, the security cloud platform can send the generated various rules and lists to the terminal side at an appropriate time, such as sending them regularly every day, or sending them when the terminal device is charging, connected to Wi-Fi, or idle.

[0158] Smart cloud platform: includes decision-making middle platform and machine learning platform. The machine learning platform is used to summarize various illegal behavior sequences reported from the end side, obtain training samples after calibration, and then perform feature calculation on these training samples to train the model, obtain a trained AI model, and use the AI ​​model for inference and prediction to verify the accuracy of the AI ​​model. It should be noted that the machine learning platform can train two types of AI models, one is the AI ​​model applied to cloud testing, called the cloud testing AI model, and the other is applied to the end side, called the end side AI model.

[0159] The above-mentioned cloud test AI model is a group recognition model. The input data may include multiple behavior sequences reported by multiple terminal devices of multiple users. Then, more complete features can be identified during the recognition process, so the recognition result is more accurate. The cloud test AI model can be expressed as a decision-making middle platform of the cloud test, which can be used to determine whether to trigger management based on the input behavior sequence. If the triggering conditions of the trigger management are met (for example, a timed trigger), the input behavior sequence can be feature analyzed to identify risks and obtain risk identification results. The risk identification result can be the package name and corresponding risk level of the identified illegal application. Then the cloud test AI model manages and distributes the risk identification results. The cloud test AI model can identify illegal applications after the cloud test implementation (after the illegal behavior is implemented on the end side) and generate a black and white list of illegal applications. Optionally, the black and white list of illegal applications generated by the smart cloud platform can be transmitted to the security cloud platform and used as a preset illegal list, or it can be used as a preset illegal application list after manual correction.

[0160] The input data of the above-mentioned end-side AI model is the behavior sequence of a single terminal device, and the recognition result obtained is the recognition result corresponding to the behavior sequence of a single terminal device. It should be noted that the smart cloud platform can also send the trained end-side AI model to the end side through the network, which can be sent to multiple terminal devices for local identification of illegal applications by the terminal devices. The smart cloud platform can also correct and optimize the generated end-side AI model based on the continuously reported behavior data to make the end-side AI model more accurate. When the continuously corrected end-side AI model is sent to the end side, the accuracy of the recognition result can be improved, and it can adapt to the evolution of illegal applications, so as to achieve the effect of continuously combating illegal applications.

[0161] In comparison, the cloud-based AI model is trained by combining training samples from multiple terminal devices, so its recognition accuracy is higher than that of the end-side AI model. The end-side AI model can identify illegal behavior sequences locally on the terminal device, which is faster and consumes less power than the cloud-based AI model.

[0162] The above-mentioned big data analysis platform, smart cloud platform, and security cloud platform can be set up on different cloud-side servers respectively, or on the same cloud-side server, which is not limited to this embodiment of the present application.

[0163] The end-side can include multiple end-devices, which can share various rules, lists, and identification results of cloud testing. Taking one of the end-devices as an example, the application layer of the end-device can install a system manager and set up an end-side identification engine. The system manager and end-side identification engine can provide a set of security services for local rapid identification and timely control of illegal applications.

[0164] The terminal recognition engine can be a terminal AI model issued by the smart cloud platform. The system framework layer of the terminal device includes multiple logical function modules, such as AMS, WMS, PMS, Notification and iAware. For the introduction of each logical function module, please refer to the previous article and will not be repeated here.

[0165] The system framework layer is also equipped with a behavior sequence collector (IHnBehaviorCollectManager), which can collect the behavior sequences reported by each logical function module. The collected behavior sequences can include dynamic behavior sequences that characterize dynamic behaviors and static behavior sequences that characterize static features. The behavior sequence collector can also report the collected behavior sequences to the system manager at the application layer, which will be recognized by the AI ​​model on the input side of the system manager.

[0166] After receiving the behavior sequence reported by the system framework layer, the system manager can first aggregate, format, filter and distribute the data according to the behavior sequence distribution rules issued by the security cloud platform, and filter out the behavior sequences that do not need to be identified. The filtered behavior sequences that need to be identified are then formatted according to the needs of data transmission and input into the end-side AI model (that is, the local AI model of the terminal device) for identification. Optionally, formatting the transmitted data is not a necessary step, but a data processing step to achieve smooth data transmission. It can be understood that in the subsequent evolution of the data format, if the entire process can be executed using a normalized data format, then the step of formatting the transmitted data can be omitted.

[0167] The end-side AI model can include a decision-making middle platform, a computing engine base, and a data middle platform.

[0168] The data center of the end-side AI model is used to manage input and output data, such as caching input behavior sequences, storing recognition results, and distributing input and output data.

[0169] The computing engine foundation is used to manage and infer the AI ​​model on the client side. Model inference is also the process of inference prediction, that is, outputting the inference result based on the input behavior sequence.

[0170] The decision-making center in the end-side AI model can be used to determine whether to trigger reasoning based on system events when inputting a behavior sequence. If the triggering conditions for triggering reasoning are met, such as an application popping up more than three times in a short period of time, or the triggering moment of the scheduled trigger arrives, the input behavior sequence can be feature analyzed, that is, the input computing engine is used for model reasoning, and then the specific risk identification results are obtained based on the reasoning results output by the computing engine. Finally, the decision-making center manages or distributes the risk identification results (for example, sending them to the system manager for management, and reporting to the smart cloud platform).

[0171] The risk identification results of the decision-making platform in the end-side AI model can also be integrated with the preset illegal list downloaded from the security cloud platform in the system manager to output the final risk identification results. The risk identification results can include the package name of the illegal application and the corresponding risk level.

[0172] The system manager can also parse the configuration files of the control rules issued by the security cloud platform to instantiate the control rules, which are then sent to the control manager at the application framework layer to implement control.

[0173] When the logic function module needs to execute an illegal behavior, it can query the control path corresponding to the illegal behavior in the control manager. Among them, the control manager is used to cache the control rules of each illegal application that needs to be controlled, and provide an interface for the logic function module to query. If the control path corresponding to the illegal behavior that needs to be executed exists in the package control list of the control manager, it means that the illegal behavior needs to be controlled, and the logic function module does not execute the subsequent process of the illegal behavior. In terms of pop-up behavior, no pop-up window will appear. If the control path corresponding to the illegal behavior that needs to be executed is not in the package control list of the control manager, it means that the illegal behavior does not need to be controlled, and the logic function module continues to execute the illegal behavior. In terms of pop-up behavior, the pop-up window will continue to appear.

[0174] The system manager can also obtain the list of viruses detected by the virus detection engine. When illegal behavior occurs, it first determines whether the illegal behavior is the behavior of the virus application. If it is, it directly executes the control strategy corresponding to the virus application. If not, the behavior sequence of the illegal behavior is input into the end-side AI model for identification.

[0175] In the above Figure 2 and Figure 3Based on the architecture shown, it is necessary to start monitoring the application program to identify illegal applications, and then control the identified illegal applications accordingly. Based on this, taking the illegal behavior of pop-up window behavior as an example, we analyzed and counted the existing illegal applications with pop-up window behavior. Taking the downloadable APPs provided on an application market as an example, it was found that the number of APPs active in the application market reached as many as one billion. Among them, there are more than 40,000 APPs with pop-up windows. Then the rest of the APPs do not need to be monitored, that is, the APPs that do not have pop-up window behavior do not need to be monitored, which can greatly reduce the scope of monitoring. Among the more than 40,000 APPs with pop-up windows, more than 1,700 APPs have more than ten pop-up windows per day. For APPs that do not have more than ten pop-up windows per day, it can be considered that the impact on users is not great, and the benefits of monitoring these APPs are relatively low. Therefore, there is no need to monitor APPs with fewer pop-up windows, which further reduces the scope of monitoring. Of course, among these more than 1,700 APPs, there are also some APPs that are legal and compliant APPs widely used by users, such as APPs with relatively large download volumes (such as APPs ranked in the top 3,000 in terms of download volumes). Although these legal and compliant APPs frequently pop up, the pop-up windows are the pop-up windows expected by users, so there is no need to monitor them. Therefore, more than 1,500 APPs are screened out, which once again narrows the scope of monitoring. In the case of adding more than 100 illegal applications every week, the number of mobile phones that need to be monitored is about 38,000 (the total number of mobile phones is about 20,000). Then, these more than 1,500 APPs are monitored on more than 38,000 mobile phones. Compared with monitoring all applications, the number of monitored APPs is greatly reduced. Therefore, for a single terminal device, the embodiment of the present application can effectively reduce the applications that need to be monitored by limiting the monitoring conditions that trigger the monitoring behavior sequence, that is, narrowing the scope of the monitoring package, so that the terminal device can save system resources and power.

[0176] The illegal application control process described in the embodiment of the present application may include the following processes: triggering the collection of illegal behavior sequences, distributing illegal behavior sequences, triggering and identifying risk levels, and illegal application control.

[0177] 1. Triggering the collection of illegal behavior sequences:

[0178] When the logic function module executes a behavior (action), it will output a behavior sequence representing the behavior to complete the execution of the action. The behavior sequence collector can collect the behavior sequence and cache it.

[0179] In the embodiment of the present application, the behavior sequence collector can be a container of a process, which is set at the application framework layer. For details, see Figure 2 and Figure 3As shown. The behavior sequence collector can cache the behavior sequences reported by each logical function module. Specifically, the behavior sequence collector can build a buffer queue with a preset length, such as a buffer queue with a preset length of 256, to store the reported behavior sequences. When the buffer queue is not full, the behavior sequence collector can cache the behavior sequences reported by each logical function module, and the behavior sequences that overflow the buffer queue can be directly discarded. Usually, logical function modules such as AMS, WMS, PMS, Notification and iAware do not need to perceive whether the behavior sequences reported by themselves need to be reported to the system manager of the application layer, but directly call the behavior sequence interface (sendBehavior) to obtain the behavior sequence of the behavior (action) to be executed, and return immediately after adding it to the buffer queue (ConcurrentLinkedQueue) of the behavior sequence collector. The above-mentioned behavior sequence can carry parameters such as the package name (pkg) of the behavior sequence, the behavior sequence identifier (bid) and the content (bundle) of the behavior sequence.

[0180] Usually, the behavior sequence collector can also store the behavior sequence whitelist issued by the system manager, and the behavior sequence whitelist includes multiple behavior sequences that need to be monitored. For example, the behavior sequences that need to be monitored may include but are not limited to one or more of the following: pop-up advertising pop-ups on the interface of third-party applications, pop-up advertising pop-ups on the desktop, pop-up advertising pop-ups on the lock screen interface, the application setting icon transparency, the application setting icon hiding, the application setting lock screen disabled, the third-party application using system capabilities to achieve self-startup, the third-party application is pulled up again when running (not pulled up on the desktop), impersonating system applications, impersonating system contact data providers, setting for barrier-free startup, etc. The behavior sequence corresponding to the behavior. Each behavior sequence in the behavior sequence whitelist can also carry the corresponding package name (pkg) and / or behavior sequence identifier (bid), so the behavior sequence whitelist can be a table (bid list) including behavior sequence identifiers of multiple behavior sequences that need to be monitored.

[0181] The number of behavior sequences in the above-mentioned behavior sequence whitelist can be one or more. Each behavior sequence carries its own package name, each package name represents an illegal application that needs to be monitored, and each package name can correspond to one or more behavior sequence identifiers. Each behavior sequence identifier can represent the illegal behavior that can be performed by the illegal application of the corresponding package name, and each illegal behavior can be described by a behavior parameter. The behavior parameters include but are not limited to: startup path, startup terminal name, timestamp and other information.

[0182] Specifically, the behavior sequence collector can compare the behavior sequence reported by the logic function module with the behavior sequence whitelist. If the behavior sequence reported by the logic function module is in the behavior sequence whitelist, it means that the behavior sequence is an illegal behavior sequence that needs to be collected, that is, it is necessary to start monitoring the behavior sequence, then the behavior sequence collector can report the behavior sequence to the system manager. If the behavior sequence reported by the logic function module is not in the behavior sequence whitelist, it means that the behavior sequence is not an illegal behavior sequence at present, or it is an illegal behavior sequence that has not yet been identified. It does not need to be collected temporarily, and no attention is required, that is, there is no need to start monitoring the behavior sequence. The behavior sequence collector can directly discard the behavior sequence and no longer report it, and it will not trigger the monitoring process for illegal behavior sequences. This can avoid reporting invalid behavior sequences and avoid wasting resources.

[0183] Exemplary: The behavior sequence whitelist may include the package name: pkg1, and the package name of pkg1 corresponds to the behavior sequence identifiers bid: 1, bid: 2, bid: 3. Among them, bid: 1, bid: 2, bid: 3 respectively represent the three behaviors of attempting background pop-ups on the lock screen interface, background pop-ups on the desktop, and attempting background pop-ups on other third-party applications. Each behavior is described by the corresponding behavior parameters. If the behavior sequence reported by WMS includes: pkg1, bid: 1, and the behavior parameters of the behavior of attempting background pop-ups on the lock screen interface, and the behavior sequence is a behavior sequence that exists in the behavior sequence whitelist, it means that the behavior sequence is an illegal behavior sequence that needs to be reported. The behavior sequence collector can then report the illegal behavior sequence of pkg1, bid: 1, and the behavior parameters of the behavior of attempting background pop-ups on the lock screen interface to the system manager.

[0184] Optionally, before reporting the illegal behavior sequence, the behavior sequence collector may format the illegal behavior sequence and then report it to meet the demand of data transmission.

[0185] Optionally, the above-mentioned behavior sequence whitelist can be a configuration file including illegal behavior sequences that need to be monitored sent by the security cloud platform to the system manager on the terminal side, which is parsed by the system manager and then sent to the behavior sequence collector of the application framework layer for screening; optionally, the behavior sequence whitelist can also be pre-set in the system manager of the terminal device, parsed and then sent to the behavior sequence collector of the application framework layer, and subsequently regularly updated according to the configuration file of illegal behavior sequences that need to be monitored sent by the security cloud platform to ensure the accuracy of illegal behavior sequence reporting. The embodiments of the present application are not limited to this.

[0186] Optionally, when there is no behavior sequence whitelist in the behavior sequence collector, for example, when the terminal device is newly turned on or restored to factory settings, the system manager has not received the configuration file of illegal behavior sequences that need to be monitored issued by the security cloud platform, resulting in the lack of a behavior sequence whitelist in the behavior sequence collector. The behavior sequence collector can discard all behavior sequences and all system events reported by all logical function modules to save system resources and power consumption.

[0187] Optionally, if the behavior sequence collector does not have a behavior sequence whitelist, the terminal device can count and filter the behavior sequences of the application programs through the system manager, obtain the behavior sequences that need to be monitored, and generate a behavior sequence whitelist.

[0188] Optionally, if there is a behavior sequence whitelist in the behavior sequence collector, the system manager can also count and filter the behavior of the application to obtain the behavior sequences that need to be monitored and the behavior sequences that do not need to be monitored, and use this to update the existing behavior sequence whitelist, such as adding new behavior sequences that need to be monitored to the behavior sequence whitelist, or deleting behavior sequences that do not need to be monitored in the behavior sequence whitelist, so as to achieve dynamic updating of the behavior sequence whitelist, so that the illegal behavior sequences reported by the behavior sequence collector are more accurate and reasonable, avoiding the waste of resources caused by monitoring too many behavior sequences, and avoiding missed monitoring due to monitoring too few behavior sequences, thereby balancing resource allocation and user experience.

[0189] The above triggering of collecting illegal behavior sequences will also trigger reporting of the collected illegal behavior sequences to implement illegal application management and control. Therefore, triggering the collection of illegal behavior sequences is triggering application monitoring. For ease of understanding, the following is an exemplary description of the method of triggering application monitoring in the embodiment of the present application using the illegal behavior being a pop-up behavior. It can be understood that illegal behavior can also be other types of user-unexpected behavior, and the embodiment of the present application does not limit this.

[0190] When a new application is installed on a terminal device, the system manager can monitor the system event of the new application installation. The application is called a newly installed application. At this time, the system manager can start monitoring the illegal behavior of the newly installed application.

[0191] Optionally, when the system manager monitors the pop-up behavior, the pop-up behavior is a suspected behavior, the corresponding behavior sequence is a suspected behavior sequence, and the newly installed application that executes the pop-up is a suspected application. The system manager can also first determine whether the pop-up behavior is executed by an application in the identified illegal whitelist. Among them, the identified illegal whitelist includes at least one identifier of an application that has been determined not to be an illegal application, and it may also be empty. If the pop-up behavior is executed by an application in the identified illegal whitelist, that is, the identifier of the application corresponding to the behavior sequence of the pop-up behavior is in the identified illegal whitelist, the system manager can determine that the pop-up behavior of the newly installed application does not need to be monitored, which can save system resources and power consumption. When the logical function module needs to execute the pop-up behavior, the WMS first queries the control manager whether there is a control path corresponding to the behavior sequence of the pop-up behavior. If not, there is no need to monitor the pop-up behavior, and the query in the control manager is an in-process query, which consumes almost no power consumption.

[0192] It should be noted that when an application on a terminal device is newly upgraded, the system manager can monitor the system event of the newly upgraded application. The application is called a newly upgraded application. At this time, the system manager can start monitoring the illegal behavior of the newly upgraded application. And the monitoring conditions for the newly upgraded application can be completely referred to the monitoring method of the newly installed application, and will not be described separately in the full text.

[0193] For newly installed applications, when the system manager monitors suspected pop-up behavior, the system manager can also first determine whether the pop-up behavior is executed by an application in the identified illegal whitelist. If not, it is necessary to determine whether the pop-up behavior is executed by an application in the identified illegal blacklist. That is to say, if the identifier of the application corresponding to the behavior sequence of the pop-up behavior is in the identified illegal blacklist and not in the identified illegal whitelist, the system manager can determine that the pop-up behavior of the newly installed application needs to be monitored. Among them, the identified illegal blacklist includes the identifier of at least one application with an identified risk level. It should be noted that for the same terminal device, the above-mentioned identified illegal whitelist and the identified illegal blacklist generally do not have an intersection, so if it exists in the identified illegal whitelist, it will not exist in the identified illegal blacklist. Usually, in addition to the identifier of the application, the identified illegal blacklist also includes the risk level corresponding to the identifier of the application. The system manager can determine the target control strategy corresponding to the newly installed application based on the target risk level and preset control rules corresponding to the identification of the newly installed application in the identified illegal blacklist (for example, the package name), and then control the newly installed application according to the target control strategy.

[0194] Optionally, the implementation method of determining the target control strategy according to the risk level and the preset control rules is the process of instantiating the control rules for the newly installed application, which may specifically include: the system manager can determine the control path set corresponding to the target risk level in the preset control rules, and then delete the control path that needs to be deleted by the newly installed application and add the control path that needs to be added according to the settings in the special control rules corresponding to the newly installed application, and then generate the target control path set. Then the system manager sends the target control path set to the control manager for storage. When the logic function module queries the control manager for the existence of the control path corresponding to the pop-up behavior of the newly installed application, the pop-up behavior is directly intercepted. In other words, when the system monitors the system event of the newly installed application, if the newly installed application is an illegal application with an identified risk level, the process of instantiating the control rules is directly triggered. When the newly installed application executes the suspicious application of the pop-up behavior, the logic function module can directly query the control manager at the system framework layer to learn that it needs to be intercepted, and then directly intercept the pop-up behavior. The logic function module directly queries the control manager at the system framework layer, which is also an in-process query and consumes almost no power. At the same time, the identified illegal blacklist can directly trigger the instantiation of control rules for newly installed applications, and control can be achieved without monitoring pop-up behaviors, thus saving system resources.

[0195] Optionally, for a detailed description of the process of implementing application control based on risk levels and preset control policies, preset control rules, control rule instantiation, and special control rules, please refer to the detailed description below and will not be repeated here.

[0196] For the timing interaction diagram of installing a safe application that has been determined not to be an illegal application on the terminal device and installing an identified illegal application, please refer to Figure 4 As shown, including:

[0197] S401. The system manager can receive the identified illegal blacklist, identified illegal whitelist and preset control rules issued by the security cloud platform.

[0198] Optionally, the receiving timing may be when the network connection is Wifi, which can save network resources; or when the terminal device is in a charging state, the power consumption can be ignored; or it may be when the network connection is Wifi and the terminal device is in a charging state, or other idle times.

[0199] S401'. Optionally, the system manager may also receive the terminal-side AI model and / or fixed recognition rules issued by the smart cloud platform.

[0200] S402: Download a new application from the application market.

[0201] S403: The system manager monitors the installation event of the newly installed application, and determines that the newly installed application is an application in the identified illegal whitelist (referred to as whitelist application).

[0202] S404: The newly installed application calls the logic function module to output a behavior sequence, and queries the corresponding control path in the control manager.

[0203] The control manager will not have the control path of the whitelisted applications, so any behavior sequence of the newly installed applications will not be started for monitoring. At the same time, the behavior sequence collector's behavior sequence whitelist will not contain any behavior sequence identifier of the newly installed application, so the whitelisted applications will not generate additional consumption.

[0204] Optionally, if an application in an identified illegal blacklist (hereinafter referred to as a blacklist application) is installed, the following steps may be performed:

[0205] S405: Download the newly installed application from the application market.

[0206] S406: The system manager monitors the installation event of the newly installed application, determines that the newly installed application is an application in the identified illegal blacklist, and then issues the control policy corresponding to the newly installed application. This process does not need to trigger the monitoring of the behavior sequence and then instantiate it. The instantiated control policy is obtained directly when the application is newly installed, which can save power consumption.

[0207] The control policy is used to describe which behaviors of the application are intercepted and which are not. The control policy relies on the control rules for execution. Optionally, the control policy issued in this article can be the process of instantiating the control rules for the application, obtaining the control rules corresponding to the application, and issuing the control rules to the control manager. The control rules include a control path set consisting of the control paths corresponding to the behaviors that need to be intercepted by the application. The process of instantiating the control rules is the process of generating the control rules corresponding to the application.

[0208] Specifically, the system manager can query the identified illegal blacklist when triggered by the installation event of the newly installed application. When it is determined that the newly installed application is an identified illegal application, it directly starts the instantiation of the control rules, generates the control path set (that is, the control policy) corresponding to the newly installed application, and sends it to the control manager.

[0209] Optionally, whether to directly trigger the instantiation of the control rules here can also depend on the risk level of the application. For example, if the risk level of the newly installed application is high risk or low risk, the instantiation of the control rules can be directly triggered. If the risk level of the newly installed application is medium risk, the instantiation of the control rules may not be triggered first, but the instantiation of the control rules may be triggered when the existing application exhibits illegal behavior for the first time. Because in some scenarios, the behavior of medium-risk applications may not be unexpected by users, so triggering the instantiation of control rules when illegal behavior occurs can avoid the situation where the user's expected behavior is intercepted by directly triggering the instantiation of control rules when the application is newly installed, making the control strategy more reasonable.

[0210] S407: The newly installed application calls the logic function module to output a behavior sequence, and queries the corresponding control path in the control manager.

[0211] The corresponding control path set already exists in the control manager. When a newly installed application starts automatically, the logic function module will be called to output the behavior sequence and the corresponding control path will be queried in the control manager. When the control path corresponding to the output behavior sequence is found to exist, the behavior corresponding to the behavior sequence is directly intercepted and the subsequent process is no longer executed. This query process is also an in-process query and consumes almost no power.

[0212] Taking the above S405-S406 process as an example, after measurement and statistics, the power consumption of each pop-up window intercepted is 3.5 milliamperes per hour (mA / h) compared to the power consumption of executing a pop-up window behavior. The daily power consumption benefit of common illegal applications is about 86.5mA / h; if the illegal behavior is originally kept alive in the background, if it is successfully intercepted, the daily power consumption benefit will be 408mA / h, and the power saving effect is obvious.

[0213] Optionally, if the newly installed application is neither an application in the identified illegal blacklist nor an application in the identified illegal whitelist, but is an unidentified suspected application, then the suspected behavior sequence corresponding to the suspected behavior of the suspected application can be collected, and whether to trigger application monitoring can be determined based on the record of the suspected behavior sequence. Figure 5 The method for triggering application monitoring shown includes:

[0214] S501: Obtain a record of a suspected behavior sequence, where the record of the suspected behavior sequence is used to characterize behavior features of the suspected behavior corresponding to the suspected behavior sequence.

[0215] Specifically, taking the pop-up behavior executed by the terminal device as an example, when the application on the terminal device has a pop-up behavior, the terminal device can regard the pop-up behavior as a suspected behavior and record the behavior characteristics of the suspected behavior. Optionally, the behavior characteristics can characterize the frequency of the suspected behavior, the triggering time, and other information. For example, the number of pop-ups within one hour is ten.

[0216] S502: If the record of the suspected behavior sequence indicates that the suspected behavior meets a preset monitoring condition, monitoring of the suspected behavior sequence is started. The monitoring condition is used to determine whether the behavior characteristics of the suspected behavior on the terminal device reach a level that requires monitoring.

[0217] If the record of the suspected behavior sequence indicates that the suspected behavior meets the preset monitoring condition, it means that monitoring is required, and the monitoring of the suspected behavior can be started. Optionally, the risk level corresponding to the suspected behavior sequence can be identified and other operations can be performed next.

[0218] Figure 5 In the method shown, since the monitoring conditions are used to determine whether the suspected behavior on the terminal device has reached the level that requires monitoring, the terminal device sets the monitoring conditions and then judges the behavioral characteristics of the collected behavior sequence according to the monitoring conditions. The monitoring of the behavior is only initiated when the monitoring conditions are met, making the monitoring process more effective. If the monitoring conditions are not met, the monitoring of the behavior will not be initiated. In this way, some behaviors that do not need to be monitored can be screened out, thereby reducing the number of monitored applications and saving system resources and power.

[0219] From the perspective of the entire process of application management, taking the execution of pop-up behavior as an example, the control process for illegal applications can specifically include: when the logical function module needs to execute a pop-up behavior, the WMS first queries the control manager to see whether there is a control path corresponding to the behavior sequence of the pop-up behavior.

[0220] If the control path corresponding to the pop-up behavior already exists in the control manager, it means that the pop-up behavior has been controlled, and the behavior sequence corresponding to the pop-up behavior does not need to be reported to the system manager, and there is no need to start monitoring the pop-up behavior, so as to avoid waste of resources caused by invalid monitoring. WMS can directly control according to the queried control rules. At this time, regardless of whether the pop-up behavior is intercepted or not, the control information corresponding to this query will be generated and recorded, and then uploaded to the system manager. Optionally, the control information may include: the package name of the application of the pop-up behavior, the control path and control result of the pop-up behavior (the control result of the pop-up behavior can be controlled, intercepted, or not intercepted or not controlled). Among them, the control path is the control method of the behavior sequence, and each control path can correspond to a behavior sequence. The control path is described in detail below, which will not be repeated here.

[0221] If there is no control path for the pop-up behavior in the control manager, such as when the terminal device is newly turned on or has just been restored to factory settings, it means that the corresponding control rules have not yet been instantiated for the pop-up behavior. In other words, when WMS queries the behavior sequence of the pop-up behavior in the control manager and there is no corresponding control path, WMS will still execute the pop-up behavior as usual. Optionally, the control information of the pop-up behavior can also be recorded by the control manager and then uploaded to the system manager. For example, the control information at this time may include, but is not limited to: the package name of the application of the pop-up behavior, the control path of the pop-up behavior, and the control result (the control result of the pop-up behavior is not controlled or not intercepted).

[0222] Optionally, the control information of the above pop-up behavior can be uploaded to the system manager in real time, or the accumulated control information of various behaviors can be uploaded uniformly at certain intervals, such as once a day or once every hour. Before the control information is uploaded to the system manager, the control information of various behavior sequences is stored by the control manager. After uploading, the control manager can clear the uploaded control information to free up space. When the system manager receives the control information uploaded by the control manager, including the control information that is not controlled or intercepted, it can filter the illegal behaviors that need to be monitored according to the preset monitoring conditions, and then generate a behavior sequence whitelist for the screened illegal behavior sequences that need to be controlled and send it to the behavior sequence collector. Afterwards, the behavior sequence collector can filter the illegal behavior sequences that need to be reported according to the behavior sequence whitelist, thereby triggering the monitoring process.

[0223] Optionally, the control manager can also report the control information obtained when querying the above-mentioned various behavior sequences to the management database through the system manager, that is, the big data analysis platform (such as Hiview). The big data analysis platform can perform result statistics and analysis based on the control information of the various behavior sequences reported. For example, the big data analysis platform counts the number of interceptions and / or non-interceptions of each reported behavior sequence, and obtains the effect analysis results of successful and failed interceptions. Optionally, the effect analysis results can be used to adjust the control strategy.

[0224] The above monitoring conditions can be: when the behavior characteristics of illegal behavior reach the degree of control set by the system manager, it means that the illegal behavior sequence meets the monitoring conditions, and it is determined that the illegal behavior sequence needs to be added to the behavior sequence whitelist. Taking the monitoring condition that the number of pop-up windows of a newly installed application (newly installed application) exceeds five times within one hour as an example, when the system manager queries the control information of the control manager, it is found that there is a newly installed application pkg3 installed within three days. The newly installed application pkg3 has five pop-up windows within one hour (for example, corresponding to bid: 1), then it is determined that the pop-up behavior of the newly installed application meets the monitoring conditions, so the system manager can add the package name of the illegal behavior sequence and the behavior sequence identifier corresponding to the package name (for example, the serial number of the bid) to the behavior sequence whitelist, for example, the package name pkg3 corresponding to the pop-up behavior and the bid: 1 of the pop-up behavior are added to the behavior sequence whitelist, and optionally, the behavior parameters of the pop-up window can also be added to the behavior sequence whitelist. Afterwards, the system manager can send the behavior sequence whitelist to the behavior sequence collector.

[0225] When the behavior sequence collector receives the required behavior sequence (behavior sequence to be identified) reported by the logical function module, it determines whether the behavior sequence to be identified matches the behavior sequence whitelist. For example, whether the package name (identifier of the application) and bid (identifier representing the behavior sequence) corresponding to the reported behavior sequence are the behavior sequence of the application that needs to be monitored in the behavior sequence whitelist. If it matches, the behavior sequence collector determines that the behavior sequence to be identified is a suspected behavior sequence (such as the pop-up behavior sequence of a newly installed application), and reports the suspected behavior sequence to the system manager. If it does not match, for example, the package name corresponding to the reported behavior sequence does not exist in the behavior sequence whitelist, or the identifier of the reported behavior sequence does not exist under the corresponding package name in the behavior sequence whitelist, the identified behavior sequence is discarded and no longer reported.

[0226] Optionally, the illegal behavior is a pop-up behavior for exemplary description, and the above monitoring conditions may also include but are not limited to one or more combinations of the following (if there is no contradiction):

[0227] a. The number of pop-up windows exceeds the preset number within the preset time period. For example, the number of pop-up windows exceeds ten times within one hour; if an application pops up more than twelve times within one hour, it means that the monitoring conditions are met, and the behavior sequence and corresponding package name of the pop-up behavior can be added to the behavior sequence whitelist to start the monitoring of the behavior sequence.

[0228] b. The number of pop-up windows of a newly installed application exceeds the preset number within the preset period after installation. For example, the application framework layer reports to the system manager that the package name of the newly installed application is pkg2. Within three days after installation, if the pop-up sequence with the package name pkg2 appears more than five times per hour, then the behavior sequence identifier of pkg2 and the corresponding pop-up behavior and the corresponding package name will be updated to the behavior sequence whitelist, and the behavior sequence corresponding to the pop-up behavior executed by pkg2 will be reported by the behavior sequence collector to the system manager for monitoring.

[0229] c. The number of pop-up windows of the newly upgraded application (newly upgraded application) exceeds the preset number within the preset period after the upgrade. For example, the application framework layer reports the registration of the newly upgraded application as pkg3 to the system manager. Within three days after the upgrade, if the pop-up sequence with the package name pkg3 appears more than five times per hour, then the behavior sequence of pkg3 and the corresponding pop-up behavior will be updated to the behavior sequence whitelist, and the behavior sequence corresponding to the pop-up behavior executed by pkg3 will be reported to the system manager by the behavior sequence collector.

[0230] Optionally, when a newly installed application or a newly upgraded application has been monitored for three days, there may be two monitoring results for the application: one is that there is no illegal behavior and it will not affect user use; the other is that the corresponding control strategy has been identified through three days of monitoring, and control can be performed directly according to the control strategy without monitoring. At this time, the system manager can delete the behavior sequence related to the package name of the application in the behavior sequence whitelist and no longer report the related behavior sequence of the application, that is, stop monitoring to save system resources.

[0231] Optionally, taking the illegal behavior as pop-up behavior as an example, if a newly installed application or a newly upgraded application is monitored for three days and no illegal behavior that needs to be monitored is found, the system manager can reduce the frequency of reporting illegal behavior sequences. If the monitoring frequency of a newly installed application or a newly upgraded application within three days is to monitor the number of pop-up windows once an hour, then after three days, the number of pop-up windows can be changed to monitor once a day.

[0232] During the daily monitoring process, if the pop-up window of the application is found to be active again, for example, more than ten pop-ups appear in one day, then high-frequency monitoring can be restarted. For example, the number of pop-ups can be monitored once an hour in the next three days. If the number of pop-ups within one hour meets the monitoring conditions, for example, more than five pop-ups appear within one hour, then monitoring of the pop-up behavior can be started to avoid missing monitoring.

[0233] Optionally, if there are some special marked risky applications, the system manager can also parse the configuration information sent by the security cloud to obtain the application identification of the marked risky application. When scanning the system applications and finding that the marked risky application is installed, the monitoring process of the application can be forcibly started for three days to avoid missed monitoring.

[0234] Optionally, monitoring condition 1 is: the installation time of the suspected application corresponding to the suspected behavior sequence is less than or equal to the preset day threshold (that is, the newly installed application is within a few days of installation), and the number of executions of the suspected behavior corresponding to the suspected behavior sequence in the first preset time period exceeds the first preset number threshold (that is, the number of suspected behaviors executed in a period of one day exceeds the first preset number threshold). Optionally, the preset day threshold can be three days, four days or five days, etc.; the first preset time period is a period of less than one day, which can be half an hour, one hour or two hours, etc.; the first preset number threshold can be four times, five times or six times, etc.

[0235] Optionally, monitoring condition 2 is: the upgrade duration of the suspected application is less than or equal to the preset day threshold (that is, the newly upgraded application is within a few days of the upgrade), and the number of executions of the suspected behavior within the first preset time period exceeds the first preset number threshold (that is, the number of suspected behaviors executed within a period of one day exceeds the first preset number threshold). Optionally, the preset day threshold can be three days, four days or five days, etc.; the first preset time period is a period less than one day, which can be half an hour, one hour or two hours, etc.; the first preset number threshold can be four times, five times or six times, etc. For example, within three days of the suspected application being installed or upgraded, monitor once every hour, obtain a record of a suspected behavior sequence with eight pop-up windows within one hour, and the record of the suspected behavior sequence meets the monitoring condition that the number of pop-up windows exceeds five times within one hour, then the monitoring of the suspected behavior can be initiated.

[0236] Optionally, monitoring condition 3 is: the installation time and / or upgrade time of the suspected application is greater than the preset number of days threshold, and the number of executions of the suspected behavior within the second preset time period exceeds the second preset number threshold. That is to say, if an application is installed and / or upgraded for more than the preset number of days threshold, the monitoring frequency can be reduced. Optionally, the second preset time period can be a period of 12 hours, a day, etc., which is less than or equal to the length of a day; the second preset number threshold can be ten times, eight times, twelve times, etc. For example, the system manager determines that the suspected behavior is executed more than ten times in one day. For example, three days after the suspected application is installed or upgraded, it is monitored once a day, and a record of a suspected behavior sequence with twelve pop-up windows in one day is obtained. The record of the suspected behavior sequence meets the monitoring condition that the number of pop-up windows exceeds ten times in one day, and the monitoring of the suspected behavior can be started.

[0237] Optionally, monitoring condition 4 is: the identifier of the suspected application exists in the list of applications to be monitored, and the device identifier of the terminal device matches the device identifier corresponding to the identifier of the suspected application in the list of applications to be monitored, the list of applications to be monitored includes multiple identifiers of applications to be monitored, and the list of applications to be monitored is a list issued by the cloud test. Usually, the security cloud platform can summarize some application lists that need to be monitored, and then send them to the terminal device during idle time. If the identifier of the suspected application is in the list of applications to be monitored, and the terminal device is the same or similar to the device type that needs to be monitored corresponding to the identifier of the suspected application in the list of applications to be monitored, then monitoring can be started, that is, the model of the terminal device can be distinguished to determine whether monitoring is required.

[0238] Optionally, monitoring condition 5 is: the identifier of the suspected application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the suspected application, and the blacklist of identified illegal applications includes at least one identifier of an illegal application. In other words, if the suspected application is an illegal application that has been identified, but the control rules have not been instantiated and cannot be directly controlled, monitoring can be started.

[0239] If the record of the suspected behavior sequence indicates that the suspected behavior sequence does not meet the monitoring conditions, the monitoring of the suspected behavior will not be started, and the step of obtaining the record of the suspected behavior sequence will continue in the next monitoring cycle. In other words, even if the current suspected behavior does not meet the monitoring conditions for triggering monitoring, relevant information can continue to be obtained in the next monitoring cycle. For example, for a newly installed application, if the number of pop-ups is less than five times within an hour, monitoring will not be started, but the number of pop-ups will still be counted in the next hour. If it reaches five times, monitoring can continue to be started to avoid missing monitoring.

[0240] Optionally, monitoring condition 6 is: the identifier of the suspected application exists in the blacklist of identified illegal applications, and the control path corresponding to the suspected behavior sequence does not exist in the existing control path corresponding to the suspected application. In other words, if the suspected application is an illegal application that has been identified, and there are instantiated control rules, but the existing control rules do not contain the control path corresponding to the current suspected behavior, that is, although the suspected application is controlled, there are other illegal behaviors, then monitoring of the newly appeared illegal behavior can be started.

[0241] For details, the system manager can determine whether to monitor suspicious behaviors. Figure 6 The flowchart shown, Figure 6In the example, the preset number of days is three days, the first preset time period is one hour, the second preset time period is one day, the first preset number of times is five times, and the second preset number of times is ten times, combined with the above monitoring conditions 1-6, an exemplary description is given, including:

[0242] S601: The system manager obtains the record of the suspected behavior sequence. If obtained, S602 is executed; if not, S607 is executed.

[0243] S602: Determine whether the suspected application has been installed within three days and the number of background pop-up windows per hour is greater than five. If yes, execute S608; if no, execute S603.

[0244] S603: Determine if the suspected application upgrade is within three days and the number of background pop-up windows per hour is greater than five. If yes, execute S608; if no, execute S604.

[0245] S604: Determine whether the suspected application has more than ten pop-up windows per day three days after installation / upgrade, and is not an application in the identified illegal whitelist. If yes, execute S608; if no, execute S605.

[0246] S605: Determine whether there is no corresponding control path for the suspected application, or whether there is no control path corresponding to the current suspected behavior among the existing control paths. If yes, execute S608; if no, execute S606.

[0247] S606: The suspected application is an application marked by Cloud Testing that needs to be monitored on the device type of the terminal device. If yes, execute S608; if not, execute S607.

[0248] Above Figure 6 The order of the steps in the embodiment can also be interchanged, and this is not limited in the embodiments of the present application.

[0249] Optionally, the system manager can also re-screen the behavior sequences that need to be identified based on the behavior characteristics of illegal behaviors and in combination with some system events. That is to say, the system manager can add some events in the system events to the monitoring conditions. Among them, the system events can be obtained by monitoring the events of the application framework layer. Taking the system event as the temperature of the terminal device and / or the battery power in the uncharged state as an example, on the basis that the behavior characteristics of the illegal behavior meet the above monitoring conditions, it can continue to be screened according to whether the temperature is at a low temperature level. For example, the temperature level of the terminal device can also be divided into level 3, level 2 and level 1 from high to low. Among them, the temperature range covered by level 3 is 60 degrees (inclusive) to 30 degrees (exclusive); level 2 is second, and the temperature range covered is 30 degrees (exclusive) to 20 degrees (inclusive); level 1 is the lowest temperature level, and the temperature range covered is 20 degrees (exclusive) to -20 degrees (inclusive). Then if the temperature of the terminal device is at temperature level 2 or below, it can be considered that triggering the monitoring process will not cause the terminal device to overheat. If the number of pop-up windows meets five times, it can be determined that the monitoring process needs to be started, that is, the illegal behavior sequence is added to the behavior sequence whitelist.

[0250] Optionally, whether the terminal device starts monitoring can also be screened according to the temperature level of the terminal device as shown in Table 1. For example, the temperature level of the terminal device can be as shown in Table 1 below:

[0251] Table 1

[0252] Inlet temperature Setback temperature Temperature level Front shell temperature 37℃ Front shell temperature 35℃ 1 Front shell temperature 40℃ Front shell temperature 38℃ 2 Front shell temperature 43℃ Front shell temperature 41℃ 3 Front shell temperature 48℃ Front shell temperature 46℃ 4

[0253] The entry temperature indicates the temperature threshold for entering the temperature level during the heating process, and the fallback temperature indicates the temperature threshold for exiting the temperature level during the cooling process. For example, when the temperature level of the terminal device is 2 or below, it can be considered that triggering the monitoring process will not cause the terminal device to overheat, so it can be determined that the monitoring process needs to be started, and the illegal behavior sequence is added to the behavior sequence whitelist.

[0254] Optionally, the system manager can also directly trigger risk level identification when illegal behaviors reach a certain frequency, which can trigger the control of illegal behaviors in a timely manner and improve user experience.

[0255] Optionally, the above monitoring conditions may also include that charging is disconnected and the power is greater than a preset power upper limit threshold value, based on the fact that the behavioral characteristics of the illegal behavior meet the requirements. For example, when the terminal device is not charging (charging is disconnected) and the power is too low, for example, the power is 20%, then the power consumed by the monitoring process will accelerate the power consumption of the entire terminal device, resulting in a shortened standby time. Therefore, setting the monitoring process to start when charging is disconnected and the power is greater than 30% (an example of a preset power upper limit threshold value) can avoid the situation where the power is consumed too quickly when the power is too low, shortening the standby time, and giving priority to ensuring the standby time, thereby improving the user experience.

[0256] Optionally, the system manager can add to the monitoring conditions: the temperature of the terminal device is lower than a preset temperature threshold (for example, lower than 38 degrees), and / or the power of the terminal device is greater than a preset power threshold (for example, greater than 30%) or is in a charging state (also called a charging connection state). For example, when the system manager finds that a newly installed application pops up more than five times within an hour, if the temperature of the terminal device is lower than 38 degrees, the charging is disconnected, and the power is 50%, it means that the monitoring conditions are met. If the system manager finds that a newly installed application pops up more than five times within an hour, but the temperature of the terminal device exceeds 38 degrees, for example, reaches 40 degrees, or the power is 10% and the charging is disconnected, it means that the monitoring conditions are not met. When the monitoring conditions are not met, the system manager will not add the behavior sequence of the pop-up window to the behavior sequence whitelist, that is, it will not start monitoring the pop-up behavior, which can avoid the consumption of the little remaining power, and can also avoid the terminal device from being damaged by continuous overheating and the user feeling that the experience is not high, such as being hot.

[0257] It should be noted that in the above examples, the specific values ​​and distribution methods of power and temperature are examples and are not intended to limit the technical solutions of the embodiments of the present application. The two system events of power and temperature are also examples of system events. In actual use, users can add other system events to the monitoring conditions as needed to further filter the behavior sequences to be monitored, thereby optimizing the monitoring conditions and making the triggering of the monitoring behavior sequences more reasonable. I will not go into details here.

[0258] Optionally, after starting monitoring, if it is found that the power level is low, lower than a preset power threshold, for example, lower than 20% of the preset power threshold, or the temperature of the terminal device is high, for example, higher than a preset temperature threshold of 38 degrees, indicating that the monitoring conditions are not met, monitoring can be stopped in time to avoid consumption of the little remaining power, and to avoid damage to the terminal device caused by continuous overheating and the user feeling that the experience is not good, such as being hot. The specific values ​​of the preset temperature threshold and the preset power threshold are not limited in the embodiments of this application.

[0259] Optionally, if the system manager finds that the behavior characteristics of the behavior sequence do not meet the above monitoring conditions, it can continue to obtain new management and control information in the next cycle and continue to filter according to the monitoring conditions.

[0260] When the application corresponding to the originally monitored behavior sequence is uninstalled, the system manager can stop collecting illegal behavior sequences corresponding to the package name of the application. For example, the system manager deletes all behavior sequences corresponding to the package name of the uninstalled application in the behavior sequence whitelist, thereby saving storage space and avoiding consuming too many monitoring resources.

[0261] Optionally, the behaviors that need to be monitored included in the above-mentioned behavior sequence whitelist may be identified as illegal behaviors, the behavior sequences that need to be monitored may be illegal behavior sequences, and the illegal behavior sequences may include illegal dynamic behavior sequences and / or illegal static behavior sequences.

[0262] Optionally, illegal static behaviors include, but are not limited to: impersonating an unconnected contact data provider, setting as barrier-free startup, setting as the default input method, setting as default mandatory, multiple threads pulling each other to keep alive, the presence of transparent / floating windows, hiding desktop icons, hiding activities in the recently run list, impersonating system applications, application installation sources, and one or more of the other static features.

[0263] Optionally, triggering the collection of illegal behavior sequences, that is, triggering the monitoring process of illegal applications, may be triggered by reporting of illegal dynamic behaviors.

[0264] Optionally, the above-mentioned behavior sequence whitelist may include illegal dynamic behavior sequences but not illegal static behavior sequences. When the system manager monitors illegal dynamic behavior, it can start monitoring system events and scanning illegal static behavior. Among them, scanning illegal static behavior can obtain the illegal static behavior sequence of the application. Specifically, it can include: when the logical function module performs illegal dynamic behavior, such as performing pop-up behavior, the behavior sequence collector determines that the illegal dynamic behavior sequence of the illegal dynamic behavior is in the behavior sequence whitelist based on the behavior sequence whitelist, and needs to be reported, then the collected illegal dynamic behavior sequence can be reported to the system manager. At the same time, the system manager starts monitoring system events (usually system broadcast events). Optionally, the system manager can also scan illegal static behavior to obtain illegal static behavior sequences. Among them, illegal dynamic behavior can be described by illegal dynamic behavior sequences, and illegal static behavior can be described by illegal static behavior sequences. The above-mentioned system events may include system events such as locking or unlocking the screen, lighting the screen or stopping the screen. In other words, the system manager does not need to scan all illegal static behavior sequences and system events at the beginning. Since system events can only be effectively used when illegal behaviors occur, starting the collection of system events and illegal static behaviors when triggered by illegal dynamic behaviors can avoid the waste of resources caused by obtaining invalid system events and illegal static behaviors, thereby saving system resources.

[0265] It should be noted that the illegal behavior sequence reported by the behavior sequence collector to the system manager indicates that the application that performs the illegal behavior is a suspicious application. The next step is to identify the suspicious application as an illegal application, thereby triggering the illegal application control process; or the system manager can combine the monitored system events, filter out the illegal behavior sequences that do not need to be identified and the behavior sequences required by other recognition engines, and then select the illegal behavior sequences that need to be controlled to identify illegal applications and trigger the illegal application control process.

[0266] 2. Distribute illegal behavior sequences:

[0267] Optionally, the behavior sequence reported by the behavior sequence collector to the system manager can directly enter the end-side AI model for identification, or the behavior sequence can be distributed through the behavior sequence distribution module in the system manager, for example, sent one way to the smart cloud platform and another way to the end-side AI model for identification.

[0268] Optionally, the system manager can pre-process the illegal behavior sequences reported by the application management layer according to the behavior sequence distribution rules issued by the security cloud platform, including but not limited to behavior sequence aggregation, formatting, filtering and distribution, to obtain illegal applications to be identified that need to be identified. Among them, filtering illegal behavior sequences can be to screen out behavior sequences that need to be identified and input them into the end-side AI model, and distribute other data that do not need to be identified to their respective corresponding recognition engines, such as distributing anti-fraud behavior sequences to the anti-fraud recognition engine, or distributing virus application behavior sequences to the virus application recognition engine.

[0269] In some embodiments, the reporting process of illegal behavior sequences can be found in Figure 7 As shown. Figure 7 As shown, each logical function module will report the behavior sequence of its own execution to the behavior sequence collector. Specifically, the behavior sequence collector can report illegal dynamic behavior sequences to the illegal application data analysis module (IAppRogueBehaviorDataAnalyzer) of the system manager. For example, WMS will report the behavior sequence of the lock screen background pop-up window, the behavior sequence of the desktop background pop-up window, and the behavior sequence of the third-party application interface pop-up window to the illegal application data analysis module through the behavior sequence collector. The power consumption manager will report the behavior sequence of the system application launching the third-party application and the behavior sequence of the third-party application self-starting in the background.

[0270] A system event monitoring module (SystemEventMonitor) can be set in the system manager to monitor system events reported by the application framework layer. Optionally, the system events reported here include but are not limited to: lock screen or unlock screen, screen on or off, network connection or disconnection, Home or back button, battery, volume, charging connection or disconnection, Wifi connection or not, Bluetooth connection or not, new application installation, application upgrade and application uninstallation.

[0271] An application characteristic analysis module (ApplicationCharacterizationAnalysis) may also be set in the system manager to obtain an illegal static behavior sequence representing illegal static behaviors through a corresponding interface (eg, a getAppStaticCharacter(pkg) interface).

[0272] You can also set up an auto-start application monitoring module (AutoStartAppsMonitor) in the system manager to monitor auto-start applications.

[0273] Optionally, a behavior sequence distribution module can also be set up in the system butler. The behavior sequence distribution module can pre-process the illegal dynamic behavior sequences output by the illegal application data analysis module, the system events output by the system event monitoring module, the self-started applications output by the self-started application monitoring module, and the illegal static behavior sequences output by the application feature analysis module, such as behavior sequence aggregation, formatting and filtering, and then distribute the filtered illegal behavior sequences that need to be monitored to the end-side AI model (also known as the end-side decision-making middle platform) and the management database. Optionally, the control information of the above-mentioned different behavior sequences can be reported to the system butler through the control manager, and the system butler's behavior sequence distribution module sends the control information to the management database. Optionally, the behavior sequence distribution module formats the illegal behavior sequences to adapt to the needs of data transmission.

[0274] It should be noted that the above trigger control process can be to add the illegal applications corresponding to the above illegal behavior sequence to the risk control center for control, or to input the illegal behavior sequence into the end-side AI model for direct identification, so as to obtain the risk level corresponding to the illegal behavior sequence, and finally implement different control strategies according to the risk level. For details about the risk control center and control strategy, please refer to the description below, which will not be repeated here.

[0275] 3. Trigger and identify risk levels:

[0276] The terminal device can use the end-side AI model of the application layer to identify the input illegal behavior sequence and obtain the risk level of the illegal application to which the illegal behavior sequence belongs. Exemplarily, the risk level can be divided into level one, level two, level three and level four, or even more levels; it can also be divided into high level (high risk), medium level (medium risk) and low level (low risk). Different risk levels correspond to different management and control strategies. The higher the risk level, the greater the impact on the user, and the more stringent the management and control strategy. In the embodiment of the present application, the number of risk levels is not limited, and the risk level can be divided into a larger number of risk levels according to the sophistication requirements of the management and control.

[0277] Optionally, the end-side AI model may be a trained model issued by the smart cloud platform. The end-side AI model may perform fixed rule recognition and / or AI recognition on the input illegal behavior sequence.

[0278] Optionally, after the system manager inputs the illegal behavior sequence into the end-side AI model, the trigger management module integrated in the end-side AI model determines whether the trigger condition is met. If it is met, the identification process is triggered. If it is not met, the identification process is not triggered. Optionally, the illegal behavior sequence can continue to be identified. Specifically, the above-mentioned illegal behavior sequence includes illegal dynamic behavior sequence, illegal static behavior sequence and system events. The trigger management module can monitor the illegal behavior sequence that meets the trigger condition based on the illegal dynamic behavior sequence and the illegal static behavior sequence in combination with the system event, and then execute the subsequent identification process.

[0279] Optionally, system events include, but are not limited to: one or more of: screen lock or unlock, screen on or off, network connection or disconnection, Home or back button, battery level, volume, charging connection or disconnection, Wifi connection or not, Bluetooth connection or not, new application installation, application upgrade, and application uninstallation.

[0280] Specifically, since many illegal behaviors are triggered when system events are monitored, for example: when a new application is installed, it will trigger an interface that displays whether to start the antivirus software, which can be linked to the antivirus software; when an application is uninstalled, it will trigger a pop-up window to download and install other similar applications; when the network is disconnected, it will trigger a pop-up window to download free Wifi applications; when the battery power is lower than the threshold, it will trigger a pop-up window of applications such as the battery manager; when the Home button or the back button is clicked, it will trigger an ad pop-up window on the desktop; when the screen is locked, an ad pop-up window will pop up, and the ad pop-up window that pops up when the screen is locked will be directly displayed on the unlock page; when the screen is turned on, an ad pop-up window will be displayed, etc. Then the system manager can determine that the trigger conditions are met when these system events occur, thereby triggering the identification process. This implementation method can combine system events to clarify the scenarios that need to be identified and controlled, so that the recognition rate and accuracy of illegal behavior sequences are higher, thereby improving the control accuracy of illegal applications.

[0281] For another example, the system manager can also determine whether the terminal device is currently suitable for triggering the identification process based on system events. That is, the triggering conditions may include that the battery power is greater than or equal to the preset power threshold, and / or the temperature is lower than the preset temperature threshold. Specifically, the system manager can determine whether the temperature of the current terminal device is lower than the preset temperature threshold, and / or whether the battery power is greater than or equal to the preset power threshold and is in a charging state, to determine whether the current resources of the terminal device are suitable for triggering the identification process. If the current battery power is sufficient or in a charging state, the identification process can be triggered; if the current battery power is insufficient and is not in a charging state, the identification process will not be triggered, thereby reducing the power consumption of the terminal device; if the temperature of the terminal device exceeds the preset temperature threshold, the identification process will not be triggered to avoid overheating of the terminal device, resulting in damage to the device or the user finding it hot; if the temperature of the terminal device is lower than the preset temperature threshold, the identification process can be started without worrying about problems caused by overheating.

[0282] Optionally, before the end-side AI model performs fixed rule recognition and / or AI recognition, the input illegal behavior sequence may be first identified based on a preset illegal list issued by the security cloud platform:

[0283] Optionally, the preset illegal list may include an illegal blacklist and / or an illegal whitelist. Among them, the illegal blacklist may include at least one package name of an illegal application whose risk level has been identified, that is, the illegal blacklist may include at least one package name of an illegal application and the risk level corresponding to each package name. The illegal blacklist here may also be the aforementioned identified illegal blacklist. The illegal whitelist may also include at least one package name that has been identified as not an illegal application. The illegal blacklist here may also be the aforementioned identified illegal whitelist.

[0284] Specifically, the end-side AI model can first search for the package name corresponding to the illegal behavior sequence in the preset illegal list. If the package name of the illegal behavior sequence exists in the illegal blacklist, there is no need to perform fixed rule recognition or AI recognition. The risk level of the package name corresponding to the illegal behavior sequence in the illegal blacklist can be directly obtained. The risk level is also the risk level of the illegal application to which the illegal behavior sequence belongs.

[0285] If the package name of the illegal behavior sequence exists in the illegal whitelist, it means that the illegal application to which the illegal behavior sequence belongs is actually not illegal, but legal. For example, although pop-ups appear continuously in common chat apps, they are message pop-ups, which are the behavior expected by users. The terminal device can remove the illegal application corresponding to the illegal behavior sequence from the risk control center and no longer monitor the illegal application.

[0286] Optionally, the preset illegal list may also include a virus list. Among them, the virus list may include a virus blacklist and a virus whitelist. The virus blacklist represents a list of applications that are determined to be virus applications, and the virus whitelist represents a list of applications that are determined not to be virus applications. If the package name of the illegal behavior sequence exists in the virus blacklist, it can be directly determined that the package name of the illegal behavior sequence corresponds to the highest risk level, or the risk level specific to the virus application, and the most stringent control policy corresponding to the virus application is executed. If the package name of the illegal behavior sequence exists in the virus whitelist, it can be directly determined that the package name of the illegal behavior sequence does not correspond to the highest risk level, and other control policies other than the most stringent control policy corresponding to the virus application can be executed. Optionally, the above-mentioned virus list may be the result of killing by a virus engine. The virus engine may be a module separated from the end-side AI model, or a module integrated in the end-side AI model specifically for killing viruses. The embodiments of the present application are not limited to this.

[0287] Optionally, if the package name of the illegal behavior sequence does not exist in the above-mentioned preset illegal list, it means that the illegal behavior sequence is a behavior sequence generated by an unrecognized application and needs to be identified. The terminal-side AI model can be used to perform fixed rule identification and / or AI identification to obtain the identification result.

[0288] First, fixed rule identification is introduced: Usually, the system manager can receive the configuration file including fixed rules issued by the security cloud platform and parse it to obtain the fixed rules, or it can use the fixed rules preset in the system manager, and then judge the input illegal behavior sequence according to the fixed rules. Optionally, if the fixed rules cannot identify the risk level, the illegal behavior sequence can continue to be AI identified to obtain the risk level. Fixed rules may include, but are not limited to, the number of pop-up windows in a fixed time period exceeds the first number threshold for high risk, the number of pop-up windows exceeding the second number threshold and less than the first number threshold for medium risk, and the number of pop-up windows exceeding the third number threshold and less than the second number threshold for low risk, where the first number threshold is greater than the second number threshold, and the second number threshold is greater than the third number threshold.

[0289] Next, we will introduce AI recognition: the function module that performs AI recognition can be the function module of AI recognition in the end-side AI model trained by the smart cloud platform. The function module of AI recognition can perform feature analysis on the input illegal behavior sequence to obtain the recognition result.

[0290] Optionally, the above-mentioned process of determining whether to trigger the identification process and identifying the list according to the preset illegal list can be executed by using separate functional modules, or can be integrated with fixed rule identification and AI identification in the end-side AI model for execution. When integrated in the end-side AI model for execution, the entire identification process can be decoupled from the control process, and only the illegal behavior sequence needs to be input into the end-side AI model, thereby realizing the decoupling of the identification process and facilitating deployment.

[0291] Optionally, the end-side AI model may also use fixed rule recognition to obtain a rule recognition result on the one hand, and use AI recognition to obtain an AI recognition result on the other hand, and then select one of the rule recognition result and the AI ​​recognition result as the final recognition result.

[0292] Optionally, the end-side AI model may first adopt fixed rule recognition. If the rule recognition result can be obtained, the fixed rule recognition is more efficient. If the fixed rule cannot be recognized, the illegal behavior sequence can continue to be AI recognized to improve the recognition rate.

[0293] It should be noted that the identification result may include the identification of the illegal application corresponding to the illegal behavior sequence (for example, the package name of the illegal application) and the risk level. Optionally, the identification result may also carry the identification date, risk level score, and identification source. Different risk levels may correspond to different risk scores. Optionally, the format of the identification result output may be exemplarily expressed as a blacklist field:

[0294] The blacklist fields include: AI recognition results;

[0295] {

[0296] "date":"2000-01-17", [identification date];

[0297] “pkgname”:”pkg5”, [application package name];

[0298] "level":"1", [risk level 1: rogue application; risk level 0, non-rogue application];

[0299] "score":"50",[risk score];

[0300] “source”:”user_model” [Identification source: end / cloud-model / rule cloud_rule; cloud_model; user_rule; user_model].

[0301] In the above blacklist field, risk level 1 indicates illegal applications, and risk level 0 indicates non-illegal applications; the risk score indicates the frequency or probability of illegal behavior. The higher the risk score, the higher the risk level and the stricter the corresponding control rules. cloud_rule indicates that the source of identification is the result of fixed rule identification on the cloud side; cloud_model indicates that the source of identification is the result of AI identification on the cloud side; user_rule indicates that the source of identification is the result of fixed rule identification on the terminal side; user_model indicates that the source of identification is the result of AI identification on the terminal side.

[0302] If the end-side AI model identifies an illegal application, the illegal application and the corresponding risk level are added to the illegal blacklist so that the next time the behavior sequence appears, there is no need to identify it, and the identification result can be obtained directly by querying the illegal blacklist in the preset illegal list.

[0303] Optionally, the end-side AI model may first identify the illegal behavior sequence to obtain a preliminary identification result, and then modify the preliminary identification result according to the virus application list.

[0304] For example, see Table 2:

[0305] If the package name of the application does not exist in the virus application list (empty or NA), the final identification result shall be based on the preliminary identification result. That is, if the preliminary identification result is high risk, the final identification result shall be high risk; if the preliminary identification result is medium risk, the final identification result shall be medium risk; if the preliminary identification result is low risk, the final identification result shall be low risk; if the preliminary identification result is not a risky application (i.e., an illegal application whitelist), the final identification result shall be not a risky application.

[0306] If the virus application list indicates that the application is on the virus blacklist (determined to be a virus), and the preliminary identification result of the illegal application is empty, the final identification result is high risk, which means it is treated as a virus; if the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is empty, the final identification result is not a virus application.

[0307] If the virus application list indicates that the application is not a virus (white list of virus applications), and the preliminary identification result of the illegal application is high risk or medium risk, the final identification result is medium risk.

[0308] Table 2

[0309] Virus Application List Preliminary identification results of illegal applications Final recognition result Empty(NA) High Risk / Medium Risk / Low Risk / White High Risk / Medium Risk / Low Risk / White Black / White Empty(NA) High Risk / White white High Risk / Medium Risk Medium risk

[0310] Optionally, after the identified illegal application is added to the illegal blacklist, when the illegal behavior of the illegal application occurs, the control rule instantiation can be triggered to obtain the control rule corresponding to the illegal application, and then control is performed according to the control rule.

[0311] Optionally, the end-side AI model can also report illegal behavior sequences to the smart cloud platform at regular intervals, and the smart cloud platform retrains or corrects the end-side AI model based on the illegal behavior sequences reported by the terminal devices, making the end-side AI model more accurate. After the smart cloud platform collects a variety of different illegal behavior sequences (i.e., group data) reported by more terminal devices, it can train the end-side AI model more comprehensively and accurately. The updated end-side AI model can be sent to the end-side at an appropriate time. Usually, management tools such as aiSplitAPK are set up on the smart cloud platform, which can be used to manage the end-side AI model, such as managing the download or update of the end-side AI model. When the smart cloud platform sends the updated end-side AI model to the end-side, even if some illegal behaviors that have not appeared before appear on the current terminal device, and these illegal behaviors have been reported by other terminal devices, then the terminal device that currently accepts the updated end-side AI model does not need to wait until the illegal behavior occurs itself and spends a certain amount of time and resources to identify it by itself, and can accurately identify the illegal application through the new end-side AI model and manage it in time. This approach can achieve end-to-end cloud integration and rapid identification when faced with the situation where illegal applications are generated too quickly, thus playing a long-term role in combating illegal applications.

[0312] In other words, the end-side AI model and the cloud-side AI model can collaborate with each other to form an end-cloud combined AI recognition engine. Next, the end-cloud combined AI recognition engine is described based on functional deployment.

[0313] Among them, the end-side AI model includes a data middle platform, which can obtain the dotting data through the data dotting interface and upload it to the smart cloud platform for model training and data analysis on the smart cloud platform. Among them, the dotting data is the collected illegal behavior sequence, such as illegal dynamic behavior sequence, illegal static behavior sequence and system event. Optionally, the illegal dynamic behavior sequence may include a sequence of behaviors such as pop-up window events, chart hiding and transparency, system application pulling up third-party applications, and third-party application background starting activity; illegal static behavior sequences include but are not limited to: application installation source, whether it is set as a device manager application and other static features corresponding to the sequence; it may also include: user feedback data, such as user processing information after risk control reminders, user cleaning background / uninstalling application information after pop-up windows. Optionally, dotting data access can be in the "point management" system, applying for the corresponding dotting data ID, software version (version) and each dotting field that needs to be dotted, after which the data analysis tool will send the dotting data to the data middle platform through a preset interface. Optionally, the data middle platform can also store the dotting data, support data query, and aging.

[0314] The end-side AI model also includes a trigger decision module, which decides whether to trigger the end-side recognition process by monitoring system events, such as providing a time fence as a condition for triggering the recognition process. For example, the time fence can include a newly installed application within three days from the time of installation.

[0315] The end-side AI model is an in-process identification model, that is, when illegal behavior occurs on a single device, when the triggering decision module decides to meet the conditions for triggering the identification process, identification can be performed locally to execute subsequent control processes. For specific identification methods, please refer to the detailed description of the fixed rules and / or AI identification described above, which will not be repeated here. In-process identification means that the illegal behavior is identified on the local device during the occurrence of the behavior, without waiting for the identification results on the cloud side. The local in-process identification can promptly identify the risk level corresponding to the illegal behavior sequence, which is convenient for timely control and improves the user experience.

[0316] The cloud-side AI model is a post-recognition model, and the cloud-side AI model can also include fixed rule recognition and / or AI recognition on the cloud side. The cloud-side AI model uses group data reported by multiple terminal devices as the basis for model training and fixed rule extraction, so the recognition result is more accurate.

[0317] The cloud-side AI model can also display and distribute the recognition results, which can include the package name and the corresponding risk level, and can be used to update the preset illegal list of the security cloud platform. Optionally, users can also manually review and correct the recognition results of the cloud-side AI model, and update the preset illegal list of the security cloud platform with the corrected results.

[0318] Big data analysis and rule extraction: Big data analysis is performed based on the data provided by the data center to extract business rules. The rules have limited coverage but strong certainty, fast speed and quick effectiveness. The AI ​​recognition engine supports big data parameter updates.

[0319] Next, we will compare the accuracy of cloud-side recognition and device-side recognition with specific data:

[0320] First, define recall and precision: See Table 3 for details:

[0321] Table 3

[0322]

[0323] Among them, recall rate = TP / (TP+FN), that is, the recall rate is the number of correctly predicted illegal behaviors / the number of all real illegal behaviors;

[0324] Precision = FP / (TP+FP), i.e. correctly predicted illegal behaviors / all predicted illegal behaviors;

[0325] And the accuracy rate = 1-error rate.

[0326] According to statistics, the recall rate of post-identification on the cloud side is >90%; the accuracy rate (=1-false recognition rate) is >95%; the accuracy rate of in-process identification on the terminal side is >85%, and the accuracy rate of cloud-based identification is even higher.

[0327] 4. Illegal application control:

[0328] After the risk level is identified, different control strategies can be implemented according to the risk level. In order to implement differentiated control strategies, in the embodiment of the present application, different control path identifiers (path IDs) are defined to represent different control paths, and then control is implemented through the control paths.

[0329] Specifically, a control path identifier is defined for each control path (path ID). The control path can be represented by a non-repeating identifier, such as a non-repeating integer, and each control path corresponds to an illegal behavior. Optionally, different illegal behaviors may also include different startup methods or startup paths for behaviors that are not expected by the user. For example, control path 1001 corresponds to a pop-up window on the lock screen interface; control path 1002 corresponds to a pop-up window on the desktop background; control path 1003 corresponds to a pop-up window on the interface of a third-party application. Although these three control paths all represent pop-up behaviors, the corresponding startup methods are different. Optionally, the definition of the control path can be exemplified as shown in Table 4:

[0330] Table 4

[0331]

[0332] In Table 4 above, the behavior source represents the logical function module where the illegal behavior is executed. In Table 4, the source of the control paths 1001, 1002, and 1003 is the window manager. Table 4 defines the illegal behavior of pop-up windows in three different startup paths (from the lock screen interface, from the desktop / background, and from the interface of a third-party application). Therefore, the illegal behaviors of the three startup methods can be managed separately to achieve fine-grained management of pop-up window behaviors.

[0333] The starting control risk level in Table 4 indicates from which risk level to the higher risk level, a consistent control strategy is implemented. In Table 4, whether the default is intercepted indicates whether the illegal behavior is intercepted or not intercepted (released) in the default state. Taking the content shown in Table 4 as an example, the control path 1001 represents starting from low risk, including medium risk and high risk, and the illegal behavior of the lock screen interface pop-up window is intercepted by default. If the risk level corresponding to the control path 1002 is medium risk, it means starting from medium risk, including high risk, and the illegal behavior of the desktop / background pop-up window is intercepted by default. Optionally, the default flag bit of whether to intercept is "yes" or "Y" to indicate interception, and can also be represented by characters such as "1" or "true". Of course, if the corresponding default interception is not intercepted, then the corresponding flag bit can be "no", "N", "0" or "false" and other characters indicating negative interception, indicating that it is not intercepted and is in a state of release.

[0334] Optionally, the control path shown in Table 4 is only an example, and the control paths actually defined include more types. For example, it also includes various illegal behaviors performed by other logical function modules, such as background keep alive, launching together with system applications, etc., and the control path identifiers of different illegal behaviors are different.

[0335] In some embodiments, each control path can be represented by a globally unique integer. The control path can support expansion and continuous evolution. For example, when it is necessary to add control of new illegal behaviors, a new control path can be used to uniquely represent the newly added illegal behavior, and the control path that has been used before or has been abandoned will not be reused. If an unused control path needs to be abandoned, this unused control path will no longer be reused for other illegal behaviors, thereby ensuring the uniqueness of the control path. In this way, even in the process of system version iteration, when new and old system versions are cross-used between different terminal devices, the uniqueness of the control path can ensure that the control strategy is compatible with the new and old versions, and no logical confusion will occur. In addition, for abandoned control paths, the corresponding illegal behaviors will no longer be controlled and released by default, that is, the illegal behaviors will no longer be intercepted, which can reduce invalid interception behaviors and save system resources.

[0336] Optionally, the evolution of the control path can also be reflected in the subdivision of the control path. For example, the initial control path of the pop-up behavior is 100, and 100 represents the pop-up behavior of all startup methods. But later it was discovered that not all pop-up behaviors can meet the usage requirements by executing the same control method. Then the pop-up behavior can be subdivided into three types according to the startup method: lock screen interface pop-up, desktop / background pop-up, and third-party application interface pop-up as shown in Table 4, and the three new control path identifiers 1001, 1002, and 1003 are added to represent them one by one, so that differentiated control can be performed for different startup methods of pop-up behaviors, and fine-grained control can be achieved, making the control strategy more accurate and improving the user experience. The original control path 100 can be discarded and no longer used.

[0337] The previous article introduced the control path. Next, we will introduce the relationship between the control path and different risk levels.

[0338] Take the example of identifying risk levels including high risk, medium risk and low risk:

[0339] For high-risk applications, you can join the risk management center. If it is an application with the highest risk level, it will also be treated as a virus application. For example, for high-risk applications, the control paths that need to be controlled may include: shutting down the network, disabling permissions, shutting down notifications, prohibiting background pop-ups, prohibiting automatic startup, prompting uninstallation, etc. Optionally, high-risk applications can be controlled directly by the system manager according to the control rules of high-risk applications without the user's awareness. Optionally, a pop-up window such as Figure 5The interface of the risk control center shown in the figure, users can operate the controls corresponding to different illegal behaviors in the interface to adjust the control strategy. Users can also click the "Uninstall" control to directly uninstall the high-risk application. The control path corresponding to the illegal behavior that needs to be controlled can be added to the instantiation result of the high-risk application. Among them, the instantiation result is used to characterize the specific strategy when the application executes control. The specific process of instantiation can be described in detail in the following description, which will not be repeated here.

[0340] Here we first explain the risk control center. The risk control center is a user experience interface (User Experience, UX) of the system manager. You can refer to Figure 8 shown. Figure 8 The risk details interface of an illegal application with a high risk level is shown. Figure 8 Taking the illegal application as a film and television application as an example, the interface can include the name of the illegal application (advertising application), the risk level (high), and multiple illegal behavior controls (for example, including but not limited to: connecting to the network, privacy permissions, background pop-ups, notifications, and installing other applications within the application, etc.). Users can click on different controls to adjust the management and control strategy. For example, when the user clicks on the control to close the background pop-up window, it means that there is no need to control the background pop-up behavior of the advertising application, that is, the user allows advertising pop-ups to appear. It should be noted that when the user does not manually operate the risk details interface, the settings of each control in the risk details interface can be the default state, that is, follow the default high-risk application management rules.

[0341] For medium-risk applications, you can also join the risk control center for management and control. For medium-risk applications, the illegal behaviors that need to be controlled are not as strict as those for high-risk applications, and the control paths that need to be controlled are not as many as those for high-risk applications. For example, for medium-risk applications, the control paths that need to be controlled may include: turning off notifications, prohibiting background pop-ups, and prohibiting automatic startup. Optionally, after identifying the risk level, the medium-risk application can display the control interface of the risk control center on the interface of the terminal device according to the risk level, so that the user can clearly perceive that the application is being controlled. Optionally, the control interface of the risk control center for medium-risk applications can be found in Fig. 9 The risk details interface shown includes application identification, risk level, and controls corresponding to multiple management paths.

[0342] For example, when the risk level of a film and television application is identified as medium risk, the following is displayed: Fig. 9 The management and control interface of the risk management center allows users to clearly perceive that the system manager has performed risk management on the current film and television applications, which can improve the user experience. Fig. 9Also shown are icons of multiple control paths, and the switch controls corresponding to each control path. Optionally, the initial settings of the switch controls corresponding to each control path in the control interface of the risk control center can be set according to the default control policy for medium-risk applications. When the user observes the control interface of the risk control center, he can manually modify the settings of the switch controls corresponding to each control path according to his own needs, thereby modifying the control policy for medium-risk applications. When the user operates the switch control of a control path, the default control policy will be updated. For example, the user can turn on the switch control of a control path to intercept the control path, or turn off the switch control of a control path to open the control path. For example, if the user clicks on Fig. 9 The switch control for turning off notifications in the notifications view cancels the control for turning off notifications. When notification messages arrive, they will not be intercepted and can be displayed normally.

[0343] For low-risk applications, if they are legal and compliant applications that are widely used by users, such as applications with a large number of downloads (such as applications ranked in the top 3,000 in terms of downloads), it means that the application is a widely verified legal application and does not need to be added to the risk control center, let alone display the control interface of the risk control center, which can save control resources. Then the control paths corresponding to low-risk applications can also be reduced relative to medium-risk and high-risk applications. For example, the system manager can control some pop-up behaviors that users do not expect, such as prohibiting background pop-ups.

[0344] The previous article introduced the management and control principles for applications of different risk levels. Next, we will introduce how to implement management and control strategies for applications of different risk levels based on the management paths.

[0345] Specifically, the terminal device can receive the control rule configuration file issued by the security cloud platform through the system manager. The system manager can parse the control rule configuration file to obtain the control path set corresponding to different risk levels, and then obtain the control path set corresponding to the application program of different risk levels based on the risk level corresponding to the application program, thereby realizing the instantiation of the control rules. The control rules in the above-mentioned control rule configuration file may include general control rules. Taking the different risk levels including high risk, medium risk and low risk as an example, the general control rules may include: control path set 1 corresponding to low risk, control path set 2 corresponding to medium risk and control path set 3 corresponding to high risk.

[0346] For example, it can be expressed in the following form:

[0347] Low risk (low): [1001, 1002, 1003...], indicating the control paths that low-risk applications need to control (control path set 1);

[0348] Medium risk (middle): [2001, 2002, 2003...], indicating the control paths (control path label set 2) that need to be controlled for medium risk level applications;

[0349] Medium risk (high): [2100001, 2100002, 2100003...], indicating the control paths (control path set 3) that need to be controlled for high-risk applications.

[0350] In some embodiments, common rules can also be divided into fixed common rules (CommonPolicy) corresponding to fixed identification rules and AI common rules (aiCommonPolicy) identified by AI. If the risk level is identified by a fixed rule, it is managed and controlled according to the fixed common rules. If the risk level is identified by AI, it can be managed and controlled according to the AI ​​common rules. Which one is executed can be determined based on the identification source in the identification result. Optionally, the control paths for different risk levels of fixed common rules and AI common rules may be consistent, or there may be certain differences.

[0351] Optionally, in addition to general rules, the above control rules may also include special rules. Special rules may include some control rules for specific applications, such as separate control rules for blacklist applications. Special rules include, but are not limited to, any one or more combinations of package name, risk level, control date, added control path, and removed control path.

[0352] Exemplarily, generating the control policy logic for pkg1 (that is, the process of instantiating the control rules) includes: obtaining the collection of control paths corresponding to the current risk level of the current pkg1 from the general rules issued by the cloud side, then adding the control paths added in the special rules of pkg1 issued by the cloud side, and finally deleting the control paths removed from the special rules of pkg1 issued by the cloud side, to obtain the final set of all paths that need to be controlled corresponding to pkg1. This process is called control rule instantiation, and the final set of all paths that need to be controlled corresponding to pkg1 is the result of instantiating the control rules for pkg1.

[0353] Taking the package name pkg1 as an example, the special rules of pkg1 may include: package name, risk level, control date, added control paths (indicating paths that currently require more control), and removed control paths (indicating paths that currently do not require control). For example:

[0354] The package name is: pkg1;

[0355] The risk level is: low risk;

[0356] The control date is: 20221008;

[0357] The added control paths are: 2001, 2003;

[0358] The removed control path is 1001.

[0359] Then the logic of the control rule instantiation process of pkg1 can be: the control path set 1 corresponding to low risk [1001, 1002, 1003], plus the added control path: [2001, 2003], minus the removed control path

[1001] , and the final control path [1002, 1003, 2001, 2003]. This method can adjust the control strategy for each application separately, realize more fine-grained differentiated control of the application, and improve the control efficiency and accuracy. This process can be called control rule instantiation, and the result of instantiation is the package name of the application and the corresponding control path set that needs to be controlled. If the control rules are instantiated for the above-mentioned suspected application according to the corresponding target risk level, the control path set obtained is the above-mentioned target control path set.

[0360] In the above control strategies, since the results obtained by AI recognition have not been manually reviewed and confirmed, the corresponding control strategies may be different from the control strategies corresponding to the applications in the illegal blacklist. The control rules can be configured differently for these two situations. The specific method can be to define differentiated control rules based on different identification sources.

[0361] It should be noted that if the user targets an application that has already generated instantiation results, the user can adjust the control strategy through the risk control center. Specifically, the user can turn on or off the control corresponding to a certain control path on the risk details page corresponding to the application, and the system manager will update the control path set in the instantiation result according to the user operation. For example, when the user changes the notification control from off to on, it means that the user does not want to see the notification, and the system manager will delete the control path corresponding to the notification from the originally instantiated control path set; when the user changes the background pop-up control from on to off, it means that the user allows the background pop-up, and the system manager will add the control path corresponding to the background pop-up to the originally instantiated control path set. After that, the updated new control path set will be sent to the control manager to implement control.

[0362] Optionally, after the control rules are instantiated, the instantiation results can be stored in the system butler. When the system butler finds the first occurrence of illegal behavior, it can trigger the instantiation results to be sent to the control manager. The control manager can store the instantiation results, that is, store the control rule table, and provide an interface for WMS, iAWare and other logical function modules to query. When the logical function module performs illegal behavior again, it can first query the control rule table in the control manager. If the queried control path exists in the control rule table, it means that the illegal behavior corresponding to the control path needs to be controlled, and the illegal behavior will not continue to be executed, thereby achieving control of the illegal behavior. If the queried control path does not exist in the control rule table, it means that the illegal behavior corresponding to the control path does not need to be controlled, and the illegal behavior will continue to be executed. Afterwards, the monitoring of illegal behaviors for which control strategies have been implemented can be stopped to save system resources and power consumption.

[0363] If the control rules for the above-mentioned suspected applications are instantiated according to the corresponding target risk level, the obtained control path set is the above-mentioned target control path set. After that, the monitoring of suspected behaviors can be stopped. That is, the identifiers of suspected behavior sequences and / or all behavior sequence identifiers corresponding to the identifiers of suspected applications in the behavior sequence whitelist can be deleted, and the corresponding callbacks can be cleared, which can save storage space, reduce the number of monitored behaviors, and save system resources and power.

[0364] The above sequence diagram of installing a safe application that is determined not to be an illegal application and installing an identified illegal application can be found in Fig.10 As shown, including:

[0365] S1001 (S1001'), the system manager receives the list and rules issued by the security cloud platform during idle time, including: the identified illegal blacklist, the identified illegal whitelist, and the preset control rules.

[0366] S1001', the system manager receives rules and models issued by the smart cloud platform during idle time, such as the end-side AI model and fixed recognition rules.

[0367] Optionally, the receiving timing may be when the network connection is Wifi, which can save network resources; or when the terminal device is in a charging state, the power consumption can be ignored; or it may be when the network connection is Wifi and the terminal device is in a charging state, or other idle times.

[0368] S1002, downloading a new application from the application market.

[0369] Fig.10 In the figure, a newly installed application is taken as an example as an illegal application that needs to be identified.

[0370] S1003: The system manager monitors the installation event of a new application, and determines that the new application is not an application in the identified illegal whitelist or the identified illegal blacklist, and records it as an illegal application.

[0371] S1004. The illegal application calls the logic function module to output the illegal behavior sequence, and queries the corresponding control path in the control manager.

[0372] When an illegal application calls the logic function module to output an illegal behavior sequence, it will query whether there is a corresponding control path in the control manager. At this time, there is no control path corresponding to the illegal behavior in the control manager.

[0373] S1005. The control manager queries whether there is any control path and records the execution record of the illegal behavior.

[0374] At this time, there is no corresponding control path in the control manager, so the control result of the query is not intercepted. At the same time, the control manager will record a record of illegal behavior that was not intercepted. At this time, the monitoring of illegal behavior is not started, and only the execution record of illegal behavior is recorded as a query within the process, and there is almost no power consumption.

[0375] S1006. The system manager periodically obtains execution records of illegal behaviors.

[0376] S1007. The system manager determines that the execution record of the illegal behavior meets the monitoring conditions.

[0377] S1008. The system manager issues a monitoring instruction to start monitoring system events and obtaining illegal static behavior sequences.

[0378] After measurement and statistics, after starting monitoring, an illegal application consumes about 0.43 mA of power per day (0.43mA / APP / day).

[0379] S1009. The illegal application calls the logic function module to output the illegal behavior sequence again, and queries the corresponding control path in the control manager again.

[0380] The illegal application calls the logic function module to output the illegal behavior sequence again, and queries the control manager to see if there is a corresponding control path. There is still no corresponding control path. This process is a query action completed at the system application framework layer, which is an in-process call and consumes almost no power.

[0381] S1010. The logic function module reports the illegal behavior sequence to the behavior sequence collector.

[0382] S1011. The behavior sequence collector reports the reported illegal behavior sequence to the system manager.

[0383] The system manager can also format the illegal behavior sequence before transmitting it according to the data transmission requirements.

[0384] S1012. The system manager inputs the illegal behavior sequence into the end-side AI model.

[0385] S1013. The end-side AI model can store illegal behavior sequences and identify risk levels.

[0386] After measurement and statistics, for an illegal application, the power consumption of the edge-side AI model to identify the risk level is 0.3 mA per day (0.3mA / APP / day).

[0387] The end-side AI model can first store the input illegal behavior sequence and then trigger the risk level identification at a fixed time; it can also trigger the risk level identification under specific conditions, such as the input of an illegal behavior sequence, or the triggering of a specific system event.

[0388] S1014. The end-side AI model returns the risk level corresponding to the identified illegal behavior sequence to the system manager.

[0389] S1015. The system manager adds the identifier of the illegal application to the identified illegal blacklist.

[0390] This process will not be called across processes, and there is almost no power consumption loss.

[0391] S1016. The system manager stops monitoring illegal activities.

[0392] Stopping monitoring illegal behavior promptly can save power consumption.

[0393] Specifically, the system manager may issue instructions or update information to delete the identifier of the illegal behavior sequence in the illegal behavior sequence whitelist in the behavior sequence collector, and the behavior sequence collector will no longer report the illegal behavior sequence, thereby stopping the monitoring of illegal behavior.

[0394] S1017. The illegal application calls the logic function module to output the illegal behavior sequence again, and once again queries the corresponding control path in the control manager.

[0395] S1018, the system manager pops up a window to prompt the user whether to join the risk management center, and generates management rules according to the user's instructions. The power consumption of each APP prompted by the system manager pop-up window is about 0.001 mA (0.001mA / APP), which can be ignored.

[0396] S1019. The system manager sends the control rules to the control manager.

[0397] S1020. The illegal application calls the logic function module to output the illegal behavior sequence again, and once again queries the corresponding control path in the control manager.

[0398] S1021. The control manager outputs the result that the illegal behavior needs to be intercepted to intercept the illegal behavior.

[0399] This process is intercepted at the system application framework layer and is an in-process call with almost no power consumption.

[0400] S1022. The control manager records the interception result and reports it to the cloud test at an appropriate time.

[0401] Specifically, the control manager records the results of the interception and reports them to the smart cloud platform at an appropriate time, so that the smart cloud platform can correct the end-side AI model based on the results of the interception. It can also be uploaded to the big data platform to analyze the interception success rate. The appropriate time may be when Wifi is connected and / or when charging. Reporting when Wifi is connected does not require consuming network resources, and reporting when charging can ignore power loss, so it is more reasonable to report data when Wifi is connected and / or when charging.

[0402] After measurement and statistics, the power consumption benefit of intercepting a pop-up window is 3.5 milliamperes per hour (mA / h) compared to executing a pop-up window. The daily power consumption benefit of common illegal applications is about 86.5mA / h. If the illegal behavior is originally kept alive in the background, if it is successfully intercepted, the daily power consumption benefit will be 408mA / h, which has a significant power saving effect.

[0403] Above Fig.10 The process shown details how unidentified illegal applications utilize fewer system resources to implement application management when illegal behavior occurs. Fig.10 The order of the steps in the method can be interchanged when no contradiction occurs. The explanation of the steps can also refer to the explanation of other identical steps in the text, which will not be repeated here.

[0404] In order to systematically describe how to trigger behavior monitoring, the process of triggering and stopping behavior monitoring can be divided into three stages, including: the initial stage, the behavior sequence analysis stage, and the end stage. For details, see Fig.11 The interaction diagram shown may specifically include:

[0405] Initial stage:

[0406] S1101. The logic function module reports illegal behavior sequences to a behavior sequence collector.

[0407] S1102. The behavior sequence collector discards illegal behavior sequences.

[0408] In the initial stage, the identifier of the illegal behavior sequence has not been added to the behavior sequence collector, so the behavior sequence collector does not need to report the illegal behavior sequence to the system manager, and can directly discard the illegal behavior sequence reported by the logical function module without starting monitoring. Generally, if it is an illegal application that has been identified and the illegal application of the control rules has been instantiated, it does not need to be reported and can be directly discarded; it can also be a safe application that has been identified as not an illegal application, and it does not need to be reported and can be directly discarded.

[0409] Behavior sequence analysis phase:

[0410] S1103. The security cloud platform sends configuration files to the system manager every day.

[0411] The configuration file may include monitoring conditions, behavior sequence reporting lists, etc. The configuration file may also be control rules, fixed identification rules, illegal blacklists, illegal whitelists, etc.

[0412] S1104. The system manager receives the illegal behavior sequence reported by the logic function module.

[0413] S1105: The system manager determines that the behavior characteristics of the illegal behavior sequence meet the monitoring conditions.

[0414] S1106. The system manager starts system broadcast monitoring.

[0415] Starting system broadcast monitoring can monitor system events.

[0416] S1107: The system manager issues a behavior sequence reporting callback function to the behavior sequence collector to obtain the package name and behavior sequence identifier of the illegal behavior that is allowed to be reported.

[0417] The package name of the illegal behavior is also the identifier of the illegal application corresponding to the illegal behavior.

[0418] The format of the list of illegal behavior sequences allowed to be reported may include: a list of package names and corresponding behavior sequence identifiers.

[0419] S1108. The logic function module outputs the illegal behavior sequence to the behavior sequence collector.

[0420] S1109: The behavior sequence collector determines whether the illegal behavior sequence matches the list of illegal behavior sequences allowed to be reported.

[0421] The behavior sequence collector checks whether the identifier of the reported illegal behavior sequence exists in the list of illegal behavior sequences allowed to be reported. If not, it is determined that there is no match, and the illegal behavior sequence reported by the logic function module can be discarded and no longer reported.

[0422] S1110 , if there is a match, the behavior sequence collector reports the illegal behavior sequence to the system manager.

[0423] The behavior sequence collector checks whether the list of illegal behavior sequences allowed to be reported contains the identifier of the reported illegal behavior sequence. If so, a match is determined. The behavior sequence collector can establish a callback channel with the system manager to report the illegal behavior sequence.

[0424] Optionally, the data format of the illegal behavior sequence may be: package name, identifier of the illegal behavior sequence, and behavior parameters.

[0425] S1111. The system manager records the reported illegal behavior sequence and reports it to the big data analysis platform.

[0426] The system manager can record and store the reported illegal behavior sequences, and then upload them to the big data analysis platform. For example, the system manager can record the illegal behavior sequences reported within one day and then upload them to the big data analysis platform once a day.

[0427] S1112. The system manager may send the reported illegal behavior sequence to the end-side AI model.

[0428] S1113. The system manager reports illegal static behavior sequences and system events to the end-side AI model.

[0429] S1114. The end-side AI model triggers recognition at regular intervals based on illegal static behavior sequences, illegal dynamic behavior sequences, and system events to obtain recognition results.

[0430] The identification result may include the identification of the application (eg, package name) and the corresponding risk level.

[0431] S1115. The end-side AI model will also report the input illegal behavior sequence to the smart cloud platform.

[0432] The smart cloud platform can correct the AI ​​model (end-side AI model and cloud-side AI model) based on the illegal behavior sequence reported by the end side.

[0433] S1116. The logic function module executes the illegal behavior sequence, triggering the system manager to instantiate the management and control rules.

[0434] Later, when the illegal behavior is performed again, it can be intercepted.

[0435] After completing the behavioral sequence analysis, enter the ending phase.

[0436] Ending stage:

[0437] S1117. The system manager clears the package names of illegal behaviors that are allowed to be reported and the callback function of the behavior sequence identifier report in the behavior sequence collector.

[0438] S1118. The system manager deletes the callback function.

[0439] S1119. The system manager turns off the system broadcast for monitoring system events.

[0440] Fig.11 The order of the steps in the above formula can be interchanged if no contradiction occurs. Fig.11 The explanation of the relevant steps in the above process can also be found in the explanation of other identical steps in the text, which will not be repeated here.

[0441] For a comprehensive and systematic introduction to the technical solutions of the embodiments of the present application, please refer to Fig.12 The architecture diagram shown includes:

[0442] S1201. The security cloud platform issues behavior sequence distribution rules to the system manager.

[0443] S1202. The security cloud platform sends control rules for illegal behavior to the system manager.

[0444] S1203. The security cloud platform sends a preset illegal list to the system manager.

[0445] S1204. The smart cloud platform receives the behavior sequence reported by the terminal side and collects the behavior characteristics.

[0446] S1205. The smart cloud platform performs behavioral characteristic analysis based on the data collected based on the behavioral characteristics.

[0447] S1206. The smart cloud platform trains an AI model based on the results of the behavior feature analysis. The AI ​​model may include a device-side AI model and a cloud-side AI model.

[0448] S1207. The smart cloud platform sends the trained end-side AI model to the terminal device. The end-side AI model carries fixed recognition rules. The smart cloud platform can also use the trained cloud-testing AI model to identify the risk level of illegal behavior sequences on the cloud side.

[0449] S1208: The smart cloud platform performs behavioral feature analysis based on the collected behavioral sequences and obtains an initial illegal list, which may include an illegal blacklist and an illegal whitelist, and may also include an initial virus list.

[0450] S1209. The security cloud platform receives the results of manual review and correction of the initial illegal list, and obtains a preset illegal list or an updated preset illegal list.

[0451] S1210. The logic function module queries the illegal behavior sequence in the control manager to obtain the control result corresponding to the illegal behavior sequence.

[0452] S1211A: When the control result is no control, the illegal behavior sequence is reported to the behavior sequence collector. Then, S1212 is executed.

[0453] S1211B. When the control result is control, the illegal behavior corresponding to the illegal behavior sequence will no longer be executed.

[0454] S1212: The behavior sequence collector reports the illegal behavior sequence to the behavior sequence distribution module of the system manager.

[0455] S1213. The behavior sequence distribution module filters illegal behavior sequences and sends the illegal behavior sequences that need to be monitored to the end-side AI model for identification.

[0456] S1214. The end-side AI model identifies the risk level corresponding to the illegal behavior sequence.

[0457] S1215. The system manager obtains the final risk level based on the identified risk level and the preset illegal list.

[0458] S1214 and S1215 can also be that the system manager first queries the preset illegal list. If there is an illegal behavior sequence in the preset illegal list, the subsequent process can be executed according to the corresponding risk level in the preset illegal list; if there is no illegal behavior sequence in the preset illegal list, continue to input the end-side AI model for identification to obtain the risk level.

[0459] S1216. When the illegal behavior sequence is triggered next time, the system manager triggers the instantiation of the control rules according to the risk level and sends the instantiation results to the control manager.

[0460] S1217. When the illegal behavior sequence is triggered again, the control rules in the control manager are queried to obtain the control result, which is used to control the illegal behavior sequence.

[0461] S1218. The control manager collects the control results and reports them to the system manager.

[0462] S1219. The system manager reports the management and control results to the big data analysis platform.

[0463] S1220. The big data analysis platform sends the statistical control results to the security cloud platform for generating new or updated behavior sequence distribution rules, control rules, and preset illegal lists, etc.

[0464] It should be noted that Fig.12The order of the numbering of the steps in the example is only an example and is not used to limit the order of execution of the steps. Fig.12 The execution of the steps in the process is interleaved and can be in any order if the steps do not conflict with each other. Fig.12 For a detailed description of each step in the above, please refer to the relevant description in the previous text, which will not be repeated here.

[0465] The above describes in detail an example of the method provided by the present application. It is understandable that, in order to implement the above functions, the corresponding device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0466] The present application can divide the functional modules of the device for triggering application monitoring according to the above method example. For example, each function can be divided into each functional module, or two or more functions can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0467] Fig.13 The schematic diagram of the structure of a device for triggering application monitoring provided by the present application is shown. The device 1300 is applied to a terminal device and includes:

[0468] An acquisition module 1301 is used to acquire a record of a suspected behavior sequence, where the record of the suspected behavior sequence is used to characterize the behavior characteristics of the suspected behavior corresponding to the suspected behavior sequence;

[0469] The determination module 1302 is used to start monitoring of the suspected behavior if the record of the suspected behavior sequence indicates that the suspected behavior meets a preset monitoring condition. The monitoring condition is used to determine whether the behavior characteristics of the suspected behavior reach a level that requires monitoring on the terminal device.

[0470] In some embodiments, the determination module 1302 is also used to not start monitoring of the suspected behavior if the record of the suspected behavior sequence indicates that the suspected behavior sequence does not meet the monitoring condition, and to enable the acquisition module 1301 to continue to execute the step of acquiring the record of the suspected behavior sequence in the next monitoring cycle.

[0471] In some embodiments, the monitoring conditions include a combination of one or more of the following conditions: the installation duration of the suspected application corresponding to the suspected behavior sequence is less than or equal to a preset day threshold, and the number of executions of the suspected behavior corresponding to the suspected behavior sequence within a first preset time period exceeds the first preset number threshold; the upgrade duration of the suspected application is less than or equal to the preset day threshold, and the number of executions of the suspected behavior within the first preset time period exceeds the first preset number threshold; the installation duration and / or upgrade duration of the suspected application is greater than the preset day threshold, and the number of executions of the suspected behavior within the second preset time period exceeds the second preset number threshold; the identifier of the suspected application exists in the list of applications to be monitored, and the device identifier of the terminal device The identification and the identification of the suspected application match the device identification corresponding to the list of monitored applications, the list of monitored applications includes multiple identifications of monitored applications that need to be monitored, and the list of monitored applications is a list issued by Cloud Measurement; the identification of the suspected application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the suspected application, and the blacklist of identified illegal applications includes at least one identification of an illegal application; the identification of the suspected application exists in the blacklist of identified illegal applications, and there is no control path corresponding to the suspected behavior sequence in the existing control path corresponding to the suspected application; wherein, the first preset time period is a time period less than one day, and the second preset time period is a time period less than or equal to one day.

[0472] In some embodiments, the monitoring conditions also include: the temperature of the terminal device is lower than a preset temperature threshold, and / or the battery power of the terminal device in an uncharged state is greater than a preset power threshold.

[0473] In some embodiments, the determination module 1302 is specifically configured to use a behavior sequence collector to report the suspected behavior sequence to the system manager to initiate monitoring of the suspected behavior.

[0474] In some embodiments, the determination module 1302 is specifically used to use the system manager to generate a behavior sequence whitelist when the suspected behavior sequence meets the monitoring conditions, and send the behavior sequence whitelist to the behavior sequence collector, the behavior sequence whitelist including the identifier of the suspected application and the identifier of the suspected behavior sequence; and use the behavior sequence collector to receive the behavior sequence to be identified reported by the logical function module; and use the behavior sequence collector to determine whether the behavior sequence to be identified matches the behavior sequence whitelist, the behavior sequence whitelist including the identifiers of M behavior sequences that need to be monitored and the identifier of the corresponding application program, M is a non-negative integer; if so, the behavior sequence collector is used to determine that the behavior sequence to be identified is a suspected behavior sequence, and the suspected behavior sequence is reported to the system manager; if not, the behavior sequence collector is used to discard the behavior sequence to be identified.

[0475] In some embodiments, determination module 1302 is also used to use an end-side AI model to identify the risk level of a suspected behavior sequence to obtain a target risk level. The target risk level is used to characterize the degree of influence of a suspected application corresponding to the suspected behavior sequence on the user. The end-side AI model is an AI model trained on the cloud side. The end-side AI model is used to identify the risk level corresponding to the application to which the behavior sequence belongs; according to the target risk level, a target control strategy corresponding to the suspected application is determined, and the target control strategy is used to control the suspected application.

[0476] In some embodiments, the suspected behavior sequence includes a suspected dynamic behavior sequence and an illegal static behavior sequence. The acquisition module 1301 is specifically used to obtain the suspected dynamic behavior sequence; if the identifier of the suspected dynamic behavior sequence exists in the behavior sequence whitelist, the system event monitoring is started to obtain system events, and the illegal static behavior is scanned to obtain the illegal static behavior sequence, and the illegal static behavior sequence is used to characterize the illegal static behavior existing on the terminal device; and the suspected dynamic behavior sequence and the illegal static behavior sequence are reported to the system manager.

[0477] In some embodiments, the determination module 1302 is also used to determine whether the suspected behavior sequence meets the trigger condition based on the system event, and the trigger condition is used to characterize whether it is necessary to identify the risk level of the suspected behavior sequence; if so, the terminal-side AI model is used to identify the risk level of the suspected behavior sequence to obtain the target risk level.

[0478] In some embodiments, the determination module 1302 is specifically used to use the trigger management module in the end-side AI model to determine whether the suspected behavior sequence meets the trigger condition based on the system event; use the recognition module in the end-side AI model to identify the risk level of the dynamic behavior sequence and the illegal static behavior sequence to obtain the target risk level; when the suspected behavior sequence does not meet the trigger condition, the recognition module is not used to identify the risk level of the suspected behavior sequence.

[0479] In some embodiments, the determination module 1302 is further used to stop monitoring the suspected behavior after determining the target control policy corresponding to the suspected application according to the target risk level.

[0480] In some embodiments, the determination module 1302 is specifically configured to delete the identifier of the suspected behavior sequence in the behavior sequence whitelist.

[0481] In some embodiments, the acquisition module 1301 is specifically used to monitor the installation event or upgrade event of the suspected application corresponding to the suspected behavior sequence; if the identifier of the suspected application is not the identifier of the application in the identified illegal blacklist, and is not the identifier of the application in the identified illegal whitelist, then obtain the record of the suspected behavior sequence; wherein the identified illegal blacklist includes the identifier of at least one application with an identified risk level, and the identified illegal whitelist includes the identifier of at least one application that is not an illegal application.

[0482] In some embodiments, determination module 1302 is specifically used to determine the target control strategy corresponding to the suspected application if the identifier of the suspected application is the identifier of an application in an identified illegal blacklist, based on the target risk level and preset control rules corresponding to the identifier of the suspected application in the identified illegal blacklist; the suspected application is controlled according to the target control strategy, and the preset control rules include a set of control paths corresponding to different risk levels.

[0483] In some embodiments, the determination module 1302 is specifically used to use the system manager to instantiate the control rules for the suspected application according to the target risk level and preset control rules, obtain the target control path set corresponding to the suspected application, and use the system manager to send the target control path set to the control manager, and use the logical function module to query whether there is a control path corresponding to the suspected behavior sequence in the control manager; if so, intercept the suspected behavior.

[0484] In some embodiments, the determination module 1302 is specifically configured to not initiate monitoring of the suspected behavior when the suspected application is an application in an identified illegal whitelist.

[0485] In some embodiments, the acquisition module 1301 is also used to receive any one or more of an identified illegal blacklist, an identified illegal whitelist, a terminal-side AI model, and preset control rules when the terminal device is in a Wi-Fi connected and / or charging state before obtaining a record of a suspected behavior sequence.

[0486] The specific manner in which device 1300 executes the method of triggering application monitoring and the beneficial effects produced can be found in the relevant description of the method embodiment, which will not be repeated here.

[0487] The present application also provides an electronic device, including the above processor. The electronic device provided by this embodiment can be Figure 1The terminal device 100 shown is used to execute the above-mentioned method for triggering application monitoring. In the case of an integrated unit, the terminal device may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the terminal device, for example, it can be used to support the terminal device to execute the steps performed by the display unit, the detection unit and the processing unit. The storage module can be used to support the terminal device to execute the stored program code and data, etc. The communication module can be used to support the communication between the terminal device and other devices.

[0488] Among them, the processing module can be a processor or a controller. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processor (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other terminal devices, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc.

[0489] In one embodiment, when the processing module is a processor and the storage module is a memory, the terminal device involved in this embodiment may be a Figure 1 Device of the structure shown.

[0490] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the method for triggering application monitoring described in any of the above embodiments.

[0491] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the method for triggering application monitoring in the above-mentioned embodiment.

[0492] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0493] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, the replaced units may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0494] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0495] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0496] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for triggering application monitoring, characterized in that: Applied to a terminal device, the method comprises: Acquire a record of a suspected behavior sequence, wherein the record of the suspected behavior sequence represents a behavior feature of the suspected behavior corresponding to the suspected behavior sequence; If the record of the suspected behavior sequence indicates that the suspected behavior meets a preset monitoring condition, monitoring of the suspected behavior is initiated, and the monitoring condition is used to determine whether the behavioral characteristics of the suspected behavior on the terminal device reach a level that requires monitoring.

2. The method according to claim 1, characterized in that The method further comprises: If the record of the suspected behavior sequence indicates that the suspected behavior sequence does not meet the monitoring condition, monitoring of the suspected behavior is not initiated, and the step of obtaining the record of the suspected behavior sequence is continued in the next monitoring cycle.

3. The method according to claim 1, characterized in that The monitoring conditions include one or more combinations of the following conditions: The installation duration of the suspected application corresponding to the suspected behavior sequence is less than or equal to a preset number of days threshold, and the number of executions of the suspected behavior corresponding to the suspected behavior sequence within a first preset time period exceeds a first preset number threshold; The upgrade duration of the suspected application is less than or equal to a preset number of days, and the execution times of the suspected behavior within a first preset time period exceeds the first preset number of times threshold; The installation time and / or upgrade time of the suspected application is greater than the preset day threshold, and the execution times of the suspected behavior within the second preset time period exceeds the second preset number threshold; The identifier of the suspected application exists in the list of applications to be monitored, and the device identifier of the terminal device and the device identifier corresponding to the identifier of the suspected application in the list of applications to be monitored match, the list of applications to be monitored includes identifiers of multiple applications to be monitored that need to be monitored, and the list of applications to be monitored is a list issued by Cloud Testing; The identifier of the suspected application exists in the blacklist of identified illegal applications, and there is no corresponding control path for the suspected application, and the blacklist of identified illegal applications includes the identifier of at least one illegal application; The identifier of the suspected application exists in the blacklist of identified illegal applications, and the existing control path corresponding to the suspected application does not contain a control path corresponding to the suspected behavior sequence; The first preset time period is a time period that is less than one day, and the second preset time period is a time period that is less than or equal to one day.

4. The method according to claim 3, characterized in that The monitoring conditions also include: The temperature of the terminal device is lower than a preset temperature threshold, and / or the battery power of the terminal device in an uncharged state is greater than a preset power threshold.

5. The method according to any one of claims 1 to 3, characterized in that The initiating monitoring of the suspected behavior includes: The suspected behavior sequence is reported to the system manager by using a behavior sequence collector to start monitoring of the suspected behavior.

6. The method according to claim 5, characterized in that The adopting a behavior sequence collector to report the suspected behavior sequence to a system manager includes: When the suspected behavior sequence meets the monitoring condition, the system manager generates a behavior sequence whitelist, and sends the behavior sequence whitelist to the behavior sequence collector, wherein the behavior sequence whitelist includes an identifier of the suspected application and an identifier of the suspected behavior sequence; The behavior sequence collector is used to receive the behavior sequence to be identified reported by the logic function module; The behavior sequence collector is used to determine whether the behavior sequence to be identified matches the behavior sequence whitelist, wherein the behavior sequence whitelist includes identifiers of M behavior sequences that need to be monitored and identifiers of corresponding application programs, where M is a non-negative integer; If yes, the behavior sequence collector is used to determine that the behavior sequence to be identified is the suspected behavior sequence, and the suspected behavior sequence is reported to the system manager; If not, the behavior sequence collector is used to discard the behavior sequence to be identified.

7. The method according to claim 6, characterized in that After the behavior sequence collector is used to report the suspected behavior sequence to the system manager, the method further includes: The device-side AI model is used to identify the risk level of the suspected behavior sequence to obtain a target risk level, where the target risk level is used to characterize the degree of influence of the suspected application corresponding to the suspected behavior sequence on the user. The device-side AI model is an AI model trained on the cloud side, and the device-side AI model is used to identify the risk level corresponding to the application to which the behavior sequence belongs; A target control strategy corresponding to the suspected application is determined according to the target risk level, and the target control strategy is used to control the suspected application.

8. The method according to claim 7, characterized in that The suspected behavior sequence includes a suspected dynamic behavior sequence and / or an illegal static behavior sequence, and the adopting a behavior sequence collector to report the suspected behavior sequence to the system manager includes: Acquire the suspected dynamic behavior sequence; If the identifier of the suspected dynamic behavior sequence exists in the behavior sequence whitelist, system event monitoring is started to obtain system events, and illegal static behaviors are scanned to obtain the illegal static behavior sequence, where the illegal static behavior sequence is used to characterize the illegal static behavior existing on the terminal device; The suspected dynamic behavior sequence and the illegal static behavior sequence are reported to the system manager.

9. The method according to claim 8, characterized in that The adopting of the end-side AI model to identify the risk level of the suspected behavior sequence to obtain a target risk level includes: Determining, according to the system event, whether the suspected behavior sequence satisfies a trigger condition, wherein the trigger condition is used to indicate whether a risk level identification is required for the suspected behavior sequence; If so, the terminal-side AI model is used to identify the risk level of the suspected behavior sequence to obtain the target risk level.

10. The method according to claim 9, characterized in that The determining, according to the system event, whether the suspected behavior sequence satisfies a trigger condition includes: Using the trigger management module in the end-side AI model, determine whether the suspected behavior sequence meets the trigger condition according to the system event; The using the end-side AI model to identify the risk level of the suspected behavior sequence to obtain the target risk level includes: Using the recognition module in the end-side AI model to identify the risk level of the suspected behavior sequence, and obtain the target risk level; The method further comprises: If the suspected behavior sequence does not meet the trigger condition, the identification module is not used to identify the risk level of the suspected behavior sequence.

11. The method according to any one of claims 7 to 10, characterized in that After determining the target control strategy corresponding to the suspected application according to the target risk level, the method includes: Stop monitoring the suspected behavior.

12. The method according to claim 11, characterized in that The stopping of monitoring the suspected behavior includes: The identifier of the suspected behavior sequence in the behavior sequence whitelist is deleted.

13. The method according to any one of claims 1 to 12, characterized in that The obtaining of the record of the suspected behavior sequence includes: When an installation event or an upgrade event of a suspected application corresponding to the suspected behavior sequence is monitored; If the identifier of the suspected application is not an identifier of an application in the identified illegal blacklist and is not an identifier of an application in the identified illegal whitelist, obtaining a record of the suspected behavior sequence; The identified illegal blacklist includes the identifier of at least one application program with an identified risk level, and the identified illegal whitelist includes the identifier of at least one application program that is not an illegal application.

14. The method according to claim 13, characterized in that The method further comprises: If the identifier of the suspected application is an identifier of an application in the identified illegal blacklist, then according to the target risk level corresponding to the identifier of the suspected application in the identified illegal blacklist and the preset control rule, determine the target control strategy corresponding to the suspected application, wherein the preset control rule includes a set of control paths corresponding to different risk levels; The suspected application is controlled according to the target control strategy.

15. The method according to claim 14, characterized in that The determining, according to the target risk level corresponding to the identifier of the suspected application in the identified illegal blacklist and the preset control rule, a target control strategy corresponding to the suspected application includes: Using a system manager to instantiate control rules for the suspected application according to the target risk level and the preset control rules, and obtain a target control path set corresponding to the suspected application, wherein the target control path set includes a control path corresponding to at least the behavior that needs to be intercepted; Using a system manager to send the target control path set to a control manager; The controlling the suspected application according to the target control strategy includes: Using a logical function module to query whether there is a control path corresponding to the suspected behavior sequence in the control manager; If so, the suspected behavior is intercepted.

16. The method according to any one of claims 13 to 15, characterized in that The method further comprises: If the suspected application is an application in the identified illegal whitelist, monitoring of the suspected behavior is not initiated.

17. The method according to claim 16, characterized in that Before obtaining the record of the suspected behavior sequence, the method further includes: When the terminal device is in Wifi connection and / or charging state, it receives any one or more of the identified illegal blacklist, the identified illegal whitelist, the terminal-side AI model and the preset control rules.

18. An electronic device, characterized in that: include: Processors, memory, and interfaces; The processor, the memory and the interface cooperate with each other so that the electronic device executes the method as claimed in any one of claims 1 to 17.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 17.

Images