Service component detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a service component detection method and device, electronic equipment and a storage medium. The method comprises the steps that a client obtains a running environment where the client is located; the client matches a selected detection strategy corresponding to the operation environment; the client determines a running state of a to-be-detected service component based on the calling condition of the running verification information, and the to-be-detected service component runs in a running environment of the client; if it is judged that the to-be-detected service component is abnormal based on the selected detection strategy and the running state, running data of the to-be-detected service component are sent to a server; receiving a comparison result generated by the server; and based on the comparison result, determining a processing measure for the to-be-detected service component. According to the embodiment of the invention, the to-be-detected service component can be detected according to the operation environment of the client, the selected detection strategy, the operation state of the to-be-detected service component, the detection of the server and other dimensions, and the security detection accuracy of the service component can be improved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a method, device, electronic device and storage medium for detecting a service component. Background Art

[0002] With the rapid development of technologies such as cloud computing and mobile Internet, the functional requirements of applications are increasing. The above requirements have given rise to the access requirements of a large number of business components. Different business components can be used to achieve different functions. The above business components may come from other departments or different teams within the same enterprise; they may also come from suppliers or third-party companies outside the enterprise. Since the technical implementation methods of business components are different, the security capabilities are uneven. If the business components are not security tested, it will bring great security risks.

[0003] In the prior art, security detection of business components is usually performed based on static information of business components (such as hash values, copyright information, digital signatures, etc.) The dimensions of security detection in the prior art are relatively single, which leads to low accuracy of security detection of business components. Summary of the invention

[0004] The embodiments of the present application provide a business component detection method, device, electronic device and storage medium, which can improve the problem of low security detection accuracy in the prior art.

[0005] The present application provides a service component detection method, which is applied to a user terminal device, wherein the user terminal device is installed with a client, and the method includes:

[0006] The client obtains its own operating environment; the client matches a selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies; the client determines the operating status of a business component to be detected based on the calling of operation verification information, and the business component to be detected runs in the operating environment of the client; if it is determined that the business component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the business component to be detected is sent to a server; the comparison result generated by the server based on the comparison of the operating data with preset data is received; and based on the comparison result, a processing measure for the business component to be detected is determined.

[0007] The present application also provides a service component detection method, which is applied to a server, and the method includes:

[0008] Receive operation data of a business component to be detected that is determined by a client to have an abnormality, wherein the client determines that the business component to be detected has an abnormality based on a selected detection strategy and the operation status of the business component to be detected; the selected detection strategy corresponds to the operation environment of the client itself; the operation status of the business component to be detected is determined by the client based on the call of operation verification information; the operation data of the business component to be detected is compared with preset data to obtain a comparison result; and the comparison result is sent to the client so that the client can determine a processing measure for the business component to be detected based on the comparison result.

[0009] The embodiment of the present application also provides a service component detection device, which is applied to a user terminal device, wherein the user terminal device is installed with a client, and the device includes:

[0010] An environment acquisition unit, used to obtain its own operating environment;

[0011] A strategy matching unit, configured to match a corresponding selected detection strategy from a plurality of pre-stored detection strategies based on the operating environment;

[0012] An operation status determination unit, configured to determine the operation status of a service component to be detected based on the calling status of the operation verification information, wherein the service component to be detected is running in the operation environment of the client;

[0013] A data sending unit, configured to send the operation data of the service component to be detected to a server when it is determined that the service component to be detected is abnormal based on the selected detection strategy and the operation status;

[0014] A measure determination unit is used to receive the comparison result generated by the server based on the comparison between the operation data and the preset data; based on the comparison result, determine the processing measures for the service component to be detected.

[0015] In one implementation, the running state of the service component to be detected is a running state; accordingly, the data sending unit includes:

[0016] A feature acquisition subunit, used to acquire the operation feature of the service component to be detected;

[0017] The abnormality determination subunit is used to determine that the service component to be detected is abnormal when the running service component to be detected does not meet the selected detection strategy or if the running characteristics are abnormal.

[0018] In one embodiment, the operation characteristics include file static information, prohibited access rights of the business component to be detected, and allowed access rights of the business component to be detected; accordingly, the abnormality determination subunit is specifically used to determine that the operation characteristics are abnormal when the business component to be detected has at least one of the following conditions:

[0019] The file static information of the service component to be detected does not match the preset static information;

[0020] The service component to be detected accesses the prohibited access permission;

[0021] The service component to be detected does not access the permitted access permission.

[0022] In one embodiment, the measure determination unit includes:

[0023] A first measure subunit, configured to maintain the operating state of the service component to be detected when the comparison result is that the operating data of the service component to be detected is consistent with the preset data;

[0024] The second measure subunit is configured to terminate the program process corresponding to the service component to be detected when the comparison result is that the operation data of the service component to be detected is inconsistent with the preset data.

[0025] In one embodiment, the device further comprises:

[0026] A policy receiving unit is used to receive the multiple detection policies filtered by the server, wherein the server filters out the multiple detection policies corresponding to the user terminal device from all detection policies based on the correspondence between the detection policies and the business components and the business components corresponding to the user terminal device; and stores the multiple detection policies.

[0027] In one embodiment, the device further comprises:

[0028] a data sending unit, configured to send, in response to a query request from the server, working data generated by the client in a preset processing process to the server, wherein the preset processing process is a process in which the client determines that an abnormality exists in the service component to be detected; or

[0029] The working data generated by the client during a preset processing process is sent to the server at intervals of a preset time length.

[0030] The embodiment of the present application also provides a service component detection device, which is applied to a server, and the device includes:

[0031] A data receiving unit, configured to receive operation data of a service component to be detected that is determined by a client to be abnormal, wherein the client determines that the service component to be detected is abnormal based on a selected detection strategy and an operation status of the service component to be detected; the selected detection strategy corresponds to an operation environment in which the client is located; and the operation status of the service component to be detected is determined by a call condition of the client based on operation verification information;

[0032] A comparison result acquisition unit, used to compare the operation data of the service component to be detected with preset data to obtain a comparison result;

[0033] The comparison result sending unit is used to send the comparison result to the client, so that the client determines a processing measure for the service component to be detected based on the comparison result.

[0034] In one embodiment, the device further comprises:

[0035] A policy receiving unit, used to receive and store all detection policies sent by the management terminal device, and the corresponding relationship between the detection policies and the service components;

[0036] A service component acquisition unit, used to acquire the service component corresponding to the user terminal device;

[0037] A policy determination unit, configured to determine a plurality of detection policies corresponding to the user terminal device based on a correspondence between the detection policies and the service components;

[0038] A policy sending unit is used to send the multiple detection policies to the user terminal device.

[0039] In one embodiment, the device further comprises:

[0040] A message receiving unit, used to receive a service component inquiry message sent by a management terminal device;

[0041] The data returning unit is used to return the service component detection data to the management terminal device, wherein the service component detection data includes: data generated by the comparison process between the operation data of the service component to be detected and the preset data and the comparison result.

[0042] In the business component detection method provided in the embodiment of the present application, the client can first obtain the operating environment in which it is located, and then match the corresponding selected detection strategy from multiple pre-stored detection strategies based on the operating environment. The client also determines the operating status of the business component to be detected based on the call status of the operation verification information, and the business component to be detected runs in the operating environment of the client. Subsequently, the client determines whether there is an abnormality in the business component to be detected based on the selected detection strategy and the operating status; when it is determined that there is an abnormality in the business component to be detected, the data of the business component to be detected is sent to the server, and the server makes further judgments. The client receives the comparison result returned by the server, and determines the processing measures for the business component to be detected based on the comparison result returned by the server.

[0043] In the embodiment of the present application, the client can first determine whether the business component to be detected is abnormal based on the operating environment in which it is located, the selected detection strategy, and the operating status of the business component to be detected. After determining that the business component to be detected is abnormal, the business component to be detected is sent to the server, and the server performs further detection and judgment. Subsequently, based on the comparison result returned by the server, the treatment measures for the business component to be detected are determined. In the embodiment of the present application, the business component to be detected can be detected based on multiple dimensions such as the operating environment in which the client is located, the selected detection strategy, the operating status of the business component to be detected, and the detection of the server, which can improve the accuracy of the security detection of the business component. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1a It is a schematic diagram of a usage scenario of the service component detection method provided in an embodiment of the present application;

[0046] Figure 1b It is a flowchart of a service component detection method provided by an embodiment of the present application;

[0047] Figure 1c A schematic diagram of the interface of the safety detection software is shown;

[0048] Figure 2 is a flowchart of a service component detection method provided by another embodiment of the present application;

[0049] Figure 3 is a flowchart of a service component detection method provided by another embodiment of the present application;

[0050] Figure 4 This is a structural diagram of a service component detection device provided by an embodiment of the present application;

[0051] Figure 5 It is a structural schematic diagram of a service component detection device provided by another embodiment of the present application;

[0052] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0054] Embodiments of the present application provide a service component detection method, device, electronic device, and storage medium.

[0055] The service component detection device can be integrated in an electronic device, which can be a terminal, a server, or other devices. The terminal can be a mobile phone, a tablet computer, a smart Bluetooth device, a laptop, or a personal computer (PC), or a smart device with computing functions. The server can be a single server or a server cluster composed of multiple servers.

[0056] In some embodiments, the service component detection device may also be integrated into multiple electronic devices. For example, the service component detection device may be integrated into multiple servers, and the service component detection method of the present application may be implemented by multiple servers.

[0057] In some embodiments, the server may also be implemented in the form of a terminal.

[0058] For more information, please see Figure 1aThe method provided in the embodiment of the present application includes: the client obtains the operating environment in which it is located; the client matches the selected detection strategy corresponding to the operating environment from multiple pre-stored detection strategies; the client determines the operating status of the business component to be detected based on the calling status of the operation verification information, and the business component to be detected runs in the operating environment of the client; if it is determined that the business component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the business component to be detected is sent to the server; the comparison result generated by the server based on the comparison of the operating data with the preset data is received; based on the comparison result, the processing measures for the business component to be detected are determined.

[0059] In the above method, the business components to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the business components to be detected, and the detection of the server, which can improve the accuracy of security detection of business components.

[0060] It is understandable that in the embodiments of the present application, related data such as user information is involved. When the embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0061] It should be noted that the serial numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0062] In this embodiment, a service component detection method is provided, such as Figure 1b As shown, the service component detection method is applied to a user terminal device, and the user terminal device is installed with a client. The specific process of the method may include the following steps 110 to 160:

[0063] 110. The client obtains its own operating environment.

[0064] The operating environment refers to the software and hardware environment that the client application depends on.

[0065] Optionally, the operating environment can be the device security detection level of the user terminal device on which the client is installed. The device security detection level can be obtained by detecting the security level of the user terminal device by the security detection software installed on the user terminal device. The above levels can specifically include: safe, low risk, medium risk, high risk, etc. The above levels can be formed based on the detection results of the security detection software for each compliance detection item; among them, each compliance detection item may include: desktop icon protection, camera protection, USB disk protection, file download protection, web firewall, file system protection, registry protection, process protection, driver protection, hacker intrusion protection, etc. For details, please see Figure 1c .

[0066] Optionally, the operating environment may also include the network environment in which the client is located, which includes an enterprise local area network or the World Wide Web; the operating environment may include the geographical location of the user terminal device where the client is installed, which includes domestic or overseas, etc.; the operating environment may also include the device type of the user terminal device where the client is installed, which includes enterprise standardized devices and bring your own devices (Bring Your Own Device, BYOD for short), where the enterprise standardized devices can be user terminal devices configured by the enterprise for employees for office purposes.

[0067] Optionally, in a specific implementation, part of the operating environment, such as the network environment, geographic location, device type, etc. of the client, may adopt the cache value collected last time, thereby achieving a balance between the accuracy of the operating environment and the performance overhead.

[0068] It should be understood that the specific environment content of the operating environment should not be understood as a limitation of the present application.

[0069] 120. The client matches a selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies.

[0070] There is a corresponding relationship between the operating environment and the detection strategy. Different operating environments have their own corresponding series of detection strategies. For example, if the operating environment is: the device security detection level is safe, then the selected detection strategy corresponding to the device security detection level of safe can be matched: detection strategy group A; if the operating environment is: the device security detection level is low risk, then the selected detection strategy corresponding to the device security detection level of low risk can be matched: detection strategy group B. Under normal circumstances, the policy complexity of detection strategy group B can be higher than the policy complexity of detection strategy group A. For another example, if the operating environment is: the device type is enterprise standardized equipment, then the selected detection strategy corresponding to the device type of enterprise standardized equipment can be matched: detection strategy group C; if the operating environment is: the device type is BYOD, then the selected detection strategy corresponding to the device type of BYOD can be matched: detection strategy group D. Under normal circumstances, the detection authority corresponding to detection strategy group C can be higher than the detection authority corresponding to detection strategy group D.

[0071] It should be understood that the specific detection policy contents of the multiple detection policies, as well as the corresponding relationship between the operating environment and the detection policies, can be set by the enterprise administrator according to the enterprise development needs.

[0072] Optionally, if there are multiple selected detection strategies matched based on the operating environment, and there is a priority setting between the multiple selected detection strategies, the selected detection strategy with the highest priority may be selected as the final selected detection strategy.

[0073] Optionally, in a specific implementation manner, before step 120, the method provided in the embodiment of the present application may further include the following steps:

[0074] Receiving the multiple detection policies obtained by screening by the server, wherein the server screens the multiple detection policies corresponding to the user terminal device from all detection policies based on the correspondence between the detection policies and the service components and the service components corresponding to the user terminal device;

[0075] Storing the multiple detection strategies. In the above implementation, the multiple detection strategies may be sent by the server to the client, and stored by the client itself. The specific process of the server sending the multiple detection strategies to the client will be described in detail below.

[0076] 130. The client determines the running status of the service component to be detected based on the calling status of the running verification information.

[0077] The business component to be detected runs in the operating environment of the client. The operation verification information is verification information for determining whether a business component is in a running state. Optionally, the operation verification information includes: the process occupied by the business component, the installation path corresponding to the business component, the signature corresponding to the business component, and the port corresponding to the business component. A port is a number used to identify a specific application. The port can be an application programming interface (Application Programming Interface, referred to as API).

[0078] The client can obtain the calling status of the operation verification information in real time, and determine the running status of the business component to be detected in real time based on the calling status.

[0079] The business component to be tested is a business component to be subjected to security testing. The operating status of the business component to be tested includes two operating states: running and not running. The business component to be tested corresponds to one or more operating verification information. If the one or more operating verification information corresponding to the business component to be tested are all in the operating state, then the operating state of the business component to be tested can be determined as: running; if one or more operating verification information corresponding to the business component to be tested contains operating verification information that is not in the operating state, then the operating state of the business component to be tested can be determined as: not running.

[0080] For example, let the business component to be detected be business component A. In one implementation, the operation verification information corresponding to business component A includes: process a, signature b, and installation path c. Then: if process a, signature b, and installation path c are all running, the operation status of business component A can be determined as: running; if process a and signature b are both running, and installation path c is not running, the operation status of business component A can be determined as: not running.

[0081] In another embodiment, the operation verification information corresponding to the service component A includes: port d. Then: if port d is occupied, the operation state of the service component A can be determined as: running; if port d is not occupied, the operation state of the service component A can be determined as: not running.

[0082] 140. If it is determined that the service component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the service component to be detected is sent to a server.

[0083] Optionally, in a specific implementation, the service components to be detected may be preliminarily screened according to their running states, that is, the service components to be detected that are in running state may be screened out first, and then the security detection may be performed on the screened service components to be detected.

[0084] It may be assumed that the running state of the service component to be detected is in the running state; accordingly, in step 140, "determining whether the service component to be detected is abnormal based on the selected detection strategy and the running state" may specifically include the following steps 141 to 142:

[0085] 141. Obtain the operating characteristics of the service component to be detected.

[0086] The operation characteristics are characteristics that reflect the operation status of the service component to be detected. The operation characteristics may include static information of files, prohibited access rights of the service component to be detected, and permitted access rights of the service component to be detected.

[0087] File static information is static information generated by the real-time running status of the business component to be tested. File static information includes: application copyright information, hash value, application digital signature, etc. Prohibited access rights refer to: permissions that cannot be accessed by the business component to be tested in normal operation; for example, a list of websites that the business component to be tested is prohibited from accessing, directories and files that the business component to be tested cannot access, and APIs that the business component to be tested cannot trigger. Running access rights refer to: permissions that the business component to be tested needs to access in normal operation; for example, a list of websites that the business component to be tested needs to access, directories and files that the business component to be tested needs to access, and APIs that the business component to be tested needs to trigger.

[0088] Optionally, the above-mentioned file-related read and write operations can be detected in real time using technical methods such as File System MinifilterDrivers (file system mini filter driver)

[0089] 142. If the running service component to be detected does not satisfy the selected detection strategy, or if the running characteristic is abnormal, it is determined that the service component to be detected is abnormal.

[0090] The selected detection strategy is: the strategy that will be executed when the service component to be detected is in normal operation. For example, let's assume that the service component to be detected is in normal operation and will trigger API-1, API-3 and API-2 in sequence. If the service component to be detected does not trigger the above three APIs, or triggers the above three APIs but not in the above order, it can be determined that the running service component to be detected does not meet the selected detection strategy.

[0091] Optionally, if the amount of data uploaded by the service component to be detected does not meet the amount of data specified by the selected detection policy, it can also be determined that the running service component to be detected does not meet the selected detection policy. For example, if the selected detection policy requires detection of five groups of data, and the client only obtains three groups of data, it is determined that the amount of data uploaded by the service component to be detected does not meet the amount of data specified by the selected detection policy.

[0092] Optionally, in a specific implementation, the “operation feature is abnormal” in step 142 includes:

[0093] If the operating characteristics have at least one of the following conditions, it is determined that the operating characteristics are abnormal:

[0094] The file static information of the service component to be detected does not match the preset static information;

[0095] The service component to be detected accesses the prohibited access permission;

[0096] The service component to be detected does not access the permitted access permission.

[0097] The preset static information is the static information corresponding to the normal operation of the service component to be detected. Therefore, if the two do not match, it means that there is a high possibility that the service component to be detected is abnormal.

[0098] Similarly, if the business component to be detected accesses permissions that cannot be accessed under normal operating conditions, or the business component to be detected does not access permissions that need to be accessed under normal operating conditions, it means that there is a high possibility that the business component to be detected is abnormal.

[0099] Optionally, in one implementation, if the business component to be detected accesses permissions that cannot be accessed under normal operating conditions, the number of times the business component to be detected accesses prohibited access permissions within a preset time period can be further recorded. If the number exceeds a preset threshold, it can be determined that there is a high possibility that the business component to be detected has an abnormality.

[0100] Optionally, in one embodiment, whether there is an abnormality in the running characteristics can be realized by injecting a security module to detect the API of the business component to be detected. For example, a DLL file can be injected into the target process, and then a specific function can be implemented in the DLL. The above process can be implemented using APIs such as LoadLibrary and CreateRemoteThread. For another example, by constructing Shellcode, it is injected into the target process. This can be implemented using APIs such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.

[0101] In a specific implementation, it is also possible to determine whether the business component to be detected has an abnormality based on whether the business component to be detected triggers an API related to sensitive permissions. For the Windows platform, the APIs related to sensitive permissions include: APIs for obtaining system information, such as GetSystemInfo, GetUserName, and GetComputerName; APIs related to permission operations, such as DuplicateTokenEx, OpenProcessToken, etc.; APIs related to memory operations, such as VirtualAllocEx, WriteProcessMemory, GetThreadContext, etc. For the Mac platform, the APIs related to sensitive permissions include: obtaining clipboard operations NSPasteboard.general, file search operations NSMetadataQuery, obtaining screenshot operations of the entire screen CGWindowListCreateImage, obtaining network connection information proc_pidfdinfo, obtaining disk list operations API FileManager().mountedVolumeURLs, etc.

[0102] In the above implementation, the permissions of APIs related to sensitive permissions can also be divided, that is, the APIs related to sensitive permissions can be divided into prohibited access permissions or allowed access permissions. The division method can be: perform statistics over a period of time, and classify the APIs related to sensitive permissions whose access frequency of the business components to be detected is not less than the preset access threshold into the running access permissions, and classify the APIs related to sensitive permissions whose access frequency is less than the preset access threshold into the prohibited access permissions. In addition to the above division method, the staff can also make artificial divisions based on their work experience.

[0103] When it is determined that the service component to be detected has an abnormality, the client may send the data of the service component to be detected to the server so that the server can perform a more accurate comparison process.

[0104] The operation data of the business component to be detected is the data generated during the actual operation of the business component to be detected, such as real-time application copyright information, hash values, application digital signatures, etc., and real-time access permissions of the business component to be detected. Optionally, the operation data also includes: the actual execution path of the business component to be detected and the actual detection path of the client.

[0105] The preset data is the benchmark data for security detection, including: correct application copyright information, hash value, application digital signature, etc., and the permissions that the service component to be detected should have access to. Optionally, the preset data may also include: the correct execution path of the service component to be detected, the correct detection path of the client, etc.

[0106] The server can compare the running data with the preset data to obtain a comparison result.

[0107] In the above implementation, the user terminal device where the service component to be detected is located has the risk of being tampered by attack software, so the data of the service component to be detected can be sent to the server for further judgment. The above process can further increase the accuracy of detection.

[0108] 150. Receive the comparison result generated by the server based on comparing the operating data with preset data.

[0109] The comparison results include the following two types: the operation data of the service component to be detected is consistent with the preset data, or the operation data of the service component to be detected is inconsistent with the preset data. Different comparison results have their own corresponding processing measures.

[0110] 160. Based on the comparison result, determine a processing measure for the service component to be detected.

[0111] Optionally, in a specific implementation, step 160 may specifically include the following steps 161 to 162:

[0112] 161. If the comparison result is that the operating data of the service component to be detected is consistent with preset data, the operating state of the service component to be detected is maintained.

[0113] If the comparison result is: the operating data is consistent with the preset data, it means that the security of the service component to be detected is relatively high, so the operating state of the service component to be detected can be maintained.

[0114] 162. If the comparison result is that the operating data of the service component to be detected is inconsistent with the preset data, then terminate the program process corresponding to the service component to be detected.

[0115] If the comparison result is that the running data is inconsistent with the preset data, it means that the security of the business component to be detected is low, so the program process corresponding to the business component to be detected can be stopped.

[0116] Optionally, if the comparison result is that the running data is inconsistent with the preset data, the processing measures, in addition to stopping the program process corresponding to the service component to be detected, may also include: prohibiting the service component to be detected from starting, prohibiting the service component to be detected from connecting to the Internet, and other processing measures.

[0117] In the above implementation, the business components to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the business components to be detected, and the detection of the server, making the detection process more diverse and objective, thereby helping to improve the accuracy of the detection.

[0118] Optionally, in a specific implementation, after step 160, the embodiment of the present application may further include the following step 170:

[0119] 170. In response to the query request of the server, sending the working data generated by the client in a preset processing process to the server, wherein the preset processing process is a process in which the client determines whether the service component to be detected has an abnormality; or

[0120] The working data generated by the client during a preset processing process is sent to the server at intervals of a preset time length.

[0121] Optionally, step 170 may occur when a query request from the server is received, periodically according to a preset time length, or once each time a judgment process of a service component to be detected is completed. It should be understood that the specific time when step 170 occurs should not be construed as a limitation to the present application.

[0122] In the above-mentioned implementation mode, the client sends the work data generated in the judgment process to the server for storage and recording, and can leave a record for the judgment process for the business component to be detected, which is conducive to the subsequent verification of whether the judgment process is standardized. The embodiment of the present application realizes combined detection for website access, file operation, and local files of user terminal equipment, and realizes the detection work of the business component to be detected while reducing the performance consumption of the user terminal equipment as much as possible. In the specific detection work process, the embodiment of the present application can compare the actual execution path of the business component to be detected with the correct execution path, judge whether there is omission or offset in the actual execution path, and judge whether there are some abnormal high-risk operations in the actual execution path. In addition to the detection of the path, the above process can also be applied to the detection of system events and local inter-process communication. The above-mentioned technical means can be combined with the embodiment of the present application to form a detection scheme with stronger applicability and flexibility, so as to further improve the detection accuracy of the embodiment of the present application.

[0123] In the business component detection method provided in the embodiment of the present application, the client can first obtain the operating environment in which it is located, and then match the corresponding selected detection strategy from the pre-stored multiple detection strategies based on the operating environment. The client also determines the operating state of the business component to be detected based on the call of the operation verification information. Subsequently, the client determines whether the business component to be detected is abnormal based on the selected detection strategy and the operating state; when it is determined that the business component to be detected is abnormal, the data of the business component to be detected is sent to the server, and the server makes further judgment. The client receives the comparison result returned by the server, and determines the processing measures for the business component to be detected based on the comparison result returned by the server. In the embodiment of the present application, the client can first determine whether the business component to be detected is abnormal based on the operating environment in which it is located, the selected detection strategy and the operating state of the business component to be detected. After determining that the business component to be detected is abnormal, the business component to be detected is sent to the server, and the server makes further detection judgment. Subsequently, based on the comparison result returned by the server, the processing measures for the business component to be detected are determined. In the embodiment of the present application, the service component to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the service component to be detected, and the detection of the server.

[0124] The embodiments of the present application can improve the accuracy of security detection of business components.

[0125] In this embodiment, a service component detection method is provided, such as Figure 2 As shown, the service component detection method is applied to the server, and the specific process of the method may include the following steps 210 to 230:

[0126] 210. Receive operating data of a business component to be detected that is determined by the client to have an abnormality, wherein the client determines that the business component to be detected has an abnormality based on a selected detection strategy and the operating status of the business component to be detected; the selected detection strategy corresponds to the operating environment of the client itself; and the operating status of the business component to be detected is determined by the client's call based on operating verification information.

[0127] In the above implementation, the user terminal device where the service component to be detected is located has the risk of being tampered with by attack software, so the data of the service component to be detected can be sent to the server for further judgment.

[0128] Optionally, in a specific implementation manner, before step 210, the embodiment of the present application may further include the following steps S1 to S4:

[0129] S1. Receive and store all detection strategies sent by the management terminal device, as well as the corresponding relationship between the detection strategies and the service components.

[0130] All detection strategies and the corresponding relationship between detection strategies and business components can be set by the enterprise administrator on the management terminal device according to the development needs of the enterprise. In addition to setting detection strategies, enterprise administrators can also set the priority of detection strategies.

[0131] After the enterprise administrator completes the settings, all of the above detection strategies and the corresponding relationships between the detection strategies and business components can be sent to the server by the management terminal device.

[0132] S2. Obtain the service component corresponding to the user terminal device.

[0133] S3. Based on the correspondence between the detection strategies and the service components, determine a plurality of detection strategies corresponding to the user terminal device.

[0134] The server can obtain the business components corresponding to the user terminal device. Since different user terminal devices may have different business components installed, the server can obtain the business components corresponding to each user terminal device and determine multiple detection strategies corresponding to each user terminal device based on the correspondence between the detection strategy and the business component.

[0135] For example, let's assume that user terminal device x includes service component A and service component B. Service component A corresponds to detection strategy 1 and detection strategy 2; service component B corresponds to detection strategy 3. Then the server can send detection strategy 1, detection strategy 2, and detection strategy 3 to the user terminal device. If after a period of time, the detection strategy corresponding to service component B iterates from detection strategy 3 to detection strategy 4, the server can promptly send detection strategy 4 to replace detection strategy 3.

[0136] S4. Send the multiple detection strategies to the user terminal device.

[0137] After determining the detection strategy corresponding to each user terminal device, the above-mentioned multiple detection strategies are sent to the user terminal device.

[0138] In the above implementation, the server can determine multiple detection strategies corresponding to each user terminal device according to the service components corresponding to the user terminal device and the corresponding relationship between the detection strategy and the service components, and send the multiple detection strategies to the user terminal device, thereby avoiding the detection strategy from being sent to the user terminal device that does not have the corresponding service component, saving the transmission data resources.

[0139] 220. Compare the operating data of the service component to be detected with preset data to obtain a comparison result.

[0140] The operation data of the business component to be detected is the data generated during the actual operation of the business component to be detected, such as the application copyright information, hash value, application digital signature, etc. generated in real time, and the real-time access permissions of the business component to be detected. Optionally, the operation data also includes: the actual execution path of the business component to be detected, and the actual detection path of the client. The preset data is the benchmark data for security detection, including: the correct application copyright information, hash value, application digital signature, etc., and the permissions that the business component to be detected should access. Optionally, the preset data can also include: the correct execution path of the business component to be detected, the correct detection path of the client, etc.

[0141] The server can compare the running data with the preset data to obtain a comparison result.

[0142] Optionally, in a specific implementation, the server may also determine whether the client fully executes all policy contents of the selected detection policy. If the client does not fully execute all policy contents of the selected detection policy, it may also be determined that an abnormality exists in the business component to be detected, and a comparison result that an abnormality exists in the business component to be detected is obtained. If the client fully executes all policy contents of the selected detection policy, it is then determined whether an abnormality exists in the business component to be detected based on the comparison of the operating data with the preset data.

[0143] 230. Send the comparison result to the client, so that the client determines a processing measure for the service component to be detected based on the comparison result.

[0144] If the comparison result is: the operating data is consistent with the preset data, it means that the security of the service component to be detected is relatively high, so the processing measure may be to maintain the operating state of the service component to be detected.

[0145] If the comparison result is that the running data is inconsistent with the preset data, it means that the security of the business component to be detected is low, so the processing measure may be to stop the program process corresponding to the business component to be detected.

[0146] Optionally, if the comparison result is that the running data is inconsistent with the preset data, the processing measures, in addition to stopping the program process corresponding to the service component to be detected, may also include: prohibiting the service component to be detected from starting, prohibiting the service component to be detected from connecting to the Internet, and other processing measures.

[0147] Optionally, in a specific implementation manner, after step 230, the embodiment of the present application may further include the following steps 240 to 250:

[0148] 240. Receive a service component inquiry message sent by the management terminal device.

[0149] The business component inquiry message is a message for inquiring about the relevant judgment process of the business component.

[0150] 250. Returning service component detection data to the management terminal device, wherein the service component detection data includes: data generated by a comparison process between the operating data of the service component to be detected and preset data, and the comparison result.

[0151] After receiving the service component query message, the server may return service component detection data to the management terminal device, so that the management terminal device can determine whether the service component determination process is reasonable based on the data generated by the comparison process and the comparison result.

[0152] In the embodiment of the present application, the service component to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the service component to be detected, and the detection of the server.

[0153] The embodiments of the present application can improve the accuracy of security detection of business components.

[0154] The method described in the above embodiment will be further described in detail below.

[0155] In this embodiment, the interaction process between the server and the user terminal device is taken as an example to describe the method of the embodiment of the present application in detail.

[0156] like Figure 3 As shown, the specific process of a business component detection method is as follows:

[0157] 301. The server receives and stores all detection strategies sent by the management terminal device, as well as the correspondence between the detection strategies and the service components.

[0158] 302. The server obtains the service component corresponding to the user terminal device.

[0159] 303. The server determines multiple detection policies corresponding to the user terminal device based on the correspondence between the detection policies and the service components.

[0160] 304. The user terminal device receives the multiple detection strategies screened by the server and stores the multiple detection strategies.

[0161] 305. The client in the user terminal device obtains its own operating environment.

[0162] 306. The client in the user terminal device matches a corresponding selected detection strategy from a plurality of pre-stored detection strategies based on the operating environment.

[0163] 307. The client in the user terminal device determines the running status of the service component to be detected based on the calling status of the running verification information.

[0164] The service component to be detected runs in the operating environment of the client.

[0165] 308. The client in the user terminal device obtains the operating characteristics of the service component to be detected.

[0166] 309. If the running service component to be detected does not satisfy the selected detection strategy, or if the running characteristic is abnormal, the client in the user terminal device determines that the service component to be detected is abnormal.

[0167] Optionally, the operation characteristics include static file information, prohibited access rights of the service component to be detected, and permitted access rights of the service component to be detected.

[0168] If the operating characteristics have at least one of the following conditions, it is determined that the operating characteristics are abnormal:

[0169] The file static information of the service component to be detected does not match the preset static information;

[0170] The service component to be detected accesses the prohibited access permission;

[0171] The service component to be detected does not access the permitted access permission.

[0172] 310. The client in the user terminal device sends the operation data of the service component to be detected to the server.

[0173] 311. The server compares the operating data of the service component to be detected with preset data to obtain a comparison result.

[0174] 312. The server sends the comparison result to the client in the user terminal device.

[0175] 313. The client in the user terminal device determines a processing measure for the service component to be detected based on the comparison result.

[0176] If the comparison result is that the operation data of the service component to be detected is consistent with the preset data, the client maintains the operation state of the service component to be detected;

[0177] If the comparison result is that the operating data of the service component to be detected is inconsistent with the preset data, the client ends the program process corresponding to the service component to be detected.

[0178] 314. The user terminal device sends work data to the server.

[0179] Optionally, the specific manner in which the user terminal device sends the work data to the server includes:

[0180] In response to the query request of the server, the working data generated by the client in a preset processing process is sent to the server, wherein the preset processing process is a process in which the client determines that the service component to be detected has an abnormality; or

[0181] The working data generated by the client during a preset processing process is sent to the server at intervals of a preset time length.

[0182] 315. The server receives the service component inquiry message sent by the management terminal device.

[0183] 316. Return the service component detection data to the management terminal device.

[0184] The specific execution process of step 301 to step 316 has been described in detail above and will not be repeated here.

[0185] In the business component detection method provided in the embodiment of the present application, the client can first obtain the operating environment in which it is located, and then match the corresponding selected detection strategy from the pre-stored multiple detection strategies based on the operating environment. The client also determines the operating state of the business component to be detected based on the call of the operation verification information. Subsequently, the client determines whether the business component to be detected is abnormal based on the selected detection strategy and the operating state; when it is determined that the business component to be detected is abnormal, the data of the business component to be detected is sent to the server, and the server makes further judgment. The client receives the comparison result returned by the server, and determines the processing measures for the business component to be detected based on the comparison result returned by the server. In the embodiment of the present application, the client can first determine whether the business component to be detected is abnormal based on the operating environment in which it is located, the selected detection strategy and the operating state of the business component to be detected. After determining that the business component to be detected is abnormal, the business component to be detected is sent to the server, and the server makes further detection judgment. Subsequently, based on the comparison result returned by the server, the processing measures for the business component to be detected are determined. In the embodiment of the present application, the service component to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the service component to be detected, and the detection of the server.

[0186] The embodiments of the present application can improve the accuracy of security detection of business components.

[0187] In order to better implement the above method, the embodiment of the present application also provides a business component detection device, which can be specifically integrated in an electronic device, and the electronic device can be a terminal, a server and other devices. Among them, the terminal can be a mobile phone, a tablet computer, a smart Bluetooth device, a laptop, or a personal computer (Personal Computer, PC) and other devices; the server can be a single server or a server cluster composed of multiple servers. For example, in this embodiment, the user terminal device in which the business component detection device is specifically integrated in the electronic device is taken as an example to describe the device of the embodiment of the present application in detail.

[0188] For example, Figure 4 As shown, the service component detection device is applied to a user terminal device, the user terminal device is installed with a client, and the device includes:

[0189] The environment acquisition unit 401 is used to acquire the operating environment in which the unit is located;

[0190] A strategy matching unit 402, configured to match a corresponding selected detection strategy from a plurality of pre-stored detection strategies based on the operating environment;

[0191] The running state determining unit 403 is used to determine the running state of the service component to be detected based on the calling status of the running verification information, wherein the service component to be detected runs in the running environment of the client;

[0192] A data sending unit 404 is used to send the operation data of the service component to be detected to the server when it is determined that the service component to be detected is abnormal based on the selected detection strategy and the operation status;

[0193] A comparison result unit 405, configured to receive the comparison result generated by the server based on the comparison between the operation data and the preset data;

[0194] The measure determination unit 406 is used to determine a processing measure for the service component to be detected based on the comparison result.

[0195] In one implementation, the running state of the service component to be detected is a running state; accordingly, the data sending unit 404 includes:

[0196] A feature acquisition subunit, used to acquire the operation feature of the service component to be detected;

[0197] The abnormality determination subunit is used to determine that the service component to be detected is abnormal when the running service component to be detected does not meet the selected detection strategy or if the running characteristics are abnormal.

[0198] In one embodiment, the operation characteristics include file static information, prohibited access rights of the business component to be detected, and allowed access rights of the business component to be detected; accordingly, the abnormality determination subunit is specifically used to determine that the operation characteristics are abnormal when the business component to be detected has at least one of the following conditions:

[0199] The file static information of the service component to be detected does not match the preset static information;

[0200] The service component to be detected accesses the prohibited access permission;

[0201] The service component to be detected does not access the permitted access permission.

[0202] In one implementation, the measure determination unit 406 includes:

[0203] A first measure subunit, configured to maintain the operating state of the service component to be detected when the comparison result is that the operating data of the service component to be detected is consistent with the preset data;

[0204] The second measure subunit is configured to terminate the program process corresponding to the service component to be detected when the comparison result is that the operation data of the service component to be detected is inconsistent with the preset data.

[0205] In one embodiment, the device further comprises:

[0206] A policy receiving unit, configured to receive the plurality of detection policies obtained by screening by the server, wherein the server screens the plurality of detection policies corresponding to the user terminal device from all detection policies based on the correspondence between the detection policies and the service components and the service components corresponding to the user terminal device;

[0207] The multiple detection strategies are stored.

[0208] In one embodiment, the device further comprises:

[0209] a data sending unit, configured to send, in response to a query request from the server, working data generated by the client in a preset processing process to the server, wherein the preset processing process is a process in which the client determines that an abnormality exists in the service component to be detected; or

[0210] The working data generated by the client during a preset processing process is sent to the server at intervals of a preset time length.

[0211] In specific implementation, the above units can be implemented as independent entities, or can be arbitrarily combined to be implemented as the same or several entities. The specific implementation of the above units can refer to the previous method embodiments, which will not be repeated here.

[0212] In the service component detection device provided in the embodiment of the present application, the client can first obtain the operating environment in which it is located, and then match the corresponding selected detection strategy from the pre-stored multiple detection strategies based on the operating environment. The client also determines the operating state of the service component to be detected based on the call of the operation verification information. Subsequently, the client determines whether the service component to be detected is abnormal based on the selected detection strategy and the operating state; when it is determined that the service component to be detected is abnormal, the data of the service component to be detected is sent to the server, and the server makes further judgment. The client receives the comparison result returned by the server, and determines the processing measures for the service component to be detected based on the comparison result returned by the server. In the embodiment of the present application, the client can first determine whether the service component to be detected is abnormal based on the operating environment in which it is located, the selected detection strategy and the operating state of the service component to be detected. After determining that the service component to be detected is abnormal, the service component to be detected is sent to the server, and the server makes further detection judgment. Subsequently, based on the comparison result returned by the server, the processing measures for the service component to be detected are determined. In the embodiment of the present application, the service component to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the service component to be detected, and the detection of the server.

[0213] The embodiments of the present application can improve the accuracy of security detection of business components.

[0214] In order to better implement the above method, the embodiment of the present application also provides a business component detection device, which can be specifically integrated in an electronic device, and the electronic device can be a terminal, a server and other devices. Among them, the terminal can be a mobile phone, a tablet computer, a smart Bluetooth device, a laptop, or a personal computer (Personal Computer, PC) and other devices; the server can be a single server or a server cluster composed of multiple servers. For example, in this embodiment, the device of the embodiment of the present application will be described in detail by taking the specific integration of the business component detection device in the server as an example.

[0215] For example, Figure 5 As shown, the service component detection device is applied to a server, and the device includes:

[0216] The data receiving unit 501 is used to receive the operation data of the service component to be detected that is determined by the client to be abnormal, wherein the client determines that the service component to be detected is abnormal based on the selected detection strategy and the operation status of the service component to be detected; the selected detection strategy corresponds to the operation environment of the client itself; the operation status of the service component to be detected is determined by the client based on the call status of the operation verification information;

[0217] A comparison result acquisition unit 502 is used to compare the operation data of the service component to be detected with preset data to obtain a comparison result;

[0218] The comparison result sending unit 503 is used to send the comparison result to the client, so that the client determines a processing measure for the service component to be detected based on the comparison result.

[0219] In one embodiment, the device further comprises:

[0220] A policy receiving unit, used to receive and store all detection policies sent by the management terminal device, and the corresponding relationship between the detection policies and the service components;

[0221] A service component acquisition unit, used to acquire the service component corresponding to the user terminal device;

[0222] A policy determination unit, configured to determine a plurality of detection policies corresponding to the user terminal device based on a correspondence between the detection policies and the service components;

[0223] A policy sending unit is used to send the multiple detection policies to the user terminal device.

[0224] In one embodiment, the device further comprises:

[0225] A message receiving unit, used to receive a service component inquiry message sent by a management terminal device;

[0226] The data returning unit is used to return the service component detection data to the management terminal device, wherein the service component detection data includes: data generated by the comparison process between the operation data of the service component to be detected and the preset data and the comparison result.

[0227] In the embodiment of the present application, the service component to be detected can be detected based on multiple dimensions such as the operating environment of the client itself, the selected detection strategy, the operating status of the service component to be detected, and the detection of the server.

[0228] The embodiments of the present application can improve the accuracy of security detection of business components.

[0229] The embodiment of the present application also provides an electronic device, which can be a terminal, a server, etc. The terminal can be a mobile phone, a tablet computer, a smart Bluetooth device, a laptop, a personal computer, etc. The server can be a single server or a server cluster composed of multiple servers, etc.

[0230] In some embodiments, the service component detection device may also be integrated into multiple electronic devices. For example, the service component detection device may be integrated into multiple servers, and the service component detection method of the present application may be implemented by multiple servers.

[0231] In this embodiment, the electronic device of this embodiment is an electronic device as an example for detailed description, for example, Figure 6 As shown, it shows a schematic diagram of the structure of the electronic device involved in the embodiment of the present application, specifically:

[0232] The electronic device may include one or more processors 601 of processing cores, one or more computer-readable storage media memories 602, a power supply 603, an input module 604, and a communication module 605. Those skilled in the art will appreciate that Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0233] The processor 601 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 602, and calling data stored in the memory 602. In some embodiments, the processor 601 may include one or more processing cores; in some embodiments, the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 601.

[0234] The memory 602 can be used to store software programs and modules. The processor 601 executes various functional applications and business component detection by running the software programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.

[0235] The electronic device also includes a power supply 603 for supplying power to various components. In some embodiments, the power supply 603 can be logically connected to the processor 601 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. The power supply 603 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0236] The electronic device may further include an input module 604, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0237] The electronic device may further include a communication module 605. In some embodiments, the communication module 605 may include a wireless module. The electronic device may perform short-range wireless transmission through the wireless module of the communication module 605, thereby providing the user with wireless broadband Internet access. For example, the communication module 605 may be used to help the user send and receive emails, browse web pages, and access streaming media.

[0238] Although not shown, the electronic device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 601 in the electronic device will load the executable files corresponding to the processes of one or more application programs into the memory 602 according to the following instructions, and the processor 601 will run the application programs stored in the memory 602, thereby realizing various functions, as follows:

[0239] The client obtains its own operating environment; the client matches a selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies; the client determines the operating status of a business component to be detected based on the calling of operation verification information, and the business component to be detected runs in the operating environment of the client; if it is determined that the business component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the business component to be detected is sent to a server; the comparison result generated by the server based on the comparison of the operating data with preset data is received; and based on the comparison result, a processing measure for the business component to be detected is determined.

[0240] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0241] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0242] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the steps in any of the service component detection methods provided in the embodiments of the present application. For example, the instructions can execute the following steps:

[0243] The client obtains its own operating environment; the client matches a selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies; the client determines the operating status of a business component to be detected based on the calling of operation verification information, and the business component to be detected runs in the operating environment of the client; if it is determined that the business component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the business component to be detected is sent to a server; the comparison result generated by the server based on the comparison of the operating data with preset data is received; and based on the comparison result, a processing measure for the business component to be detected is determined.

[0244] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0245] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the various optional implementations provided in the above embodiments.

[0246] Since the instructions stored in the storage medium can execute the steps in any business component detection method provided in the embodiments of the present application, the beneficial effects that can be achieved by any business component detection method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0247] The above is a detailed introduction to a business component detection method, device, electronic device and computer-readable storage medium provided in an embodiment of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A service component detection method, characterized in that: Applied to a user terminal device, the user terminal device is installed with a client, and the method includes: The client obtains its own operating environment; The client matches a selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies; The client determines the running state of the service component to be detected based on the calling status of the running verification information, and the service component to be detected runs in the running environment of the client; If it is determined that the service component to be detected is abnormal based on the selected detection strategy and the operating status, the operating data of the service component to be detected is sent to the server; Receiving the comparison result generated by the server based on comparing the operating data with preset data; Based on the comparison result, a processing measure for the service component to be detected is determined.

2. The method according to claim 1, characterized in that The running state of the service component to be detected is running; The determining, based on the selected detection strategy and the running status, that the service component to be detected has an abnormality includes: Obtaining the operating characteristics of the service component to be detected; If the running service component to be detected does not meet the selected detection strategy, or if the running characteristic is abnormal, it is determined that the service component to be detected is abnormal.

3. The method according to claim 2, characterized in that The operation characteristics include static file information, prohibited access rights of the service component to be detected, and permitted access rights of the service component to be detected; The operating characteristics are abnormal, including: If the operating characteristics have at least one of the following conditions, it is determined that the operating characteristics are abnormal: The file static information of the service component to be detected does not match the preset static information; The service component to be detected accesses the prohibited access permission; The service component to be detected does not access the permitted access permission.

4. The method according to claim 1, characterized in that The determining, based on the comparison result, a processing measure for the service component to be detected includes: If the comparison result is that the operating data of the service component to be detected is consistent with the preset data, then maintaining the operating state of the service component to be detected; If the comparison result is that the operating data of the service component to be detected is inconsistent with the preset data, then the program process corresponding to the service component to be detected is terminated.

5. The method according to claim 1, characterized in that Before the client matches the selected detection strategy corresponding to the operating environment from a plurality of pre-stored detection strategies, the method further includes: Receiving the multiple detection policies obtained by screening by the server, wherein the server screens the multiple detection policies corresponding to the user terminal device from all detection policies based on the correspondence between the detection policies and the service components and the service components corresponding to the user terminal device; The multiple detection strategies are stored.

6. The method according to claim 1, characterized in that After determining the processing measures for the service component to be detected based on the comparison result, the method further includes: In response to the query request of the server, the working data generated by the client in a preset processing process is sent to the server, wherein the preset processing process is a process in which the client determines that the service component to be detected has an abnormality; or The working data generated by the client during a preset processing process is sent to the server at every preset time interval.

7. A service component detection method, characterized in that: Applied to a server, the method comprises: Receive operation data of a service component to be detected that is determined by a client to be abnormal, wherein the client determines that the service component to be detected is abnormal based on a selected detection strategy and the operation status of the service component to be detected; the selected detection strategy corresponds to the operation environment of the client itself; the operation status of the service component to be detected is determined by the client based on the calling situation of the operation verification information; Comparing the operating data of the service component to be detected with preset data to obtain a comparison result; The comparison result is sent to the client, so that the client determines a processing measure for the service component to be detected based on the comparison result.

8. The method according to claim 7, characterized in that Before the receiving client determines that there is abnormal operation data of the service component to be detected, the method further includes: Receive and store all detection strategies sent by management terminal devices, as well as the correspondence between detection strategies and business components; Obtain the service component corresponding to the user terminal device; Based on the correspondence between the detection strategy and the service component, determining multiple detection strategies corresponding to the user terminal device; Send the multiple detection strategies to the user terminal device.

9. The method according to claim 7, characterized in that The method further comprises: Receive business component inquiry messages sent by management terminal devices; Returning service component detection data to the management terminal device, wherein the service component detection data includes: data generated by a comparison process between the operation data of the service component to be detected and preset data and the comparison result.

10. A service component detection device, characterized in that: Applied to a user terminal device, the user terminal device is installed with a client, and the device comprises: An environment acquisition unit, used to obtain its own operating environment; A strategy matching unit, configured to match a corresponding selected detection strategy from a plurality of pre-stored detection strategies based on the operating environment; An operation status determination unit, configured to determine the operation status of a service component to be detected based on the calling status of the operation verification information, wherein the service component to be detected is running in the operation environment of the client; a data sending unit, configured to send the operating data of the service component to be detected to a server when it is determined that the service component to be detected is abnormal based on the selected detection strategy and the operating status, so that the server compares the operating data of the service component to be detected with preset data to obtain a comparison result; A comparison result unit, configured to receive the comparison result generated by the server based on the comparison between the operation data and the preset data; A measure determination unit is used to determine a processing measure for the service component to be detected based on the comparison result.

11. A service component detection device, characterized in that: Applied to a server, the device comprises: A data receiving unit, configured to receive operation data of a service component to be detected that is determined by a client to be abnormal, wherein the client determines that the service component to be detected is abnormal based on a selected detection strategy and an operation status of the service component to be detected; the selected detection strategy corresponds to an operation environment in which the client is located; and the operation status of the service component to be detected is determined by a call condition of the client based on operation verification information; A comparison result acquisition unit, used to compare the operation data of the service component to be detected with preset data to obtain a comparison result; The comparison result sending unit is used to send the comparison result to the client, so that the client determines a processing measure for the service component to be detected based on the comparison result.

12. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute the steps in the service component detection method according to any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the service component detection method according to any one of claims 1 to 9.

14. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the steps in the method for identifying the shopping mall passenger flow status according to any one of claims 1 to 9.

Images