Permission real-time monitoring method and device

Abstract

The invention provides an authority real-time monitoring method and device, and the method comprises the steps: obtaining the current use data of an authority after the use authority of an application is detected, and obtaining the number of use times of the authority; when the number of use times is smaller than N, storing the current use data into a database; when the number of times of use is equal to N, training an analysis model according to the use data of the N times of use permission; when the number of use times is greater than N, inputting the current use data into the analysis model to obtain an output result; n is a preset value, and N is a positive integer. Through the scheme, the system of the electronic equipment can monitor and analyze the permission use of the application in real time, the security of the permission use of the application can be improved, and the information security of a user is protected.

Description

Technical Field

[0001] The present application relates to the field of data security, and specifically, to a method and device for real-time monitoring of permissions. Background Art

[0002] There are various applications in Android devices. These applications need to use Android system permissions when in use, so as to provide users with rich functions and experiences. However, after obtaining authorization, applications no longer need to request users to confirm when using permissions, and can use these permissions at will. Therefore, they may use permissions without the user's knowledge, or use privacy-sensitive permissions at will, posing a threat to the user's privacy information. The Android system provides management of application permissions, but only for the first permission request of an application. It cannot manage the application in a timely manner after using permissions, and cannot provide users with sufficient privacy and security protection.

[0003] Based on this, how to improve the security of application permissions has become an urgent problem to be solved. Summary of the invention

[0004] This application provides a real-time permission monitoring method that can improve the security of application permission use and protect user information security.

[0005] In a first aspect, a method for real-time monitoring of permissions is provided, the method comprising: after detecting that an application uses the permission, obtaining the current usage data of the permission and the number of times the permission is used; when the number of uses is less than N, storing the current usage data in a database; when the number of uses is equal to N, training an analysis model based on the usage data of N times the permission is used; when the number of uses is greater than N, inputting the current usage data into the analysis model to obtain an output result; N is a preset value, and N is a positive integer.

[0006] Through the technical solution of the embodiment of the present application, the analysis model is trained according to the usage data, so that the parameters of the analysis model can be more in line with the user's usage habits and the accuracy of the analysis can be improved. After the training is completed, when the permission usage data is obtained, the data is input into the analysis model in real time for analysis and the output results are obtained, so that the permission usage behavior of the application can be monitored and analyzed in real time, thereby improving the security of permission usage and protecting the user's information security.

[0007] In combination with the first aspect, in some implementations of the first aspect, the analysis model is used to obtain an output result according to the rule base and the current usage data.

[0008] Through the technical solution of this implementation, the analysis process of the model combines the rule base and the current usage data, that is, matches the rules recorded in the rule base to obtain the final analysis result as the output of the model, which can perform accurate analysis and judgment based on the rule base.

[0009] In combination with the first aspect, in some implementations of the first aspect, the method further includes: updating the rule base according to the training results of the analysis model.

[0010] Through the technical solution of this implementation, the rule base can learn user data through the analysis model to achieve personalized dynamic adjustment based on users, which can make the rule base more suitable for the current user's usage habits, thereby enhancing the analysis ability of the analysis model, making it more in line with user preferences and improving user experience.

[0011] In combination with the first aspect, in some implementations of the first aspect, the rule base includes usage rules of permissions, and the usage rules include application type, permission type, context information, and usage time period.

[0012] Through the technical solution of this implementation, the rules in the rule base can provide users with permission usage constraints, which can ensure the user's permission security and help improve application security performance.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the current usage data includes usage behavior from the time the application starts using the permission to the time the application ends using the permission, and the usage behavior includes the type of permission, the start time and end time of the permission use, and the usage context information of the application; the usage context information includes the running status of the application, whether the screen is turned off, and whether the user is active.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the output results of the analysis model include the time period of permission usage, whether there is a risk in using the data, and the risk level.

[0015] In combination with the first aspect, in some implementations of the first aspect, the method further includes: when there is a risk in using the data, pushing a risk alert to the user.

[0016] Through the technical solution of this implementation method, the current usage data is input into the analysis model, which can be analyzed in real time after the application's permission usage behavior ends, providing users with timely behavior analysis results, which is conducive to timely discovery of risky applications or permission usage issues, greatly improving the security performance of application permissions and protecting user privacy data.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the risk alert includes a plurality of alerts corresponding one-to-one to a plurality of risk levels.

[0018] Through the technical solution of this implementation, the risks are differentiated by level, and different forms of alerts can be pushed to users according to the risk level to inform users of risky behaviors in a timely manner. This technical solution can monitor risky behaviors in real time, and distinguish different risk levels according to differences in application behaviors, and notify users in real time in different ways, so as to flexibly handle risk information and provide users with timely and accurate information, thereby improving the security of application permission use.

[0019] In combination with the first aspect, in certain implementations of the first aspect, the risk of using data includes that the application uses the permission at a risky time, or that the context information of the permission's usage is risky, or that the frequency of the application's use of the permission is risky.

[0020] Through the technical solution of this implementation method, different risk types are obtained from usage data, and different risk situations in application permissions can be flexibly handled, giving users real-time and clear notifications, facilitating timely handling of permission security issues and enhancing the flexibility of real-time monitoring.

[0021] In combination with the first aspect, in some implementations of the first aspect, the method further includes: obtaining request data when detecting that an application requests permission; notifying the user of the request data; and storing the request data in a database.

[0022] Through the technical solution of this implementation method, it is possible to monitor and analyze before the permission is used, and to promptly discover possible problems with the application, thereby reducing the risks of subsequent use and other behaviors and improving application security.

[0023] In combination with the first aspect, in some implementations of the first aspect, the request data includes the type of permission, request time, request context information, and usage data.

[0024] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: after obtaining the request data, matching the request data with the usage rules in the rule library; if the match fails, pushing a risk alert to the user, and if the match succeeds, obtaining the usage data of the permission; after obtaining the usage data of the permission, storing the usage data in a database; a failed match includes that the permission is not authorized, and a successful match includes that the permission is authorized.

[0025] Through the technical solution of this implementation, the application's permission request data can be matched with the rule base, and corresponding judgments and feedback can be made on the application's request behavior based on the request data. This method can monitor the application's permission requests and usage behaviors in real time, and flexibly process them based on the rules in the rule base, so that the monitoring method can cooperate with the user's choice, improve the user experience, and enhance the security of application permissions.

[0026] In combination with the first aspect, in certain implementations of the first aspect, the risk alert includes an operation interface, which is used by users to manage authorization of permissions; the risk alert also includes the name of the application, the type of permission, and request context information and / or usage context information.

[0027] Through the technical solution of this implementation, users can manage application permissions in a timely manner in the alarm, which can provide users with convenient operation and management, and is conducive to improving the security of the system and the user experience.

[0028] In combination with the first aspect, in certain implementations of the first aspect, the database stores the request data and the usage data in a table format.

[0029] In combination with the first aspect, in certain implementations of the first aspect, the method also includes regularly updating and / or clearing data in the database; updating includes deleting expired permission authorization information, storing new permission authorization information, and requesting data and / or using data; clearing includes deleting data that has exceeded the storage period.

[0030] Through the technical solution of this implementation, it is possible to prevent invalid data from affecting the accuracy of data analysis, while reducing the storage space of the database and preventing excessive data from affecting the operation of the system.

[0031] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: organizing request data and usage data in a database, and regularly pushing usage reports to users; the usage reports include usage trends, risk summaries, and security recommendations.

[0032] Through the technical solution of this implementation method, the usage report can provide users with detailed application permission usage records, and based on data analysis, users can obtain information more intuitively, which is convenient for selecting processing methods according to needs, providing convenience for users, facilitating the rapid and efficient management of user permissions, and further enhancing the security management of application permissions.

[0033] In combination with the first aspect, in some implementations of the first aspect, the usage report includes a settings interface, the settings interface includes application alarm frequency settings, permission permission range adjustment settings for each application, and whether to allow automatic restriction of application permissions settings.

[0034] In combination with the first aspect, in certain implementations of the first aspect, usage trends include the number of times permissions are used, usage time distribution, and usage frequency; risk summary includes risk and risk level, time, and frequency; and security recommendations include usage recommendations for applications and / or permissions.

[0035] Through the technical solution of this implementation, detailed permission data is provided to users regularly, and users are reminded to check the usage, which helps users to obtain application usage information in a timely and convenient manner, thereby enhancing users' permission security awareness, thereby reducing the possibility of application permission risks and enhancing application permission security. In addition, through the setting of the operation interface, users can quickly perform management operations on the current page based on data reports or security recommendations without entering the system operation, providing users with a convenient platform and facilitating the timely management of risky behaviors, which is conducive to improving the security performance of application permissions.

[0036] In a second aspect, a computer-readable storage medium is provided, which stores a program code for executing a device, wherein the program code includes a method for executing a real-time monitoring method of permissions in any possible implementation manner of the first aspect.

[0037] In a third aspect, an electronic device is provided, which includes a processor and a memory, the memory is used to store program instructions, and the processor is used to call the program instructions to execute a real-time permission monitoring method such as any possible implementation method in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a schematic block diagram of an electronic device 100 provided in an embodiment of the present application; Figure 2 It is a schematic flowchart of a method 200 for real-time monitoring of permissions provided in an embodiment of the present application; Figure 3 It is a schematic flowchart of another method 300 for real-time monitoring of permissions provided in an embodiment of the present application; Figure 4 It is a schematic flowchart of another method 400 for real-time monitoring of permissions provided in an embodiment of the present application; Figure 5 It is a schematic flowchart of another method 500 for real-time monitoring of permissions provided in an embodiment of the present application; Figure 6 It is a schematic flowchart of another method 600 for real-time monitoring of permissions provided in an embodiment of the present application; Figure 7 It is a schematic block diagram of another electronic device 2 700 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0040] The method provided in this application relates to the Android system, and the method can be applied to the built-in system of an electronic device. The electronic device may be a portable electronic device that also includes other functions, such as a mobile phone, a tablet computer, etc., and a wearable electronic device with a wireless communication function, such as a smart watch, etc. Examples of portable electronic devices include, but are not limited to, portable electronic devices equipped with iOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as laptops (Laptop), etc. It should be understood that in some other embodiments, the above-mentioned electronic devices may not be portable electronic devices, but desktop computers, smart screens, large-screen devices, etc., and the embodiments of this application do not specifically limit this.

[0041] For example, Figure 1 1 shows a schematic block diagram of an electronic device 100 provided in an embodiment of the present application. The electronic device 100 may include a main processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, a communication module 150, an audio module 160, a sensor module 170, a display module 180, and the like.

[0042] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0043] The main processor 110 may include one or more processing units, for example, the main processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated into one or more processors. Among them, the controller may be a core module of the electronic device 100, and the controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of reading instructions and executing instructions.

[0044] The main processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the main processor 110 is a cache memory. The memory may store instructions or data that the main processor 110 has just used or cyclically used. If the main processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the main processor 110, and thus improves the efficiency of the system.

[0045] In some embodiments, the main processor 110 may include one or more interfaces. The interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0046] The external memory interface 120 can be used to connect an external memory card to expand the storage capacity of the electronic device 100. The external memory card communicates with the main processor 110 through the external memory interface 120 to implement a data storage function, such as storing pictures, audio, video and other files in the external memory card.

[0047] The internal memory 121 can be used to store computer executable program codes, which include instructions. The main processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function, such as a sound playback function, an image playback function, etc., and the data storage area can store data created during the use of the electronic device 100. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0048] The communication module 150 of the electronic device 100 may include an antenna, a mobile communication module, a wireless communication module, etc. Among them, the wireless communication function of the electronic device 100 can be realized by the antenna, the mobile communication module, the wireless communication module, the modulation and demodulation processor, and the baseband processor. The antenna is used to transmit and receive electromagnetic wave signals. Each antenna in the electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization rate of the antenna. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0049] The mobile communication module can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module can include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module can receive electromagnetic waves through an antenna, filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna. In some embodiments, at least some of the functional modules of the mobile communication module can be set in the main processor 110. In some embodiments, at least some of the functional modules of the mobile communication module can be set in the same device as at least some of the modules of the main processor 110.

[0050] The wireless communication module can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module can be one or more devices integrating at least one communication processing module. The wireless communication module receives electromagnetic waves via an antenna, modulates the frequency of the electromagnetic wave signal and performs filtering processing, and sends the processed signal to the main processor 110. The wireless communication module can also receive the signal to be sent from the main processor 110, modulate the frequency of the signal, amplify it, and convert it into electromagnetic waves for radiation through the antenna.

[0051] The electronic device 100 can realize audio functions, such as music playing, recording, etc., through the audio module 160. The audio module 160 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 160 can also be used to encode and decode audio signals. In some embodiments, the audio module 160 can be arranged in the main processor 110, or some functional modules of the audio module 160 can be arranged in the main processor 110.

[0052] The audio module 160 may include a speaker, a receiver, a microphone, a headphone jack, and an application processor. The speaker is also called a horn, which is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker. The receiver is also called a handset, which is used to convert an audio electrical signal into a sound signal. When the electronic device 100 answers a call or voice message, the voice can be answered by placing the receiver close to the human ear. The microphone is also called a microphone or a microphone, which is used to convert a sound signal into an electrical signal. The electronic device 100 can be provided with at least one microphone. In other embodiments, the electronic device 100 can be provided with two microphones, which can not only collect sound signals, but also realize a noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones to collect sound signals, reduce noise, identify the source of sound, realize a directional recording function, and the like.

[0053] The sensor module 170 may include a pressure sensor, a gyro sensor, an air pressure sensor, a magnetic sensor, an acceleration sensor, a distance sensor, a proximity light sensor, a fingerprint sensor, a temperature sensor, a touch sensor, an ambient light sensor, a bone conduction sensor, and the like.

[0054] The electronic device 100 implements the display function through the display module 180, GPU and application processor. The GPU is a microprocessor for image processing, connecting the display module 180 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The main processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.

[0055] The display module 180 is used to display images, videos, etc. The display module 180 can be a display screen, which includes a display panel. The display panel can be a liquid crystal display module (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), MiniLed, MicroLed, Micro-oLed, quantum dot light emitting diodes (QLED), etc. In some embodiments, the electronic device 100 may include one or more display modules 180.

[0056] In the iOS, Android, Microsoft or other operating systems carried by the above-mentioned electronic devices, various permissions are set in the system to protect the privacy of users. Taking the Android system as an example, the Android system divides permissions into different types, including installation permissions, runtime permissions and special permissions. Each permission type corresponds to the restricted data range that the application can access and the restricted operation range that the application can perform after the system grants the application the permission. Depending on the function, the system will automatically grant permissions or prompt the user to approve the request. The system provides monitoring of application permissions, and sends notifications to users when the application is first downloaded or applies for permission, reminding users which permissions will be authorized. Users can choose to authorize all or part of the permissions requested according to their needs.

[0057] In actual applications, when running and using functions, applications on Android devices need to apply for authorization from users before they can access system permissions. This function can monitor the permissions of applications, but after the application is authorized, the system will no longer restrict the application's use of permissions. Some applications may use permissions without the user's knowledge and at abnormal time periods, including permissions that may involve user sensitive information, which will pose a great threat to the user's privacy and security. In addition, some systems lack real-time monitoring of risky use of application permissions and cannot provide timely security protection for users.

[0058] Based on the above problems, an embodiment of the present application provides a method for real-time monitoring of permissions. By real-time monitoring of application permission behavior, obtaining and analyzing its permission usage behavior, the security of application permission usage can be improved and user information security can be protected.

[0059] Figure 2 FIG. 2 is a schematic flow chart of a method 200 for real-time monitoring of permissions provided in an embodiment of the present application. As an example, the monitoring method 200 can be applied to Figure 1 In the electronic device 100 shown, more specifically, the monitoring method 200 can be executed by the main processor 110.

[0060] like Figure 2 As shown, the real-time permission monitoring method 200 includes the following steps.

[0061] S201, after detecting the application usage permission, obtaining the current usage data of the permission; S202, obtaining the number of times the permission is used; S203, determining the number of times the permission is used; S204, when the number of times used is less than N, the current use data is stored in the database; S205, when the number of times of use is equal to N, training the analysis model according to the stored N times of use data; S206, when the number of times used is greater than N, inputting the current usage data of the application permission into the analysis model; S207, obtain output results.

[0062] In the embodiment of the present application, N is a preset value and a positive integer. The setting of N can be built-in in the monitoring method or can be set by the user. The present application does not specifically limit the value of N.

[0063] In step S201, the current usage record of the permission includes the complete usage behavior from the start of the application using the permission to the end of the use. As an example and not limitation, the usage behavior may include the type of permission, the start time and end time of the permission use, and usage context information.

[0064] Optionally, the usage context information may include the running status of the application, whether the device screen is turned off, whether the user is active, whether the application is running in the foreground or background of the Android system, whether the phone screen is turned on or off, etc.

[0065] Among them, application usage permissions refer to the permissions that application software calls within the system to complete its required functions. Before the application uses permissions, it is necessary to execute a call instruction within the system. The embodiment of the present application realizes real-time monitoring by monitoring the instruction. Specifically, the permission usage behavior of the application can be obtained in real time by calling the API provided by the Android system. For example, the two APIs AppOpsManager and UsageStatsManager are called to obtain permission authorization information and application usage statistics respectively. AppOpsManager can control application permission settings. Through this API, the permissions and authorization status of each application can be obtained; UsageStatsManager can provide a service for statistical application usage. Through this API, statistical data of application usage permissions within a specified time interval, statistical data of state change events, and statistical data of configuration information can be obtained.

[0066] In step S204, after obtaining the application permission usage data, the data is stored in the database in real time, that is, once the complete permission usage data is obtained, it is immediately saved in the database to ensure that each permission usage behavior can be traced. As an example but not a limitation, each permission of each application in the database corresponds to multiple information, such as the aforementioned start time, end time, context information, etc.

[0067] In step S205, the analysis model is trained according to N pieces of usage data, so that the parameters of the analysis model are more in line with the user's usage habits and the accuracy of the analysis is improved.

[0068] In some embodiments, the analysis model can be pre-trained based on preset data, that is, it already has model parameters and is built into the device system. During the training of the analysis model, first, based on the N pieces of permission usage data obtained, the server pre-processes and summarizes the information in these data to construct a training data set. The analysis model is then trained based on the above data set and adjusted to an analysis model that is more suitable for the user's usage habits, that is, the user's usage habits are learned and the parameters of the analysis model are fine-tuned according to the data. As an example and not a limitation, the training data set includes but is not limited to multi-dimensional information such as the time, frequency, contextual information, and user status of permission usage.

[0069] Optionally, the analysis model in the embodiment of the present application may be at least one of a deep learning model, a classification analysis model, a detection analysis model, etc., and the preprocessing of the data may include methods such as standardization, normalization, or data enhancement. The embodiment of the present application does not specifically limit the type of analysis model and the preprocessing method.

[0070] In step S206, after the application has used permission more than N times, each time permission usage data is obtained, the data is input into the analysis model for analysis, and the output result is returned to the system after it is obtained. This method can monitor and analyze the permission usage behavior of the application in real time, thereby improving the security of permission usage and protecting user information security.

[0071] The analysis model is the output result obtained based on the rule base and the current usage data. Specifically, after the application usage permission ends, the system sends the current usage data to the server in real time and inputs it into the analysis model for analysis. Exemplarily, the analysis process of the model can be performed based on the rule base, that is, the current usage data is processed and matched with the rules recorded in the rule base to obtain the final analysis result as the output of the model.

[0072] Optionally, the analysis model can be set up on a cloud server, and the permission usage data is transmitted from the user end to the server via the network. After obtaining the output result, the analysis model feeds the analysis result back to the system, that is, sends the output result back to the user end, records it in the database, and can also push it to the user to inform the user of the permission usage of the application in a timely manner.

[0073] In step S207, the output result of the analysis model is an analysis report of the permission usage behavior. As an example but not limitation, the output result can be a JSON (JavaScript object notation) message, that is, encoded data, and the output result can include, for example, the time period of permission usage, whether there is risk in using the data, the risk level, risky applications, etc.

[0074] In some embodiments, after the analysis model training is completed, the rule base can be updated according to the training results of the analysis model. That is, the adjustment of the rule base can be a dynamic adjustment, and the updated data is returned to the rule base through the analysis model's learning of user data, so as to realize a personalized dynamic rule base based on users. Specifically, after the analysis model is trained, its parameters and recorded application permission usage behaviors are adjusted to be more suitable for the current user's usage habits. At this time, the learned permission usage behaviors are updated to the rule base, and the rules recorded in the rule base that are not applicable to the current user are modified, so that the rule base can be optimized in time, thereby enhancing the analysis ability of the analysis model, making it more in line with the user's preferences, and improving the user's usage experience.

[0075] Optionally, users can customize the permission usage rules of the rule base and add these rules to the basic rules of the rule base. Based on the analysis model's learning of data, the rule base is dynamically adjusted to better adapt to the user's usage habits based on the preset rules. Therefore, in the process of continuous adjustment, the rule base can form a personalized rule base that suits user needs, thereby greatly improving the user experience.

[0076] In some implementations, the rule base includes usage rules for applications to use permissions, and the usage rules include but are not limited to application type, permission type, context information, and usage time period.

[0077] Optionally, the rule base includes preset basic permission usage rules and also includes records of application permission permissions after requesting permissions. As an example and not limitation, the preset basic rules may include rules such as "map applications can only use location permissions in the foreground" and "applications should not enable the camera when the screen is off". Each rule should include conditions such as application type, permission type, context and time period, which are used to analyze and judge permission usage behavior. In addition, when an application requests permission to use, the permission record selected by the user is stored in the rule base, which is used to match the application when requesting permission to determine whether it is authorized. The rules in the rule base can provide users with permission usage constraints, which can ensure the security of users' permissions and help improve application security performance.

[0078] After analyzing the permission usage data of the application and obtaining output results, the real-time permission monitoring method 200 also includes a real-time risk alert process for promptly notifying the user of the detected risky usage. Figure 3 A schematic flowchart of another method 300 for real-time monitoring of permissions provided in an embodiment of the present application is shown, and the following parts are omitted in the figure: Figure 2 The same content as the monitoring method 200 shown.

[0079] like Figure 3 As shown, the request monitoring method 300 includes the following steps.

[0080] S301, detecting that there is a risk in the permission usage data of the application; S302, push risk alert to the user; S303, the user performs rights management operations.

[0081] In the embodiments of the present application, Figure 2 In the method 200 shown, when an application uses permissions, its usage data will be input into the analysis model in real time for analysis, and the model will output the results and feed them back to the system. Further, when the output results of the analysis model show that the application usage behavior is risky, the system will issue an alarm to the user to remind the user that the application is risky. By inputting each piece of usage data into the analysis model in real time, it can be analyzed in real time after the application's permission usage behavior ends, providing users with timely behavior analysis results, which is conducive to timely discovery of risky applications or permission usage problems, greatly improving the security performance of application permissions, and protecting user privacy data.

[0082] In step S301, the risk of permission usage data of the application may include that the application uses the permission at a risky time, or that the permission usage context information has a risk, or that the frequency of permission usage by the application has a risk.

[0083] In step S302, risks can be divided into multiple levels according to the degree of abnormality of the application permission usage behavior, and the risk alerts pushed to the user include multiple alerts corresponding to multiple risk levels. Differentiating the risks by level can push different forms of alerts to users according to the risk level, and promptly inform users of risky behaviors. This method can monitor risky behaviors in real time, and distinguish different risk levels according to differences in application behaviors, and notify users in real time in different ways, so as to flexibly handle risk information, provide users with timely and accurate information, and improve the security of application permission usage.

[0084] Optionally, based on the type of permission, the time when the risky behavior occurs, and contextual information, the risk can be divided into four levels, for example, including low risk, medium risk, high risk, and severe risk. For example, low risk may include the application's high-frequency use of permissions when the screen is on, medium risk may include the application's multiple use of sensitive permissions when the screen is on, high risk may include the application's use of sensitive permissions when the screen is off, and severe risk may include the application's high-frequency use of sensitive permissions when the screen is off. Setting different risk levels can flexibly handle different risk situations when application permissions appear, give users real-time and clear notifications, facilitate timely handling of permission security issues, and enhance the flexibility of real-time monitoring.

[0085] In step S303, the risk alert includes an operation interface, which is used by the user to perform authorization management of the permission. The risk alert also includes an application name, permission type, and request context information and / or usage context information.

[0086] Optionally, the risk alert may include detailed information, such as the application name, permission type, and contextual information, so that users can view or operate in a timely manner. Optionally, different push methods may be used according to the aforementioned different risk levels. As an example and not limitation, the alert corresponding to the severe risk level may include a record of severe risk behavior, suggesting that the user immediately revoke the permission, and requiring the user to manually handle the notification, otherwise it will remain on the screen; the notification corresponding to the high risk level may prompt the user whether to take immediate action, and show the specific permission usage behavior of the application; the notification corresponding to the low or medium risk level may include a simple prompt to inform the user of the risky application and permission usage behavior.

[0087] Before an application uses permissions, the real-time permissions monitoring method 300 also includes a real-time permissions request monitoring process for monitoring and analyzing the application's request behavior.

[0088] Figure 4 FIG. 4 is a schematic flow chart of another method 400 for real-time monitoring of permissions provided in an embodiment of the present application. Figure 2 The monitoring method 200 and Figure 3 The same content as the monitoring method 300 is shown.

[0089] like Figure 4 As shown, the request monitoring method 400 includes the following steps.

[0090] S401, detecting that an application requests permission to use; S402, real-time monitoring and obtaining application permission request data; S403, notifying the user of the requested data; S404, storing the requested data in a database.

[0091] In an embodiment of the present application, the permission request behavior of the application is monitored in real time and the user can be notified in real time. The method can monitor and analyze before the permission is used, and promptly discover possible problems with the application, thereby reducing the risk of subsequent use and other behaviors and improving application security.

[0092] In step S401, in some implementations, when an application requests permission from the system, the system background triggers a permission request event, and after detecting the event, real-time monitoring is started and the information of the permission request is recorded. For example, the behavior of each application requesting permission can be captured in real time by monitoring the permission request broadcast of the Android system or intercepting the permission application interface of the system layer.

[0093] In step S402, the request data obtained above includes but is not limited to the type of permission requested, request time, request context information, etc. As an example but not limitation, the request time can be accurate to seconds, and the request context information can include user status, application usage status, screen status, etc.

[0094] In step S403, while monitoring the application's permission request behavior, the user can be notified of the request information in real time. Specifically, a dialog box can be popped up to explain the permission request behavior, that is, the application needs to explain the purpose of the permission it requests, for example, "use the microphone for voice search function", "use the camera for face recognition function", or "access location for weather update", etc. These explanatory information, together with the aforementioned permission application type and context information, are also recorded in the database for analysis of the rationality of permission use and behavior.

[0095] In step S404, optionally, the database stores the request data and the usage data in a table format. The format of the database can also be fields, etc., which is not specifically limited in the embodiment of the present application.

[0096] Combined with Figure 2 The monitoring method 200 shown and Figure 4 The monitoring method 400 shown below generally integrates the process of the application's permission request behavior and usage behavior. Figure 5 A schematic flowchart of another method 500 for real-time monitoring of permissions provided in an embodiment of the present application is shown, and the following parts are omitted in the figure: Figure 2 The monitoring method 200 shown and Figure 4 The same content as the monitoring method 400 shown.

[0097] like Figure 5 As shown, the request monitoring method 500 includes the following steps.

[0098] S501, obtaining request data; S502, matching with rules in the rule base; S503: Matching failed, the application cannot use the permission, and is not monitored; S504, push risk alert to the user; S505, matching is successful, obtaining permission usage data; S506, storing the usage data in a database.

[0099] The matching may include determining whether the permission applied for by the application is authorized, a matching failure includes that the permission is not authorized, and a matching success includes that the permission is authorized.

[0100] In an embodiment of the present application, the permission request data of the application will be matched with the rule library, and corresponding judgment and feedback will be made on the request behavior of the application based on the request data. The method can monitor the permission request and usage behavior of the application in real time, and flexibly process it based on the rules in the rule library, so that the monitoring method can cooperate with the user's choice, improve the user experience, and enhance the security of application permissions.

[0101] In step S501, the request data may be as follows: Figure 4 Request data in the monitoring method shown.

[0102] In step S502, after the system obtains the request data, it matches the request data with the usage rules in the rule library. The matched rules may be as follows: Figure 2 The preset basic permission usage rules in the monitoring method 200 are shown.

[0103] If the match fails, a risk alert will be pushed to the user. If the monitoring permission usage behavior stops after the application is used, the usage behavior will be recorded in real time, including but not limited to the specific permissions used, start and end time, etc. In addition to usage behavior, the context of permission usage can also be recorded, including but not limited to the application running status, i.e. foreground or background, whether the phone screen is turned off, whether the user is active, etc.

[0104] In step S504, the risks include failure to match the application request data with the rule base, that is, the permissions requested by the application do not comply with the rules in the rule base, and the application's permission usage data has risks. Risks can include Figure 3 The multiple risk levels in the monitoring method 300 shown, the risk alerts include alerts corresponding to the multiple risk levels, which can be pushed to the user in different forms according to the risk levels. Further, the user can perform permission management operations after receiving the notification.

[0105] In step S505, the usage data may be as follows: Figure 2 Usage data in monitoring method 200 is shown.

[0106] In step S506, the database can analyze the frequency and time period of the stored usage data. Specifically, the database can regularly count the frequency of use of permissions by each application. As an example and not limitation, the database can count once a day, that is, every 24 hours, and calculate the number of times the application uses the permission in each hour to monitor the frequency and duration of use of the permission and determine whether it is occupied for a long time. Among them, for sensitive permissions, that is, permissions that may involve user privacy, such as cameras, microphones, locations, etc., their usage time periods are counted to monitor the risk of the permissions. For example, using microphone permissions when the user is not operating the phone, or using camera permissions late at night, etc., will be considered to be risky.

[0107] Optionally, the data in the database can be updated and / or cleared regularly, where updating includes deleting expired authorization information, storing new authorization information, and request data and / or usage data, and clearing includes deleting data that has been stored for an extended period of time. Regularly updating the database can clear expired data in a timely manner and add new authorization data, which can prevent invalid data from affecting the accuracy of data analysis and reduce the storage space of the database.

[0108] In some implementations, the information in the database can also provide a query function, that is, the user can search by time or permission type and view the historical request behavior of the application. For example, the user's authorization of application permissions may change, such as revoking or opening the permission to use the permissions. The database can update the database information at regular intervals and clear the expired data. Optionally, the regular time can be one week or two weeks, etc., which is not specifically limited in the embodiments of the present application.

[0109] Regularly updating the data in the database and correcting the modified information can ensure the correctness of data storage and provide users with the information they need. Regularly clearing data from the database can prevent excessive data from affecting system operation.

[0110] Optionally, the database can store two months of data. When the data storage time exceeds two months, the data will be cleared and only the latest two months of data will be retained. Exemplarily, when the data has not timed out but the amount of data is too large, a data compression and storage mechanism can be used to reduce the system storage space occupied by the data and prevent a large amount of permission usage data from affecting system performance. Compression methods can include, for example, one or more methods such as encoding simplified data format, data deduplication, hierarchical partition storage, etc., which are not specifically limited in the embodiments of the present application.

[0111] After obtaining the permission request data, usage data and performing risk analysis, the permission real-time monitoring method also includes a data analysis and reporting method. Figure 6A schematic flowchart of another method 600 for real-time monitoring of permissions provided in an embodiment of the present application is shown, and the following parts are omitted in the figure. Figures 2 to 5 The monitoring methods 200 to 500 shown have the same contents.

[0112] like Figure 6 As shown, the monitoring method 600 includes the following steps.

[0113] S601, arranging data in a database; S602, regularly push permission usage reports to users, including usage trends, risk summaries, and security recommendations; S603, the user performs customized settings according to the usage report.

[0114] Combined with Figures 2 to 5 In the monitoring methods 200 to 500 shown, the database stores the permission request data and permission usage data of the application. Based on these records, the relationship between the data is analyzed and calculated to generate the permission usage trend, risk behavior summary and user security suggestions for each application. The report can provide users with detailed application permission usage records, and based on data analysis, users can obtain information more intuitively, which is convenient for selecting processing methods according to needs, providing users with convenience, facilitating the rapid and efficient management of user permissions, and further enhancing the security management of application permissions.

[0115] In step S601, the database analyzes the stored usage data and request data. As an example and not limitation, the analysis result may include the usage time period, usage duration and usage frequency of the permission.

[0116] In step S602, the database regularly generates permission usage reports and pushes the usage reports to the user. Optionally, the usage reports include permission usage trends, risk behavior summaries, and security recommendations generated based on the user's usage habits. The user can manage permissions based on the reports and recommendations.

[0117] The usage report includes a settings interface, which includes application alert frequency settings, permission range adjustment settings for each application, and whether to allow automatic restriction of application permissions. More specifically, usage trends include the number of times permissions are used, usage time distribution, and usage frequency; risk summaries include risks and risk levels, time, and frequency; and security recommendations include usage recommendations for applications and / or permissions.

[0118] Optionally, the usage trend may include the collation of usage behavior data. As an example and not limitation, the number of times the application permissions are used, the distribution of usage time, and the frequency of permission usage may be calculated and analyzed according to a report generation cycle, such as daily, weekly, or monthly, and a report may be generated to display the above information to the user.

[0119] Optionally, the risk summary can display relevant information about risky behaviors of permission usage, and analyze the potential risks of the application based on this information. As an example but not limitation, the report may include the risk level, behavior time, frequency, etc. of risky behaviors. Potential risks may include whether the application frequently uses sensitive permissions in unreasonable time periods, etc. Providing users with detailed permission data regularly and reminding users to check usage will help users obtain application usage information in a timely and convenient manner, thereby enhancing users' permission security awareness, thereby reducing the possibility of application permission risks and enhancing application permission security.

[0120] In some embodiments, security recommendations are generated for users based on the data presented in the aforementioned report and the user's usage habits. For example, according to the data summary in the aforementioned usage report, security recommendations can be automatically generated in combination with the alarm records of risky behaviors, and operational recommendations can be made for risky applications, such as recommending that users restrict the permissions of the application or uninstall the application. Optionally, personalized security recommendations can also be generated in combination with the user's application usage habits. For example, for applications that users have used for a long time, it is recommended to set stricter permission usage rules for them, or adjust permission permissions, etc.

[0121] In step S603, the permission usage report may include a user-friendly interface, that is, allowing the user to view the risk data of permission usage at any time, and the interface may display the detailed permission usage behavior of each application, such as request or usage time, usage frequency, request or usage environment, etc. In addition, fast permission management operations may also be provided. For example, the user may quickly take measures through the interface, such as revoking specific permissions of an application, suspending the operation of the application, or setting further permission restrictions. Through the setting of the operation interface, the user can quickly perform management operations on the current page according to the data report or security recommendations without entering the system operation, which provides a convenient platform for users, facilitates the timely management of risky behaviors, and is conducive to improving the security performance of application permissions.

[0122] Optionally, the aforementioned monitoring rules and alarm policies can be set by the user. For example, users can flexibly set the alarm frequency according to their own application usage needs, that is, increase or decrease the number of alarms to avoid too many invalid notifications affecting the normal use of users, or users can set the system to automatically limit application permissions, so that users can avoid risks in time when it is inconvenient to handle. Optionally, an operation interface is constructed to facilitate users to set rules. The page may include functions such as application alarm frequency settings, permission range adjustment settings for each application, and whether to allow automatic restriction of application permissions. Allowing users to customize setting rules and policies can provide users with flexible selection space, so that users can set health methods as better options according to their usage habits and needs, and can better meet user needs on the basis of ensuring safety, thereby improving user satisfaction.

[0123] For example, Figure 7 7 is a schematic block diagram of another electronic device 2 700 provided in an embodiment of the present application. The electronic device 2 700 may include: a processor 710 and a memory 720. The processor 710 and the memory 720 are connected via an internal connection path, the memory 720 is used to store instructions, and the processor 710 is used to execute the instructions stored in the memory 720 and receive / send some parameters. Optionally, the memory 720 may be coupled to the processor 710 via an interface or may be integrated with the processor 710.

[0124] In the embodiment of the present application, the electronic device 2 700 may be as follows: Figure 1 In the electronic device 100 shown in FIG. 1 , the processor 710 may be the main processor 110 in the electronic device 100, and the memory 720 may be Figure 1 The internal memory 121 in the electronic device 100 shown may also be the memory in the main processor 110 .

[0125] The processor 710 is a circuit with signal processing capability. In another implementation, the processor 710 may be a circuit with instruction reading and execution capability, such as a central processing unit (CPU), a microprocessor, etc. In another implementation, the processor 710 may implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as the processor 710 is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as a field programmable gate array (FPGA). In a reconfigurable hardware circuit, the processor 710 loads a configuration document to implement the hardware circuit configuration process, which can be understood as the process of the processor 710 loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0126] The present application also provides a computer-readable storage medium, which stores program codes or instructions. When the computer program codes or instructions are executed by a processor of a computer, the processor implements the above-mentioned Figures 2 to 6 Any method embodiment and any possible implementation thereof.

[0127] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0128] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0130] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0131] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0132] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0133] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for real-time monitoring of permissions, characterized in that: include: After detecting that the application uses the permission, obtain the current usage data of the permission and the number of times the permission is used; When the number of times used is less than N, the current use data is stored in a database; When the number of times of use is equal to N, training the analysis model based on the usage data of the N times of using the permission; When the number of times of use is greater than N, the current use data is input into the analysis model to obtain an output result; N is a preset value, and N is a positive integer.

2. The method according to claim 1, characterized in that The analysis model is used to obtain the output result according to the rule base and the current usage data.

3. The method according to claim 2, characterized in that The method also includes: updating the rule base according to the training result of the analysis model.

4. The method according to claim 3, characterized in that The rule base includes usage rules for the permissions, and the usage rules include application type, permission type, context information, and usage time period.

5. The method according to claim 4, characterized in that The current usage data includes usage behavior from the time the application starts using the permission to the time the application stops using the permission, and the usage behavior includes the type of the permission, the start time and the end time of the permission use, and the usage context information of the application; The usage context information includes the running status of the application, whether the screen is turned off, and whether the user is active.

6. The method according to claim 5, characterized in that The output result of the analysis model includes the usage time period of the permission, whether there is risk in the usage data, and the risk level.

7. The method according to claim 6, characterized in that The method further includes: when there is a risk in the usage data, pushing a risk alert to the user.

8. The method according to claim 7, characterized in that The risk alarm includes a plurality of alarms corresponding to a plurality of risk levels one by one.

9. The method according to claim 7, characterized in that: The risk of using the data includes that the application uses the permission at a risky time, or the usage context information of the permission is risky, or the frequency of using the permission by the application is risky.

10. The method according to claim 9, characterized in that Also includes: When detecting that the application requests the permission, obtaining request data; Notifying the user of the request data; The request data is stored in the database.

11. The method according to claim 10, characterized in that The request data includes the type of permission, request time, request context information and usage data.

12. The method according to claim 11, characterized in that Also includes: After obtaining the request data, matching the request data with the usage rules in the rule base; If the match fails, the risk alert is pushed to the user, and if the match succeeds, the usage data of the permission is obtained; After acquiring the usage data of the permission, storing the usage data in the database; The match failure includes that the permission is not authorized, and the match success includes that the permission is authorized.

13. The method according to claim 12, characterized in that The risk alert includes an operation interface, and the operation interface is used for the user to perform authorization management of the permission; The risk alert further includes the name of the application, the type of the permission, and the request context information and / or the usage context information.

14. The method according to claim 12, characterized in that The database stores the request data and the usage data in a table form.

15. The method according to claim 14, characterized in that Also includes: Regularly update and / or clear data from the database; The updating includes deleting the invalid authority authorization information and storing the new authority authorization information, as well as the request data and / or the usage data; The clearing includes deleting data whose storage time exceeds the time limit.

16. The method according to claim 15, characterized in that Also includes: Arrange the request data and the usage data in the database, and regularly push usage reports to users; The usage reports include usage trends, risk summaries, and security recommendations.

17. The method according to claim 16, characterized in that The usage report includes a setting interface, and the setting interface includes application alarm frequency settings, permission range adjustment settings for each application, and whether to allow automatic restriction of application permissions settings.

18. The method according to claim 16, characterized in that The usage trend includes the number of times the permission is used, the distribution of usage time, and the frequency of use; The risk summary includes the risk and risk level, time, and frequency; The security suggestion includes a usage suggestion for the application and / or the permission.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a device to execute a program code, wherein the program code includes code for executing the method according to any one of claims 1 to 18.

20. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store program instructions, and the processor is used to call the program instructions to execute the method according to any one of claims 1 to 18.

Images