App security assessment method, medium and system based on cloud mobile phone

Abstract

The invention discloses an App security assessment method, medium and system based on a cloud mobile phone, and the method comprises the steps: obtaining an assessment request, downloading a corresponding to-be-assessed App installation package based on the assessment request, and installing the to-be-assessed App installation package to the cloud mobile phone; randomly generating test parameters, and controlling the cloud mobile phone to perform simulation operation on the to-be-evaluated App based on the test parameters; collecting plaintext data generated in the simulation running process, and analyzing the plaintext data to judge whether the plaintext data contains personal information or not; if the plaintext data contains personal information, generating corresponding alarm information; the data acquisition convenience can be effectively improved in the process of detecting whether the App acquires and transmits the personal information or not; meanwhile, the detection efficiency and the detection accuracy are improved.

Description

Technical Field

[0001] The present application relates to the field of program security detection technology, and in particular to a cloud phone-based App security assessment method, medium and system. Background Art

[0003] With the progress of the times and the development of science and technology, mobile apps are used everywhere in people's lives, bringing great convenience to daily life, work, study, leisure and entertainment. However, while mobile apps bring convenience, there are also some apps that illegally collect personal information and transmit it to the server through the network. These behaviors seriously infringe on citizens' information security and data security rights.

[0004] In the related technology, when testing whether an App collects and transmits personal information, it is often necessary to configure a mobile proxy server and a packet capture tool to obtain network data on the mobile phone, and then manually analyze and judge the network data. This method of obtaining network data requires the use of a proxy server, which is inconvenient; in addition, the manual judgment method is deeply affected by human factors, prone to misjudgment, and has low detection efficiency. Summary of the invention

[0006] The present invention aims to solve at least one of the technical problems in the related art to a certain extent. To this end, one purpose of the present invention is to propose an App security assessment method based on a cloud phone, which can effectively improve the convenience of data collection in the process of detecting whether an App collects and transmits personal information; at the same time, improve the detection efficiency and detection accuracy.

[0007] In the first aspect, an embodiment of the present invention proposes an App security assessment method based on a cloud phone, comprising the following steps: obtaining an assessment request, and downloading a corresponding App installation package to be assessed based on the assessment request, and installing the App installation package to be assessed to the cloud phone; randomly generating test parameters, and controlling the cloud phone to perform simulated operation on the App to be assessed based on the test parameters; collecting plaintext data generated by the simulated operation process, and parsing the plaintext data to determine whether the plaintext data contains personal information; if the plaintext data contains personal information, generating corresponding alarm information.

[0008] According to the cloud phone-based App security assessment method of an embodiment of the present invention, first, an assessment request is obtained, and the corresponding App installation package to be assessed is downloaded based on the assessment request, and the App installation package to be assessed is installed on the cloud phone; then, test parameters are randomly generated, and the cloud phone is controlled to simulate the operation of the App to be assessed based on the test parameters; then, the plaintext data generated by the simulation operation process is collected, and the plaintext data is parsed to determine whether the plaintext data contains personal information; then, if the plaintext data contains personal information, a corresponding alarm message is generated; thereby effectively improving the convenience of data collection in the process of detecting whether the App collects and transmits personal information; at the same time, the detection efficiency and accuracy are improved.

[0009] In some embodiments, before installing the App installation package to be evaluated to the cloud phone, it also includes: obtaining the App name to be evaluated corresponding to the App installation package to be evaluated; querying the cloud phone's installed application list according to the App name to be evaluated to determine whether the cloud phone has installed the application with the same name corresponding to the App to be evaluated; if the cloud phone has installed the application with the same name, uninstalling the application with the same name.

[0010] In some embodiments, the plaintext data includes socket network data packets, wherein collecting the plaintext data generated by the simulation running process includes: determining the key functions of socket communication; inserting a first data stream writing function into each of the key functions, so that the cloud phone saves the socket network data packet to the sandbox directory corresponding to the App to be evaluated based on the first data stream writing function.

[0011] In some embodiments, the plaintext data includes https network data packets, wherein collecting the plaintext data generated by the simulation operation process includes: determining the key functions of https communication; inserting a second data stream writing function into each of the key functions, so that the cloud phone saves the https network data packets to the sandbox directory corresponding to the App to be evaluated based on the second data stream writing function.

[0012] In some embodiments, the plaintext data is parsed to determine whether the plaintext data contains personal information, including: parsing the plaintext data based on an open source named entity recognition library to obtain corresponding multiple entities; matching the multiple entities based on a preset rule library to determine whether the multiple entities contain personal information.

[0013] In some embodiments, the rule base is generated by keywords, regular expressions and algorithms.

[0014] In some embodiments, determining whether the plaintext data contains personal information includes: obtaining device information generated by the cloud phone during the simulation operation; detecting whether the plaintext data contains the device information based on the DFA algorithm; if the plaintext data contains the device information, determining that the plaintext data contains personal information.

[0015] In some embodiments, the read-only memory image corresponding to the cloud phone is generated based on AOSP, and the cloud phone is installed and deployed on an ARM development board; a plurality of the cloud phones are run in batches on the ARM development board.

[0016] In the second aspect, an embodiment of the present invention proposes a computer-readable storage medium, on which a cloud phone-based App security assessment program is stored. When the cloud phone-based App security assessment program is executed by a processor, the cloud phone-based App security assessment method as described above is implemented.

[0017] In the third aspect, an embodiment of the present invention proposes an App security assessment system based on a cloud phone, including: a task engine module, the task engine module is used to obtain an assessment request, and download the corresponding App installation package to be assessed based on the assessment request, and install the App installation package to be assessed to the cloud phone; the task engine module is also used to randomly generate test parameters, and control the cloud phone to simulate the operation of the App to be assessed based on the test parameters; a data acquisition engine module, the data acquisition engine module is used to collect plaintext data generated by the simulation operation process; a rule engine module, the rule engine module is used to parse the plaintext data to determine whether the plaintext data contains personal information, and generate corresponding alarm information when the judgment result is yes.

[0018] According to the cloud phone-based App security assessment system of the embodiment of the present invention, a task engine module is set to obtain an assessment request, and based on the assessment request, the corresponding App installation package to be assessed is downloaded, and the App installation package to be assessed is installed on the cloud phone; the task engine module is also used to randomly generate test parameters, and based on the test parameters, the cloud phone is controlled to simulate the App to be assessed; the data collection engine module is used to collect the plaintext data generated during the simulation operation; the rule engine module is used to parse the plaintext data to determine whether the plaintext data contains personal information, and when the judgment result is yes, a corresponding alarm message is generated. Thereby, the convenience of data collection is effectively improved in the process of detecting whether the App collects and transmits personal information; at the same time, the detection efficiency and accuracy are improved.

[0019] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a cloud phone-based App security assessment method according to an embodiment of the present invention; Figure 2 is a flow chart of a cloud phone-based App security assessment method according to another embodiment of the present invention; Figure 3 4 is a block diagram of an App security assessment system based on a cloud phone according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0024] The following describes a cloud phone-based App security assessment method according to an embodiment of the present invention with reference to the accompanying drawings.

[0025] See also Figure 1 , Figure 1 FIG. 6 is a flow chart of a method for evaluating App security based on a cloud phone according to an embodiment of the present invention; Figure 1 As shown, the cloud phone-based App security assessment method includes the following steps: S101, obtaining an evaluation request, downloading a corresponding installation package of the App to be evaluated based on the evaluation request, and installing the installation package of the App to be evaluated to the cloud phone.

[0026] In some embodiments, before installing the installation package of the App to be evaluated to the cloud phone, it also includes: obtaining the name of the App to be evaluated corresponding to the installation package of the App to be evaluated; querying the list of installed applications of the cloud phone according to the name of the App to be evaluated to determine whether the cloud phone has installed the application with the same name corresponding to the App to be evaluated; if the cloud phone has installed the application with the same name, uninstalling the application with the same name.

[0027] As an example, first, obtain the evaluation request of the App to be evaluated, which may include the download address of the App to be evaluated, the name of the App to be evaluated, etc.; then, based on the download address in the evaluation request, use the script to download the installation package of the App to be evaluated; then, in order to prevent other versions of the App to be evaluated from already existing in the applications installed on the cloud phone; before installing the App to be evaluated on the cloud phone, first, obtain the name of the App to be evaluated; then, query the list of installed applications on the cloud phone based on the name of the App to be evaluated, and determine whether there is an application with the same name corresponding to the App to be evaluated in the list of installed applications; if so, uninstall the application with the same name, and then install the installation package of the App to be evaluated after the uninstallation is complete; if not, install it directly. In this way, the installation failure caused by the existence of applications with the same name can be avoided.

[0028] S102, randomly generating test parameters, and controlling the cloud phone to simulate the running of the App to be evaluated based on the test parameters.

[0029] That is to say, during the evaluation process, first, the test parameters (for example, the number of swipes, the number of clicks, the click coordinates, returning to the main interface of the mobile phone, and the operation time corresponding to each instruction, etc.) are randomly generated; then, based on the randomly generated test parameters, the cloud phone is controlled to simulate the operation of the App to be evaluated.

[0030] As an example, first, after the App to be evaluated is successfully installed, use adb shell monkey -p<package name> <count>This MonKey command drives the App to be evaluated to run on the cloud phone. cout indicates the number of random operations of MonKey, and package name indicates the name of the App to be evaluated. During the running process, clicks, slides, returns to the main interface of the phone, pulls down and other actions are randomly triggered according to the test parameters.

[0031] In some embodiments, the read-only memory image corresponding to the cloud phone is generated based on AOSP, and the cloud phone is installed and deployed on an ARM development board; multiple cloud phones are run in batches on the ARM development board.

[0032] It is understandable that when there is only one cloud phone, the test parameters randomly generated by a single cloud phone can only cover a single usage scenario. Therefore, in order to cover a more comprehensive usage scenario, the App to be evaluated can be run simultaneously on multiple cloud phones to make the test scenario more comprehensive, thereby improving the accuracy of the final evaluation results.

[0033] S103, collecting plaintext data generated during the simulation operation process, and parsing the plaintext data to determine whether the plaintext data contains personal information.

[0034] In some embodiments, the plaintext data includes socket network data packets, wherein collecting the plaintext data generated by the simulation running process includes: determining the key functions of the socket communication; inserting the first data stream writing function into each key function, so that the cloud phone saves the socket network data packet to the sandbox directory corresponding to the App to be evaluated based on the first data stream writing function.

[0035] As an example, first, determine the key functions of socket communication; preferably, the socketWrite function in java.net.SocketOutputStream, the socketRead function in java.net.SocketInputStream, the sendto function and the recvfrom function in libc.so (dynamic library file) are used as the key functions of socket communication; then, insert the first data stream write function (for example, the writeToFiles function) in the source code of each key function; through the first data stream write function, the socket network data packets sent and received during the simulation operation of the cloud phone can be saved in the sandbox directory corresponding to the App to be evaluated, so as to subsequently obtain the socket network data packets from the sandbox directory corresponding to the App to be evaluated, which greatly improves the convenience of obtaining the corresponding data for the simulation operation.

[0036] In some embodiments, the plaintext data includes https network data packets, wherein collecting the plaintext data generated by the simulation operation process includes: determining the key functions of https communication; inserting a second data stream writing function into each key function, so that the cloud phone saves the https network data packets to the sandbox directory corresponding to the App to be evaluated based on the second data stream writing function.

[0037] As an example, first, determine the key functions corresponding to https communication. Preferably, the SSL_write function and the SSL_read function in libssl.so are used as the key functions corresponding to https communication. Then, insert the second data stream write function into the key function corresponding to https communication, so that the https network data packets sent and received during the simulation operation of the cloud phone can be saved in the sandbox directory corresponding to the App to be evaluated through the second data stream write function, so as to subsequently obtain the https network data packets from the sandbox directory corresponding to the App to be evaluated, which greatly improves the convenience of obtaining data corresponding to the simulation operation.

[0038] In some embodiments, plaintext data is parsed to determine whether the plaintext data contains personal information, including: parsing the plaintext data based on an open source named entity recognition library to obtain corresponding multiple entities; matching multiple entities based on a preset rule library to determine whether the multiple entities contain personal information.

[0039] In some embodiments, the rule base is generated by keywords, regular expressions, and algorithms.

[0040] In some embodiments, determining whether the plaintext data contains personal information includes: obtaining device information generated by the cloud phone during the simulation operation; detecting whether the plaintext data contains device information based on the DFA algorithm; if the plaintext data contains device information, determining that the plaintext data contains personal information.

[0041] As an example, first, after obtaining the plaintext data corresponding to the simulation running process, the obtained plaintext data is preprocessed to filter out invalid information in the plaintext data; specifically, the IP, domain name, tcp payload, http / https Url, http / https header, http / https body and other information of the network request in the plaintext data can be regarded as invalid information, and then these invalid information are filtered out to reduce the amount of calculation and improve the efficiency of subsequent evaluation operations. Next, the plaintext data is parsed into corresponding multiple entities through an open source named entity recognition library (for example, HanLP); then, the multiple entities are matched through a preset rule library to determine whether the multiple entities contain personal information; preferably, personal information may include but is not limited to mobile phone number, email address, address, ID number, location information, mobile device information, call records, text message records, etc.; by matching the preset rule library, it can be determined whether the plaintext data includes the above-mentioned sensitive information (i.e., personal information); then, the device information generated by the cloud phone during the simulation operation (specifically, the device information may include location information, mobile device information (IMEI, IMSI, Wi-Fi Mac, SSID, etc.), call records, text message records, etc.) is obtained; and the device information is saved in the root directory of the cloud phone; then, the plaintext data is detected based on the DFA algorithm to determine whether the plaintext data contains device information; if the plaintext data contains personal information or device information, it is determined that the plaintext data contains personal information.

[0042] S104: If the plaintext data contains personal information, corresponding warning information is generated.

[0043] That is to say, if the plaintext data contains personal information, it means that the App to be evaluated illegally obtains the user's personal information; therefore, a corresponding warning message is generated as the detection result of the App to be evaluated.

[0044] As a specific embodiment of the present invention, Figure 2 As shown, the cloud phone-based App security assessment method proposed in the present invention includes the following steps: S201, obtaining an evaluation request, and downloading a corresponding installation package of the App to be evaluated based on the evaluation request.

[0045] S202, obtaining the name of the App to be evaluated corresponding to the App installation package to be evaluated.

[0046] S203, determine whether the cloud phone has installed the application with the same name corresponding to the App to be evaluated; if yes, execute step S204; if not, execute step S205.

[0047] S204: Uninstall the application with the same name.

[0048] S205, installing the installation package of the App to be evaluated into the cloud phone.

[0049] S206, randomly generating test parameters, and controlling the cloud phone to simulate the running of the App to be evaluated based on the test parameters.

[0050] S207, collecting plaintext data generated during the simulation operation process.

[0051] S208, parsing the plaintext data based on an open source named entity recognition library to obtain corresponding multiple entities.

[0052] S209, matching multiple entities based on a preset rule base to determine whether the multiple entities contain personal information; if yes, executing step S210; if not, executing step S211.

[0053] S210, generating alarm information.

[0054] S211, obtaining device information generated by the cloud phone during the simulation operation.

[0055] S212, based on the DFA algorithm, detect whether the plaintext data contains device information; if yes, execute step S213; if not, execute step S214.

[0056] S213, determining that the plaintext data contains personal information, and generating warning information.

[0057] S214, end.

[0058] To summarize, according to the cloud phone-based App security assessment method of an embodiment of the present invention, first, an assessment request is obtained, and the corresponding App installation package to be assessed is downloaded based on the assessment request, and the App installation package to be assessed is installed on the cloud phone; then, test parameters are randomly generated, and the cloud phone is controlled to simulate the operation of the App to be assessed based on the test parameters; then, the plaintext data generated by the simulation operation process is collected, and the plaintext data is parsed to determine whether the plaintext data contains personal information; then, if the plaintext data contains personal information, a corresponding alarm message is generated; thereby effectively improving the convenience of data collection in the process of detecting whether the App collects and transmits personal information; at the same time, the detection efficiency and accuracy are improved.

[0059] In the second aspect, an embodiment of the present invention proposes a computer-readable storage medium, on which a cloud phone-based App security assessment program is stored. When the cloud phone-based App security assessment program is executed by a processor, the cloud phone-based App security assessment method as described above is implemented.

[0060] In a third aspect, an embodiment of the present invention proposes an App security assessment system based on a cloud phone; Figure 3 As shown, the cloud phone-based App security assessment system includes: a task engine module 10, a data acquisition engine module 20 and a rule engine module 30.

[0061] The task engine module 10 is used to obtain an evaluation request, download the corresponding App installation package to be evaluated based on the evaluation request, and install the App installation package to be evaluated to the cloud phone; The task engine module 10 is also used to randomly generate test parameters, and control the cloud phone to simulate the operation of the App to be evaluated based on the test parameters; The data collection engine module 20 is used to collect the plain text data generated during the simulation operation; The rule engine module 30 is used to parse the plain text data to determine whether the plain text data contains personal information, and to generate corresponding warning information when the determination result is yes.

[0062] It should be noted that the above description of the cloud phone-based App security assessment method is also applicable to the cloud phone-based App security assessment system, and will not be repeated here.

[0063] In summary, according to the cloud phone-based App security assessment system of the embodiment of the present invention, a task engine module is set to obtain an assessment request, and based on the assessment request, the corresponding App installation package to be assessed is downloaded, and the App installation package to be assessed is installed on the cloud phone; the task engine module is also used to randomly generate test parameters, and based on the test parameters, the cloud phone is controlled to simulate the App to be assessed; the data acquisition engine module is used to collect the plaintext data generated during the simulation operation; the rule engine module is used to parse the plaintext data to determine whether the plaintext data contains personal information, and when the judgment result is yes, a corresponding alarm message is generated. Thereby, the convenience of data collection is effectively improved in the process of detecting whether the App collects and transmits personal information; at the same time, the detection efficiency and accuracy are improved.

[0064] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0065] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0066] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0067] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0068] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0069] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0070] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being "above", "above" or "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0071] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.< / count>

Claims

1. A cloud phone-based App security assessment method, characterized in that: The following steps are involved: Obtain an evaluation request, download a corresponding installation package of the App to be evaluated based on the evaluation request, and install the installation package of the App to be evaluated on the cloud phone; Randomly generate test parameters, and control the cloud phone to simulate the operation of the App to be evaluated based on the test parameters; Collecting plaintext data generated during the simulation operation process, and parsing the plaintext data to determine whether the plaintext data contains personal information; If the plaintext data contains personal information, corresponding warning information is generated.

2. The cloud phone-based App security assessment method according to claim 1, characterized in that: Before installing the App installation package to be evaluated into the cloud phone, the following steps are also included: Obtain the name of the App to be evaluated corresponding to the App installation package to be evaluated; Query the cloud phone's installed application list according to the name of the App to be evaluated to determine whether the cloud phone has installed an application with the same name corresponding to the App to be evaluated; If the cloud phone has installed an application with the same name, the application with the same name is uninstalled.

3. The cloud phone-based App security assessment method according to claim 1, characterized in that: The plaintext data includes a socket network data packet, wherein collecting the plaintext data generated during the simulation operation includes: Determine the key functions of socket communication; A first data stream writing function is inserted into each of the key functions so that the cloud phone saves the socket network data packet to the sandbox directory corresponding to the App to be evaluated based on the first data stream writing function.

4. The cloud phone-based App security assessment method according to claim 1, characterized in that: The plaintext data includes https network data packets, wherein collecting the plaintext data generated during the simulation operation includes: Determine the key functions of https communication; A second data stream writing function is inserted into each of the key functions so that the cloud phone saves the https network data packet into the sandbox directory corresponding to the App to be evaluated based on the second data stream writing function.

5. The cloud phone-based App security assessment method according to claim 1, characterized in that: Parsing the plaintext data to determine whether the plaintext data contains personal information includes: Parsing the plaintext data based on an open source named entity recognition library to obtain corresponding multiple entities; The multiple entities are matched based on a preset rule library to determine whether the multiple entities contain personal information.

6. The cloud phone-based App security assessment method according to claim 5, characterized in that: The rule base is generated through keywords, regular expressions and algorithms.

7. The cloud phone-based App security assessment method according to claim 1, characterized in that: Determining whether the plaintext data contains personal information includes: Obtain device information generated by the cloud phone during the simulation operation; Detecting whether the plaintext data contains the device information based on the DFA algorithm; If the plaintext data includes the device information, it is determined that the plaintext data includes personal information.

8. The cloud phone-based App security assessment method according to claim 1, characterized in that: The read-only memory image corresponding to the cloud phone is generated based on AOSP, and the cloud phone is installed and deployed on an ARM development board; A plurality of the cloud phones are run in batches on the ARM development board.

9. A computer-readable storage medium, characterized in that: An App security assessment program based on a cloud phone is stored thereon, and when the App security assessment program based on a cloud phone is executed by a processor, the App security assessment method based on a cloud phone as described in any one of claims 1-8 is implemented.

10. An App security assessment system based on cloud mobile phone, characterized in that: include: A task engine module, the task engine module is used to obtain an evaluation request, download a corresponding installation package of the App to be evaluated based on the evaluation request, and install the installation package of the App to be evaluated to the cloud phone; The task engine module is also used to randomly generate test parameters, and control the cloud phone to simulate the operation of the App to be evaluated based on the test parameters; A data acquisition engine module, wherein the data acquisition engine module is used to collect the plaintext data generated during the simulation operation; A rule engine module is used to parse the plaintext data to determine whether the plaintext data contains personal information, and generate corresponding alarm information when the judgment result is yes.

Images