Pure flow acquisition method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a pure flow acquisition method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: determining a to-be-monitored target application program; and only controlling the target application program to be connected with the network in the flow collection stage, and taking the collected flow data as the pure flow of the target application program. By adopting the method, the pure traffic of the target application program can be acquired on the premise of not modifying the original traffic data.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium and computer program product for obtaining pure traffic. Background Art

[0002] Network traffic classification is an important part of the network monitoring system. Identifying and classifying the network traffic generated by mobile terminal applications is of great significance to network monitoring and network security services. In the network traffic classification method, whether it is based on rules to accurately identify the application to which the traffic belongs from the network traffic, or using machine learning training models for network traffic classification, it is necessary to obtain the pure traffic of a single application. Therefore, a method is needed to obtain the network traffic of a single application from an Android device.

[0003] In the related technology, a method based on Android VpnService is used to collect the network traffic of a single application. Although this method can be used to directly collect the full traffic data during the operation of a specific Android application, it will modify the network layer and transport layer header data of the original data packet, resulting in the network traffic obtained by this method cannot be used for subsequent research and analysis when the original traffic data is needed.

[0004] Therefore, a method is needed to obtain the original network traffic of a single application. Summary of the invention

[0005] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for obtaining pure traffic of a single application's original network traffic in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for obtaining pure traffic, including:

[0007] Determine the target application to be monitored;

[0008] During the traffic collection phase, only the target application is controlled to connect to the network, and the collected traffic data is used as the pure traffic of the target application.

[0009] By adopting the pure traffic acquisition method provided in the embodiment of the present application, through the technical means of controlling only the target application to connect to the network during the traffic collection stage, and not connecting other applications to the network, the pure traffic of the target application can be collected without modifying the original traffic data, thereby improving the efficiency and accuracy of collecting pure traffic.

[0010] In one embodiment, controlling only the target application to connect to the network during the traffic collection phase includes:

[0011] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed;

[0012] The networking configuration file is read through a networking control function module, and network connection of each of the applications is performed according to the networking status of each of the applications in the networking configuration file.

[0013] By adopting the pure traffic acquisition method provided in the embodiment of the present application, the networking status of each application can be configured through a networking configuration file, and the networking control function module can be used to control only the target application to connect to the network at the same time based on the networking status of each application, thereby achieving the acquisition of pure traffic for the target application.

[0014] In one of the embodiments, the networking control function module is constructed based on the networking key functions of each of the applications, and the networking key functions are obtained by reverse analysis of each of the applications.

[0015] By adopting the pure traffic acquisition method provided in the embodiment of the present application, the key networking functions of each application can be obtained by reverse analysis of each application, and then a networking control function module can be written to control each application to connect to the network, so that only the target application is connected to the network at the same time, thereby achieving the acquisition of pure traffic for the target application.

[0016] In one embodiment, the method further comprises:

[0017] For any of the above applications, perform the following reverse engineering operations:

[0018] Obtain an installation package of the application, and extract a DEX file and an ELF file from the installation package;

[0019] Decompile the DEX file and the ELF file to obtain decompiled code;

[0020] Determine candidate key functions from the decompiled code by statically analyzing the decompiled code;

[0021] The candidate key functions are dynamically analyzed by Hook, and the networking key function is determined from the candidate key functions.

[0022] By adopting the pure traffic acquisition method provided in the embodiment of the present application, static analysis and dynamic analysis can be used to perform reverse analysis on the application, so as to extract the key networking functions of the application for writing the networking control function module, and then control each application to connect to the network through the networking control function module, so as to achieve only the target application connecting to the network at the same time, and then achieve the acquisition of pure traffic for the target application.

[0023] In one embodiment, the step of determining the candidate key function from the decompiled code by statically analyzing the decompiled code includes:

[0024] Determine from the decompiled code an alternative call link with a key function as a call starting point and a networked system service as a call end point, wherein a function signature of the key function conforms to a preset function signature format;

[0025] The key function in the alternative call link is used as an alternative key function.

[0026] According to the above logic, alternative key functions related to network control can be screened out from the key functions, and then the networking key functions can be determined by dynamically analyzing the alternative key functions, which can improve the extraction efficiency and accuracy of the networking key functions. Then, a networking control function module can be written based on the extracted networking key functions, and each application can be controlled to connect to the network through the networking control function module. This can achieve the goal of only connecting the target application to the network at the same time, thereby achieving the acquisition of pure traffic for the target application.

[0027] In one embodiment, the method further comprises:

[0028] During the traffic collection phase, the top-level Activity is monitored, and when the top-level Activity changes, the current Activity name and the current system timestamp are recorded;

[0029] After the traffic collection phase is completed, the pure traffic corresponding to the target function operation is extracted from the collected traffic data based on the recorded Activity name and system timestamp.

[0030] By adopting the pure traffic acquisition method provided in the embodiment of the present application, it is possible to monitor the changes of the top-level Activity and record the Activity name and system timestamp when the top-level Activity changes, so that the pure traffic of a specific application function can be extracted from the acquired traffic data based on the recorded information, and then performance optimization, troubleshooting, security review and other operations of related functions can be performed based on the extracted pure traffic.

[0031] In a second aspect, the present application also provides a pure traffic acquisition device, including:

[0032] A determination module, used to determine a target application to be monitored;

[0033] The collection module is used to control only the target application to connect to the network during the flow collection phase, and use the collected flow data as the pure flow of the target application.

[0034] In one embodiment, the acquisition module is further used for:

[0035] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed;

[0036] The networking configuration file is read through a networking control function module, and network connection of each of the applications is performed according to the networking status of each of the applications in the networking configuration file.

[0037] In one of the embodiments, the networking control function module is constructed based on the networking key functions of each of the applications, and the networking key functions are obtained by reverse analysis of each of the applications.

[0038] In one embodiment, the device further comprises:

[0039] The reverse analysis module is used to perform the following reverse analysis operations on any of the above applications:

[0040] Obtain an installation package of the application, and extract a DEX file and an ELF file from the installation package;

[0041] Decompile the DEX file and the ELF file to obtain decompiled code;

[0042] Determine candidate key functions from the decompiled code by statically analyzing the decompiled code;

[0043] The candidate key functions are dynamically analyzed by Hook, and the networking key function is determined from the candidate key functions.

[0044] In one embodiment, the reverse analysis module is further used to:

[0045] Determine from the decompiled code an alternative call link with a key function as a call starting point and a networked system service as a call end point, wherein a function signature of the key function conforms to a preset function signature format;

[0046] The key function in the alternative call link is used as an alternative key function.

[0047] In one embodiment, the device further comprises:

[0048] A monitoring module, used to monitor the top-level activity during the traffic collection phase, and record the current activity name and the current system timestamp when the top-level activity changes;

[0049] The extraction module is used to extract the pure traffic corresponding to the target function operation from the collected traffic data according to the recorded Activity name and system timestamp after the traffic collection phase is completed.

[0050] In a third aspect, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements any of the above-mentioned methods for obtaining pure traffic when executing the computer program.

[0051] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, any of the above-mentioned methods for obtaining pure traffic is implemented.

[0052] In a fifth aspect, the present application also provides a computer program product, including a computer program, which implements any of the above-mentioned pure traffic acquisition methods when executed by a processor.

[0053] The above-mentioned method, device, computer equipment, computer-readable storage medium and computer program product for obtaining pure traffic determine the target application to be monitored; in the traffic collection stage, only the target application is controlled to connect to the network, and the collected traffic data is used as the pure traffic of the target application. By adopting the method, device, computer equipment, computer-readable storage medium and computer program product provided in the embodiments of the present application, by controlling only the target application to connect to the network in the traffic collection stage, and other applications not connecting to the network, the pure traffic of the target application can be collected without modifying the original traffic data, which can improve the efficiency and accuracy of collecting pure traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0055] FIG1 is a schematic diagram of a process of obtaining pure traffic in one embodiment;

[0056] FIG2 is a schematic diagram of a flow chart of step 104 in one embodiment;

[0057] FIG3 is a schematic diagram of a flow chart of a reverse analysis step in one embodiment;

[0058] FIG4 is a schematic diagram of a flow chart of step 306 in one embodiment;

[0059] FIG5 is a schematic diagram of a process of obtaining pure traffic in one embodiment;

[0060] FIG6 is a schematic diagram of a method for obtaining pure traffic in one embodiment;

[0061] FIG7 is a schematic diagram of a method for obtaining pure traffic in one embodiment;

[0062] FIG8 is a schematic diagram of a method for obtaining pure traffic in one embodiment;

[0063] FIG9 is a structural block diagram of a pure flow acquisition device in one embodiment;

[0064] FIG. 10 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0066] In one embodiment, as shown in FIG1 , a method for obtaining pure traffic is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps 102 to 104, wherein:

[0067] Step 102, determining the target application to be monitored;

[0068] In the embodiment of the present application, the user can set the target application to be extracted from the pure traffic. For example, a list of applications can be obtained, and the target application can be selected from the list. In response to the user's selection operation, the terminal determines the application corresponding to the selected operation as the target application to be monitored. Alternatively, the user can also determine the target application through the command line. The embodiment of the present application does not specifically limit the method of determining the target application.

[0069] Step 104, during the traffic collection phase, only the target application is controlled to connect to the network, and the collected traffic data is used as the pure traffic of the target application.

[0070] In the embodiment of the present application, after determining the target application, it can be set to allow only the target application to connect to the network, and other applications are not allowed to connect to the network, and traffic collection is turned on. In the traffic collection stage, after operating the target user application, the corresponding traffic data will be collected. Since only the target application is connected to the network at this time, the collected traffic data is the pure traffic of the target application.

[0071] The above-mentioned method for obtaining pure traffic determines the target application to be monitored; in the traffic collection stage, only the target application is controlled to connect to the network, and the collected traffic data is used as the pure traffic of the target application. The method for obtaining pure traffic provided by the embodiment of the present application is adopted. By controlling only the target application to connect to the network in the traffic collection stage, and other applications are not connected to the network, the pure traffic of the target application can be collected without modifying the original traffic data, which can improve the efficiency and accuracy of collecting pure traffic.

[0072] In an exemplary embodiment, as shown in FIG. 2 , in step 104 , only the target application is controlled to connect to the network during the traffic collection phase, including steps 202 to 204 , wherein:

[0073] Step 202, in the networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to the application other than the target application is set to a second state, wherein the first state indicates that the network connection is allowed, and the second state indicates that the network connection is not allowed;

[0074] Step 204: read the networking configuration file through the networking control function module, and perform network connection for each application according to the networking status of each application in the networking configuration file.

[0075] In an embodiment of the present application, after determining the target application, you can use "adb shell pm listpackages" to obtain all the installed application package names of the system, and traverse the obtained application package names. For the currently traversed application package name, you can determine whether the currently traversed application package name (for example: packagenameA) is consistent with the application package name of the target application (for example: packagenameB). If they are consistent, the networking state corresponding to the application package name in the networking configuration file is set to the first state, otherwise the networking state corresponding to the application package name in the networking configuration file is set to the second state. Exemplarily, when the currently traversed application package name is consistent with the application package name of the target application, "packagenameB:true" can be appended to the networking configuration file, otherwise "packagenameA:false" can be appended to the configuration file.

[0076] After completing the configuration of the networking configuration file, you can restart the system. After the system restarts, the networking control function module will read the networking configuration file and control each application to connect to the network based on the read networking status. Since only the networking status of the target application is the first status and the networking status of other applications is the second status, only the target application can connect to the network, and other applications cannot connect to the network.

[0077] By adopting the pure traffic acquisition method provided in the embodiment of the present application, the networking status of each application can be configured through a networking configuration file, and the networking control function module can be used to control only the target application to connect to the network at the same time based on the networking status of each application, thereby achieving the acquisition of pure traffic for the target application.

[0078] In an exemplary embodiment, the networking control function module is constructed based on the networking key functions of each application program, and the networking key functions are obtained by reverse analysis of each application program.

[0079] In an embodiment of the present application, the networking key function of each application can be obtained by reverse analysis of each application, wherein the networking key function is the function of the application responsible for network connection. After obtaining the networking key function of each application, a networking control function module can be written based on the networking key function. Exemplarily, the application networking management and control module can be written using the Xposed framework. During the reverse analysis process, the networking key function of each application has been obtained, and the networking control function module can be written based on the networking key function using the Xposed framework. The networking control function module can control the network connection of each application based on each networking key function.

[0080] By adopting the pure traffic acquisition method provided in the embodiment of the present application, the key networking functions of each application can be obtained by reverse analysis of each application, and then a networking control function module can be written to control each application to connect to the network, so that only the target application is connected to the network at the same time, thereby achieving the acquisition of pure traffic for the target application.

[0081] In an exemplary embodiment, as shown in FIG. 3 , the method may further include: for any application, performing the following reverse analysis operation steps 302 to 308 , wherein:

[0082] Step 302, obtaining the installation package of the application, and extracting the DEX file and the ELF file from the installation package;

[0083] Step 304, decompile the DEX file and the ELF file to obtain decompiled code;

[0084] Step 306, determining candidate key functions from the decompiled code by statically analyzing the decompiled code;

[0085] Step 308: Dynamically analyze the candidate key functions through Hook and determine the networking key function from the candidate key functions.

[0086] In the embodiment of the present application, the installation package file of the application can be obtained, and the DEX file and the ELF file can be extracted from the installation package file of the application. Exemplarily, the installation package path of the application can be obtained using "adb shell pm path application package name". Use "adb pull application installation package path" to extract the installation package file of the application to the local. And use the decompression tool to decompress the installation package file of the application, and obtain the DEX file and the ELF file from the installation package file.

[0087] After obtaining the DEX file and the ELF file, a decompilation tool can be used to decompile the DEX file and the ELF file, and the decompiled code can be obtained therefrom. By statically analyzing the decompiled code, functions related to network control can be determined from the decompiled code as candidate key functions (for example, the candidate key functions can include network communication initialization, data sending, receiving, etc.), and further by dynamically analyzing each candidate key function through Hook, the networking key function can be determined from the candidate key functions.

[0088] Call Hook technology to dynamically analyze alternative key functions. Hook is a technology that can insert custom code before or after the function is executed. Through Hook technology (such as using frida and objection to hook the list of alternative key functions), the calling situation of the alternative key functions can be captured, including the parameters when calling.

[0089] When the candidate key function is actually called, the Hook technology will capture and output the key parameters passed in. These parameters may include the target address of the network request, port number, data packet content and other information. By analyzing the output parameters, it can be determined whether these parameters are related to network connection control. For example, whether they contain key information such as the IP address and port number of the network connection, or whether they involve specific network protocols.

[0090] According to the results of parameter analysis, the functions that are truly responsible for the application networking control (networking key functions) are further screened out from the candidate key functions, such as: functions that actually initiate network connections, send data, or receive data. For example, when the results of parameter analysis show that the function input includes key information such as the IP address and port number of the network connection, or involves a specific network protocol, etc., the function can be determined to be a networking key function. By analogy, the aforementioned reverse analysis process is performed for each application, and the corresponding networking key functions of each application can be obtained, and then the networking control function module can be written based on the networking key functions.

[0091] By adopting the pure traffic acquisition method provided in the embodiment of the present application, static analysis and dynamic analysis can be used to perform reverse analysis on the application, so as to extract the key networking functions of the application for writing the networking control function module, and then control each application to connect to the network through the networking control function module, so as to achieve only the target application connecting to the network at the same time, and then achieve the acquisition of pure traffic for the target application.

[0092] In an exemplary embodiment, as shown in FIG. 4 , in step 306 , by statically analyzing the decompiled code, determining the candidate key function from the decompiled code includes steps 402 to 404 , wherein:

[0093] Step 402, determining from the decompiled code an alternative call link with a key function as a call starting point and a networked system service as a call end point, wherein the function signature of the key function conforms to a preset function signature format;

[0094] Step 404: Use the key function in the candidate call link as the candidate key function.

[0095] In the embodiment of the present application, static analysis technology can be used to understand the code call logic link, and the candidate key functions can be selected according to the call logic. Exemplarily, the preset function signature format is (Ljava / lang / String;Z)Z, which represents receiving a string parameter and a Boolean type parameter, and the return value is a Boolean type. The function whose function signature conforms to the preset function signature format is used as the key function.

[0096] Select a key function as the starting point for calling. The calls to functions related to network control often go through multiple intermediate layers (which may be other functions or services) and finally reach the network system services in the Android system, where the network system services include NMS (Network Management Service, network monitoring service), Binder and netd.

[0097] Among them, NMS is a system service in the Android system, which is responsible for managing network connections and network status operations. In Android, Binder is an interprocess communication (IPC) mechanism that allows different applications or system services to communicate with each other. NMS interacts with other processes (such as applications) through Binder. Netd is a network daemon process in the Android system, responsible for executing network-related commands (such as configuring the network, managing network interfaces, etc.). NMS ultimately performs actual network operations or sends management instructions to the netd process through Binder.

[0098] That is, when the key function is the starting point of the call, if the calling end point of the call link is to interact with the Android NMS system service, and then interact with the netd process through the Binder service, it can be determined that the key function is related to network control, and the key function can be used as an alternative key function.

[0099] According to the above logic, alternative key functions related to network control can be screened out from the key functions, and then the networking key functions can be determined by dynamically analyzing the alternative key functions, which can improve the extraction efficiency and accuracy of the networking key functions, and write a networking control function module based on the extracted networking key functions, and control each application to connect to the network through the networking control function module, so that only the target application can be connected to the network at the same time, thereby realizing the acquisition of pure traffic for the target application.

[0100] In an exemplary embodiment, as shown in FIG. 5 , the method may further include steps 502 to 504, wherein:

[0101] Step 502, monitoring the top-level Activity during the traffic collection phase, and recording the current Activity name and the current system timestamp when the top-level Activity changes;

[0102] Step 504: After the flow collection phase is completed, the pure flow corresponding to the target function operation is extracted from the collected flow data according to the recorded Activity name and system timestamp.

[0103] In the embodiment of the present application, in an Android application, an Activity is a single screen of a user interface, and the top-level Activity is usually the Activity that the current user is interacting with. During the traffic collection process, by monitoring the Activity life cycle of the application, the user's operation process and when important function operations are performed can be understood.

[0104] For example, you can monitor the current system top-level Activity. When the top-level Activity changes (switches from one Activity to another), record the current Activity name and the current system timestamp. After the network acquisition module is started, open the target application and perform corresponding operations on the interface to collect traffic data. After the operation on the specified application is completed, stop the network acquisition module and stop monitoring the system top-level Activity.

[0105] Based on the recorded Activity name and system timestamp, as well as the correspondence between the top-level Activity name and the target function operation, the timestamp range where the target function operation stays can be obtained, and the pure traffic corresponding to the target function operation can be further extracted from the captured traffic data according to the timestamp range.

[0106] By adopting the pure traffic acquisition method provided in the embodiment of the present application, it is possible to monitor the changes of the top-level Activity and record the Activity name and system timestamp when the top-level Activity changes, so that the pure traffic of a specific application function can be extracted from the acquired traffic data based on the recorded information, and then performance optimization, troubleshooting, security review and other operations of related functions can be performed based on the extracted pure traffic.

[0107] In order to enable those skilled in the art to better understand the embodiments of the present application, the embodiments of the present application are described below through specific examples.

[0108] As shown in FIG6 , this step is used to obtain key functions of application networking control through reverse engineering technology.

[0109] Obtain the application installation package file, and extract the DEX file and the ELF file from the application installation package file. Exemplarily, the process of extracting the DEX file and the ELF file includes the following steps a to c, wherein:

[0110] Step a, use "adb shell pm path application package name" to obtain the application installation package path;

[0111] Step b: Use "adb pull application installation package path" to extract the application installation package file to the local computer;

[0112] Step c: Use a decompression tool to decompress the application installation package file to obtain the DEX file and ELF file.

[0113] Furthermore, the extracted DEX file and ELF file can be decompiled by a decompilation tool to obtain the decompiled code. For example, JADX can be used to decompile the DEX file to obtain the decompiled Smali code, and Ghidra can be used to decompile the ELF file to obtain the decompiled Arm assembly code.

[0114] Analyze the decompiled code and determine the location of the key functions of the application network, including: using static analysis technology to understand the code call logic link, and brush the list of alternative key functions according to the call logic. Exemplarily, the key function signature should be (Ljava / lang / String;Z)Z, which means receiving a string parameter and a Boolean type parameter, and the return value is a Boolean type. Taking the key function as the starting point of the call, the end of the call link is to interact with the Android NMS system service, and then interact with the netd process through the AndroidBinder service. According to this call logic, brush the alternative key functions from the key function to build a list of alternative key functions for dynamic analysis.

[0115] Use Hook dynamic analysis technology to analyze the selected candidate key function list. When the candidate key function is called, the parameters passed into the key function will be output. By analyzing the output parameters, the specific networking key function can be further determined from the candidate key function list. For example, frida and objection are used to hook the backup key function list, output the incoming parameters of the calling key function, and analyze the hook call output to further locate the specific networking key function from the candidate key function list.

[0116] Use the Xposed framework to write the application networking control function module. During the reverse analysis process, the application's key networking functions have been obtained, and the networking control function module is written based on the application's key networking functions.

[0117] As shown in Figure 7, use "adb shell pm list packages" to obtain the names of all installed application packages in the system, traverse the obtained application package names, and determine whether the currently traversed application package name (packagenameA) is consistent with the application package name (packagenameB) of the target application. If they are consistent, add the networking status "packagenameB:true" to the configuration file, otherwise add the networking status "packagenameA:false" to the configuration file.

[0118] As shown in Figure 8, use "adb reboot" to restart the system. When the network control function module is initialized, it will load the network configuration file and set whether the corresponding application can connect to the network according to the configuration parameters in the network configuration file. Specifically, if the network status read is "packagenameB:true", then "packagenameB" can be connected to the network. If the network status read is "packagenameA:false", then "packagenameA" cannot be connected to the network.

[0119] Start the network acquisition module and start capturing the specified application traffic. The network acquisition module uses tcpdump, which is a packet capture program that works on Unix and Unix-like operating systems. Since Android is based on the Linux system, tcpdump can also work on the Android system.

[0120] Monitor the current system top-level Activity. When the top-level Acitivity changes, record the current Activity name and the current system timestamp.

[0121] After the network acquisition module is started, open the target application and perform corresponding operations on the interface. After the operation on the specified application is completed, stop the network acquisition module and stop monitoring the top-level Activity of the system. Write the packet capture results to a file for further analysis.

[0122] The timestamp range of a specific function is obtained based on the recorded top-level Activity, and the specific network traffic is extracted from the captured network packets based on the timestamp range, thereby obtaining the network traffic of the specific function of the application.

[0123] The method for obtaining pure traffic provided in the embodiment of the present application is adopted. Through reverse engineering technology, the network management function of the Android device is reversely analyzed. Based on the reverse analysis results, a network control function module is developed to allow only a single application to access the network at the same time, and then the network traffic on the device is collected through the network collection module. By recording the top-level Activity and timestamp of the system, the different functions of the application are distinguished according to different Activities, and then the network traffic packets of specific functions are extracted from the collected network traffic according to the timestamp. Compared with the traditional method of obtaining application traffic under the mobile terminal, the embodiment of the present application uses the network management function of the Android system itself, which can accurately control the networking status of the specified application and will not modify the network traffic. The use of the application embodiment technology can realize the function of obtaining the network traffic of the specified application under the Android device, and will not modify the obtained traffic, which is convenient for the subsequent use of the traffic, and can also obtain the network traffic of the specified application when operating a specific function.

[0124] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0125] Based on the same inventive concept, the embodiment of the present application also provides a pure flow acquisition device for implementing the above-mentioned pure flow acquisition method. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above-mentioned method, so the specific limitations in one or more pure flow acquisition device embodiments provided below can refer to the limitations of the pure flow acquisition method above, and will not be repeated here.

[0126] In an exemplary embodiment, as shown in FIG9 , a pure flow acquisition device is provided, including: a determination module 902 and a collection module 904, wherein:

[0127] A determination module 902 is used to determine a target application to be monitored;

[0128] The collection module 904 is used to control only the target application to connect to the network during the traffic collection phase, and use the collected traffic data as the pure traffic of the target application.

[0129] The above-mentioned pure traffic acquisition device determines the target application to be monitored, controls only the target application to connect to the network during the traffic collection phase, and uses the collected traffic data as the pure traffic of the target application. The pure traffic acquisition device provided by the embodiment of the present application is adopted, and by means of the technical means that only the target application is controlled to connect to the network during the traffic collection phase, and other applications are not connected to the network, the pure traffic of the target application can be collected without modifying the original traffic data, which can improve the efficiency and accuracy of collecting pure traffic.

[0130] In one embodiment, the acquisition module 904 is further configured to:

[0131] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed;

[0132] The networking configuration file is read through a networking control function module, and network connection of each of the applications is performed according to the networking status of each of the applications in the networking configuration file.

[0133] In one of the embodiments, the networking control function module is constructed based on the networking key functions of each of the applications, and the networking key functions are obtained by reverse analysis of each of the applications.

[0134] In one embodiment, the device further comprises:

[0135] The reverse analysis module is used to perform the following reverse analysis operations on any of the above applications:

[0136] Obtain an installation package of the application, and extract a DEX file and an ELF file from the installation package;

[0137] Decompile the DEX file and the ELF file to obtain decompiled code;

[0138] Determine candidate key functions from the decompiled code by statically analyzing the decompiled code;

[0139] The candidate key functions are dynamically analyzed by Hook, and the networking key function is determined from the candidate key functions.

[0140] In one embodiment, the reverse analysis module is further used to:

[0141] Determine from the decompiled code an alternative call link with a key function as a call starting point and a networked system service as a call end point, wherein a function signature of the key function conforms to a preset function signature format;

[0142] The key function in the alternative call link is used as an alternative key function.

[0143] In one embodiment, the device further comprises:

[0144] A monitoring module, used to monitor the top-level activity during the traffic collection phase, and record the current activity name and the current system timestamp when the top-level activity changes;

[0145] The extraction module is used to extract the pure traffic corresponding to the target function operation from the collected traffic data according to the recorded Activity name and system timestamp after the traffic collection phase is completed.

[0146] Each module in the above-mentioned clean traffic acquisition device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0147] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG10. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for obtaining pure traffic is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0148] Those skilled in the art will understand that the structure shown in FIG. 10 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0149] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0150] Determine the target application to be monitored; in the traffic collection stage, only control the target application to connect to the network, and use the collected traffic data as the pure traffic of the target application.

[0151] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0152] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed; the networking configuration file is read through a networking control function module, and network connection is performed for each of the applications according to the networking state of each of the applications in the networking configuration file.

[0153] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0154] For any of the above applications, perform the following reverse analysis operations: obtain the installation package of the application, and extract the DEX file and the ELF file from the installation package; decompile the DEX file and the ELF file to obtain the decompiled code; determine the alternative key functions from the decompiled code by statically analyzing the decompiled code; dynamically analyze each of the alternative key functions by Hook, and determine the networking key function from the alternative key functions.

[0155] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0156] An alternative calling link with a key function as a calling starting point and a networked system service as a calling end point is determined from the decompiled code, and a function signature of the key function conforms to a preset function signature format; the key function in the alternative calling link is used as an alternative key function.

[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0158] During the traffic collection phase, the top-level Activity is monitored, and when the top-level Activity changes, the current Activity name and the current system timestamp are recorded; after the traffic collection phase ends, the pure traffic corresponding to the target function operation is extracted from the collected traffic data based on the recorded Activity name and system timestamp.

[0159] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0160] Determine the target application to be monitored; in the traffic collection stage, only control the target application to connect to the network, and use the collected traffic data as the pure traffic of the target application.

[0161] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0162] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed; the networking configuration file is read through a networking control function module, and network connection is performed for each of the applications according to the networking state of each of the applications in the networking configuration file.

[0163] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0164] For any of the above applications, perform the following reverse analysis operations: obtain the installation package of the application, and extract the DEX file and the ELF file from the installation package; decompile the DEX file and the ELF file to obtain the decompiled code; determine the alternative key functions from the decompiled code by statically analyzing the decompiled code; dynamically analyze each of the alternative key functions by Hook, and determine the networking key function from the alternative key functions.

[0165] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0166] An alternative calling link with a key function as a calling starting point and a networked system service as a calling end point is determined from the decompiled code, and a function signature of the key function conforms to a preset function signature format; the key function in the alternative calling link is used as an alternative key function.

[0167] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0168] During the traffic collection phase, the top-level Activity is monitored, and when the top-level Activity changes, the current Activity name and the current system timestamp are recorded; after the traffic collection phase ends, the pure traffic corresponding to the target function operation is extracted from the collected traffic data based on the recorded Activity name and system timestamp.

[0169] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0170] Determine the target application to be monitored; in the traffic collection stage, only control the target application to connect to the network, and use the collected traffic data as the pure traffic of the target application.

[0171] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0172] In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed; the networking configuration file is read through a networking control function module, and network connection is performed for each of the applications according to the networking state of each of the applications in the networking configuration file.

[0173] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0174] For any of the above applications, perform the following reverse analysis operations: obtain the installation package of the application, and extract the DEX file and the ELF file from the installation package; decompile the DEX file and the ELF file to obtain the decompiled code; determine the alternative key functions from the decompiled code by statically analyzing the decompiled code; dynamically analyze each of the alternative key functions by Hook, and determine the networking key function from the alternative key functions.

[0175] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0176] An alternative calling link with a key function as a calling starting point and a networked system service as a calling end point is determined from the decompiled code, and a function signature of the key function conforms to a preset function signature format; the key function in the alternative calling link is used as an alternative key function.

[0177] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0178] During the traffic collection phase, the top-level Activity is monitored, and when the top-level Activity changes, the current Activity name and the current system timestamp are recorded; after the traffic collection phase ends, the pure traffic corresponding to the target function operation is extracted from the collected traffic data based on the recorded Activity name and system timestamp.

[0179] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0180] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0181] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0182] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for obtaining pure traffic, characterized in that: The method comprises: Determine the target application to be monitored; During the traffic collection phase, only the target application is controlled to connect to the network, and the collected traffic data is used as the pure traffic of the target application.

2. The method according to claim 1, characterized in that The step of only controlling the target application to connect to the network during the traffic collection phase includes: In a networking configuration file, the networking state corresponding to the target application is set to a first state, and the networking state corresponding to applications other than the target application is set to a second state, wherein the first state indicates that network connection is allowed, and the second state indicates that network connection is not allowed; The networking configuration file is read through a networking control function module, and network connection of each of the applications is performed according to the networking status of each of the applications in the networking configuration file.

3. The method according to claim 2, characterized in that The networking control function module is constructed based on the networking key functions of each of the applications, and the networking key functions are obtained by reverse analysis of each of the applications.

4. The method according to claim 3, characterized in that The method further comprises: For any of the above applications, perform the following reverse engineering operations: Obtain an installation package of the application, and extract a DEX file and an ELF file from the installation package; Decompile the DEX file and the ELF file to obtain decompiled code; Determine candidate key functions from the decompiled code by statically analyzing the decompiled code; The candidate key functions are dynamically analyzed by Hook, and the networking key function is determined from the candidate key functions.

5. The method according to claim 4, characterized in that The step of determining candidate key functions from the decompiled code by statically analyzing the decompiled code includes: Determine from the decompiled code an alternative call link with a key function as a call starting point and a networked system service as a call end point, wherein a function signature of the key function conforms to a preset function signature format; The key function in the alternative call link is used as an alternative key function.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: During the traffic collection phase, the top-level Activity is monitored, and when the top-level Activity changes, the current Activity name and the current system timestamp are recorded; After the traffic collection phase is completed, the pure traffic corresponding to the target function operation is extracted from the collected traffic data based on the recorded Activity name and system timestamp.

7. A pure flow acquisition device, characterized in that: The device comprises: A determination module, used to determine a target application to be monitored; The collection module is used to control only the target application to connect to the network during the flow collection phase, and use the collected flow data as the pure flow of the target application.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images