Permission abuse detection method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a permission abuse detection method and device, electronic equipment and a readable storage medium, and relates to the technical field of neural networks, and the method comprises the steps: obtaining operation behavior data corresponding to an operation behavior of a user on the electronic equipment; acquiring system state information of the electronic equipment; obtaining access information corresponding to the access operation of the target application program on the private data; based on the operation behavior data, the system state information and the access information, determining a permission abuse detection result of the target application program through a pre-trained permission abuse detection model; and outputting a malicious access prompt under the condition of determining that the target application program has malicious access based on the permission abuse detection result. According to the application, the problems of user information leakage and poor user experience caused by malicious access of the target application program to the privacy data of the user are avoided.

Description

Technical Field

[0001] The present application relates to the field of neural network technology, and more specifically, to a method, device, electronic device and readable storage medium for detecting abuse of authority. Background Art

[0002] Currently, an application can access the user's private data after the user authorizes it, but there is a problem that the application maliciously accesses the user's private data after authorization. Summary of the invention

[0003] The present application proposes a method, device, electronic device and readable storage medium for detecting permission abuse.

[0004] In a first aspect, an embodiment of the present application provides a method for detecting permission abuse, comprising: obtaining operation behavior data corresponding to the user's operation behavior on the electronic device; obtaining system status information of the electronic device; obtaining access information corresponding to the target application's access operation on privacy data; based on the operation behavior data, the system status information and the access information, determining a permission abuse detection result of the target application through a pre-trained permission abuse detection model; and outputting a malicious access prompt when it is determined that the target application has malicious access based on the permission abuse detection result.

[0005] In the second aspect, an embodiment of the present application also provides a device for detecting permission abuse, including: an operation behavior data generation unit, used to obtain operation behavior data corresponding to the user's operation behavior on the electronic device; a system status information acquisition unit, used to obtain system status information of the electronic device; an access information acquisition unit, used to obtain access information corresponding to the target application's access operation on privacy data; a permission abuse detection result determination unit, used to determine the permission abuse detection result of the target application based on the operation behavior data, the system status information and the access information through a pre-trained permission abuse detection model; a prompt unit, used to output a malicious access prompt when it is determined that the target application has malicious access based on the permission abuse detection result.

[0006] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: one or more processors; a memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method described in the first aspect.

[0007] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the method described in the first aspect above.

[0008] The permission abuse detection method, device, electronic device and readable storage medium provided in the embodiments of the present application first obtain the operation behavior data corresponding to the user's operation behavior on the electronic device, the access information corresponding to the target application's access operation to the privacy data and the system status information of the electronic device respectively, and then use the operation behavior data corresponding to the user's operation behavior on the electronic device, the access information corresponding to the target application's access operation to the privacy data and the system status information of the electronic device as a trained permission abuse detection model to perform permission abuse detection, and obtain the permission abuse detection result of the target application, and then, when it is determined that the target application has malicious access according to the permission abuse detection result, a malicious access prompt can be output, so as to prompt the user to manage the access rights of the target application, so as to avoid the problem of user information leakage and poor user experience caused by the target application's malicious access to the user's privacy data.

[0009] Other features and advantages of the embodiments of the present application will be described in the subsequent description, and partly become apparent from the description, or can be understood by practicing the embodiments of the present application. The purposes and other advantages of the embodiments of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 An application scenario diagram of the method for detecting abuse of rights provided in an embodiment of the present application is shown;

[0012] Figure 2 A method flow chart of a method for detecting abuse of rights provided in an embodiment of the present application is shown;

[0013] Figure 3 A method flow chart of a method for detecting abuse of rights provided by another embodiment of the present application is shown;

[0014] Figure 4 The specific step flow chart of step S210 provided in the embodiment of the present application is shown;

[0015] Figure 5 The specific step flow chart of step S220 provided in the embodiment of the present application is shown;

[0016] Figure 6 A method flow chart of a method for detecting permission abuse provided by another embodiment of the present application is shown;

[0017] Figure 7 A schematic diagram showing the detection of permission abuse provided by an embodiment of the present application is shown;

[0018] Figure 8 A method flow chart of a method for detecting abuse of rights provided in yet another embodiment of the present application is shown;

[0019] Fig. 9 A structural block diagram of a detection device for abuse of rights provided in an embodiment of the present application is shown;

[0020] Fig.10 A structural block diagram of an electronic device provided in an embodiment of the present application is shown;

[0021] Fig.11 A structural block diagram of a computer-readable storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] In order to make those skilled in the art better understand the present application scheme, the technical scheme in the present application embodiment will be clearly and completely described below in conjunction with the drawings in the present application embodiment. Obviously, the described embodiment is only a part of the present application embodiment, rather than all the embodiments. The components of the present application embodiment usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents the selected embodiment of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0023] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0024] At present, with the development of computer technology, applications that want to obtain certain permissions, such as taking pictures, reading files, etc., need user confirmation. However, since some applications need to frequently access users' private data, in order to avoid authorizing access every time, users usually choose "Allow while in use" for the application, thereby fully authorizing it.

[0025] However, the inventors found in their research that when certain applications are fully authorized, they will constantly access the user's private data, thereby inferring the user's preferences or recent attention content and other user information through big data calculations, and then send the user information to other applications to push content and advertisements to the user in a targeted manner, or leak the user's information and cause the user's property loss.

[0026] Therefore, in order to solve or partially solve the above problems, the present application provides a method, device, electronic device and readable storage medium for detecting permission abuse.

[0027] See also Figure 1 , Figure 1 An application scenario diagram of the permission abuse detection method provided in an embodiment of the present application is shown, namely, a permission abuse detection scenario 100, which may include an electronic device 110 and a server 120, wherein the electronic device 110 is connected to the server 120.

[0028] The electronic device 110 can access the Internet and thereby establish a connection with the server 120 which is also connected to the Internet. The electronic device 110 can access the Internet wirelessly, such as through wireless communication technologies such as Wi-Fi and Bluetooth, etc.; the electronic device 110 can also access the Internet in a wired manner, such as through an Rj45 network cable or optical fiber.

[0029] The user can control the electronic device 110 so that the electronic device executes the detection method for abuse of authority. For example, the user can directly operate the electronic device 110 to control the electronic device to execute the detection method for abuse of authority. The electronic device 110 can be locally deployed with relevant environment configurations for executing the detection method for abuse of authority. For detailed description, please refer to the subsequent implementation methods. Optionally, the electronic device 110 can also call the server 120 to detect abuse of authority.

[0030] The server 120 may be a cloud server or a local server.

[0031] See also Figure 2 , Figure 2The method flow chart of a method for detecting a permission abuse provided by an embodiment of the present application is shown. The method for detecting a permission abuse can be applied to Figure 1 The electronic device shown may specifically use a processor of the electronic device as an execution subject of the detection method for abuse of authority. The detection method for abuse of authority may include steps S110 to S150.

[0032] Step S110: Acquire operation behavior data corresponding to the user's operation behavior on the electronic device.

[0033] As a method, the operation behavior data can be data used to indicate the specific operation of the user on the electronic device, or it can be data indicating the access behavior corresponding to the operation on the electronic device. For example, the user views the corresponding displayed or stored data in the application by sliding, long pressing, clicking, etc. on the electronic device, thereby generating data triggered by the user's operation action on the electronic device. The operation behavior data can also be operation behavior data generated by the user operating an external device connected to the electronic device. For example, when the user connects to the electronic device through an external keyboard, mouse, handwriting tablet, etc. through an interface or Bluetooth connection to click, select, etc. on the electronic device, corresponding behavior data is generated. Optionally, the electronic device can be a smart phone.

[0034] Optionally, after the user performs an operation on the electronic device, the processor of the electronic device determines the user's specific operation and the data access behavior performed by the application based on the operation based on the operation and the specific application corresponding to the operation.

[0035] Step S120: Acquire system status information of the electronic device.

[0036] As a method, the system status information is used to indicate the usage of the electronic device in different tasks or different operations. Optionally, the system status information can be information such as system resource usage information of the electronic device, running memory information of the electronic device, and network bandwidth usage information corresponding to different applications on the electronic device.

[0037] It is understandable that, since different applications occupy different resources on electronic devices and different applications have different system status information in electronic devices, the application currently running in the electronic device can be determined first, and then the system status information corresponding to the electronic device can be obtained based on the application in the running state. For example, if the application in the running state is a game-type application, the occupancy state of the graphics processing unit (GPU) of the electronic device is obtained, and the occupancy state of the image processor is used as the system status information of the electronic device; if the application in the running state is a large software that occupies most of the memory of the electronic device, the memory information of the electronic device is obtained, and the memory information is used as the system status information of the electronic device; if the application in the running state is software that performs tasks together with a cloud server, the proportion of the network bandwidth of the application in the electronic device to the network bandwidth occupied by all applications in the electronic device is obtained, and the proportion is determined as the system status information of the electronic device.

[0038] Step S130: Obtain access information corresponding to the target application's access operation on private data.

[0039] As a method, the access information is used to indicate that the target application generates information for accessing the private data stored by the user in the electronic device based on the user's operation. Optionally, the access information may include the type of data accessed to the private data, the data range accessed to the private data, the access frequency and / or cycle of accessing the private data, etc. The target application may be an application currently operated by the user on the electronic device, or an application that the user has not operated on the electronic device but accesses the private data, or any one or more applications on the electronic device, which are not specifically limited here.

[0040] Optionally, the privacy data indicates data stored by the user in a local database of the electronic device, wherein the privacy data may be non-public information such as pictures, audio, historical information corresponding to different applications, text documents, address books, call records, etc. stored by the user in the local database.

[0041] Optionally, when a user operates a target application on an electronic device, the target application responds to the user's operation on the electronic device to access private data stored in the electronic device, thereby generating an access operation. The access operation includes the path of the local database accessed by the target application, the type of data accessed, the authorized data range of the accessed data, and the frequency of accessing the private data. After the access operation is generated, the access information can be determined based on the access operation.

[0042] Step S140: Based on the operation behavior data, the system status information, and the access information, a permission abuse detection result of the target application is determined by a pre-trained permission abuse detection model.

[0043] As a method, the permission abuse detection model is used to evaluate whether there is permission abuse when different applications access private data stored in electronic devices. The permission abuse model may include one or more networks such as convolutional neural networks, deep residual networks, deep residual shrinkage networks, forward feedback networks, Hopfield networks, AlexNet networks, vgg networks, googlenet networks, resnet networks, etc. for detecting permission abuse of applications.

[0044] Optionally, before the permission abuse detection model is applied offline, it is necessary to select sample access information of multiple applications performing access operations on privacy data, sample operation data generated for operations on electronic devices, and sample system status information corresponding to the electronic device when different applications are used to train the permission abuse detection model, so as to obtain a trained permission abuse detection model.

[0045] Optionally, the permission abuse detection model can determine whether the access behavior of the target application to the private data in the electronic device after the user operates the electronic device is malicious access based on the operation behavior data, system status information and access information, that is, the permission abuse detection results of the target application include malicious access to the private data by the target application and non-malicious access to the private data by the target application (that is, normal access behavior).

[0046] Optionally, since the application will execute corresponding functions based on the operation performed by the user on the electronic device, the application will access certain data when executing the corresponding function. When accessing private data, since the user has authorized the application's access behavior, the application can access the private data without restriction, which may lead to the application frequently accessing private data when the user does not need to obtain or access the private data, thereby causing the user's private data to be leaked after the application is fully authorized to access the private data. Therefore, each time the target application accesses private data, it can be identified based on the operation behavior data, system status information and access information in the permission abuse detection model stored in the electronic device to determine the permission abuse detection result of the target application, and then the permissions of the target application can be managed based on the permission abuse detection result of the target application.

[0047] Step S150: When it is determined based on the permission abuse detection result that the target application has malicious access, a malicious access prompt is output.

[0048] As a method, malicious access behavior is used to indicate that the target application does not access private data according to the user's wishes, for example, it can be a behavior indicating that the target application's behavior of accessing private data does not match the user's operation on the electronic device or the system status information of the electronic device. Optionally, the malicious access behavior can be that the target application accesses private data with high frequency or high frequency, or the data range of the private data accessed by the target application is different from the data range selected by the user's operation on the electronic device, or the behavior of the private data accessed by the target application is different from the behavior indicated by the system status information of the electronic device. For example, the target application has a short cycle of accessing private data, and the number of times is greater than the number threshold, which is a threshold determined by the user's operation on the electronic device, or the user operates on the electronic device to control the target application to access the image stored in the electronic device, but the target application accesses the audio or other types of private data stored in the electronic device, or the system status information of the electronic device indicates that there is a large amount of rendering activity of the image processor at present, at this time it can be determined that the running target application does not need to access the private data, but at this time the target application accesses the private data.

[0049] Optionally, the permission abuse detection result may include the result of classifying the behavior of the target application's access to corresponding privacy data by the permission abuse model. When the permission abuse detection result indicates that the target application has malicious access, the type of malicious access behavior of the target application can be determined based on the permission abuse detection result, and then a malicious access prompt can be generated based on the malicious access behavior type, so that the user can manage permissions for the target application based on the malicious access prompt that can indicate the type of malicious access behavior.

[0050] Optionally, permission management of the target application based on the malicious access prompt can be to set an access password or access restrictions for the privacy data accessed by the malicious access behavior based on the type of malicious access behavior. When the number of accesses, access frequency and accessed data range of the target application meet the access restrictions, the electronic device rejects the access behavior of the target application, or the user must enter the access password before accessing the target application.

[0051] Optionally, the permission abuse detection result may be a detection result in text form, and the malicious access prompt may be a text pop-up window display prompt in an electronic device, or a voice broadcast text content prompt. The prompt method may be set according to actual needs and is not specifically limited here.

[0052] Optionally, if the permission abuse detection result indicates that the target application has malicious access behavior, a malicious access log is generated based on the operation behavior data, system status information, and access information corresponding to the target application to facilitate analysis by developers.

[0053] As another way, if the permission abuse detection result indicates that the target application does not have malicious access behavior, the target application can be added to the whitelist to avoid insufficient user experience caused by permission management of the target application.

[0054] In an embodiment of the present application, first, operation behavior data corresponding to the user's operation behavior on the electronic device, access information corresponding to the target application's access operation on privacy data, and system status information of the electronic device are respectively obtained, and then the operation behavior data corresponding to the user's operation behavior on the electronic device, the access information corresponding to the target application's access operation on privacy data, and the system status information of the electronic device are used as a trained permission abuse detection model to perform permission abuse detection, and obtain the permission abuse detection result of the target application. Then, when it is determined that the target application has malicious access according to the permission abuse detection result, a malicious access prompt can be output to prompt the user to manage the access rights of the target application, so as to avoid the problem of user information leakage and poor user experience caused by malicious access to the user's privacy data by the target application.

[0055] See also Figure 3 , Figure 3 The method flow chart of a method for detecting a permission abuse provided by an embodiment of the present application is shown. The method for detecting a permission abuse can be applied to Figure 1 In the illustrated detection scenario of permission abuse, the electronic device may specifically use the processor of the electronic device as the execution subject of the detection method of permission abuse. The detection method of permission abuse may include steps S210 to S290.

[0056] Step S210: Determine access operation information corresponding to the sample application and sample access data corresponding to the access operation information based on the user's access operation to the sample application.

[0057] As a method, access operation information is used to indicate the operation information corresponding to the user's access to private data through the sample application. The access operation information may include the user's specific operation on the sample application in the electronic device, the database accessed corresponding to the access behavior of the sample application based on the user's access operation on the electronic device, and the database accessed corresponding to the access behavior triggered by the user's continuous operation on the electronic device. For example, it is used for access behaviors triggered by sliding certain pages of the sample application in the electronic device, access behaviors triggered by clicking certain interfaces of the sample application, access behaviors triggered by long pressing the sample application on the electronic device, and access behaviors triggered by multiple consecutive sample applications on the electronic device, access history databases triggered by sliding, access to local databases triggered by clicking, access to local databases triggered by continuous clicking, and cloud databases triggered by long pressing.

[0058] The sample access data is used to indicate the data stored in the electronic device in response to the access operation of the sample application. Optionally, the access operation information is also used to indicate the data type corresponding to the accessed data corresponding to the user's access operation on the sample application on the electronic device and the storage location of the data in the local database, and then, according to the access operation information, the data type in the local database accessed by the sample application in the electronic device based on the user's access operation on the sample application is determined, thereby obtaining the sample access data.

[0059] In some embodiments, Figure 4 As shown, the step S210 includes:

[0060] Step S211: Generate access operation information corresponding to the sample application according to the sample privacy data accessed by the user based on the sample application.

[0061] As a method, after the user performs an operation in the sample application, the sample application responds to the operation to access the corresponding private data based on the authorized access rights, thereby obtaining the sample private data. Optionally, if the sample application accesses the private data of the electronic device for the first time, the sample application applies to the user for authorization to access the corresponding private data through the electronic device, and the sample application will access the corresponding sample private data only after being authorized. Optionally, the sample private data is the data selected by the user, for example, if the user accesses the target image through the sample application, the target image is the sample private data.

[0062] Optionally, the access operation information is used to indicate the correspondence between the sample private data accessed based on the sample application and the access operation performed by the user on the sample application on the electronic device. The access operation information can be the user clicking to trigger the access behavior and the sample private data accessed corresponding to the access behavior and the data type of the sample private data.

[0063] Step S212: Determine the access rights corresponding to the sample application.

[0064] As a way, different applications are authorized with different access rights. In order to improve the training accuracy of the permission abuse detection model, this can be achieved by determining the access rights corresponding to the sample application. Optionally, the access rights corresponding to the sample application may be to allow access to the gallery of the electronic device, to allow access to the audio of the electronic device, to allow access to the electronic device's macro culture, to allow access to the electronic device's historical information, to allow access to the electronic device's location information, and to not allow access to the electronic device's local database, etc. Optionally, the access rights corresponding to the sample application may be determined by obtaining the access flag of the sample application. The access flag may be a flag generated by the user when the sample application is authorized to access the corresponding data, and is used to determine whether authorization has been granted when the sample application subsequently accesses the electronic device's private data.

[0065] Step S213: Determine, according to the access permission, sample data accessed by the sample application program when executing the access operation, as the sample access data.

[0066] As a method, after determining the access rights corresponding to the sample application, the sample application can perform the corresponding access operation by executing the user's operation on the electronic device based on the access rights, thereby determining the sample data accessed by the sample application in the electronic device as the sample access data. Optionally, the sample access data can be the data corresponding to the access rights. For example, if the access rights are images in the last month, the sample access data is images with a storage date in the electronic device within 30 days.

[0067] Please continue reading Figure 3 , step S220: obtaining resource occupancy information of the sample application when executing the access operation.

[0068] As a method, the resource occupation information is used to indicate the state of system resources occupied by the electronic device when the sample application performs the access operation. Optionally, the resource occupation information may include the memory occupation state of the sample application in the electronic device, the processor work occupation state of the sample application in the electronic device, and the network bandwidth occupation state of the sample application in the electronic device.

[0069] Optionally, since the sample applications occupy different resources of the electronic device to implement different functions when in operation, in order to make the training of the permission abuse model more accurate, it is necessary to determine the resource occupancy information of the electronic device when the sample applications perform user access operations on the electronic device.

[0070] Optionally, the resource occupancy information may be determined by acquiring the processor operating status of the electronic device, the memory occupancy status of the electronic device, the network consumption of the electronic device, and the network consumption corresponding to different applications in the electronic device.

[0071] In some embodiments, Figure 5 As shown, the step S220 includes:

[0072] Step S221: Obtain the application type of the sample application, the memory occupancy rate and the network request frequency when performing the access operation.

[0073] As a way, since different types of applications require different frequencies of IO interaction and thus different frequencies of accessing privacy data, the application type of the sample application can be used as an influencing factor when determining the resource usage information of the sample application when performing access operations.

[0074] The network request frequency can be used to indicate the frequency at which the sample application uploads private data when performing access operations. Optionally, since the network request frequency corresponding to the sample application performing access operations when authorized to access private data will also lead to the training accuracy of the permission abuse detection model, when determining the resource usage information of the sample application when performing access operations, the network request frequency of the sample application when performing access operations can be used as an influencing factor.

[0075] The memory usage rate is used to indicate the memory occupied by the sample application in the electronic device when performing an access operation. The higher the memory occupied, the less likely the sample application is to access private data, and the greater the probability of malicious access behavior. Therefore, when determining the resource usage information of the sample application when performing an access operation, the memory usage rate of the sample application when performing an access operation can be used as an influencing factor.

[0076] Step S222: Detect whether the application type, the memory occupancy rate, and the network request frequency meet their respective corresponding target conditions.

[0077] As a way, whether the application type, memory usage, and network request frequency corresponding to the sample application can be used as sample data for training the permission abuse detection model also requires determining whether the application type, memory usage, and network request frequency corresponding to the sample application can meet their respective target conditions.

[0078] Optionally, the target condition may be that the application type, memory usage, and network request frequency corresponding to the sample application satisfy the conditions corresponding to malicious access behavior. For example, the application type is a sample application that does not need to access private data but performs access behavior, or the memory usage indicates that the sample application has a large amount of rendering activities, and the sample application does not need to access private data but performs access behavior. It can also be that the network request frequency of the sample application is greater than the frequency threshold when the user does not choose to read the corresponding private data, indicating that the sample application reads the private data in the background and uploads it.

[0079] In some embodiments, the step S222 includes: when it is detected that the application type is a preset type, determining that the application type satisfies a first target condition corresponding to the application type; when it is detected that the memory occupancy rate is greater than a first threshold, determining that the memory occupancy rate satisfies a second target condition corresponding to the memory occupancy rate; when it is detected that the network request frequency is greater than a second threshold, determining that the network request frequency satisfies a third target condition corresponding to the network request frequency.

[0080] As a method, the first target condition may be that an application of a preset type does not need to access private data but performs an access operation to access private data. Optionally, the type of application that does not need to access private data may be preset as a preset type, and then when the application type of the sample application is determined to be the preset type, it is determined whether the sample application performs an access operation, so that when the application type of the sample application is determined to be the preset type and the sample application performs an access operation, it is determined that the application type meets the first target condition.

[0081] As a method, the second target condition may be that when the sample application performs an access operation, the sample application reads the privacy data in the background and performs frequent IO interactions, so that the memory usage of the sample application is much greater than the set second threshold. Optionally, when the memory occupancy rate of the sample application when performing an access operation is greater than the second threshold, it can be determined that the sample application reads the privacy data in the background and performs relatively frequent IO interactions, and it is determined that the second target condition corresponding to the memory occupancy rate is met. Alternatively, the memory occupancy rate indicates that the user has not performed any privacy data access operation but the sample application has performed privacy data access operations. For example, when the memory occupancy rate indicates that the sample application in the electronic device has a large amount of rendering activities, but there is indeed privacy data access behavior that causes the memory occupancy rate to be greater than the second threshold, it is determined that the second target condition corresponding to the memory occupancy rate is met.

[0082] As a method, the third target condition may be that when the user does not read the private data of the sample application, the sample application background reads the private data and uploads the private data, so that the network request frequency of the sample application is greater than the second threshold. Optionally, after the sample application performs an access operation, the network request frequency corresponding to the sample application is obtained to be greater than the second threshold, and it can be determined that the sample application background reads the private data and uploads the private data, and the third target condition corresponding to the network request frequency is determined.

[0083] Step S223: taking at least one of the application type, memory occupancy rate, and network request frequency that meet the corresponding target condition as a reference indicator.

[0084] As a method, the reference index is used to indicate the state of the electronic device corresponding to the behavior of the sample application program in maliciously accessing the private data. Optionally, the sample application program corresponding to the target condition can be determined, and then the sample application program and the parameters satisfying the corresponding target condition are associated to obtain the reference index.

[0085] Step S224: Determine the resource occupancy information based on the reference indicator.

[0086] As one approach, after the reference indicator is determined, resource occupancy information of the access operation performed by the corresponding sample application in the electronic device is generated based on the parameters in the reference indicator that meet the corresponding target conditions and the corresponding sample application.

[0087] Please continue reading Figure 3, step S230: performing malicious access behavior based on the access operation information, the sample access data corresponding to the access operation information and the resource occupancy information to obtain malicious access behavior information, and performing non-malicious access behavior based on the access operation information, the sample access data corresponding to the access operation information and the resource occupancy information to obtain non-malicious access behavior information.

[0088] As a method, malicious access behavior information is used to indicate the specific malicious access behavior of the sample application and the data accessed by the malicious access behavior. Optionally, after collecting the access operation information, the sample access data corresponding to the access operation information, and the resource occupancy information, in order to ensure the training of the permission abuse model, a simple process that can access the private data of the electronic device can be constructed, and then malicious access behavior can be created through the process and the collected access operation information, the sample access data corresponding to the access operation information, and the resource occupancy information, so as to obtain malicious access information. Optionally, the execution of malicious access behavior can be to create high-frequency and high-frequency random or periodic access behavior, and the type of private data accessed each time is different and the type of private data accessed is different, or to create the behavior of accessing private data when the user does not perform an operation, or to access private data and upload or send private data without the user's authorization, so as to obtain malicious access behavior information.

[0089] Optionally, in order to ensure the accuracy of the training of the permission abuse model, it is also necessary to set control data, which is the opposite data of the malicious behavior information generated by executing malicious access behavior, that is, the non-malicious access information generated by executing non-malicious access behavior. Non-malicious access behavior information is used to indicate the specific normal access behavior of the sample application and the data accessed by the normal access behavior. Optionally, the malicious access behavior can be an access behavior that is performed in accordance with the user's wishes, and the type of privacy data accessed each time is the same as the data type corresponding to the user's wishes and access rights, or the privacy data is uploaded or sent only after the user's authorization, so as to obtain non-malicious access behavior information.

[0090] Step S240: Train the model to be trained according to the malicious access behavior information and the non-malicious access behavior information to improve the accuracy of the model to be trained in identifying sample applications corresponding to the malicious access behavior information as permission-abusing applications, and use the trained model to be trained as the permission abuse detection model.

[0091] As a method, after determining the malicious access behavior information and the non-malicious access behavior information, the malicious access behavior information and the non-malicious access behavior information are used as training sample data, and the access operation information, the sample access data corresponding to the access operation information, and the resource occupancy information are also used as training sample data to train the training model.

[0092] Optionally, if the access operation information corresponding to the sample application, the sample access data and resource usage information corresponding to the access operation information indicate that the sample application has malicious access behavior, but the inference result based on the model to be trained indicates non-malicious access behavior, then the first loss value of the loss function is determined based on the inference result and the malicious access behavior information, and then the parameters of the model to be trained are adjusted based on the first loss value, and the inference is repeated. When the inference result indicates malicious access behavior, the second loss value of the loss function is determined based on the inference result and the non-malicious access behavior information, and the training is terminated when the second loss value is less than the loss threshold. If the second loss value is not less than the loss threshold, the parameters of the model to be trained are adjusted based on the loss value, and the inference is repeated until the second loss value is less than the loss threshold and the training is terminated when the number of training times of the model to be trained is greater than the number threshold.

[0093] Step S250: Acquire operation behavior data corresponding to the user's operation behavior on the electronic device.

[0094] Step S260: Acquire system status information of the electronic device.

[0095] Step S270: Obtain access information corresponding to the target application's access operation on the private data.

[0096] Step S280: Based on the operation behavior data, the system status information, and the access information, determine the permission abuse detection result of the target application program through a pre-trained permission abuse detection model.

[0097] Step S290: When it is determined based on the permission abuse detection result that the target application has malicious access, a malicious access prompt is output.

[0098] Among them, the specific step descriptions of steps S250 to S290 can refer to steps S110 to S150, which will not be repeated here.

[0099] In this embodiment, malicious access behavior and non-malicious access behavior are first performed by collecting access operation information corresponding to the user's access operation to the sample application, sample access data corresponding to the access operation information, and resource occupancy information of the sample application when performing the access operation to obtain malicious access behavior information and non-malicious access behavior information. In this way, the malicious access behavior information and non-malicious access behavior information can be used as training data for training, thereby ensuring the integrity of the training data, thereby improving the training accuracy of the permission abuse model. The access operation information corresponding to the user's access operation to the sample application, the sample access data corresponding to the access operation information, and the resource occupancy information of the sample application when performing the access operation are used as training data, so that the model has more complete information and vision, thereby improving the training accuracy of the permission abuse model.

[0100] See also Figure 6 , Figure 6 The method flow chart of a method for detecting a permission abuse provided by an embodiment of the present application is shown. The method for detecting a permission abuse can be applied to Figure 1 In the illustrated detection scenario of permission abuse, the electronic device may specifically use the processor of the electronic device as the execution subject of the detection method of permission abuse. The detection method of permission abuse may include steps S310 to S370.

[0101] Step S310: Acquire operation behavior data corresponding to the user's operation behavior on the electronic device.

[0102] Step S320: Acquire system status information of the electronic device.

[0103] Step S330: Obtain access information corresponding to the target application's access operation on private data.

[0104] Step S340: Based on the operation behavior data, the system status information and the access information, the access type probabilities corresponding to the multiple access types are determined by the permission abuse detection model.

[0105] As a way, the permission abuse detection model performs permission abuse detection based on operation behavior data, system status information, and access information, and outputs the access type of the target application to the private data and the access probability given to the access type, such as Figure 7As shown, the operation behavior data, system status information and access information are input into the input layer of the permission abuse detection model, and then inferred through multiple hidden layers, and finally different values ​​are output by the output layer, and then the multiple access types corresponding to the target application and the access type probabilities corresponding to the multiple access types are determined according to the mapping relationship between different values ​​and access types, where the probability of malicious access to photos is 0.3, the probability of malicious access to voice is 0.1, the probability of malicious access to files is 0.1, the probability of malicious access to locations is 0.15, the probability of malicious access to contacts is 0.15, and the probability of non-malicious access is 0.2. Optionally, the permission abuse detection model can output the access type probabilities corresponding to the multiple access types in sequence according to the pre-set access type order.

[0106] Step S350: Determine an access behavior detection result of the target application based on the access type probability, wherein the access behavior detection result indicates an access type of the target application to the private data.

[0107] As a method, the access type probability indicates the probability of the target application's access to the private data, so that the access behavior detection result of the target application's access to the private data can be determined by the access type probability. Optionally, the access behavior detection result can be determined by comparing the size of the access type probabilities corresponding to multiple access types, or by comparing the access type probabilities corresponding to multiple access types with the probability threshold to determine the access behavior detection result.

[0108] In some embodiments, the step S350 includes: taking the target access type corresponding to the access type probability greater than or equal to a third threshold as the access behavior detection result.

[0109] As one approach, a third threshold may be preset, and then the access type probabilities corresponding to the multiple access types are compared with the third threshold respectively, so as to determine the target access type corresponding to the access type probability greater than or equal to the third threshold.

[0110] In some other embodiments, the step S350 includes: taking the target access type corresponding to the maximum access type probability as the access behavior detection result.

[0111] As one approach, the access type probabilities corresponding to the multiple access types may be compared, so that the access type having the largest value corresponding to the access type probability among the multiple access types is the target access type.

[0112] Step S360: Determine the permission abuse detection result based on the access behavior detection result, wherein the permission abuse detection result includes the presence of malicious access or the absence of malicious access.

[0113] As a method, since the access behavior detection result includes the specific access type of the target application, it can be determined whether the target application has malicious access based on the specific access type. Optionally, if the access behavior detection result indicates that the target application is of a normal access behavior type, it is determined that the target application does not have malicious access; if the access behavior detection result indicates that the target application is not of a normal access behavior type, it is determined that the target application has malicious access.

[0114] Step S370: When it is determined based on the permission abuse detection result that the target application has malicious access, a malicious access prompt is output.

[0115] In some embodiments, the malicious access hint includes a detection result for characterizing access behavior to the target application.

[0116] Among them, the specific step descriptions of steps S310 to S330 and step S370 can refer to steps S110 to S130 and step S150, which will not be repeated here.

[0117] In this embodiment, after the permission abuse detection model performs permission abuse detection based on the operation behavior data, system status information, and access information and outputs the access type probabilities corresponding to multiple access types, the target access type corresponding to the target application is determined based on the access type probabilities corresponding to the multiple access types to determine the access behavior detection result. In this way, the permission abuse detection result including the presence or absence of malicious access can be determined based on the access behavior detection result, thereby realizing the detection of permission abuse of the application.

[0118] See also Figure 8 , Figure 8 A flowchart of a method for detecting abuse of authority provided in an embodiment of the present application is shown. Figure 8As shown, the operation behavior data corresponding to the user's operation behavior on the electronic device, the system status information of the electronic device and the access information corresponding to the target application's access operation to the privacy data are first collected, and then the operation behavior data corresponding to the user's operation behavior on the electronic device, the system status information of the electronic device and the access information corresponding to the target application's access operation to the privacy data are input into the trained permission abuse detection model, and the permission abuse detection model outputs a detection result, which includes whether the target application has malicious access behavior and the specific malicious access type, and then based on the permission abuse detection result, it is determined that the target application has malicious access, and the target application is managed according to the detection result, and a malicious access prompt is output, and the situation of malicious access to the target application is recorded to generate an access log, and according to the situation of malicious access to the target application, the data of the malicious access behavior of the target application is collected, and the permission abuse detection model is updated according to the data, so that the model judgment is closer to user habits.

[0119] See also Fig. 9 , Fig. 9 A structural block diagram of a permission abuse detection device provided in an embodiment of the present application is shown, wherein the permission abuse detection device 400 includes: an operation behavior data generation unit 410, a system status information acquisition unit 420, an access information acquisition unit 430, a permission abuse detection result determination unit 440, and a prompt unit 450.

[0120] An operation behavior data generating unit 410 is used to obtain operation behavior data corresponding to the user's operation behavior on the electronic device;

[0121] The system status information acquisition unit 420 is used to acquire the system status information of the electronic device;

[0122] An access information acquisition unit 430 is used to acquire access information corresponding to an access operation of a target application program to private data;

[0123] The permission abuse detection result determination unit 440 is used to determine the permission abuse detection result of the target application program through a pre-trained permission abuse detection model based on the operation behavior data, the system status information and the access information.

[0124] Optionally, the permission abuse detection result determination unit 440 can also be used to determine the access type probability corresponding to each of the multiple access types through the permission abuse detection model; determine the access behavior detection result of the target application based on the access type probability, wherein the access behavior detection result indicates the access type of the target application to the privacy data; determine the permission abuse detection result based on the access behavior detection result, wherein the permission abuse detection result includes the presence or absence of malicious access.

[0125] Optionally, the rights abuse detection result determining unit 440 may also be configured to take a target access type corresponding to an access type probability greater than or equal to a third threshold as the access behavior detection result.

[0126] Optionally, the rights abuse detection result determining unit 440 may also be configured to use the target access type corresponding to the maximum access type probability as the access behavior detection result.

[0127] The prompt unit 450 is configured to output a malicious access prompt when it is determined that the target application has malicious access based on the permission abuse detection result. Optionally, the malicious access prompt includes a detection result for characterizing access behavior to the target application.

[0128] In some embodiments, the permission abuse detection device 400 further includes:

[0129] The sample access data determining unit is used to determine access operation information corresponding to the sample application and sample access data corresponding to the access operation information based on the user's access operation on the sample application.

[0130] Optionally, the sample access data determination unit can also be used to generate access operation information corresponding to the sample application based on the sample privacy data accessed by the user based on the sample application; determine the access rights corresponding to the sample application; and determine the sample data accessed by the sample application to perform the access operation based on the access rights as the sample access data.

[0131] The resource occupancy information acquisition unit is used to acquire the resource occupancy information of the sample application when executing the access operation.

[0132] Optionally, the resource occupancy information acquisition unit can also be used to obtain the application type of the sample application, the memory occupancy rate and the network request frequency when performing the access operation; detect whether the application type, the memory occupancy rate and the network request frequency meet their respective corresponding target conditions; use at least one of the application type, memory occupancy rate and network request frequency that meet the corresponding target conditions as a reference indicator; and determine the resource occupancy information based on the reference indicator.

[0133] Optionally, the resource occupancy information acquisition unit can also be used to determine whether the application type satisfies a first target condition corresponding to the application type when it is detected that the application type is a preset type; determine whether the memory occupancy rate satisfies a second target condition corresponding to the memory occupancy rate when it is detected that the memory occupancy rate is greater than a first threshold; and determine whether the network request frequency satisfies a third target condition corresponding to the network request frequency when it is detected that the network request frequency is greater than a second threshold.

[0134] A behavior information acquisition unit is used to perform malicious access behavior based on the access operation information, sample access data corresponding to the access operation information, and the resource occupancy information to obtain malicious access behavior information, and to perform non-malicious access behavior based on the access operation information, sample access data corresponding to the access operation information, and the resource occupancy information to obtain non-malicious access behavior information.

[0135] A training unit is used to train a to-be-trained model according to the malicious access behavior information and the non-malicious access behavior information to improve the accuracy of the to-be-trained model in identifying sample applications corresponding to the malicious access behavior information as permission-abusing applications, and use the trained to-be-trained model as the permission-abuse detection model.

[0136] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0137] In several embodiments provided in the present application, the coupling between the units may be electrical, mechanical or other forms of coupling. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0138] See also Fig.10 , Fig.10The block diagram of a structure of an electronic device provided in an embodiment of the present application is shown. The electronic device 110 may be a smart phone, a desktop computer, a vehicle-mounted computer, a server or a tablet computer, etc. The electronic device 110 in the present application may include one or more of the following components: a processor 111, a memory 112 and one or more application programs, wherein the processor 111 is electrically connected to the memory 112, and the one or more program configurations are used to execute the methods described in the aforementioned embodiments.

[0139] The processor 111 may include one or more processing cores. The processor 111 uses various interfaces and lines to connect various parts of the entire electronic device 110, and executes various functions and processes data of the electronic device 110 by running or executing instructions, programs, code sets or instruction sets stored in the memory 112, and calling data stored in the memory 112. Optionally, the processor 111 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 111 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and computer programs; the GPU is responsible for rendering and drawing display content; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 111, and it can be implemented separately through a communication chip. Specifically, the method described in the above embodiment can be executed by one or more processors 111.

[0140] For some embodiments, the memory 112 may include a random access memory (RAM) or a read-only memory (ROM). The memory 112 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 112 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the electronic device 110 during use, etc.

[0141] See also Fig.11, which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable medium 500 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0142] The computer-readable storage medium 500 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 500 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 500 has storage space for program code 510 that performs any method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code 510 can be compressed, for example, in an appropriate form.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting abuse of authority, characterized in that: Applied to electronic equipment, the method comprises: Acquiring operation behavior data corresponding to the user's operation behavior on the electronic device; Acquiring system status information of the electronic device; Obtain access information corresponding to the target application's access operation on private data; Based on the operation behavior data, the system status information, and the access information, determining a permission abuse detection result of the target application program through a pre-trained permission abuse detection model; When it is determined based on the permission abuse detection result that the target application has malicious access, a malicious access prompt is output.

2. The method according to claim 1, characterized in that Before determining the permission abuse detection result of the target application program by using a pre-trained permission abuse detection model based on the operation behavior data, the system status information, and the access information, the method further includes: Determine access operation information corresponding to the sample application and sample access data corresponding to the access operation information based on the user's access operation to the sample application; Obtaining resource occupancy information of the sample application when executing the access operation; Perform malicious access behavior based on the access operation information, sample access data corresponding to the access operation information, and the resource occupancy information to obtain malicious access behavior information, and perform non-malicious access behavior based on the access operation information, sample access data corresponding to the access operation information, and the resource occupancy information to obtain non-malicious access behavior information; The model to be trained is trained according to the malicious access behavior information and the non-malicious access behavior information to improve the accuracy of the model to be trained in identifying sample applications corresponding to the malicious access behavior information as permission-abusing applications, and the trained model to be trained is used as the permission abuse detection model.

3. The method according to claim 2, characterized in that The determining, based on the user's access operation to the sample application, access operation information corresponding to the sample application and sample access data corresponding to the access operation information includes: Generate access operation information corresponding to the sample application according to the sample privacy data accessed by the user based on the sample application; Determine the access permissions for the sample application; Sample data accessed by the sample application program when executing the access operation is determined according to the access permission as the sample access data.

4. The method according to claim 2, characterized in that: The obtaining of resource occupation information of the sample application when executing the access operation includes: Obtaining the application type of the sample application, the memory usage rate and the network request frequency when performing the access operation; Detecting whether the application type, the memory occupancy rate, and the network request frequency meet respective corresponding target conditions; Using at least one of the application type, memory usage, and network request frequency that meet the corresponding target condition as a reference indicator; The resource occupancy information is determined based on the reference indicator.

5. The method according to claim 4, characterized in that The detecting whether the application type, the memory occupancy rate, and the network request frequency meet respective corresponding target conditions includes: In the case where it is detected that the application type is a preset type, determining that the application type satisfies a first target condition corresponding to the application type; In the case where it is detected that the memory occupancy rate is greater than the first threshold, determining that the memory occupancy rate satisfies a second target condition corresponding to the memory occupancy rate; In a case where it is detected that the network request frequency is greater than the second threshold, it is determined that the network request frequency satisfies a third target condition corresponding to the network request frequency.

6. The method according to claim 1, characterized in that The determining the permission abuse detection result of the target application program by using a pre-trained permission abuse detection model based on the operation behavior data, the system state information, and the access information includes: Determine the access type probability corresponding to each of the multiple access types through the permission abuse detection model; Determining an access behavior detection result of the target application based on the access type probability, wherein the access behavior detection result indicates an access type of the target application to the private data; The permission abuse detection result is determined based on the access behavior detection result, wherein the permission abuse detection result includes whether malicious access exists or whether malicious access does not exist.

7. The method according to claim 6, characterized in that The determining the access behavior detection result of the target application based on the access type probability includes: The target access type corresponding to the access type probability greater than or equal to the third threshold is used as the access behavior detection result.

8. The method according to claim 6, characterized in that The determining the behavior detection result of the target application based on the access type probability includes: The target access type corresponding to the maximum access type probability is used as the access behavior detection result.

9. The method according to claim 6, characterized in that The malicious access prompt includes a detection result for characterizing access behavior to the target application.

10. A detection device for abuse of authority, characterized in that: Applied to electronic equipment, the device comprises: An operation behavior data generating unit, used to obtain operation behavior data corresponding to the user's operation behavior on the electronic device; A system status information acquisition unit, used to acquire system status information of the electronic device; An access information acquisition unit, used to acquire access information corresponding to an access operation of a target application program to private data; a permission abuse detection result determination unit, configured to determine a permission abuse detection result of the target application program through a pre-trained permission abuse detection model based on the operation behavior data, the system status information, and the access information; A prompt unit is used to output a malicious access prompt when it is determined that the target application has malicious access based on the permission abuse detection result.

11. An electronic device, characterized in that: include: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, and the program code can be called by a processor to execute the method according to any one of claims 1 to 9.

Images