Hot update real-time detection method and device

Abstract

The invention provides a hot update real-time detection method and device, and relates to the field of application program data processing.The method comprises the steps that static analysis is conducted on a to-be-detected application program installation package, and a hot update framework of an application program is determined; determining a detection item for detecting the hot update behavior of the application program according to the hot update framework; and comparing the difference before and after the hot update of the application program according to the detection item, and outputting the difference. According to the method and the device, the hot update behavior of the application program can be quickly and pertinently detected.

Description

Technical Field

[0001] The present application relates to the field of application data processing, and specifically to a hot update real-time detection method and device. Background Art

[0002] With the development of the mobile terminal industry, applications (APPs) have become a vital link in the industry chain. Applications enable users to experience new features released by software developers in a timely manner. However, in the process of using applications, various defects or vulnerabilities are inevitable. The common way to repair them is to push update packages for users to download and install. However, when serious defects or vulnerabilities are found and need to be repaired urgently, developers often choose hot updates to repair and update applications online.

[0003] At present, commonly used hot update technical solutions include resource repair, code repair and dynamic library repair. Various technical solutions have different implementation principles and are suitable for different hot update scenarios. However, although the hot update repair method meets the needs of urgent vulnerability repair, its behavior of completing application updates without user confirmation and installation also poses a great security risk to users. If used by malicious developers, it will pose a serious threat to the healthy development of the mobile Internet industry ecosystem. There is an urgent need for a method and device for detecting hot update behavior. Summary of the invention

[0004] In view of the problems in the prior art, the present application provides a real-time hot update detection method and device, which can quickly and specifically detect the hot update behavior of an application.

[0005] In order to solve the above technical problems, this application provides the following technical solutions:

[0006] In a first aspect, the present application provides a hot update real-time detection method, comprising:

[0007] Perform static analysis on the application installation package to be tested to determine the application's hot update framework;

[0008] Determining, according to the hot update framework, a detection item for detecting the hot update behavior of the application program;

[0009] The differences before and after the hot update of the application are compared according to the detection items and output.

[0010] Furthermore, the static analysis of the application installation package to be detected to determine the hot update framework of the application includes:

[0011] Performing static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries;

[0012] A corresponding hot update framework is determined according to the static analysis information.

[0013] Furthermore, the hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; the detection items for detecting the hot update behavior of the application program determined according to the hot update framework include:

[0014] If the hot update framework is the code repair framework, determining that the detection item is an executable file;

[0015] If the hot update framework is the resource repair framework, determining that the detection item is a resource file;

[0016] If the hot update framework is the dynamic library repair framework, determining that the detection item is a library file;

[0017] If the hot update framework is the combined repair framework, the detection items are determined to be executable files, resource files, and library files.

[0018] Further, the difference includes a folder difference; the files in the folder include the executable file, the resource file and the library file; the comparing the difference before and after the hot update of the application according to the detection items and outputting the difference includes:

[0019] Converting the contents of the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence;

[0020] Compare the first character sequence with the second character sequence to obtain a folder comparison array;

[0021] According to the folder comparison array, the first longest common subsequence is traced back;

[0022] The difference between the folder before and after the hot update is determined according to the content and position of the first longest common subsequence.

[0023] Further, the difference includes a file difference; the file includes the executable file, the resource file and the library file; the comparison and output of the difference before and after the hot update of the application according to the detection items includes:

[0024] Converting the contents of the files before and after the update into character sequences respectively; wherein the files before the update correspond to the third character sequence; and the files after the update correspond to the fourth character sequence;

[0025] Comparing the third character sequence with the fourth character sequence to obtain a file comparison array;

[0026] Backtracking the second longest common subsequence according to the file comparison array;

[0027] The difference between the file before and after the hot update is determined according to the content and position of the second longest common subsequence.

[0028] Further, the difference includes a similarity difference; and the comparing and outputting the difference before and after the hot update of the application according to the detection items includes:

[0029] respectively determining the length of the third character sequence and the fourth character sequence;

[0030] The similarity difference is determined according to the length of the second longest common subsequence, the length of the third character sequence, and the length of the fourth character sequence.

[0031] In a second aspect, the present application provides a hot update real-time detection device, comprising:

[0032] An update framework determination unit, used to perform static analysis on the application installation package to be detected and determine the hot update framework of the application;

[0033] A detection item determination unit, configured to determine, according to the hot update framework, a detection item for detecting the hot update behavior of the application program;

[0034] The difference output unit is used to compare and output the difference before and after the hot update of the application according to the detection items.

[0035] Furthermore, the update framework determination unit includes:

[0036] A static analysis module, used to perform static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries;

[0037] The update framework determination module is used to determine the corresponding hot update framework according to the static analysis information.

[0038] Furthermore, the hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; the detection item determination unit includes:

[0039] An executable file determination module, configured to determine that the detected item is an executable file if the hot update framework is the code repair framework;

[0040] A resource file determination module, configured to determine that the detection item is a resource file if the hot update framework is the resource repair framework;

[0041] A library file determination module, used for determining that the detection item is a library file if the hot update framework is the dynamic library repair framework;

[0042] The combined file determination module is used to determine that the detected item is an executable file, a resource file and a library file if the hot update framework is the combined repair framework.

[0043] Further, the difference includes a folder difference; the files in the folder include the executable file, resource file and library file; the difference output unit includes:

[0044] A first character conversion module, used to convert the contents corresponding to the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence;

[0045] A first character comparison module, used for comparing the first character sequence with the second character sequence to obtain a folder comparison array;

[0046] A first sequence backtracking module, used for backtracking the first longest common subsequence according to the folder comparison array;

[0047] The first difference determination module is used to determine the difference before and after the hot update of the folder according to the content and position of the first longest common subsequence.

[0048] Further, the difference includes file difference; the file includes the executable file, resource file and library file; the difference output unit includes:

[0049] A second character conversion module is used to convert the contents corresponding to the files before and after the update into character sequences respectively; wherein the file before the update corresponds to the third character sequence; and the file after the update corresponds to the fourth character sequence;

[0050] A second character comparison module, used for comparing the third character sequence with the fourth character sequence to obtain a file comparison array;

[0051] A second sequence backtracking module, used for backtracking the second longest common subsequence according to the file comparison array;

[0052] The second difference determination module is used to determine the difference between the file before and after the hot update according to the content and position of the second longest common subsequence.

[0053] Further, the difference includes a similarity difference; and the difference output unit includes:

[0054] a character sequence length calculation module, used to determine the length of the third character sequence and the length of the fourth character sequence respectively;

[0055] The similarity difference calculation module is used to determine the similarity difference according to the length of the second longest common subsequence, the length of the third character sequence and the length of the fourth character sequence.

[0056] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the hot update real-time detection method when executing the program.

[0057] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the hot update real-time detection method when executed by a processor.

[0058] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which implements the steps of the hot update real-time detection method when executed by a processor.

[0059] In response to the problems in the prior art, the hot update real-time detection method and device provided by the present application can use virtual machines to build a simulation environment for mobile terminals of different models, monitor the hot update behavior of applications that are hot updated on mobile terminals, and make the monitoring of hot update behavior not limited to specific terminal models; by recording the changes in the file attributes, Dex files, resource files and So files of the application, the hot update behavior of the application is comprehensively monitored; by comparing the hot update behavior of the application on different mobile terminals, the inaccurate judgment of the hot update behavior of the application by a single data source is avoided, thereby making the monitoring results more universal; the constructed virtual machine system structure is greatly simplified compared to the physical structure of the mobile terminal, so as to facilitate the accurate monitoring of the application's file attribute changes, basic component changes, code hot replacement, resource file hot replacement and dynamic library hot replacement and other behaviors, so that the hot update behavior is clear at a glance. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 This is a flow chart of a hot update real-time detection method in an embodiment of the present application;

[0062] Figure 2 A flowchart for determining a hot update framework in an embodiment of the present application;

[0063] Figure 3 A flowchart for determining detection items in an embodiment of the present application;

[0064] Figure 4 One of the flowcharts for comparing and outputting the differences before and after the hot update in the embodiment of the present application;

[0065] Figure 5 This is the second flow chart of comparing and outputting the difference before and after the hot update in the embodiment of the present application;

[0066] Figure 6 This is the third flow chart of comparing and outputting the difference before and after the hot update in the embodiment of the present application;

[0067] Figure 7 This is a structural diagram of a hot update real-time detection device in an embodiment of the present application;

[0068] Figure 8 A structural diagram of an updating framework determination unit in an embodiment of the present application;

[0069] Fig. 9 This is a structural diagram of a detection item determination unit in an embodiment of the present application;

[0070] Fig.10 It is one of the difference output units in the embodiment of the present application;

[0071] Fig.11 It is the second difference output unit in the embodiment of the present application;

[0072] Fig.12 This is the third difference output unit in the embodiment of the present application;

[0073] Fig.13 A schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0074] Fig.14 This is one of the overall method flow diagrams in the embodiments of the present application;

[0075] Fig.15 This is the second schematic diagram of the overall method flow in the embodiment of the present application. DETAILED DESCRIPTION

[0076] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0077] The acquisition, storage, use and processing of data in the technical solution of this application comply with the relevant provisions of laws and regulations.

[0078] At present, the hot update detection and comparison method is mainly implemented by passive static comparison technology. This method first requires installing a tool on the mobile terminal to call the system interface, and then the user manually clicks to record the components related to the application in the current device. These components usually do not change due to changes in external conditions or user operations within a certain period of time, and only change when the application is updated.

[0079] These components mainly include:

[0080] Service: used to perform time-consuming operations in the background and also for inter-process communication;

[0081] Activity: used to display the interface to interact with the user;

[0082] Broadcast Receiver: performs notification operations;

[0083] Content Provider: Provides data across processes.

[0084] Generally, each application project must add an AndroidManifest.xml file in the root directory of the project source settings. This file is also called a manifest file. The manifest file contains the basic information of the APP (package name, version number, API level), basic components (services, activities, broadcast receivers, content providers) and native libraries (*.so).

[0085] Passive static comparison technology can analyze the changes in the AndroidManifest.xml file after the user manually clicks twice, and then know the changes in the basic information, basic components and native libraries of the APP, thereby realizing the detection of the hot update behavior of the APP.

[0086] Although passive comparison technology solves the problem of initial detection of hot update behavior in a highly differentiated APP development environment, some inherent limitations of this technology are gradually emerging:

[0087] First, passive comparison technology needs to be deployed in physical terminals, so the detection of hot update behavior is limited by the number of terminals. If you want to verify the behavior of the same APP when it is hot updated on mobile terminals of different brands and types, you need to purchase multiple corresponding mobile terminals, which is costly.

[0088] Second, passive comparison technology requires calling system interfaces, and it is impossible to detect hot update behavior for systems that do not provide corresponding interfaces. If the existing system interface is updated or the APP component structure changes significantly (such as a major system version number update), the detection tool needs to be adapted and updated before it can continue to detect.

[0089] Third, when facing the disguised behavior of APP and SDK, passive comparison technology mainly detects by recording the version number of APP and the last installation time. Developers can make it difficult for passive comparison technology to find and track the hot update behavior of APP by not increasing the version number during the update and tampering with the last installation time, so that the hot update can be completed under detection without being discovered.

[0090] Fourth, hot update technology also includes code repair (Dex files), resource repair (generally in the Res directory) and dynamic library repair (so files). The existing passive comparison technology is difficult to accurately detect the update behavior of these files and will miss a large number of hot update behaviors.

[0091] Fifth, passive comparison technology relies on users clicking save to record APP information. It is in a passive response state. The detection accuracy is seriously dependent on the user's saving frequency, and it is difficult to achieve real-time detection.

[0092] In one embodiment, see Figure 1 In order to quickly and specifically detect the hot update behavior of an application, the present application provides a hot update real-time detection method, including:

[0093] S101: Performing static analysis on the installation package of the application to be detected to determine the hot update framework of the application;

[0094] S102: determining, according to the hot update framework, detection items for detecting the hot update behavior of the application program;

[0095] S103: Compare the differences before and after the hot update of the application program according to the detection items and output them.

[0096] It is understandable that the mainstream hot update frameworks include: Tinker, Nuwa, rocooFix, Amigo, Robust, AndFix, Sophix and KKFix.

[0097] In order to understand the hot update of the same APP in different mobile terminals, the embodiment of the present application can simulate the software and hardware environment of the mobile terminal and establish a virtual machine for testing. The virtual machine can be used as the execution subject of the embodiment of the present application. Of course, the method provided by the present application can also be run in a real mobile terminal (such as a mobile phone) to realize the detection of a certain APP on the specific mobile terminal.

[0098] Specifically, see Fig.14 and Fig.15 , which can be achieved by following the steps below:

[0099] 1. Create a virtual machine in a personal computer (PC);

[0100] 2. Install the APP to be tested into the virtual machine and set the monitoring module parameters in the virtual machine's settings module;

[0101] 3. The monitoring module in the virtual machine performs static analysis on the APP and sends the initial files and structures obtained from the analysis to the backup module in the virtual machine for later comparison; the backup module stores the APP version before the update;

[0102] 4. Open the APP, and the monitoring module starts hot update monitoring according to the set parameters;

[0103] 5. When the set monitoring time is reached, the monitoring module calls the comparison module to analyze the changes in the files in the virtual machine and feeds the results back to the analysis module in the virtual machine;

[0104] 6. The analysis module compares the changed files with the initial files in the backup module and sends the differences to the backup module for evidence;

[0105] 7. After continuous monitoring, the analysis module will display the changes of the APP in the backup module before and after the comparison, and give the hot update judgment result.

[0106] From the above description, it can be seen that the hot update real-time detection method provided by the present application can use virtual machines to build a simulation environment for mobile terminals of different models, and monitor the hot update behavior of applications that are hot updated on mobile terminals, so that the monitoring of hot update behavior is not limited to specific terminal models; by recording changes in the file attributes, Dex files, resource files and So files of the application, the hot update behavior of the application is comprehensively monitored; by comparing the hot update behavior of the application on different mobile terminals, the inaccurate judgment of the hot update behavior of the application by a single data source is avoided, thereby making the monitoring results more universal; the constructed virtual machine system structure is greatly simplified compared to the physical structure of the mobile terminal, so as to facilitate the accurate monitoring of the application's file attribute changes, basic component changes, code hot replacement, resource file hot replacement and dynamic library hot replacement and other behaviors, so that the hot update behavior is clear at a glance.

[0107] Steps S101 to S103 are described in detail below.

[0108] Step S101: statically analyzing the application installation package to be detected to determine the hot update framework of the application.

[0109] Figure 2 This is a specific embodiment of the hot update real-time detection method implemented in the embodiment of the present application.

[0110] In one embodiment, see Figure 2 The static analysis of the application installation package to be detected to determine the hot update framework of the application includes:

[0111] S201: Performing static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries;

[0112] S202: Determine a corresponding hot update framework according to the static analysis information.

[0113] It can be understood that in the embodiment of the present application, the process of statically detecting the hot update behavior of the APP is as follows:

[0114] 1. Create a virtual machine in a personal computer (PC), keep the virtual machine connected to the Internet and ensure that the software environment of the virtual machine itself is not updated;

[0115] 2. Input the APP installation package into the virtual machine, and the backup module backs up the Dex files, resource files and So files after the APP is installed;

[0116] 3. Set the monitoring module parameters in the setting module, including at least: monitoring time, comparison frequency, full or partial monitoring;

[0117] 4. The monitoring module performs static analysis on the APP installation package. After unpacking, it analyzes the AndroidManifest.xml file in the root directory of the APP to obtain the basic information of the APP (package name, version number, API level), basic components (services, activities, broadcast receivers, content providers) and native libraries (*.so). Check whether it contains the hot update framework identification file (such as Tinker: com.tencent.tinker.*, AndFix: libandfix*.so, etc.).

[0118] The corresponding hot update framework can be determined through the hot update framework identifier.

[0119] It can be seen from the above description that the hot update real-time detection method provided by the present application can perform static analysis on the application installation package to be detected and determine the hot update framework of the application.

[0120] Step S102: determining detection items for detecting the hot update behavior of the application program according to the hot update framework.

[0121] In one embodiment, see Figure 3 The hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; the detection items for detecting the hot update behavior of the application program according to the hot update framework include:

[0122] S301: If the hot update framework is the code repair framework, determine that the detection item is an executable file;

[0123] S302: If the hot update framework is the resource repair framework, determine that the detection item is a resource file;

[0124] S303: If the hot update framework is the dynamic library repair framework, determining that the detection item is a library file;

[0125] S304: If the hot update framework is the combined repair framework, determine that the detection item is an executable file, a resource file, and a library file.

[0126] It can be understood that step S301 to step S304 represent a process of determining a detection item according to the type of the hot update framework, and the specific steps are as follows:

[0127] (1) Monitoring starts. Open the APP. The monitoring module monitors the hot update of the corresponding files according to the hot update framework of the APP obtained through analysis, various hot update schemes and set monitoring parameters, and records their file size, path, md5 and folder structure, etc.:

[0128] a. The hot update framework is a code repair framework: The hot update behavior monitoring for code repair solutions (such as Nuwa, Robust, AndFix and other frameworks) is to monitor the hot update of executable files (Dex files);

[0129] b. The hot update framework is a resource repair framework: The hot update behavior monitoring for resource repair solutions (such as Tinker and other frameworks) is to monitor the hot update of resource files;

[0130] c. The hot update framework is the dynamic library repair framework: the hot update behavior monitoring for dynamic library repair solutions (such as Sophix and other frameworks) is to perform hot update monitoring on library files (So files);

[0131] d. The hot update framework is a combined repair framework: The hot update behavior monitoring for the combined repair solution (such as Amigo and other frameworks, or when the specific hot update framework used is not detected) is to perform hot update monitoring on Dex files, resource files, and So files.

[0132] (2) When the set monitoring time is reached, the monitoring module calls the comparison module to compare the file attributes, basic components, Dex files, resource files and So files of the APP after the hot update with the file attributes, basic components, Dex files, resource files and So files of the APP before the hot update backed up in the backup module.

[0133] It can be seen from the above description that the real-time hot update detection method provided in the present application can determine the detection items for detecting the hot update behavior of the application according to the hot update framework.

[0134] Step S103: comparing the differences before and after the hot update of the application program according to the detection items and outputting the differences.

[0135] In one embodiment, see Figure 5 , the difference includes file difference; the file includes the executable file, resource file and library file; the comparison and output of the difference before and after the hot update of the application according to the detection items includes:

[0136] S501: Convert the contents of the files before and after the update into character sequences respectively; wherein the file before the update corresponds to the third character sequence; and the file after the update corresponds to the fourth character sequence;

[0137] S502: Compare the third character sequence with the fourth character sequence to obtain a file comparison array;

[0138] S503: trace back the second longest common subsequence according to the file comparison array;

[0139] S504: Determine the difference between the file before and after the hot update according to the content and position of the second longest common subsequence.

[0140] It is understandable that steps S301 to S304 have determined the detection items to be detected, that is, which files should be checked. For the files to be detected, the detection can be performed according to the following steps. The so-called detection refers to comparing whether there are differences between the files before and after the hot update. The comparison process is based on the Longest Common Subsequence (LCS) algorithm.

[0141] 1) Read the contents of the two files corresponding to the APP before and after the update, and convert them into character sequence X and character sequence Y respectively;

[0142] 2) Use the longest common subsequence (LCS) algorithm to compare each of the above files. Create a two-dimensional array dp(i,j) to represent the LCS length of the first i characters of the character sequence X and the first j characters of the character sequence Y, with the initial values ​​dp(0,j) = 0 and dp(i,0) = 0;

[0143] 3) Use dynamic programming to fill the dp(i,j) array. According to the definition of LCS, each character in the two character sequences is compared according to the following formula (1): if the characters are the same, X i =Y j , then set the array element at the corresponding position to the upper left corner element plus 1, that is, dp(i)(j)=dp(i-1)(j-1)+1; if the characters are different X i ≠Y j , then set the array element at the corresponding position to the larger value of the left and above elements, that is, dp(i)(j)=max(dp(i)(j-1),dp(i-1)(j));

[0144]

[0145] 4) According to the filled dp array, trace back to find out that the length of the longest common subsequence LCS is the value of dp(i)(j);

[0146] 5) Determine the difference of the files based on the content and position of the LCS sequence, that is, the value of dp(i)(j). The same characters indicate the same file content. Compare dp(i)(j), character sequence X, and character sequence Y. If dp(i)(j) and character sequence X and character sequence Y are the same, the two files have the same content. The difference between character sequence X and character sequence Y and dp(i)(j) is the difference before and after the application is hot-updated.

[0147] It can be seen from the above description that the real-time hot update detection method provided in the present application can compare the differences before and after the hot update of the application according to the detection items and output them.

[0148] In one embodiment, see Figure 4 , the difference includes a folder difference; the files in the folder include the executable file, resource file and library file; the comparison of the difference before and after the hot update of the application according to the detection items and outputting the difference includes:

[0149] S401: Convert the contents of the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence;

[0150] S402: Compare the first character sequence with the second character sequence to obtain a folder comparison array;

[0151] S403: trace back the first longest common subsequence according to the folder comparison array;

[0152] S404: Determine the difference between the folder before and after the hot update according to the content and position of the first longest common subsequence.

[0153] It can be understood that, similar to step S501 to step S504, step S401 to step S404 are detections performed on folders.

[0154] Use the Longest Common Subsequence (LCS) algorithm to compare the folders. The steps are as follows:

[0155] 1) List the contents of the two folders separately, including files and subfolders;

[0156] 2) For each file and subfolder, calculate the LCS length of its name, i.e. dp(i)(j);

[0157] 3) If the names of the files or subfolders are different, the LCS length is the larger value of the LCS length of the current position in the previous folder and the previous position in the current folder, and the LCS length is added to the newly added list;

[0158] 4) If a file or subfolder does not exist in one folder but exists in another folder, it is a new item. Apply the LCS algorithm to the new item, calculate the value of dp(i)(j), and add the LCS length to the new item list;

[0159] 5) If a file or subfolder has an item with the same name in another folder, treat them as matches and add them to the match list;

[0160] 6) For the matching subfolders, recursively apply the LCS algorithm and calculate the value of dp(i)(j).

[0161] For the specific formula for calculating dp(i)(j), see the above formula (1). Finally, the difference between the folder before and after the hot update is determined based on the value of dp(i)(j). Check the new list and the matching list. The value of dp(i)(j) in the new list is the newly added file or folder after the hot update. In the matching list, compare dp(i)(j), character sequence X and character sequence Y. If dp(i)(j) and character sequence X and character sequence Y are the same, the contents of the two files are consistent. The difference between character sequence X and character sequence Y and dp(i)(j) is the difference before and after the application is hot updated.

[0162] In the embodiment of the present application, the folder can be detected first, and when the folder is found to be different before and after the hot update, the file is detected; the specific implementation is not limited to this order. The detection of files and the detection of folders can be performed independently.

[0163] It can be seen from the above description that the real-time hot update detection method provided in the present application can compare the differences before and after the hot update of the application according to the detection items and output them.

[0164] In one embodiment, see Figure 6 , the difference includes a similarity difference; the comparing the difference before and after the hot update of the application according to the detection item and outputting it includes:

[0165] S601: Determine the length of the third character sequence and the length of the fourth character sequence respectively;

[0166] S602: Determine the similarity difference according to the length of the second longest common subsequence, the length of the third character sequence, and the length of the fourth character sequence.

[0167] It is understandable that if the aforementioned steps S401 to S404 or steps S501 to S504 show that there are differences between the folder or file before and after the hot update, the size of the difference, i.e. the similarity of the folder or file before and after the hot update, can be further calculated using steps S601 to S602. The specific steps can be as follows:

[0168] 1) The comparison module sends the file attributes, basic components, Dex files, resource files and So files of the APP in the virtual machine after the hot update to the backup module for evidence, and is used for the next hot update comparison;

[0169] 2) Calculate the comparison result, that is, calculate the file similarity value sim, the calculation method is: the similarity between sequence X and character sequence Y = the length of the longest common subsequence × 2 / the sum of the lengths of X and Y, that is: sim = len(LCS) × 2 / len(X) + len(Y).

[0170] 3) After the hot update comparison is completed, the comparison module feeds back the comparison result sim value to the analysis module;

[0171] 5. After continuous monitoring, the analysis module analyzes and displays the changes between different time nodes in the backup module and gives the hot update judgment result. If the value of sim is less than a certain threshold (for example, 0.8), it is determined that the APP has hot update behavior.

[0172] When it is determined that the APP has hot update behavior, a prompt message can be sent to the device used by the user (such as a personal computer or a mobile terminal).

[0173] It can be seen from the above description that the real-time hot update detection method provided in the present application can compare the differences before and after the hot update of the application according to the detection items and output them.

[0174] Based on the same inventive concept, the embodiments of the present application also provide a hot update real-time detection device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of the hot update real-time detection device to solve the problem is similar to that of the hot update real-time detection method, the implementation of the hot update real-time detection device can refer to the implementation of the method based on software performance benchmark determination, and the repetitions will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0175] In one embodiment, see Figure 7 In order to quickly and specifically detect the hot update behavior of an application, the present application provides a hot update real-time detection device, including:

[0176] An update framework determination unit 701 is used to perform static analysis on the application installation package to be detected and determine the hot update framework of the application;

[0177] A detection item determination unit 702, configured to determine, according to the hot update framework, a detection item for detecting the hot update behavior of the application program;

[0178] The difference output unit 703 is used to compare and output the difference before and after the hot update of the application according to the detection items.

[0179] In one embodiment, see Figure 8 The update framework determination unit 701 includes:

[0180] The static analysis module 801 is used to perform static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries;

[0181] The update framework determination module 802 is used to determine the corresponding hot update framework according to the static analysis information.

[0182] In one embodiment, see Fig. 9 The hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; the detection item determination unit 702 includes:

[0183] An executable file determination module 901 is used to determine that the detected item is an executable file if the hot update framework is the code repair framework;

[0184] A resource file determination module 902, configured to determine that the detected item is a resource file if the hot update framework is the resource repair framework;

[0185] A library file determination module 903, configured to determine that the detected item is a library file if the hot update framework is the dynamic library repair framework;

[0186] The combined file determination module 904 is used to determine that the detected item is an executable file, a resource file, and a library file if the hot update framework is the combined repair framework.

[0187] In one embodiment, see Fig.10 , the difference includes folder difference; the files in the folder include the executable file, resource file and library file; the difference output unit 703 includes:

[0188] The first character conversion module 1001 is used to convert the contents corresponding to the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence;

[0189] A first character comparison module 1002 is used to compare the first character sequence with the second character sequence to obtain a folder comparison array;

[0190] A first sequence backtracking module 1003, used to backtrack the first longest common subsequence according to the folder comparison array;

[0191] The first difference determination module 1004 is used to determine the difference before and after the hot update of the folder according to the content and position of the first longest common subsequence.

[0192] In one embodiment, see Fig.11 , the difference includes file difference; the file includes the executable file, resource file and library file; the difference output unit 703 includes:

[0193] The second character conversion module 1101 is used to convert the contents corresponding to the files before and after the update into character sequences respectively; wherein the files before the update correspond to the third character sequence; and the files after the update correspond to the fourth character sequence;

[0194] A second character comparison module 1102 is used to compare the third character sequence with the fourth character sequence to obtain a file comparison array;

[0195] A second sequence backtracking module 1103, configured to backtrack the second longest common subsequence according to the file comparison array;

[0196] The second difference determination module 1104 is used to determine the difference between the file before and after the hot update according to the content and position of the second longest common subsequence.

[0197] In one embodiment, see Fig.12 , the difference includes a similarity difference; the difference output unit 703 includes:

[0198] A character sequence length calculation module 1201, used to determine the length of the third character sequence and the length of the fourth character sequence respectively;

[0199] The similarity difference calculation module 1202 is used to determine the similarity difference according to the length of the second longest common subsequence, the length of the third character sequence and the length of the fourth character sequence.

[0200] From the hardware level, in order to be able to quickly and specifically detect the hot update behavior of the application, the present application provides an embodiment of an electronic device for implementing all or part of the content of the hot update real-time detection method, and the electronic device specifically includes the following content:

[0201] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between the hot update real-time detection device and related devices such as core business systems, user terminals and related databases; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the hot update real-time detection method and the embodiment of the hot update real-time detection device in the embodiment, and the contents thereof are incorporated herein and the repeated parts are not repeated.

[0202] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0203] In practical applications, part of the hot update real-time detection method can be executed on the electronic device side as described above, or all operations can be completed in the client device. The selection can be made based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0204] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0205] Fig.13 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig.13 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig.13 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0206] In one embodiment, the hot update real-time detection method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control:

[0207] S101: Performing static analysis on the installation package of the application to be detected to determine the hot update framework of the application;

[0208] S102: determining, according to the hot update framework, detection items for detecting the hot update behavior of the application program;

[0209] S103: Compare the differences before and after the hot update of the application program according to the detection items and output them.

[0210] From the above description, it can be seen that the hot update real-time detection method and device provided by the present application can use virtual machines to build a simulation environment for mobile terminals of different models, and monitor the hot update behavior of applications that are hot updated on mobile terminals, so that the monitoring of hot update behavior is not limited to specific terminal models; by recording the changes in the file attributes, Dex files, resource files and So files of the application, the hot update behavior of the application is comprehensively monitored; by comparing the hot update behavior of the application on different mobile terminals, the inaccurate judgment of the hot update behavior of the application by a single data source is avoided, thereby making the monitoring results more universal; the constructed virtual machine system structure is greatly simplified compared to the physical structure of the mobile terminal, so as to facilitate the accurate monitoring of the application's file attribute changes, basic component changes, code hot replacement, resource file hot replacement and dynamic library hot replacement and other behaviors, so that the hot update behavior is clear at a glance.

[0211] In another embodiment, the hot update real-time detection device can be configured separately from the central processing unit 9100. For example, the data composite transmission device hot update real-time detection device can be configured as a chip connected to the central processing unit 9100, and the function of the hot update real-time detection method can be realized through the control of the central processing unit.

[0212] like Fig.13 As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig.13 In addition, the electronic device 9600 may also include Fig.13 For components not shown, reference may be made to the prior art.

[0213] like Fig.13As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0214] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0215] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0216] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0217] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0218] The communication module 9110 is a transmitter / receiver 9110 that sends and receives signals via an antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0219] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the local machine through the microphone 9132, and the sound stored on the local machine can be played through the speaker 9131.

[0220] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the hot update real-time detection method in the above embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all the steps of the hot update real-time detection method in the above embodiment are implemented by the execution subject being a server or a client. For example, when the processor executes the computer program, the following steps are implemented:

[0221] S101: Performing static analysis on the installation package of the application to be detected to determine the hot update framework of the application;

[0222] S102: determining, according to the hot update framework, detection items for detecting the hot update behavior of the application program;

[0223] S103: Compare the differences before and after the hot update of the application program according to the detection items and output them.

[0224] From the above description, it can be seen that the hot update real-time detection method and device provided by the present application can use virtual machines to build a simulation environment for mobile terminals of different models, and monitor the hot update behavior of applications that are hot updated on mobile terminals, so that the monitoring of hot update behavior is not limited to specific terminal models; by recording the changes in the file attributes, Dex files, resource files and So files of the application, the hot update behavior of the application is comprehensively monitored; by comparing the hot update behavior of the application on different mobile terminals, the inaccurate judgment of the hot update behavior of the application by a single data source is avoided, thereby making the monitoring results more universal; the constructed virtual machine system structure is greatly simplified compared to the physical structure of the mobile terminal, so as to facilitate the accurate monitoring of the application's file attribute changes, basic component changes, code hot replacement, resource file hot replacement and dynamic library hot replacement and other behaviors, so that the hot update behavior is clear at a glance.

[0225] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0226] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0227] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0228] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0229] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A hot update real-time detection method, characterized in that: include: Perform static analysis on the application installation package to be tested to determine the application's hot update framework; Determining, according to the hot update framework, a detection item for detecting the hot update behavior of the application program; The differences before and after the hot update of the application are compared according to the detection items and output.

2. The hot update real-time detection method according to claim 1, characterized in that: The static analysis of the application installation package to be detected to determine the hot update framework of the application includes: Performing static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries; A corresponding hot update framework is determined according to the static analysis information.

3. The hot update real-time detection method according to claim 1, characterized in that: The hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; The detection item for detecting the hot update behavior of the application program is determined according to the hot update framework, including: If the hot update framework is the code repair framework, determining that the detection item is an executable file; If the hot update framework is the resource repair framework, determining that the detection item is a resource file; If the hot update framework is the dynamic library repair framework, determining that the detection item is a library file; If the hot update framework is the combined repair framework, the detection items are determined to be executable files, resource files, and library files.

4. The real-time detection method for hot updates according to claim 3 is characterized in that: The difference includes a folder difference; the files in the folder include the executable file, resource file and library file; the comparison and output of the difference before and after the hot update of the application according to the detection items includes: Converting the contents of the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence; Compare the first character sequence with the second character sequence to obtain a folder comparison array; According to the folder comparison array, the first longest common subsequence is traced back; The difference between the folder before and after the hot update is determined according to the content and position of the first longest common subsequence.

5. The real-time detection method for hot updates according to claim 3, characterized in that: The difference includes file difference; the file includes the executable file, resource file and library file; the comparison and output of the difference before and after the hot update of the application according to the detection items includes: Converting the contents of the files before and after the update into character sequences respectively; wherein the files before the update correspond to the third character sequence; and the files after the update correspond to the fourth character sequence; Comparing the third character sequence with the fourth character sequence to obtain a file comparison array; Backtracking the second longest common subsequence according to the file comparison array; The difference between the file before and after the hot update is determined according to the content and position of the second longest common subsequence.

6. The real-time detection method for hot updates according to claim 5, characterized in that: The difference includes a similarity difference; and the comparing and outputting the difference before and after the hot update of the application according to the detection items includes: respectively determining the length of the third character sequence and the fourth character sequence; The similarity difference is determined according to the length of the second longest common subsequence, the length of the third character sequence, and the length of the fourth character sequence.

7. A hot update real-time detection device, characterized in that: include: An update framework determination unit, used to perform static analysis on the application installation package to be detected and determine the hot update framework of the application; A detection item determination unit, configured to determine, according to the hot update framework, a detection item for detecting the hot update behavior of the application program; The difference output unit is used to compare and output the difference before and after the hot update of the application according to the detection items.

8. The hot update real-time detection device according to claim 7, characterized in that: The update framework determination unit includes: A static analysis module, used to perform static analysis on the application installation package to be detected to obtain static analysis information; wherein the static analysis information includes basic information, basic components and native libraries; The update framework determination module is used to determine the corresponding hot update framework according to the static analysis information.

9. The hot update real-time detection device according to claim 7, characterized in that: The hot update framework includes a code repair framework, a resource repair framework, a dynamic library repair framework and a combined repair framework; The detection item determination unit includes: An executable file determination module, configured to determine that the detected item is an executable file if the hot update framework is the code repair framework; A resource file determination module, configured to determine that the detection item is a resource file if the hot update framework is the resource repair framework; A library file determination module, used for determining that the detection item is a library file if the hot update framework is the dynamic library repair framework; The combined file determination module is used to determine that the detected item is an executable file, a resource file and a library file if the hot update framework is the combined repair framework.

10. The hot update real-time detection device according to claim 9, characterized in that: The difference includes a folder difference; the files in the folder include the executable file, resource file and library file; the difference output unit includes: A first character conversion module, used to convert the contents corresponding to the folders before and after the update into character sequences respectively; wherein the folder before the update corresponds to the first character sequence; and the folder after the update corresponds to the second character sequence; A first character comparison module, used for comparing the first character sequence with the second character sequence to obtain a folder comparison array; A first sequence backtracking module, used for backtracking the first longest common subsequence according to the folder comparison array; The first difference determination module is used to determine the difference before and after the hot update of the folder according to the content and position of the first longest common subsequence.

11. The hot update real-time detection device according to claim 9, characterized in that: The difference includes file difference; the file includes the executable file, resource file and library file; the difference output unit includes: A second character conversion module is used to convert the contents corresponding to the files before and after the update into character sequences respectively; wherein the file before the update corresponds to the third character sequence; and the file after the update corresponds to the fourth character sequence; A second character comparison module, used for comparing the third character sequence with the fourth character sequence to obtain a file comparison array; A second sequence backtracking module, used for backtracking the second longest common subsequence according to the file comparison array; The second difference determination module is used to determine the difference between the file before and after the hot update according to the content and position of the second longest common subsequence.

12. The hot update real-time detection device according to claim 11, characterized in that: The difference includes a similarity difference; the difference output unit includes: a character sequence length calculation module, used to determine the length of the third character sequence and the length of the fourth character sequence respectively; The similarity difference calculation module is used to determine the similarity difference according to the length of the second longest common subsequence, the length of the third character sequence and the length of the fourth character sequence.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the hot update real-time detection method according to any one of claims 1 to 6 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the hot update real-time detection method according to any one of claims 1 to 6 are implemented.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the hot update real-time detection method according to any one of claims 1 to 6 are implemented.

Images