Application hot update processing method, terminal equipment and readable storage medium

Abstract

The invention discloses an application hot update processing method, terminal equipment and a readable storage medium. The method is applied to terminal equipment, and comprises the following steps: in response to detection of hot update of a target application, uploading a corresponding patch file and an original file to a server for security detection; and receiving a security detection result fed back by the server, and performing corresponding processing according to the security detection result. Through the mode, the efficiency and the accuracy of application security detection are effectively improved, and the security and the performance are integrally improved.

Description

Technical Field

[0001] The present application relates to the technical field of application update, and in particular to a processing method, a terminal device and a readable storage medium for application hot update. Background Art

[0002] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0003] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the application store of the terminal device. After reaching the terminal device, it can download and run malicious code modules with the help of hot update behavior, endangering the data and property security of the terminal device. Summary of the invention

[0004] The present application provides a processing method, terminal device and readable storage medium for application hot update, which can effectively improve the efficiency and accuracy of application security detection and improve the overall security and performance.

[0005] In a first aspect, the present application provides a method for processing application hot updates, which is applied to a terminal device. The method includes: in response to detecting a hot update of a target application, uploading the corresponding patch file and the original file to a server for security detection; receiving the security detection results fed back by the server, and performing corresponding processing based on the security detection results.

[0006] In a second aspect, the present application provides a terminal device, which includes a processor and a memory and a communication module coupled to the processor, the communication module being used to communicate with a server; wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method provided in the first aspect.

[0007] In a third aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method provided in the first aspect.

[0008] The beneficial effect of the present application is as follows: different from the prior art, the present application provides an application hot update processing method, a terminal device and a readable storage medium. In response to detecting a target application hot update, the terminal device uploads the corresponding patch file and the original file to the server for security detection, receives the security detection result fed back by the server, and performs corresponding processing according to the security detection result. The server can use its stronger detection capability than the terminal device to perform security detection on the patch file, effectively improving the efficiency and accuracy of application security detection, and improving security and performance as a whole. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0010] in:

[0011] Figure 1 It is a flowchart of an embodiment of a method for processing application hot update provided by the present application;

[0012] Figure 2 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0013] Figure 3 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0014] Figure 4 It is a flowchart of another embodiment of the processing method for application hot update provided by the present application;

[0015] Figure 5 It is a structural diagram of an embodiment of a terminal device provided by the present application;

[0016] Figure 6 It is a structural schematic diagram of an embodiment of an electronic device provided by the present application;

[0017] Figure 7 It is a structural schematic diagram of an embodiment of a computer-readable storage medium provided by the present application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It will be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only some but not all structures related to the present application are shown in the drawings. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0019] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0020] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0021] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the application store of the terminal device. After reaching the terminal device, it can download and run malicious code modules with the help of hot update behavior, endangering the data and property security of the terminal device.

[0022] Most of the current terminal equipment manufacturers do not conduct targeted detection or restrictions on application hot update behavior. The security detection of hot update applications mainly relies on the unified detection of applications by system security software such as the device manager in the terminal device.

[0023] The unified detection of applications by security software is usually executed by users actively clicking, or triggered by predefined key sensitive behaviors of applications (such as payment), or executed regularly or when the device is idle according to a predetermined strategy. Currently, the security software of most devices generally does not include application hot update behavior in the scope of trigger detection indicators.

[0024] Before the application completes the hot update, the security software does not conduct targeted detection, recording, and prompting of the application's hot update behavior. The user is unaware of the application's hot update behavior and cannot understand whether the actual impact of a single hot update is negative.

[0025] The application may silently complete the hot update behavior without the user's knowledge, or deceive the user into agreeing to the hot update behavior of the application. Applications with hot update capabilities are not restricted when performing hot update behaviors on terminal devices, and there is a possibility that malicious code will be downloaded to the terminal device for execution without being intercepted in time by security software. Based on this, the present application proposes to detect application hot updates, and when an application hot update is detected, the corresponding patch file and the original file are uploaded to the server for security detection; the security detection results fed back by the server are received, and corresponding processing is performed according to the security detection results, so as to improve the security of application hot updates and reduce the harm of malicious code to applications and terminal devices. Please refer to any of the following technical solutions for details.

[0026] See also Figure 1 , Figure 1 1 is a flow chart of an embodiment of a method for processing application hot update provided by the present application. Applied to a terminal device, the method includes:

[0027] Step 11: In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server for security detection.

[0028] In some embodiments, the tracking technology can be used on the terminal device to detect application hot updates and provide functional support for timely interception of application hot update behaviors.

[0029] In some embodiments, when an application is hot-updated, it is necessary to download a patch file from the server of the corresponding development end. Then, the application is hot-updated using the patch file in the terminal device. Based on this, malicious code is easily inserted into the patch file, and the patch file has not been security-checked by the application store and security software, so there are security risks after the application is hot-updated. Therefore, in this embodiment, when the terminal device detects that the target application is hot-updated, the hot-update behavior can be suspended, and the corresponding patch file and the original file can be uploaded to the server for security detection. Among them, the original file may refer to the file before the target application is hot-updated. The patch file is security-checked using the server's detection capability. Since the server has stronger performance than the terminal device, it can effectively improve the efficiency and accuracy of application security detection, thereby improving security and performance as a whole.

[0030] In some embodiments, corresponding lists can be set for various applications in the terminal device. For example, a basic list and a key focus list can be set. Applications in the basic list are not subject to detection and restriction for each hot update. Applications in the key focus list are given priority detection during hot updates, and key security detection is maintained for a period of time after the hot update. Among them, the applications in the key focus list can be financial management applications, communication applications, payment applications, and other applications involving property safety and privacy security. Applications in the basic list can be applications that do not involve property safety and privacy security.

[0031] That is, in response to detecting that the target application is hot updated and the target application is on the focus list, the corresponding patch file and the original file are uploaded to the server for security detection. In response to detecting that the target application is hot updated and the target application is on the basic list, the target application continues to be hot updated until it is completed. By setting the basic list and the focus list, it supports terminal device users to configure themselves, improves the flexibility of the application hot update solution, and improves the pertinence of the hot update security detection mechanism for different categories of applications.

[0032] Step 12: Receive the security detection results fed back by the server and perform corresponding processing according to the security detection results.

[0033] In some embodiments, if the security detection result indicates that the application is a malicious application after the hot update, the hot update of the target application is intercepted.

[0034] In some embodiments, if the security detection result indicates that the application is a non-malicious application after the hot update, the application is hot updated.

[0035] In this embodiment, in response to detecting a hot update of the target application, the terminal device uploads the corresponding patch file and the original file to the server for security testing, receives the security testing results fed back by the server, and performs corresponding processing based on the security testing results. The server's stronger detection capabilities than the terminal device can be used to perform security testing on the patch file, effectively improving the efficiency and accuracy of application security testing, and improving security and performance as a whole.

[0036] See also Figure 2 , Figure 2 This is a flow chart of another embodiment of the processing method for application hot update provided by the present application. Applied to a terminal device, the method includes:

[0037] Step 21: In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server, so that the server performs static code detection on the patch file and / or simulates the hot update of the application using the patch file and the original file, and performs security detection on the simulated application after the hot update.

[0038] In some embodiments, after the server receives the patch file and the original file, the server may perform static code detection on the patch file to obtain a security detection result.

[0039] In some embodiments, after the server receives the patch file and the original file, the server can use the patch file and the original file to simulate a hot update of the application, and perform a security check on the simulated application after the hot update to obtain a security check result.

[0040] In some embodiments, after receiving the patch file and the original file, the server can perform static code detection on the patch file, simulate application hot update using the patch file and the original file, and perform security detection on the simulated application after the hot update. The static code detection result and the security detection result are combined to obtain the final security detection result.

[0041] Step 22: Receive the security detection result fed back by the server and perform corresponding processing according to the security detection result.

[0042] Step 22 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0043] In this embodiment, in response to detecting a hot update of the target application, the terminal device uploads the corresponding patch file and the original file to the server for security testing, receives the security testing results fed back by the server, and performs corresponding processing based on the security testing results. The server's stronger detection capabilities than the terminal device can be used to perform security testing on the patch file, effectively improving the efficiency and accuracy of application security testing, and improving security and performance as a whole.

[0044] See also Figure 3 , Figure 3 This is a flow chart of another embodiment of the processing method for application hot update provided by the present application. Applied to a terminal device, the method includes:

[0045] Step 31: In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server for security detection.

[0046] Step 31 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0047] Step 32: receiving the security detection result fed back by the server, and in response to the security detection result indicating that the application is a malicious application after the hot update, intercepting the hot update of the target application.

[0048] In some embodiments, after intercepting the hot update of the target application, the resource access scope of the target application is restricted, for example, the target application is restricted from accessing security data, user data, and sensitive resources related to finance, privacy, etc. in the terminal device.

[0049] In some embodiments, after intercepting the hot update of the target application, a reminder is given to uninstall the target application. Because it is detected that the application is a malicious application after the hot update, although the hot update is intercepted, it is not possible to avoid the subsequent interception failure and complete the hot update of the application. In this case, the terminal device can remind the user to uninstall the target application. Or the user is reminded that the target application has security risks, so that the user can change the terminal device's detection strategy for the target application and improve the security detection of the target application.

[0050] In some embodiments, after intercepting the current hot update of the target application, the resource access scope of the target application is restricted and a reminder is given to uninstall the target application. Although the application is detected as a malicious application after the hot update, it cannot be avoided that the application was a malicious application before the hot update (e.g., it has become a malicious application before, but has not been detected). Therefore, after intercepting the current hot update of the target application, the resource access scope of the target application is restricted and a reminder is given to uninstall the target application.

[0051] Step 33: receiving the security detection result fed back by the server, and in response to the security detection result indicating that the application is a non-malicious application after the hot update, allowing the hot update of the target application.

[0052] In some embodiments, after allowing the current hot update of the target application, security software may be used to perform security detection on the hot-updated application again after the hot update of the application to improve the accuracy of the security detection.

[0053] In this embodiment, in response to detecting a hot update of the target application, the terminal device uploads the corresponding patch file and the original file to the server for security testing, receives the security testing results fed back by the server, and performs corresponding processing based on the security testing results. The server's stronger detection capabilities than the terminal device can be used to perform security testing on the patch file, effectively improving the efficiency and accuracy of application security testing, and improving security and performance as a whole.

[0054] Furthermore, the application is processed accordingly according to the detection results to ensure the overall security of the terminal device.

[0055] See also Figure 4 , Figure 4 This is a flow chart of another embodiment of the processing method for application hot update provided by the present application. Applied to a terminal device, the method includes:

[0056] Step 41: In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server for security detection.

[0057] Step 42: In response to not receiving the security detection result within the first preset time, hot-update the target application using the patch file.

[0058] In this embodiment, considering the network delay problem, if the server has not fed back the security detection result for a long time, the target application can be hot-updated using the patch file first, and then step 43 is executed.

[0059] In some embodiments, if a security detection result is received from a server during a hot update of a target application using a patch file, if the security detection result indicates that the target application after the hot update is a malicious application, the hot update is stopped, the target application is uninstalled, and the patch file is deleted. The target application is downloaded again from the application store. If the security detection result indicates that the target application after the hot update is a non-malicious application, the hot update is continued.

[0060] Step 43: Perform security detection on the target application after the hot update, and process the target application after the hot update according to the security detection result.

[0061] In some embodiments, in response to the security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted and / or a reminder is given to uninstall the target application and a whole-device security detection is performed on the terminal device.

[0062] For example, in response to the security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted, such as restricting the target application from accessing security data, user data, and sensitive resources related to finance, privacy, etc. in the terminal device.

[0063] For example, in response to the security detection result indicating that the target application after hot update is a malicious application, a reminder to uninstall the target application and perform a whole-machine security detection on the terminal device is provided. Since it is detected that the application is a malicious application after hot update, the terminal device can remind the user to uninstall the target application. Furthermore, since the application has been hot updated at this time, the malicious code has problems that affect other applications or systems in the terminal device, so a whole-machine security detection is performed on the terminal device. And corresponding processing is performed according to the whole-machine security detection result. For example, if the whole-machine security detection result indicates that there are other applications that are malicious applications, the remaining applications are deleted, and the user is prompted to re-download the remaining deleted applications from the application store.

[0064] In some embodiments, in response to the security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted, a reminder to uninstall the target application is given, and a whole-device security detection is performed on the terminal device.

[0065] In some embodiments, in response to the security detection result indicating that the target application after the hot update is a non-malicious application, security monitoring of the target application is continuously performed within a second preset time.

[0066] Considering that malicious code is highly hidden, a single security check may not be able to detect it. Therefore, when the security check result indicates that the target application after the hot update is a non-malicious application, it is necessary to continuously monitor the security of the target application within the second preset time.

[0067] In some embodiments, if a security detection result is received from the server after the hot update, if the security detection result indicates that the target application after the hot update is a malicious application, the target application is uninstalled and the patch file is deleted, and the target application is downloaded again from the application store. If the security detection result indicates that the target application after the hot update is a non-malicious application, the security detection result of the terminal device is mainly used for subsequent operations.

[0068] In this embodiment, when it is impossible to obtain the security detection results from the server in a timely manner, after the application is hot updated, the application behavior is promptly restricted and the device-side security detection is performed on the application to avoid detection omissions when the network conditions are poor, thereby improving the security of the terminal device.

[0069] In one application scenario, for applications that perform hot updates by merging or adding patch files, this application proposes that the terminal device adopt methods such as embedding points to implement functional support for the detection of application hot update behavior and timely interception of application hot update behavior.

[0070] The security software monitors the patch file changes of the application, and determines whether the application starts to perform the hot update based on the key initial behavior of the application hot update (for example, the creation of the patch file object, etc.).

[0071] The security software prompts the user on the terminal device that the application is about to be hot-updated. With the user's consent, the patch file downloaded by the application for this hot-update and the original file are uploaded to the cloud server for security detection. The security software determines whether to allow or block this application hot-update based on the detection results fed back by the cloud server.

[0072] If the cloud server reports a malicious detection result, the security software will restrict the application to a controlled operating mode, limit the application's access to sensitive system resources, and prompt the user to uninstall the software and perform a security check on the entire machine.

[0073] If the detection results are not yet obtained from the cloud server due to delays or other reasons, the security software allows the application of this hot update, immediately performs a security check on the terminal device after the hot update, and maintains key monitoring of the application for a certain period of time.

[0074] Furthermore, users can set up whitelist applications on terminal devices, and hot updates of applications in whitelist applications are not detected or restricted.

[0075] Specifically, terminal equipment manufacturers adopt methods such as adding new functional modules and system interface embedding points to the systems in terminal equipment to implement system function support for the detection of application hot update behaviors and timely interception of application hot update behaviors.

[0076] The security software on the terminal device monitors the patch file changes of all applications on the terminal device, and determines whether the application starts to perform hot update based on the key behaviors performed in the initial stage of application hot update (such as the creation of patch file objects, etc.).

[0077] If a hot update of an application (denoted as APP1) is detected, the security software will prompt the user through the terminal device display that APP1 is about to be hot updated.

[0078] The security software asks the user whether to allow the security software to perform security checks on the application being hot-updated.

[0079] If the user does not allow it, APP1 will be hot-updated normally, and the security software will maintain key security monitoring of APP1 within a certain period of time.

[0080] If the user allows, the security software uploads the patch file downloaded by APP1 for this hot update and the original file to the cloud server.

[0081] The cloud server performs security checks on the patch file and the original file, such as static code detection on the patch file, simulated hot update of APP1, and dynamic detection of the entire APP1 after the hot update.

[0082] The cloud server feeds back the security detection result, i.e., whether APP1 is a malicious application after the hot update, to the security software of the terminal device.

[0083] If APP1 turns out to be a malicious application after hot updating, the security software will intercept the hot updating behavior of APP1 and restrict APP1's subsequent access to sensitive system resources, while prompting the user to uninstall APP1.

[0084] If APP1 is not a malicious application after the hot update, the security software will not take any other action and will allow APP1 to perform the hot update.

[0085] Furthermore, if the security detection results fed back by the cloud server cannot be obtained in time due to delays or other reasons, the security software allows APP1 to perform this hot update.

[0086] After APP1 is hot-updated, the security software immediately performs a security check on APP1 on the device. Before the check is completed, the security software temporarily restricts APP1 to a controlled operation mode, prohibiting APP1 from accessing sensitive system resources.

[0087] If the security software detects that APP1 becomes a malicious application after a hot update, the security software will restrict APP1 to a controlled operation mode, prohibit APP1 from accessing sensitive system resources, and prompt the user to uninstall the software and perform a security check on the entire device.

[0088] If the security software does not detect that APP1 becomes a malicious application after the hot update, the security software will maintain key security monitoring of APP1 for a certain period of time.

[0089] Furthermore, users can set up a whitelist of applications for hot updates and a focus list. Each hot update of applications in the whitelist is not subject to detection and restriction; applications in the focus list are given priority detection during hot updates, and they are subject to focus security detection for a period of time after the hot update.

[0090] See also Figure 5 The terminal device 50 includes a processor 51, a memory 52 and a communication module 53 coupled to the processor 51, and the communication module 53 is used to communicate with the server;

[0091] The memory is used to store the computer program, and the processor is used to execute the computer program to implement the following method:

[0092] In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server for security detection; the security detection result fed back by the server is received, and corresponding processing is performed according to the security detection result.

[0093] It can be understood that the processor 51 is used to execute a computer program to implement the method of any of the above embodiments.

[0094] See also Figure 6 , Figure 6 1 is a schematic diagram of the structure of another embodiment of the electronic device provided by the present application. The electronic device 110 may be, for example, the terminal device 50 mentioned above. The electronic device 110 may include: a memory 112, a processor (Central Processing Unit, CPU) 111, a circuit board (not shown in the figure), a power circuit and a microphone 123. The circuit board is placed inside the space surrounded by the shell; the processor 111 and the memory 112 are arranged on the circuit board; the power circuit is used to supply power to various circuits or devices of the electronic device; the memory 112 is used to store executable program code; the processor 111 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 112, so as to implement the method of any of the above embodiments.

[0095] The electronic device may also include: a peripheral interface 114, an RF (Radio Frequency) circuit 116, an audio circuit 117, a speaker 122, a power management chip 119, an input / output (I / O) subsystem 120, other input / control devices 121, a display 113 and an external port 115. These components communicate through one or more communication buses or signal lines 118.

[0096] The memory 112 can be accessed by the processor 111, the peripheral interface 114, etc. The memory 112 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more disk storage devices, flash memory devices, or other volatile solid-state storage devices. The peripheral interface 114 can connect the input and output peripherals of the device to the processor 111 and the memory 112.

[0097] The I / O subsystem 120 can connect the input and output peripherals on the device, such as the display 113 and other input / control devices 121, to the peripheral interface 114. The I / O subsystem 120 may include a display controller 1201 and one or more input controllers 1202 for controlling other input / control devices 121. Among them, the one or more input controllers 1202 receive electrical signals from other input / control devices 121 or send electrical signals to other input / control devices 121. Other input / control devices 121 may include physical buttons (press buttons, rocker buttons, etc.), dials, slide switches, joysticks, and click wheels. It is worth noting that the input controller 1202 can be connected to any of the following: a keyboard, an infrared port, a USB interface, and a pointing device such as a mouse.

[0098] The display 113 is an input interface and an output interface between the user electronic device and the user, and displays visual output to the user. The visual output may include graphics, text, icons, videos, etc.

[0099] The display controller 1201 in the I / O subsystem 120 receives an electrical signal from the display 113 or sends an electrical signal to the display 113. The display 113 detects contact on the touch screen, and the display controller 1201 converts the detected contact into interaction with a user interface object displayed on the display 113, that is, realizes human-computer interaction. The user interface object displayed on the display 113 may be an icon for running a game, an icon for connecting to a corresponding network, etc.

[0100] The RF circuit 116 is mainly used to establish communication between the mobile phone and the wireless network (i.e., the network side) to realize data reception and transmission between the mobile phone and the wireless network. For example, sending and receiving short messages, emails, etc. Specifically, the RF circuit 116 receives and sends RF signals, which are also called electromagnetic signals. The RF circuit 116 converts electrical signals into electromagnetic signals or converts electromagnetic signals into electrical signals, and communicates with the communication network and other devices through the electromagnetic signals. The RF circuit 116 may include known circuits for performing these functions, including but not limited to antenna systems, RF transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, CODEC (COder-DECoder, codec) chipsets, Subscriber Identity Module (SIM), etc.

[0101] The audio circuit 117 is mainly used to receive audio data from the peripheral interface 114, convert the audio data into an electrical signal, and send the electrical signal to the speaker 122. The speaker 122 is used to restore the voice signal received by the mobile phone from the wireless network through the RF circuit 116 to sound and play the sound to the user. The power management chip 119 is used to provide power supply and power management for the processor 111, the I / O subsystem 120 and the hardware connected to the peripheral interface 114.

[0102] The electronic device 110 mentioned above may be a mobile terminal, such as a smart phone, a tablet or other mobile device, or a terminal device, such as a personal computer, or a corresponding server, such as a log server.

[0103] See also Figure 7 , Figure 7 1 is a schematic diagram of a computer readable storage medium according to an embodiment of the present application. The computer readable storage medium 150 stores a computer program 151. When the computer program 151 is executed by a processor, the following method is implemented:

[0104] In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server for security detection; the security detection result fed back by the server is received, and corresponding processing is performed according to the security detection result.

[0105] It can be understood that when the computer program 151 is executed by a processor, it can also implement the method of any of the above embodiments.

[0106] To summarize, the present application provides a method for processing application hot updates, a terminal device, and a readable storage medium. In response to detecting a hot update of a target application, the terminal device uploads the corresponding patch file and the original file to a server for security detection, receives the security detection results fed back by the server, and performs corresponding processing based on the security detection results. The server can utilize its stronger detection capabilities than the terminal device to perform security detection on the patch file, thereby effectively improving the efficiency and accuracy of application security detection and improving security and performance as a whole.

[0107] Furthermore, the present application can prompt users when an application hot update occurs, solicit user consent for detecting application hot updates, and provide users with feedback on application hot update monitoring results, thereby enhancing users' awareness of application hot updates, improving users' understanding of application hot update status, and improving the security of the solution.

[0108] Furthermore, with the user's consent, this application uploads the code files involved in the hot update of the application to the cloud server for detection, which can effectively utilize the cloud's stronger security detection capabilities than the device side, effectively improve the efficiency and accuracy of application security detection, and improve the security and performance of the solution.

[0109] Furthermore, when it is impossible to obtain security test results from the cloud server in a timely manner, the present application can promptly restrict application behavior and perform device-side security tests on the application after the application is hot updated, thereby avoiding missed tests when the network conditions are poor, and improving the security of the solution.

[0110] Furthermore, the present application adds an application hot update whitelist, supports user self-configuration, improves the flexibility of the solution, and allows users to help improve the pertinence of the hot update security detection mechanism for different categories of applications.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only illustrative, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0112] If the integrated units in the above other embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program codes.

[0113] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for processing application hot update, characterized in that: Applied to a terminal device, the method comprises: In response to detecting a hot update of the target application, uploading the corresponding patch file and the original file to the server for security detection; Receive the security detection result fed back by the server, and perform corresponding processing according to the security detection result.

2. The method according to claim 1, characterized in that In response to detecting a hot update of a target application, uploading the corresponding patch file and the original file to a server for security detection includes: In response to detecting a hot update of the target application, the corresponding patch file and the original file are uploaded to the server, so that the server performs static code detection on the patch file and / or simulates the hot update of the application using the patch file and the original file, and performs security detection on the simulated application after the hot update.

3. The method according to claim 1, characterized in that The performing corresponding processing according to the security detection result includes: In response to the security detection result indicating that the application is a malicious application after the hot update, the hot update of the target application is intercepted.

4. The method according to claim 3, characterized in that After intercepting the hot update of the target application, the method includes: Limit the resource access scope of the target application and / or remind the user to uninstall the target application.

5. The method according to claim 3, characterized in that: The method further comprises: In response to not receiving the security detection result within a first preset time, hot updating the target application using the patch file; Perform a security check on the target application after the hot update, and process the target application after the hot update according to the security check result.

6. The method according to claim 5, characterized in that The processing of the target application after the hot update according to the security detection result includes: In response to the security detection result indicating that the target application after the hot update is a malicious application, the resource access scope of the target application is restricted and / or a reminder is given to uninstall the target application and a whole-device security detection is performed on the terminal device.

7. The method according to claim 5, characterized in that The processing of the target application after the hot update according to the security detection result includes: In response to the security detection result indicating that the target application after the hot update is a non-malicious application, security monitoring of the target application is continuously performed within a second preset time.

8. The method according to claim 1, characterized in that In response to detecting a hot update of a target application, uploading the corresponding patch file and the original file to a server for security detection includes: In response to detecting that a target application is hot updated and the target application is in a key focus list, the corresponding patch file and the original file are uploaded to a server for security detection.

9. A terminal device, characterized in that: The terminal device includes a processor, a memory and a communication module coupled to the processor, and the communication module is used to communicate with the server; The memory is used to store a computer program, and the processor is used to execute the computer program to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 8.

Images