Security protection method and device for application program, equipment and storage medium

Abstract

The invention discloses a security protection method and device for an application program, equipment and a storage medium, and belongs to the technical field of network security. The method comprises the following steps: creating a virtualization operation instance corresponding to a first application program; loading the first security component, and loading the second security component; monitoring at least one operation behavior executed for the first application program in the user space through the first security component to obtain first behavior sequence information; monitoring at least one operation behavior executed for the first application program in the kernel space through the second security component to obtain second behavior sequence information, and sending the second behavior sequence information to the first security component; and determining whether an abnormal operation behavior aiming at the first application program exists or not through the first security component according to the first behavior sequence information and the second behavior sequence information. According to the method, the first security component can effectively identify the abnormal operation behavior by comprehensively analyzing the first behavior sequence information and the second behavior sequence information, so that the security protection of the application program is realized.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security protection method, device, equipment and storage medium for an application. Background Art

[0002] Mobile applications, such as Android applications, can run in the Android user space of the Android real machine environment. Android protection mainly focuses on Android user space protection. PC (Personal Computer) applications run in the PC user space of the PC real machine environment. PC protection mainly focuses on PC kernel space protection.

[0003] Android applications can run on an Android virtualization environment in a PC user space, and the Android virtualization environment can include an Android user space and an Android kernel space, wherein Android protection can protect the Android user space in the Android virtualization environment.

[0004] With the above method, Android protection cannot perceive abnormal operation behaviors from PC user space, such as abnormal debugging behaviors, which threatens the security of Android applications. Summary of the invention

[0005] The embodiment of the present application provides a method, device, equipment and storage medium for protecting the security of an application. The technical solution provided by the embodiment of the present application is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for protecting the security of an application is provided, the method comprising:

[0007] In the user space of the first device, create a virtualized running instance corresponding to the first application, the virtualized running instance is used to provide a virtualized running environment for the first application, the virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space;

[0008] Loading a first security component in a user space of the first device, and loading a second security component in a kernel space of the first device, wherein the first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, and a communication connection is established between the first security component and the second security component;

[0009] During the running of the first application in the virtual user space, the first security component monitors at least one operation behavior executed for the first application in the user space of the first device to obtain first behavior sequence information; and the second security component monitors at least one operation behavior executed for the first application in the kernel space of the first device to obtain second behavior sequence information, and sends the second behavior sequence information to the first security component;

[0010] The first security component determines whether there is any abnormal operation behavior for the first application according to the first behavior sequence information and the second behavior sequence information.

[0011] According to one aspect of an embodiment of the present application, a security protection device for an application is provided, the device comprising:

[0012] A creation module, configured to create a virtualized running instance corresponding to a first application in a user space of a first device, wherein the virtualized running instance is used to provide a virtualized running environment for the first application, wherein the virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space;

[0013] a loading module, used to load a first security component in a user space of the first device, and to load a second security component in a kernel space of the first device, wherein the first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, and a communication connection is established between the first security component and the second security component;

[0014] a first monitoring module, configured to monitor, during the process of the first application being run in the virtual user space, at least one operation behavior executed on the first application in the user space of the first device through the first security component, to obtain first behavior sequence information; and to monitor, through the second security component, at least one operation behavior executed on the first application in the kernel space of the first device, to obtain second behavior sequence information, and to send the second behavior sequence information to the first security component;

[0015] A determination module is used to determine whether there is any abnormal operation behavior for the first application program according to the first behavior sequence information and the second behavior sequence information through the first security component.

[0016] According to one aspect of an embodiment of the present application, a computer device is provided, comprising a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the security protection method for the above-mentioned application program.

[0017] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the security protection method for the above-mentioned application program.

[0018] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes a computer program stored in a computer-readable storage medium, and a processor reads and executes the computer program from the computer-readable storage medium to implement the security protection method for the above-mentioned application.

[0019] The technical solution provided by the embodiments of the present application includes at least the following beneficial effects:

[0020] For the scenario where the application is running in a virtualized operating environment, by loading the first security component and the second security component in the first device, and the first security component and the second security component can monitor the user operation behavior executed on the first application in the user space and kernel space of the first device respectively, so as to obtain the first behavior sequence information and the second behavior sequence information respectively. The first and second behavior sequence information fully and comprehensively reflect the specific operation behavior of the user at the user level and the kernel level. Then, the first security component can effectively identify abnormal operation behavior by comprehensively analyzing the first and second behavior sequence information, thereby realizing security protection for the first application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of an implementation environment of a solution provided by an embodiment of the present application;

[0022] Figure 2 This is a flow chart of a security protection method for an application program provided by an embodiment of the present application;

[0023] Figure 3 is a flowchart of a virtualized running instance creation process provided by an embodiment of the present application;

[0024] Figure 4 It is a schematic diagram of security protection based on security components provided by an embodiment of the present application;

[0025] Figure 5 is a flow chart of a security protection method for an application program provided by another embodiment of the present application;

[0026] Figure 6 is a schematic diagram of starting verification for a first application provided by an embodiment of the present application;

[0027] Figure 7 This is a schematic diagram of sending abnormal information to a server provided by an embodiment of the present application;

[0028] Figure 8 is a flow chart of a security protection method for an application program provided by another embodiment of the present application;

[0029] Fig. 9 is a schematic diagram of security protection based on security components provided by another embodiment of the present application;

[0030] Fig.10 is a block diagram of a security protection device for an application provided by an embodiment of the present application;

[0031] Fig.11 It is a structural block diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0033] Please refer to Figure 1 , which shows a schematic diagram of a solution implementation environment provided by an embodiment of the present application. The solution implementation environment can be implemented as a computer system. The implementation environment can include: a terminal device 10 and a server 20.

[0034] The terminal device 10 can be a PC (Personal Computer), and the terminal device 10 can also be a mobile phone, an intelligent voice interaction device, a game console, a wearable device, a multimedia playback device, a PC (Personal Computer), a vehicle terminal, a smart home appliance, an AR (Augmented Reality) device, a VR (Virtual Reality) device, an MR (Mixed Reality) device and other electronic devices, which are not limited in this application.

[0035] The server 20 is used to store configuration information, which is used to indicate parameter configuration information related to creating a virtualized running instance on the terminal device 10. The terminal device 10 creates and runs the virtualized running instance based on the configuration information provided by the server 20. The virtualized running instance is used to provide a virtualized running environment for the first application.

[0036] In the embodiment of the present application, the first application may be any application that supports running on a virtualized running instance, including but not limited to any one of a game application, an office software application, a social media application, etc. The present application does not limit the type of the first application.

[0037] In some embodiments, the server 20 is also used to provide background services for the client of the first application in the terminal device 10. Exemplarily, the first application can be a game application. During the process of the game application running in the virtualized running instance created by the terminal device 10, the server 20 is used to provide background services for the game application, such as real-time battle matching, ranking list updates, game logic processing and other data services. For example, the server 20 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, but is not limited to this.

[0038] In some embodiments, the server for storing configuration information and the server for providing background services to the client of the first application may not be the same server, and this application does not limit this.

[0039] The terminal device 10 and the server 20 can communicate with each other via a network, which can be a wired network or a wireless network.

[0040] Please refer to Figure 2 , which shows a flow chart of a security protection method for an application provided by an embodiment of the present application. The execution subject of each step of the method may be a first device, and the first device may be a computer device, for example, the computer device may be Figure 1 The terminal device 10 in the embodiment. The method may include at least one of the following steps 210-240.

[0041] Step 210, in the user space of the first device, create a virtualized running instance corresponding to the first application, the virtualized running instance is used to provide a virtualized running environment for the first application, the virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space.

[0042] The user space of the first device refers to the area in the operating system used to run applications, and the operating system refers to the host operating system of the first device, that is, the operating system actually running on the hardware of the first device. The user space provides an isolated operating environment for the application to ensure that the application does not directly access or interfere with the core functions of the operating system. The kernel space of the first device refers to the area in the host operating system used to execute the core functions and services of the system. The kernel space contains the core components of the host operating system, such as process management, memory management, device drivers, file systems, and network protocol stacks. The kernel space runs at a higher privilege level, interacts directly with the hardware, and manages the resources of the system.

[0043] The virtualized running instance corresponding to the first application is an independent virtualized running environment created for the first application using virtualization technology. The virtualized running instance provides isolated resources and execution space for the first application, so that the first application can run independently therein without direct conflict with other applications or system resources.

[0044] Virtual user space refers to an independent virtual memory space created for the user process in each virtualized running instance, which is used to store process data, code, stack and other information. Virtual user space provides a safe and isolated running environment for the first application, ensuring that its data and operations are not affected by other virtualized running instances or the host operating system. The first application runs in the virtual user space, which feels like running on a real physical machine, but is actually in a virtualized environment.

[0045] The virtual kernel space refers to an independent virtual memory space created for the operating system kernel in each virtualized running instance, and the operating system refers to the client operating system. The virtual memory space is used to store kernel code, data structures, system call handlers and other kernel-related information. The virtual kernel interacts with virtual hardware to execute system calls, manage resources and process scheduling. The virtual kernel space ensures that the operating system kernel in the virtualized running instance can run in an isolated and secure environment. It can be understood that the present application creates a virtualized running instance on the host operating system of the first device, and runs the client operating system in the virtualized running instance. The host operating system and the client operating system may be the same or different, and the present application does not limit this. Exemplarily, the first device may be a PC, the host operating system may be a windows operating system, and the client operating system may be a mobile phone operating system (such as an Android operating system). Exemplarily, the first device may be a PC, the host operating system may be a windows operating system, and the client operating system may also be a windows operating system.

[0046] It is understandable that the virtual user space provides an isolated and secure operating environment for the first application, stores the code and data of the application, and interacts with the virtual kernel through the system call interface. The virtual kernel space is responsible for processing system call requests, managing the resources and hardware simulation of the virtual machine, and ensuring that the first application can perform its tasks in a stable and efficient operating environment. In some embodiments, the virtualization running instance includes a virtualization engine and a virtualization backend. Creating a virtualization running instance corresponding to the first application may include the following steps: creating a virtualization engine corresponding to the first application, the virtualization engine is used to schedule the hardware and software resources provided by the virtualization backend; creating a virtualization backend corresponding to the virtualization engine, the virtualization backend refers to the hardware and software resources that support the operation of the virtualization engine.

[0047] The virtualization engine, also known as a virtualization engine instance, is a software or component that manages and controls the creation, configuration, operation, and destruction of virtual machines, and provides functions such as virtual hardware simulation, virtual machine scheduling, and virtual resource allocation and management. It schedules the hardware and software resources provided by the virtualization backend to ensure that the virtual machine can perform its tasks correctly. The virtualization backend is the hardware and software resources that support the operation of the virtualization engine, and is responsible for processing the underlying hardware and operating system services to ensure that the virtualization engine can run efficiently and safely. Among them, hardware resources may include computing resources (CPU (Central Processing Unit, central processing unit)), memory resources, storage resources (hard disk / solid state drive), network resources (network interface card), and input and output devices (I / O (Input / Output, input / output) devices). Software resources may include operating system kernels, device drivers, virtualization management software, resource scheduling algorithms, security and management tools, etc.

[0048] like Figure 3 As shown, it shows a flowchart of a virtualized running instance creation process provided by an embodiment of the present application, which may include the following steps (S1-S5).

[0049] Step S1: The local client (ie, the first device) queries the server to obtain configuration information, where the configuration information is used to indicate parameter configuration information related to creating a virtualized running instance on the first device, such as virtual hardware configuration, resource allocation strategy, network settings, etc.

[0050] Step S2: According to the parsed configuration information, the engine management module creates a corresponding virtualization engine instance. A virtualization engine instance can represent a virtual mobile phone device.

[0051] Step S3: The virtualization engine instance creates the required virtualization backend. Exemplarily, the virtualization backend simulates the sub-device environments such as the network card, disk, audio and video, graphics card, CPU, etc. It is understandable that the virtualization backend provides the above-mentioned virtual mobile phone device with functions such as network transmission, audio and video playback, user input and output, etc.

[0052] Step S4: Start the virtualization engine instance.

[0053] Step S5: Create a virtual device. The created virtual device corresponds one-to-one to the sub-device simulated in step S3, and the virtual device is used to interact with the user and provide corresponding management and control functions. Exemplarily, the virtual device can be a virtual audio device, a virtual video device, a virtual graphics rendering device, and a virtual input and output device, etc. The created virtual device is used to display to the user, and the user can interact with the virtualized running instance through these virtual device management. For example, the user can perform audio management, video management, graphics rendering management, input and output management, etc. For example, the user can adjust the volume of the virtualized running instance through the management function of the virtual audio device (i.e., audio management). For example, the user can adjust the audio output volume of the virtual device through the volume control interface to ensure that the volume meets the user's needs. For example, the user can select the video source and adjust the video output settings through the management function of the virtual video device (i.e., video management). For example, the user can select different video input sources and adjust the video resolution, frame rate, and color settings to obtain the best viewing experience.

[0054] In the above method, the virtualization engine and the virtualization backend can dynamically allocate the required resources to the first application according to the specific requirements of the first application to ensure its smooth operation, thereby ensuring the normal operation of the first application.

[0055] Step 220, loading a first security component in the user space of the first device, and loading a second security component in the kernel space of the first device, the first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, and there is a communication connection between the first security component and the second security component.

[0056] The first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, which means that the security protection of the user space and kernel space of the first device is realized by combining the first security component and the second security component. In terms of specific division of labor, the second security component is responsible for implementing a large number of security detection strategies, and the first security component is the decision-making of these security detection strategies. Specifically, multiple monitoring points can be installed on the second security component, and the monitoring points are used to collect data information of different modules in the system in real time. Exemplarily, the monitoring points may include at least one of the following: memory monitoring points, network monitoring points, file monitoring points, process monitoring points, log monitoring points, and debugging behavior monitoring points. Among them, the memory monitoring point is used to collect data such as memory usage, memory leaks, illegal memory access, buffer overflow, etc. The network monitoring point is used to collect data such as network traffic, data packet content, communication mode, port activity, etc. The file monitoring point is used to collect operation data such as file creation, modification, deletion, access, and permission change. The process monitoring point is used to collect data such as process creation, termination, resource usage, execution path, parent process information, etc. The log monitoring point is used to collect system, application, and security log information, including event type, time, user, etc. Debugging behavior monitoring points are monitoring points set in the system to monitor and record the debugging operations performed by the debugger or tool on the program in real time. They can be used to collect data related to debugging operations, including but not limited to specific data of debugging behaviors such as breakpoint setting, memory reading and writing, register access, and single-step execution. With these data, the debugging behaviors in the system can be monitored and analyzed in detail, thereby identifying potential malware or attack behaviors.

[0057] In some embodiments, the first safety component can determine whether there is abnormal operation behavior based on the data information collected by the monitoring point of the second safety component and the decision method of the safety detection strategy. In some embodiments, the monitoring point and the decision method of the safety detection strategy can be a one-to-one correspondence. One monitoring point corresponds to a decision method of a safety detection strategy, and different monitoring points correspond to decision methods of different safety detection strategies.

[0058] Exemplarily, the second security component can send the data collected by the process monitoring point to the first security component, which may include data such as process creation, termination, resource usage, execution path, parent process information, etc. The first security component uses the decision-making method of the process security monitoring strategy to conduct a detailed analysis of the process data to determine whether there is abnormal operation behavior. For example, if a process frequently creates child processes and the execution path of the child process is abnormal, it may be malware or unauthorized process behavior.

[0059] The reason why the above method separates "implementation-decision-making" is, on the one hand, to take into account the convenience and efficiency of development. Specifically, the development of security components for the user space of the first device is relatively convenient, the development environment of the user space is more friendly, and the debugging tools and resources are more abundant. Complex decision logic can be developed and tested in the user space, avoiding the development difficulty brought about by directly integrating complex logic into the kernel space. The development of kernel space is more difficult, mainly because the debugging and maintenance costs of kernel code are high, and any code defects may cause the system to blue screen, which in turn causes the crash of the entire system. In contrast, code defects in user space software usually only cause the crash of a single software and will not affect the stability of the entire system.

[0060] On the other hand, the security of protection should be taken into consideration. Specifically, if you only rely on the first security component of the user space, it is easy to be deceived by malicious plug-ins by disguising as kernel modules. For example, the first security component of the user space needs to detect whether the memory address of a certain user space has been modified. The malicious plug-in can modify this address by disguising as a kernel module, and the first security component of the user space cannot perceive this abnormal operation behavior. The above method, by combining the first security component and the second security component, can form a multi-level protection mechanism between the kernel space and the user space. The second security component sets a monitoring point in the kernel space to collect key data in real time, and the first security component performs complex decision analysis in the user space based on the key data, thereby realizing the security protection of the kernel space and the user space of the first device.

[0061] Exemplarily, for the above example, assume that the user space of the first device needs to detect whether a certain memory address has been modified. Through the combination of the first security component and the second security component, the second security component sets a memory monitoring point in the kernel space, collects data on memory usage and modification operations in real time, and sends these data to the first security component. The first security component analyzes these data in the user space to determine whether there is abnormal operation behavior. Even if a malicious plug-in program attempts to modify the memory address by disguising itself as a kernel module, the second security component can still capture these operations because the kernel space lacks the corresponding permissions and operation records. These captured operation data will be identified and responded to by the first security component.

[0062] Step 230, during the running of the first application in the virtual user space, the first security component monitors at least one operation behavior performed on the first application in the user space of the first device to obtain first behavior sequence information; and the second security component monitors at least one operation behavior performed on the first application in the kernel space of the first device to obtain second behavior sequence information, and sends the second behavior sequence information to the first security component.

[0063] The at least one operation behavior performed on the first application refers to a specific operation or request performed by the user during the operation of the first application. The operation behavior may include file operation, process operation, network operation, permission operation, system call operation, debugging operation, etc. Among them, file operation refers to the user's operation of reading, writing, modifying, deleting, etc. on the files related to the first application. For example, the user opens a file in a document editor, edits the file content and saves the file. Process operation refers to the user's operation of creating, executing, terminating, etc. on the process related to the first application. For example, when the user creates a new task, the first application will create a new process, or the user terminates a running process. Network operation refers to the network request initiated by the user through the first application, including file upload and download, etc. For example, the user visits a website in a browser and sends data, or uses a file transfer tool to upload and download files. Permission operation refers to the user's request and use of the permissions of the first application, including permission application, permission granting and permission revocation, etc. For example, the application requests access to the user's camera and microphone permissions, and the user chooses to allow or deny. System call operation refers to the system-level operation initiated by the user through the first application, such as accessing devices, managing memory, executing kernel functions, etc. For example, an application requests to access a hardware device or call a system function. The debugging operation refers to the user using a debugging tool to analyze and obtain the running state, internal logic and data information of the first application.

[0064] It is understandable that operating behaviors may include normal operating behaviors and abnormal operating behaviors. Normal operating behaviors refer to behaviors performed by users in accordance with the expected operating procedures and specifications of the application, for example, users open files, edit texts, save files, etc. in a document editor. Exemplarily, normal operating behaviors include users browsing web pages, filling out forms, submitting requests, etc. in a browser. Abnormal operating behaviors refer to behaviors that deviate from normal operating behaviors and may pose a threat or interference to the system or application, for example, users attempt to access sensitive data without authorization, attempt to execute malicious code, delete important system files, etc. Exemplarily, abnormal operating behaviors include users attempting to bypass the authentication mechanism, use debugging tools for large-scale data capture, etc. The problem to be solved by the present application is to identify abnormal operating behaviors in operating behaviors to ensure the reliable and secure operation of the first application.

[0065] The first behavior sequence information refers to the specific data information collected by monitoring the operation behavior of the user space, and the second behavior sequence information refers to the specific data information collected by monitoring the operation behavior of the kernel space. By combining the first security component and the second security component, the security protection of the user space and the kernel space of the first device can be achieved. It can be understood that since the entire virtualization operating environment (including virtual user space and virtual kernel space) is running in the user space of the first device, the first behavior sequence information is obtained by monitoring the user operation behavior in the user space, and the second behavior sequence information is obtained by monitoring the user operation behavior in the kernel space. The first security component combines the first and second behavior sequence information to perform comprehensive analysis and anomaly detection to achieve security protection for the first application.

[0066] Step 240: Determine, by the first security component based on the first behavior sequence information and the second behavior sequence information, whether there is any abnormal operation behavior for the first application.

[0067] In some embodiments, when the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it is determined that there is abnormal operating behavior for the first application, wherein the abnormal behavior information refers to behavior information indicating that the operating behavior is an abnormal operating behavior.

[0068] In some embodiments, the first behavior sequence information may include data information corresponding to the debugging behavior in the user space collected by the first security component at the debugging behavior monitoring point. The second behavior sequence information may include data information corresponding to the debugging behavior in the kernel space collected by the second security component at the debugging behavior monitoring point. When the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal debugging behavior, it is determined that there is abnormal operation behavior for the first application.

[0069] Exemplarily, the data information corresponding to the above debugging behavior may include at least one of the following: breakpoint setting, memory reading and writing, register access, single-step execution, debugger command, process state change, exception handling, environment variables and parameters. Among them, the power-off setting records the breakpoint position set by the debugger in the program, as well as the context information when the breakpoint is triggered. Memory reading and writing is used to monitor the debugger's read and write operations on the target process memory, and record information such as memory address, read and write size, and data content. Register access is used to record the debugger's access operations on the target process register, including register name, access type (read / write), access value and other information. Single-step execution is used to monitor the debugger's single-step execution operations, record the program execution path, context information of each step, instructions involved, etc. Debugger commands are used to record debugging commands sent by the debugger, such as continuing execution, suspending execution, displaying call stack, etc. Process state change is used to monitor the state changes of the target process during the debugging process, such as suspending, resuming, terminating, etc. Exception handling is used to record the debugger's processing information on target process exceptions, such as exception type, exception address, processing result, etc. The environment variables and parameters are used to record the environment variables set by the debugger and the parameters passed to the target process. Exemplarily, the abnormal debugging behavior may include frequent single-step execution of a virtual process on a critical code path, and these behavior patterns are inconsistent with normal debugging behavior.

[0070] In the above method, the first security component can perform comprehensive analysis and anomaly detection by combining the first and second behavior sequence information, identify abnormal operation behavior, and thus achieve security protection for the first application. Specifically, by monitoring the debugging behavior in the user space and kernel space of the first device respectively, the first behavior sequence information and the second behavior sequence information can be obtained. The first security component performs comprehensive analysis and anomaly detection by combining these two behavior sequence information, identifies abnormal debugging behavior, and thus achieves security protection for the first application.

[0071] In summary, the technical solution provided by the embodiment of the present application is aimed at the scenario where the application runs in a virtualized operating environment. By loading the first security component and the second security component in the first device, and the first security component and the second security component can respectively monitor the user operation behavior executed on the first application in the user space and the kernel space of the first device, so as to obtain the first behavior sequence information and the second behavior sequence information respectively. The first and second behavior sequence information fully and comprehensively reflect the specific operation behavior of the user at the user level and the kernel level. Then, the first security component can effectively identify abnormal operation behavior by comprehensively analyzing the first and second behavior sequence information, thereby realizing security protection for the first application.

[0072] The following describes a specific implementation method for performing security protection on a first application program when a virtualized running instance includes multiple security levels.

[0073] In some embodiments, the virtualized running instance includes multiple security levels. When the virtualized running instance corresponds to different security levels, the first security component and the second security component can monitor different types of user operation behaviors. It is understandable that when the virtualized running instance corresponds to a low security level, it means that the security protection strength for the first application is low, then the first security component and the second security component can only detect and protect basic user operation behaviors, wherein the basic user operation behavior may include debugging behavior, then the first and second security components monitor the debugging behavior to perform anti-debugging protection, and anti-debugging protection refers to protection against debugging behavior.

[0074] When the virtualized running instance corresponds to a high security level, it means that the security protection strength for the first application is high. In addition to monitoring and protecting the above-mentioned basic user operation behaviors, the first security component and the second security component can also monitor and protect advanced user operation behaviors. These advanced operation behaviors may include at least one of the following operation behaviors for the first application: memory operation, file operation, and process operation. The first and second security components monitor memory operations, file operations, and process operations to perform memory protection, file protection, and process protection. Among them, memory operations refer to operations performed on the memory area of ​​the first application, including memory reading, writing, allocation, release, and copying. Memory protection refers to monitoring and protecting these memory operations to prevent malicious code injection, memory leakage, buffer overflow, and other attack behaviors, thereby ensuring the integrity and security of the memory area of ​​the first application. File operations refer to operations performed on files related to the first application, including file reading, writing, creation, deletion, and permission modification. File protection refers to monitoring and protecting these file operations to prevent files from being illegally accessed, tampered with, and deleted, thereby ensuring the integrity and security of the files of the first application. Process operation refers to the operation behavior performed on the process related to the first application, including process startup, termination, suspension, recovery, resource allocation, etc. Process protection refers to monitoring and protecting these process operations to prevent abnormal process startup or termination, thereby ensuring the integrity and security of the process operating environment of the first application. The above-mentioned security protection types corresponding to different security levels are only exemplary and are not limited in this application.

[0075] In some embodiments, the security level corresponding to the virtualized running instance includes a first security level and a second security level. The virtualized running instance of the first security level is used to monitor the external behavior sequence information of the first application, and the virtualized running instance of the second security level is used to monitor the internal behavior sequence information of the first application, wherein the external behavior sequence information is used to indicate the operation behavior on the external data of the first application, and the internal behavior sequence information is used to indicate the operation behavior on the internal data of the first application.

[0076] It is understandable that the above-mentioned low security level corresponds to the first security level, and the high security level corresponds to the second security level. When the security level corresponding to the virtualized running instance is the first security level (i.e., the low security level), since the low security level can only monitor the operations on the external data of the first application, that is, it is impossible to obtain the memory operations, file operations, process operations and other behaviors for the first application, the first and second security components can only perform basic protection, such as anti-debugging protection, but cannot provide comprehensive memory protection, file protection and process protection. When the security level corresponding to the virtualized running instance is the second security level (i.e., the high security level), since it is necessary to obtain the internal data of the first application in the virtualized running environment, on the one hand, it is necessary to load the third security component in the first application, that is, when the security level corresponding to the virtualized running instance is the second security level, the step of monitoring at least one operation behavior executed on the first application in the virtual user space and the virtual kernel space through the third security component to obtain the third behavior sequence information is performed. On the other hand, if more reliable security protection is required for the first application, it is also necessary to establish a communication connection between the first security component and the third security component. For details, please see below.

[0077] In some embodiments, Figure 4 As shown, a third security component is loaded in the first application; the third security component monitors at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space to obtain third behavior sequence information; the third security component determines whether there is an abnormal operation behavior for the first application based on the third behavior sequence information.

[0078] The third behavior sequence information refers to the specific data information obtained by the third security component in the virtual user space and the virtual kernel space by monitoring at least one operation behavior executed on the first application. Exemplarily, the operation behavior in the virtual user space may include at least one of the following: file operation, network communication, system call, memory operation, process management. Among them, file operation refers to operations such as creation, reading, writing, and deletion of files. Network communication refers to operations such as establishment of network connection, sending and receiving of data. System call refers to system call record in user space, including information such as call type, parameters, and return value. Memory operation refers to operations such as allocation, release, reading and writing of memory. Process management refers to operations such as creation, destruction, and scheduling of processes. Exemplarily, the operation behavior in the virtual kernel space may include at least one of the following: kernel function call, interrupt handling, memory management, process management, device driver operation, and exception handling. Among them, kernel function call refers to function call record in kernel space, including information such as call type, parameters, and return value. Interrupt handling refers to the triggering and processing record of interrupts. Memory management refers to operations such as allocation, release, reading and writing of kernel memory. Process management refers to operations such as process creation, destruction, and scheduling in the kernel space. Device driver operations refer to the call records of device driver programs. Exception handling refers to exception handling records in the kernel space. The third security component can obtain the third behavior sequence information by monitoring the above operation behaviors and recording the specific data information of these operations.

[0079] In some embodiments, the third security component can implement a variety of security protections for the first application based on the different monitored operating behaviors. Exemplarily, the third security component can monitor and protect the above-mentioned basic user operations and advanced user operating behaviors to perform one of the following security protections: memory protection, file protection, process protection, and anti-debugging protection. Exemplarily, the third security component can monitor memory reading, writing, allocation, release and other operations for the first application. When malicious code injection, memory leakage and buffer overflow and other attack behaviors are detected, it is determined that abnormal operating behaviors exist. Exemplarily, the third security component can monitor process startup, termination, suspension, and recovery operations. When an abnormal process startup or termination is detected, it is determined that abnormal operating behaviors exist.

[0080] In some embodiments, first characteristic information of a virtualized operating instance is stored in a first device, and the first characteristic information is used to determine the type of the virtualized operating environment. Second characteristic information corresponding to the virtualized operating instance at a first time is obtained through a third security component, where the first time refers to any time during the operation of the first application, and the second characteristic information is used to indicate the type of the virtualized operating environment corresponding to the first time. The third security component determines whether there is abnormal operation behavior against the virtualized operating environment based on the first characteristic information and the second characteristic information.

[0081] It is understandable that the virtualized running instance has a one-to-one correspondence with the first characteristic information corresponding to it, that is, one virtualized running instance corresponds to one first characteristic information, and different virtualized running instances may correspond to different first characteristic information. During the running of the first application, if the first characteristic information of the virtualized running instance changes, it indicates that there is an abnormal operation behavior, and these abnormal operation behaviors will make unauthorized changes to the characteristic information of the virtualized running environment. Such changes may threaten the safe operation of the first application.

[0082] In some embodiments, the first feature information may include at least one of the following: file information, process information, and system attribute information. Among them, the file information is used to indicate a specific file included in the virtualized running instance, such as a file name. The process information is used to indicate a specific process included in the virtualized running instance, such as a unique identifier of the process, a specific name of the process, a process priority, a scheduling priority of the process, a process status, etc. The system attribute information may include an operating system version (such as an operating system version running the virtualized running instance, such as Android), a device model simulated by the virtualized running instance, a screen resolution (the screen resolution of the device simulated by the virtualized running instance), etc. This application does not limit the specific content included in the first feature information.

[0083] In some embodiments, the first characteristic information and the second characteristic information are compared by a third security component. If the second characteristic information is consistent with the first characteristic information, it is determined that there is no abnormal operation behavior for the virtualized operating environment; if the second characteristic information is inconsistent with the first characteristic information, it is determined that there is abnormal operation behavior for the virtualized operating environment. Exemplarily, the third security component obtains the second characteristic information, and when the file information in the second characteristic information changes compared to the first characteristic information, for example, when a new file appears in the second characteristic information, it is determined that there is abnormal operation behavior for the virtualized operating environment. Exemplarily, when there is process creation or destruction in the second characteristic information, it means that a new process has been started or certain processes have been terminated in the virtualized environment, and it is determined that there is abnormal operation behavior for the virtualized operating environment.

[0084] In the above method, by comparing the first characteristic information and the second characteristic information through the third security component, changes in the virtualized operating environment can be identified in a timely manner during the operation of the first application, which is beneficial to improving system security.

[0085] In some embodiments, the third security component only collects the internal data of the virtualized operating environment to identify abnormal operation behaviors. This method has a potential defect. Assuming that the plug-in program disguises itself as the kernel space of the first device and performs abnormal operations on the internal data of the virtualized operating environment, the third security component cannot identify these abnormal operations due to the lack of data information of the kernel space and user space of the first device. In this case, the embodiment of the present application provides a comprehensive solution combining the first, second, and third security components. Specifically, if Figure 4 As shown, there is a communication connection between the third security component and the first security component, and the third behavior sequence information is sent to the first security component through the third security component; the first security component determines whether there is any abnormal operation behavior for the first application based on the third behavior sequence information and the second behavior sequence information.

[0086] In this case, the first, second, and third security components simultaneously enable security protection corresponding to the second security level, such as memory protection, file protection, process protection, anti-debugging protection, etc. Exemplarily, for memory protection, the third security component can monitor the memory operation behavior for the first application. For example, the third security component can monitor the memory read and write operations in real time to detect whether there are abnormal memory access modes (such as out-of-bounds access, illegal writes, etc.). At the same time, the first and second security components also perform similar monitoring operations on the memory monitoring points. For example, the first and second security components can set monitoring points in a specific memory address area to monitor the memory operations in the area in real time to ensure that there is no unauthorized access or tampering. In addition, the third security component monitors the memory operations of the first application and generates third behavior sequence information. The third behavior sequence information may include operation type (such as read, write), operation object (such as memory address), operation time, etc. Similarly, the second security component monitors the memory operations of the kernel space of the first device and generates second behavior sequence information. The first security component monitors the memory operations of the user space of the first device and generates first behavior sequence information.

[0087] The second security component then sends the monitored second behavior sequence information to the first security component, and the third security component sends the monitored third behavior sequence information to the first security component. The first security component integrates the first, second, and third behavior sequence information together to perform anomaly detection, such as by comparing predefined normal behavior patterns or using machine learning models to detect whether there is abnormal behavior. For example, detect whether there are continuous illegal memory write operations, or whether there are abnormally frequent memory read operations. Finally, based on the analysis results, a detailed memory operation behavior report is generated, including which operations are normal, which operations are abnormal, and the specific details of the abnormal operations (such as operation time, operation user, operation object, etc.).

[0088] In the above method, since the virtualized operating environment is an independent and isolated virtual environment, the third security component can send the internal data in the virtualized operating environment to the first security component, so that the first security component can comprehensively utilize the third behavior sequence information and the first and second behavior sequence information previously obtained, thereby achieving more comprehensive and in-depth security protection for the first application.

[0089] Please refer to Figure 5 , which shows a flow chart of a security protection method for an application provided by another embodiment of the present application. The execution subject of each step of the method may be a first device, and the first device may be a computer device, for example, the computer device may be Figure 1 The terminal device 10 in the embodiment may include the following steps (S1-S4).

[0090] Step S1: Determine whether to enable security system management, which is used to provide security protection for a first application.

[0091] Step S2: When the security system management is turned on, the security level corresponding to the first and second security components is determined according to the requirements. Exemplarily, when the security level corresponding to the first and second security components is the second security level, the first and second security components turn on memory protection, file protection, process protection, and anti-debugging protection. And perform the following steps S3 to S4. Exemplarily, when the security level corresponding to the first and second security components is the first security level, the first and second security components turn on anti-debugging protection, and the following steps S3 to S4 are not performed.

[0092] Step S3: Establishing a secure communication component, that is, loading a third secure component, and establishing a communication connection between the third secure component and the first secure component and / or establishing a communication connection between the third secure component and the second secure component.

[0093] Step S4: The third security component may also monitor the virtualized operating environment according to the first characteristic information to determine whether there is any abnormality in the virtualized operating environment.

[0094] In some embodiments, Figure 4 As shown, there is also a communication connection between the third security component and the second security component; the third behavior sequence information is sent to the second security component through the third security component; the third behavior sequence information is forwarded to the first security component through the second security component; and the first security component determines whether there is any abnormal operation behavior for the first application based on the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component.

[0095] In some embodiments, the first security component compares the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component. When the third behavior sequence information received from the third security component is consistent with the content included in the third behavior sequence information received from the second security component, it is determined that there is no abnormal operation behavior against the first application; when the third behavior sequence information received from the third security component is inconsistent with the content included in the third behavior sequence information received from the second security component, it means that the third behavior sequence information has been tampered with, and it is determined that there is abnormal operation behavior against the first application.

[0096] In some embodiments, the third security component sends the third behavior sequence information to the second security component and the first security component at the same time. When the first security component does not receive the third behavior sequence information, it may be because the third behavior sequence information is intercepted by the plug-in program. At this time, it is determined that abnormal operation behavior exists.

[0097] In some embodiments, the third security component may also send the third behavior sequence information to the second security component. When the third behavior sequence information sent by the third security component to the first security component is intercepted or not successfully received, the second security component may forward the third behavior sequence information to the first security component to ensure the delivery of the third behavior sequence information.

[0098] In the above method, on the one hand, through the forwarding function of the second security component, the entire system has higher reliability and redundancy in information transmission. Even if the direct transmission of the third security component fails in some cases, the first security component can still obtain the third behavior sequence information through the second security component. This multi-path information transmission mechanism not only improves the overall stability of the system, but also ensures safe operation in various complex environments. On the other hand, by comparing the third behavior sequence information received by the first security component and the second security component, the integrity and authenticity of the information can be ensured to prevent the information from being tampered with or lost during transmission.

[0099] In some embodiments, in response to a startup instruction for a first application, the security level corresponding to the first application is compared with the security level corresponding to the virtualized running instance; if the security level corresponding to the first application and the security level corresponding to the virtualized running instance match, the first application is started; if the security level corresponding to the first application and the security level corresponding to the virtualized running instance do not match, the first application is not started.

[0100] The startup instruction for the first application refers to various operations or requests that trigger the system to start the first application. For example, the user can directly send a request to start the first application to the system through a graphical user interface, such as clicking the first application icon or entering a startup command in a command line interface.

[0101] In some embodiments, the security level may include the above-mentioned first security level (which may be a low security level) and the second security level (which may be a high security level). When the security level of the first application is lower than or equal to the virtualized running instance, it is determined that the security level corresponding to the first application matches the security level corresponding to the virtualized running instance. When the security level of the first application is higher than the virtualized running instance, it is determined that the security level corresponding to the first application does not match the security level corresponding to the virtualized running instance. Exemplarily, the low security level can be recorded as V1 and the high security level as V2. When the security level corresponding to the first application is V1 or V2, and the security level corresponding to the virtualized running instance is V2, the two match. When the security level corresponding to the first application is V1, and the security level corresponding to the virtualized running instance is V1, the two match. When the security level corresponding to the first application is V1, and the security level corresponding to the virtualized running instance is V1, the two match. When the security level corresponding to the first application is V1, and the security level corresponding to the virtualized running instance is V2, the two do not match.

[0102] In the above method, by comparing the security level of the first application and the virtualized running instance, the system can effectively control the startup process of the first application and ensure that it runs in an environment that matches its security level. This mechanism not only improves the overall security of the system, but also ensures that appropriate and corresponding security protection can be provided to the first application according to its security protection requirements.

[0103] Please refer to Figure 6 , which shows a schematic diagram of a startup verification for a first application provided by an embodiment of the present application. The following steps may be included: (1) When the first application (Application, APP) is to be started in the virtual user space, the third security component sends startup information to the first security component, and the startup information is used to indicate the security level corresponding to the first application.

[0104] (2) The first security component queries the configuration information stored on the server, where the configuration information is used to indicate the security level corresponding to the virtualized running instance of the first device.

[0105] (3) The first security component performs a startup check on the first application according to the security level corresponding to the virtualized running instance and the security level corresponding to the first application. If the first application passes the startup check, the first application is started; if the first application fails the startup check, the first application is not started.

[0106] In some embodiments, when any one of the first safety component, the second safety component, and the third safety component determines that an abnormal operation behavior exists, abnormal information corresponding to the abnormal operation behavior is sent to other safety components.

[0107] In some embodiments, any one of the first security component, the second security component, and the third security component monitors user operation behavior in real time. When a security component detects abnormal operation behavior (such as unauthorized access, data tampering, malware execution, etc.), it will immediately generate and record corresponding abnormal information, and send the abnormal information to other security components.

[0108] The above method reduces the impact of a single safety component failure on system safety through the collaborative work of multiple safety components.

[0109] In some embodiments, Figure 7 As shown, when any one of the first security component, the second security component, and the third security component determines that there is an abnormal operation behavior, abnormal information corresponding to the abnormal operation behavior is sent to the server, and the server is used to determine processing information corresponding to the abnormal operation behavior based on the abnormal information.

[0110] The abnormal information corresponding to the abnormal operation behavior refers to the detailed data and logs related to the abnormal operation behavior. This information may include timestamp, operation type, operation user, operation object, abnormal type, abnormal level, etc.

[0111] The processing information may include at least one of the following: penalty information, repair information, security policy adjustment information, and notification information. Among them, penalty information refers to the punishment measures for abnormal operation behavior, such as disabling user accounts, restricting access rights, alarm notifications, etc. Repair information is used to provide suggestions for repairing abnormal operation behaviors, such as vulnerability patching, system updates, etc. Security policy adjustment information includes adjusting the current security policy based on abnormal operation behavior to prevent similar incidents from happening again. Notification information is used to notify relevant administrators or users about abnormal operation behaviors to ensure that they can take timely actions.

[0112] In some embodiments, the server determines the penalty information corresponding to the abnormal operation behavior based on the abnormal information through a machine learning model. Specifically, the machine learning model can be a neural network model for processing classification tasks, which is used to output the corresponding penalty category or penalty level based on the input abnormal information. For example, the output is "disable account", "restrict access rights", "send alarm notification", etc.

[0113] In some embodiments, the server determines the repair information corresponding to the abnormal operation behavior based on the abnormal information through a machine learning model. Specifically, the machine learning model can be a neural network model for processing regression tasks, which is used to output corresponding repair information, such as specific parameters of the repair strategy, based on the input abnormal information.

[0114] In some embodiments, the server used to determine the processing information corresponding to the abnormal operation behavior based on the exception information may be the same server as the server used to store the configuration information and the server used to provide background services for the client of the first application, or may not be the same server. This application does not limit this.

[0115] The above method sends the abnormal information to the server, and the server can perform in-depth analysis and processing through a machine learning model to generate corresponding processing information.

[0116] The technical solution provided in the embodiment of the present application can be applied to the anti-cheating scenario of mobile phone virtualization application based on PC. The mobile phone application can be an Android application or an IOS (iPhone Operating System) application. This application does not limit this. Here, the Android application is used as an example for explanation. Please refer to Figure 8 , which shows a flow chart of a security protection method for an application provided by another embodiment of the present application. The execution subject of each step of the method may be a first device, for example, the first device may be Figure 1 The terminal device 10 in the embodiment. The method may include at least one of the following steps 810-840.

[0117] Step 810, in the PC user space, create a virtualized running instance corresponding to the Android application, the virtualized running instance is used to provide a virtualized running environment for the Android application, the virtualized running environment includes an Android virtual user space and an Android virtual kernel space, and the Android application runs in the Android virtual user space.

[0118] PC user space refers to the user mode in the PC operating system, and PC kernel space refers to the kernel mode in the PC operating system, in which the operating system kernel can directly access system resources and hardware, and is responsible for managing hardware devices, memory allocation, process scheduling and other low-level operations. The PC operating system can be a Windows operating system, a Linux operating system, or other PC operating systems, which is not limited in this application.

[0119] Android applications can be Android games, Android social programs, and Android office programs, which are not limited in this application. The above-mentioned Android virtual user space provides an isolated and secure operating environment for Android applications, stores application code and data, and interacts with the virtual kernel through the system call interface. The Android virtual kernel space is responsible for processing system call requests, managing the resources and hardware simulation of the virtual machine, and ensuring that Android applications can perform their tasks in a stable and efficient operating environment.

[0120] In some embodiments, the virtualization running instance includes a virtualization engine and a virtualization backend; creating a virtualization running instance corresponding to an Android application may include the following steps: creating a virtualization engine corresponding to the Android application, the virtualization engine is used to schedule the hardware and software resources provided by the virtualization backend; creating a virtualization backend corresponding to the virtualization engine, the virtualization backend refers to the hardware and software resources that support the operation of the virtualization engine.

[0121] The virtualized running instance corresponding to the Android application refers to a simulated Android running environment created in the PC user space, which can provide the Android application with running conditions that meet the Android operating system specifications. In the above method, the virtualization engine and the virtualization backend can dynamically allocate the required resources to the Android application according to the specific needs of the Android application to ensure its smooth operation, thereby ensuring the normal operation of the Android application.

[0122] Step 820, loading a PC user security component in the PC user space, and loading a PC kernel security component in the PC kernel space, the PC user security component and the PC kernel security component are used to provide security protection for the PC user space and the PC kernel space, and there is a communication connection between the PC user security component and the PC kernel security component.

[0123] Step 830, during the running of the Android application in the Android virtual user space, monitor at least one operation behavior performed on the Android application in the PC user space through the PC user security component to obtain first behavior sequence information; and monitor at least one operation behavior performed on the Android application in the PC kernel space through the PC kernel security component to obtain second behavior sequence information, and send the second behavior sequence information to the PC kernel security component.

[0124] At least one operation behavior performed on an Android application refers to a specific operation or request performed by a user during the running of the Android application. The operation behavior may include normal operation behavior and abnormal operation behavior. Exemplarily, when the application is an Android game, the normal operation behavior for the Android game may include the user clicking the screen, sliding the screen, selecting in-game options, entering game instructions, loading resources, etc. Abnormal operation behavior may include malicious attack behavior, attempts to illegally modify game data, unauthorized external script execution, abnormal memory access, unauthorized system call attempts, etc.

[0125] Step 840: Determine, through the PC user security component based on the first behavior sequence information and the second behavior sequence information, whether there is any abnormal operation behavior for the Android application.

[0126] In some embodiments, when the PC user security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it is determined that there is abnormal operation behavior for the Android application, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is abnormal operation behavior.

[0127] The following describes a specific implementation method for security protection of Android applications when the virtualized running instance includes multiple security levels.

[0128] In some embodiments, the security level corresponding to the virtualized running instance includes a first security level and a second security level. The virtualized running instance of the first security level is used to monitor the external behavior sequence information of the Android application, and the virtualized running instance of the second security level is used to monitor the internal behavior sequence information of the Android application, wherein the external behavior sequence information is used to indicate the operation behavior on the external data of the Android application, and the internal behavior sequence information is used to indicate the operation behavior on the internal data of the Android application.

[0129] In some embodiments, Fig. 9 As shown, an Android security component is loaded in the Android application; the Android security component monitors at least one operation behavior performed on the Android application in the Android virtual user space and the Android virtual kernel space to obtain third behavior sequence information; and the third security component determines whether there is an abnormal operation behavior against the Android application based on the third behavior sequence information.

[0130] Exemplarily, the operation behaviors in the Android virtual user space may include user interface operations, such as clicking a button, sliding the screen, entering text, selecting a menu item, etc. System call requests of applications, such as file operations, network communications, permission requests, resource management, etc. State changes within applications, such as object creation, data updates, thread scheduling, timer triggering, etc. Exemplarily, the operation behaviors in the Android virtual kernel space may include: kernel-level system call processing, such as device driver calls, memory management, process scheduling, interrupt processing, etc. Simulation behaviors of virtual devices, such as screen input, camera operations, sensor data simulation, hardware abstraction layer calls, etc. The Android security component can obtain the third behavior sequence information by monitoring the above operation behaviors and recording the specific data information of these operations.

[0131] In some embodiments, first characteristic information of a virtualized running instance is stored in the PC, and the first characteristic information is used to determine the type of the virtualized running environment. Second characteristic information corresponding to the virtualized running instance at a first time is obtained through an Android security component, where the first time refers to any time during the running of an Android application, and the second characteristic information is used to indicate the type of the virtualized running environment corresponding to the first time. The third security component is used to determine whether there is any abnormal operating behavior against the virtualized running environment based on the first characteristic information and the second characteristic information.

[0132] It can be understood that there is a one-to-one correspondence between the Android virtualization running instance and the corresponding first characteristic information, that is, one Android virtualization running instance corresponds to one first characteristic information, and different Android virtualization running instances may correspond to different first characteristic information.

[0133] In some embodiments, Fig. 9 As shown, there is a communication connection between the Android security component and the PC user security component, and the third behavior sequence information is sent to the PC user security component through the Android security component; the PC user security component determines whether there is an abnormal operation behavior against the Android application based on the third behavior sequence information and the second behavior sequence information.

[0134] In some embodiments, Fig. 9 As shown, there is also a communication connection between the Android security component and the PC kernel security component; the third behavior sequence information is sent to the PC kernel security component through the Android security component; the third behavior sequence information is forwarded to the PC user security component through the PC kernel security component; and the PC user security component determines whether there is any abnormal operation behavior against the Android application based on the third behavior sequence information received from the Android security component and the third behavior sequence information received from the PC kernel security component.

[0135] In some embodiments, in response to a startup instruction for an Android application, the security level corresponding to the Android application is compared with the security level corresponding to the virtualized running instance; if the security level corresponding to the Android application and the security level corresponding to the virtualized running instance match, the Android application is started; if the security level corresponding to the Android application and the security level corresponding to the virtualized running instance do not match, the Android application is not started.

[0136] In some embodiments, when any one of the PC user security component, the PC kernel security component, and the Android security component determines that there is abnormal operation behavior, abnormal information corresponding to the abnormal operation behavior is sent to other security components.

[0137] In some embodiments, when any one of the PC user security component, the PC kernel security component, and the Android security component determines that there is abnormal operation behavior, abnormal information corresponding to the abnormal operation behavior is sent to the server, and the server is used to determine processing information corresponding to the abnormal operation behavior based on the abnormal information.

[0138] For any content not described in detail above, please refer to the corresponding description above.

[0139] In summary, the technical solution provided by the embodiment of the present application is aimed at the scenario where the Android application is running in the Android virtualized operating environment. By loading the PC user security component and the PC kernel security component in the PC, and the PC user security component and the PC kernel security component can monitor the user operation behavior executed for the Android application in the PC user space and the PC kernel space respectively, so as to obtain the first behavior sequence information and the second behavior sequence information respectively. The first and second behavior sequence information fully and comprehensively reflect the specific operation behavior of the user at the user level and the kernel level. Then, the PC user security component can effectively identify abnormal operation behavior by comprehensively analyzing the first and second behavior sequence information, thereby realizing the security protection of the Android application.

[0140] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0141] Please refer to Fig.10 , which shows a block diagram of a security protection device for an application provided by an embodiment of the present application. The device 1000 may include: a creation module 1010 , a loading module 1020 , a first monitoring module 1030 and a determination module 1040 .

[0142] Creation module 1010 is used to create a virtualized running instance corresponding to the first application in the user space of the first device, and the virtualized running instance is used to provide a virtualized running environment for the first application. The virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space.

[0143] The loading module 1020 is used to load a first security component in the user space of the first device and to load a second security component in the kernel space of the first device. The first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device. There is a communication connection between the first security component and the second security component.

[0144] The first monitoring module 1030 is used to monitor at least one operation behavior performed on the first application in the user space of the first device through the first security component during the running of the first application in the virtual user space to obtain first behavior sequence information; and to monitor at least one operation behavior performed on the first application in the kernel space of the first device through the second security component to obtain second behavior sequence information, and send the second behavior sequence information to the first security component.

[0145] The determination module 1040 is used to determine whether there is any abnormal operation behavior for the first application according to the first behavior sequence information and the second behavior sequence information through the first security component.

[0146] In some embodiments, the determination module 1040 is used to determine the presence of abnormal operating behavior for the first application when the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, wherein the abnormal behavior information refers to behavior information indicating that the operating behavior is the abnormal operating behavior.

[0147] In some embodiments, the first application program is loaded with a third security component; the device 1000 further includes: a second monitoring module ( Fig.10 not shown).

[0148] The second monitoring module is used to monitor at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space through the third security component to obtain third behavior sequence information; and determine whether there is any abnormal operation behavior for the first application based on the third behavior sequence information through the third security component.

[0149] In some embodiments, there is a communication connection between the third security component and the first security component, and the second monitoring module is used to send the third behavior sequence information to the first security component through the third security component; and determine whether there is any abnormal operation behavior for the first application based on the third behavior sequence information and the second behavior sequence information through the first security component.

[0150] In some embodiments, there is also a communication connection between the third security component and the second security component; the second monitoring module is used to send the third behavior sequence information to the second security component through the third security component; forward the third behavior sequence information to the first security component through the second security component; and determine through the first security component whether there is any abnormal operation behavior for the first application based on the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component.

[0151] In some embodiments, the security level corresponding to the virtualized running instance includes a first security level and a second security level, the virtualized running instance of the first security level is used to monitor the external behavior sequence information of the first application, and the virtualized running instance of the second security level is used to monitor the internal behavior sequence information of the first application, wherein the external behavior sequence information is used to indicate the operation behavior on the external data of the first application, and the internal behavior sequence information is used to indicate the operation behavior on the internal data of the first application; the second monitoring module is used to execute the step of monitoring at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space through the third security component to obtain the third behavior sequence information when the security level corresponding to the virtualized running instance is the second security level.

[0152] In some embodiments, the second monitoring module is used to respond to a startup instruction for the first application, compare the security level corresponding to the first application with the security level corresponding to the virtualized running instance; if the security level corresponding to the first application and the security level corresponding to the virtualized running instance match, start the first application; if the security level corresponding to the first application and the security level corresponding to the virtualized running instance do not match, do not start the first application.

[0153] In some embodiments, the first device stores first characteristic information of the virtualized running instance, the first characteristic information is used to determine the type of the virtualized running environment, and the second monitoring module is used to obtain second characteristic information corresponding to the virtualized running instance at a first time through the third security component, the first time refers to any time during the running of the first application, and the second characteristic information is used to indicate the type of the virtualized running environment corresponding to the first time; the third security component determines whether there is any abnormal operation behavior against the virtualized running environment based on the first characteristic information and the second characteristic information.

[0154] In some embodiments, the apparatus 1000 further includes: a sending module ( Fig.10 not shown).

[0155] The sending module is used for at least one of the following: when any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, sending abnormal information corresponding to the abnormal operation behavior to other security components; when any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, sending abnormal information corresponding to the abnormal operation behavior to a server, and the server is used to determine processing information corresponding to the abnormal operation behavior according to the abnormal information.

[0156] In some embodiments, the virtualization running instance includes a virtualization engine and a virtualization backend; the creation module 1010 is used to create a virtualization engine corresponding to the first application, and the virtualization engine is used to schedule the hardware and software resources provided by the virtualization backend; create the virtualization backend corresponding to the virtualization engine, and the virtualization backend refers to the hardware and software resources that support the operation of the virtualization engine.

[0157] The technical solution provided by the embodiment of the present application is aimed at the scenario where the application runs in a virtualized operating environment. By loading the first security component and the second security component in the first device, and the first security component and the second security component can respectively monitor the user operation behavior executed on the first application in the user space and the kernel space of the first device, so as to obtain the first behavior sequence information and the second behavior sequence information respectively. The first and second behavior sequence information fully and comprehensively reflect the specific operation behavior of the user at the user level and the kernel level. Then, the first security component can effectively identify abnormal operation behavior by comprehensively analyzing the first and second behavior sequence information, thereby realizing security protection for the first application.

[0158] It should be noted that the device provided in the above embodiment, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0159] Please refer to Fig.11 , which shows a structural block diagram of a computer device 1100 provided in one embodiment of the present application.

[0160] Typically, the computer device 1100 includes a processor 1110 and a memory 1120 .

[0161] The processor 1110 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The processor 1110 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1110 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1110 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1110 may also include an AI processor for processing computing operations related to machine learning.

[0162] The memory 1120 may include one or more computer-readable storage media, which may be non-transitory. The memory 1120 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1120 is used to store a computer program, which is configured to be executed by one or more processors to implement the security protection method of the above-mentioned application.

[0163] In some embodiments, a computer-readable storage medium is also provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the security protection method for the above-mentioned application.

[0164] Optionally, the computer readable storage medium may include: ROM (Read-Only Memory), RAM (Random-Access Memory), SSD (Solid State Drives) or optical disks, etc. Among them, the random access memory may include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0165] In some embodiments, a computer program product is also provided, which includes a computer program stored in a computer-readable storage medium, and a processor reads and executes the computer program from the computer-readable storage medium to implement the security protection method for the above-mentioned application.

[0166] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application are not limited to this.

[0167] The above description is only an exemplary embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A security protection method for an application, characterized in that: The method comprises: In the user space of the first device, create a virtualized running instance corresponding to the first application, the virtualized running instance is used to provide a virtualized running environment for the first application, the virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space; Loading a first security component in a user space of the first device, and loading a second security component in a kernel space of the first device, wherein the first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, and a communication connection is established between the first security component and the second security component; During the running of the first application in the virtual user space, the first security component monitors at least one operation behavior executed for the first application in the user space of the first device to obtain first behavior sequence information; and the second security component monitors at least one operation behavior executed for the first application in the kernel space of the first device to obtain second behavior sequence information, and sends the second behavior sequence information to the first security component; The first security component determines whether there is any abnormal operation behavior for the first application according to the first behavior sequence information and the second behavior sequence information.

2. The method according to claim 1, characterized in that The determining, by the first security component according to the first behavior sequence information and the second behavior sequence information, whether there is an abnormal operation behavior for the first application program includes: When the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it is determined that there is abnormal operation behavior for the first application, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is the abnormal operation behavior.

3. The method according to claim 1 or 2, characterized in that: The first application program is loaded with a third security component; and the method further comprises: Monitoring at least one operation behavior executed on the first application in the virtual user space and the virtual kernel space by the third security component to obtain third behavior sequence information; The third security component determines whether there is any abnormal operation behavior for the first application according to the third behavior sequence information.

4. The method according to claim 3, characterized in that: The third safety component and the first safety component have a communication connection, and the method further includes: sending the third behavior sequence information to the first security component through the third security component; The first security component determines whether there is any abnormal operation behavior for the first application according to the third behavior sequence information and the second behavior sequence information.

5. The method according to claim 3 or 4, characterized in that: The third safety component and the second safety component also have a communication connection; the method further includes: sending the third behavior sequence information to the second security component through the third security component; forwarding the third behavior sequence information to the first security component through the second security component; The first security component determines whether there is any abnormal operation behavior for the first application based on the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component.

6. The method according to any one of claims 3 to 5, characterized in that: The security level corresponding to the virtualized running instance includes a first security level and a second security level, the virtualized running instance of the first security level is used to monitor the external behavior sequence information of the first application, and the virtualized running instance of the second security level is used to monitor the internal behavior sequence information of the first application, wherein the external behavior sequence information is used to indicate the operation behavior on the external data of the first application, and the internal behavior sequence information is used to indicate the operation behavior on the internal data of the first application; The method further comprises: When the security level corresponding to the virtualized running instance is the second security level, the step of monitoring at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space through the third security component to obtain third behavior sequence information is performed.

7. The method according to claim 6, characterized in that The method further comprises: In response to a start instruction for the first application, comparing a security level corresponding to the first application with a security level corresponding to the virtualized running instance; If the security level corresponding to the first application program matches the security level corresponding to the virtualized running instance, starting the first application program; If the security level corresponding to the first application program does not match the security level corresponding to the virtualized running instance, the first application program is not started.

8. The method according to any one of claims 3 to 7, characterized in that: The first device stores first characteristic information of the virtualized running instance, and the first characteristic information is used to determine the type of the virtualized running environment. The method further includes: obtaining, by the third security component, second characteristic information corresponding to the virtualized running instance at a first time, where the first time refers to any time during the running of the first application, and the second characteristic information is used to indicate the type of the virtualized running environment corresponding to the first time; The third security component determines whether there is any abnormal operation behavior for the virtualized operating environment based on the first feature information and the second feature information.

9. The method according to any one of claims 3 to 8, characterized in that: The method further comprises at least one of the following: When any one of the first safety component, the second safety component, and the third safety component determines that the abnormal operation behavior exists, sending abnormal information corresponding to the abnormal operation behavior to other safety components; When any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, abnormal information corresponding to the abnormal operation behavior is sent to the server, and the server is used to determine processing information corresponding to the abnormal operation behavior based on the abnormal information.

10. The method according to any one of claims 1 to 9, characterized in that: The virtualization running instance includes a virtualization engine and a virtualization backend; The step of creating a virtualized running instance corresponding to the first application in the user space of the first device includes: Creating a virtualization engine corresponding to the first application, the virtualization engine being used to schedule hardware and software resources provided by the virtualization backend; The virtualization backend corresponding to the virtualization engine is created, where the virtualization backend refers to hardware and software resources that support the operation of the virtualization engine.

11. A security protection device for an application, characterized in that: The device comprises: A creation module, configured to create a virtualized running instance corresponding to a first application in a user space of a first device, wherein the virtualized running instance is used to provide a virtualized running environment for the first application, wherein the virtualized running environment includes a virtual user space and a virtual kernel space, and the first application runs in the virtual user space; a loading module, used to load a first security component in a user space of the first device, and to load a second security component in a kernel space of the first device, wherein the first security component and the second security component are used to perform security protection on the user space of the first device and the kernel space of the first device, and a communication connection is established between the first security component and the second security component; a first monitoring module, configured to monitor, during the process of the first application being run in the virtual user space, at least one operation behavior executed on the first application in the user space of the first device through the first security component, to obtain first behavior sequence information; and to monitor, through the second security component, at least one operation behavior executed on the first application in the kernel space of the first device, to obtain second behavior sequence information, and to send the second behavior sequence information to the first security component; A determination module is used to determine whether there is any abnormal operation behavior for the first application program according to the first behavior sequence information and the second behavior sequence information through the first security component.

12. A computer device, characterized in that: The computer device comprises a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which is loaded and executed by a processor to implement the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises a computer program, which is loaded and executed by a processor to implement the method according to any one of claims 1 to 10.

Images