Application security protection methods, devices, equipment and storage media

Abstract

A method, apparatus, device, and storage medium for application security protection belong to the field of network security technology. The method includes: creating a virtualized runtime instance corresponding to a first application; loading a first security component and a second security component; monitoring at least one operation performed on the first application in user space using the first security component to obtain first operation sequence information; monitoring at least one operation performed on the first application in kernel space using the second security component to obtain second operation sequence information and sending the second operation sequence information to the first security component; and determining, based on the first and second operation sequence information, whether there is any abnormal operation behavior targeting the first application. In this method, the first security component, through comprehensive analysis of the first and second operation sequence information, can effectively identify abnormal operation behavior, thereby achieving security protection for the application.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for the security protection of an application. Background Technology

[0002] Mobile applications, such as Android applications, run on the Android user space within a real Android device environment; Android protection primarily focuses on protecting the Android user space. PC (Personal Computer) applications run on the PC user space within a real PC environment; PC protection primarily focuses on protecting the PC kernel space.

[0003] Android applications can run on an Android virtualization environment in PC user space. This Android virtualization environment can include Android user space and Android kernel space. Android protection can protect the Android user space in the Android virtualization environment.

[0004] The above methods prevent Android protection from detecting abnormal operations from the PC user space, such as abnormal debugging behavior, thus jeopardizing the security of Android applications. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for application security protection. The technical solution provided by this application is as follows:

[0006] According to one aspect of the embodiments of this application, a method for security protection of an application is provided, the method comprising:

[0007] In the user space of the first device, a virtualized runtime instance corresponding to the first application is created. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space.

[0008] A first security component is loaded in the user space of the first device, and a second security component is loaded in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device. The first security component and the second security component have a communication connection.

[0009] During the operation of the first application in the virtual user space, the first security component monitors at least one operation performed on the first application in the user space of the first device to obtain first action sequence information; and the second security component monitors at least one operation performed on the first application in the kernel space of the first device to obtain second action sequence information, and sends the second action sequence information to the first security component.

[0010] The first security component determines whether there is any abnormal operation behavior targeting the first application based on the first behavior sequence information and the second behavior sequence information.

[0011] According to one aspect of the embodiments of this application, a security protection device for an application is provided, the device comprising:

[0012] A creation module is used to create a virtualized runtime instance corresponding to a first application in the user space of the first device. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space.

[0013] A loading module is used to load a first security component in the user space of the first device and a second security component in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device. The first security component and the second security component have a communication connection.

[0014] The first monitoring module is configured to, during the process of the first application running in the virtual user space, monitor at least one operation behavior performed on the first application in the user space of the first device through the first security component to obtain first behavior sequence information; and to monitor at least one operation behavior performed on the first application in the kernel space of the first device through the second security component to obtain second behavior sequence information, and send the second behavior sequence information to the first security component.

[0015] The determination module is used to determine, through the first security component, whether there is any abnormal operation behavior targeting the first application based on the first behavior sequence information and the second behavior sequence information.

[0016] According to one aspect of the embodiments of this application, a computer device is provided, the computer device including a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the security protection method for the above-described application.

[0017] According to one aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, the computer program being loaded and executed by a processor to implement the security protection method for the above-described application.

[0018] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including a computer program stored in a computer-readable storage medium, and a processor reading from the computer-readable storage medium and executing the computer program to implement the above-described security protection method for the application.

[0019] The technical solutions provided in this application have at least the following beneficial effects:

[0020] For scenarios where applications run in a virtualized environment, a first security component and a second security component are loaded into a first device. These two components monitor user actions performed on the first application in the user space and kernel space of the first device, respectively, obtaining first and second action sequence information. This first and second action sequence information comprehensively reflects the user's specific operational behavior at both the user and kernel levels. Then, by comprehensively analyzing the first and second action sequence information, the first security component can effectively identify abnormal operational behaviors, thereby achieving security protection for the first application. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the implementation environment of a solution provided in one embodiment of this application;

[0022] Figure 2 This is a flowchart of a security protection method for an application provided in one embodiment of this application;

[0023] Figure 3 This is a flowchart of the virtualization runtime instance creation process provided in one embodiment of this application;

[0024] Figure 4 This is a schematic diagram illustrating security protection based on a security component according to an embodiment of this application;

[0025] Figure 5 This is a flowchart of a security protection method for an application provided in another embodiment of this application;

[0026] Figure 6 This is a schematic diagram illustrating the startup verification of a first application provided in one embodiment of this application;

[0027] Figure 7 This is a schematic diagram illustrating the sending of exception information to a server according to an embodiment of this application;

[0028] Figure 8 This is a flowchart of a security protection method for an application provided in another embodiment of this application;

[0029] Figure 9 This is a schematic diagram illustrating security protection based on security components according to another embodiment of this application;

[0030] Figure 10 This is a block diagram of an application security protection device provided in one embodiment of this application;

[0031] Figure 11 This is a structural block diagram of a computer device provided in one embodiment of this application. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0033] Please refer to Figure 1 This diagram illustrates an implementation environment provided by one embodiment of the present application. This implementation environment can be implemented as a computer system. The implementation environment may include: a terminal device 10 and a server 20.

[0034] Terminal device 10 can be a PC (Personal Computer), or it can be a mobile phone, a smart voice interaction device, a game console, a wearable device, a multimedia playback device, a vehicle terminal, a smart home appliance, an AR (Augmented Reality) device, a VR (Virtual Reality) device, a MR (Mixed Reality) device, or other electronic devices. This application does not limit the scope of the application.

[0035] Server 20 is used to store configuration information, which is used to indicate the parameter configuration information related to creating a virtualized runtime instance on terminal device 10. Terminal device 10 creates and runs the virtualized runtime instance according to the configuration information provided by server 20. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application.

[0036] In this application embodiment, the first application can be any application that supports running on a virtualized instance, including but not limited to any one of the following: game applications, office software applications, social media applications, etc. This application does not limit the type of the first application.

[0037] In some embodiments, server 20 is also used to provide background services for the client of a first application in terminal device 10. For example, the first application may be a game application. While the game application is running on a virtualized instance created by terminal device 10, server 20 provides background services for the game application, such as real-time matchmaking, leaderboard updates, game logic processing, and other data services. For example, server 20 may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, but is not limited to these.

[0038] In some embodiments, the server used to store configuration information and the server used to provide background services for the client of the first application may not be the same server, and this application does not limit this.

[0039] Terminal device 10 and server 20 can communicate with each other via a network. This network can be a wired network or a wireless network.

[0040] Please refer to Figure 2 The document illustrates a flowchart of a security protection method for an application provided in one embodiment of this application. The executing entity for each step of the method can be a first device, which can be a computer device, for example, the computer device can be... Figure 1 The terminal device 10 in the method may include at least one of the following steps 210 to 240.

[0041] Step 210: In the user space of the first device, a virtualized runtime instance corresponding to the first application is created. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space.

[0042] The user space of the first device refers to the area within the operating system used to run applications. This operating system is the host operating system of the first device, i.e., the operating system actually running on the hardware of the first device. User space provides an isolated runtime environment for applications, ensuring that applications do not directly access or interfere with the core functions of the operating system. The kernel space of the first device refers to the area within the host operating system used to execute core system functions and services. Kernel space contains the core components of the host operating system, such as process management, memory management, device drivers, file systems, and network protocol stacks. Kernel space runs at a higher privilege level, interacts directly with the hardware, and manages system resources.

[0043] The virtualized runtime instance corresponding to the first application refers to an independent virtualized runtime environment created for the first application using virtualization technology. This virtualized runtime instance provides the first application with isolated resources and execution space, allowing the first application to run independently within it without direct conflicts with other applications or system resources.

[0044] A virtual user space is a separate virtual memory space created for each user process in a virtualized runtime instance. It stores the process's data, code, stack, and other information. The virtual user space provides a secure, isolated runtime environment for the primary application, ensuring that its data and operations are not affected by other virtualized runtime instances or the host operating system. The primary application runs in this virtual user space as if it were running on a real physical machine, but in reality, it is running within a virtualized environment.

[0045] A virtual kernel space refers to an independent virtual memory space created for the operating system kernel in each virtualized instance, where the operating system refers to the guest operating system. This virtual memory space is used to store kernel code, data structures, system call handlers, and other kernel-related information. The virtual kernel interacts with virtual hardware to execute system calls, manage resources, and schedule processes. The virtual kernel space ensures that the operating system kernel in the virtualized instance can run in an isolated and secure environment. It is understood that this application creates a virtualized instance on top of the host operating system of the first device, and the guest operating system runs within the virtualized instance. The host operating system and the guest operating system can be the same or different; this application does not impose any restrictions on this. For example, the first device can be a PC, the host operating system can be a Windows operating system, and the guest operating system can be a mobile operating system (such as an Android operating system). Alternatively, the first device can be a PC, the host operating system can be a Windows operating system, and the guest operating system can also be a Windows operating system.

[0046] Understandably, the virtual user space provides an isolated and secure runtime environment for the first application, storing the application's code and data, and interacting with the virtual kernel through system call interfaces. The virtual kernel space is responsible for handling system call requests, managing virtual machine resources and hardware emulation, and ensuring that the first application can execute its tasks in a stable and efficient runtime environment. In some embodiments, the virtualized runtime instance includes a virtualization engine and a virtualization backend. Creating a virtualized runtime instance corresponding to the first application may include the following steps: creating a virtualization engine corresponding to the first application, the virtualization engine being used to schedule the hardware and software resources provided by the virtualization backend; creating a virtualization backend corresponding to the virtualization engine, the virtualization backend referring to the hardware and software resources supporting the operation of the virtualization engine.

[0047] A virtualization engine, also known as a virtualization engine instance, is a software or component responsible for managing and controlling the creation, configuration, operation, and destruction of virtual machines. It provides functions such as virtual hardware simulation, virtual machine scheduling, and virtual resource allocation and management. It schedules the hardware and software resources provided by the virtualization backend to ensure that virtual machines can correctly execute their tasks. The virtualization backend consists of the hardware and software resources that support the operation of the virtualization engine. It is responsible for handling the underlying hardware and operating system services, ensuring the efficient and secure operation of the virtualization engine. Hardware resources can include computing resources (CPU (Central Processing Unit)), memory resources, storage resources (hard disk / solid-state drive), network resources (network interface cards), and input / output devices (I / O devices). Software resources can include the operating system kernel, device drivers, virtualization management software, resource scheduling algorithms, security and management tools, etc.

[0048] like Figure 3 The diagram illustrates a flowchart of a virtualization runtime instance creation process provided in one embodiment of this application. It may include the following steps (S1-S5).

[0049] Step S1: The local client (i.e., the first device) queries the server to obtain configuration information. This configuration information is used to indicate the parameter configuration information related to creating a virtualized running instance on the first device, such as virtual hardware configuration, resource allocation strategy, network settings, etc.

[0050] Step S2: Based on the parsed configuration information, the engine management module creates the corresponding virtualization engine instance. One virtualization engine instance can represent one virtual mobile device.

[0051] Step S3: Create the virtualization backend required for the virtualization engine instance. For example, the virtualization backend simulates sub-device environments such as network cards, disks, audio / video output, graphics cards, and CPUs. It is understood that the virtualization backend provides network transmission, audio / video playback, and user input / output functions for the aforementioned virtual mobile device.

[0052] Step S4: Start the virtualization engine instance.

[0053] Step S5: Create Virtual Devices. The created virtual devices correspond one-to-one with the sub-devices simulated in Step S3. These virtual devices interact with the user and provide corresponding management and control functions. For example, virtual devices can be virtual audio devices, virtual video devices, virtual graphics rendering devices, and virtual input / output devices. The created virtual devices are displayed to the user, who can manage and interact with the virtualized running instance through these virtual devices. For example, the user can manage audio, video, graphics rendering, and input / output. For instance, the user can adjust the volume of the virtualized running instance through the virtual audio device's management function (i.e., audio management). For example, the user can adjust the audio output volume of the virtual device through the volume control interface to ensure the volume meets the user's needs. For instance, the user can select a video source and adjust video output settings through the virtual video device's management function (i.e., video management). For example, the user can select different video input sources and adjust the video resolution, frame rate, and color settings to obtain the best viewing experience.

[0054] The above method enables the virtualization engine and virtualization backend to dynamically allocate the necessary resources to the first application according to its specific needs, ensuring its smooth operation and thus guaranteeing the normal operation of the first application.

[0055] Step 220: Load a first security component in the user space of the first device and load a second security component in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device. The first security component and the second security component have a communication connection.

[0056] The first and second security components are used to protect the user space and kernel space of the first device. This means that the security protection of the user space and kernel space of the first device is achieved by combining the first and second security components. Specifically, the second security component is responsible for implementing a large number of security detection strategies, while the first security component makes the decisions regarding these strategies. Specifically, multiple monitoring points can be installed on the second security component. These monitoring points are used to collect data information from different modules in the system in real time. For example, the monitoring points may include at least one of the following: memory monitoring points, network monitoring points, file monitoring points, process monitoring points, log monitoring points, and debugging behavior monitoring points. Among them, memory monitoring points are used to collect data such as memory usage, memory leaks, illegal memory access, and buffer overflows. Network monitoring points are used to collect data such as network traffic, data packet content, communication modes, and port activity. File monitoring points are used to collect data on file creation, modification, deletion, access, and permission changes. Process monitoring points are used to collect data such as process creation, termination, resource usage, execution path, and parent process information. Log monitoring points are used to collect system, application, and security log information, including event type, time, and user data. Debugging behavior monitoring points are monitoring points set up in the system to monitor and record debugging operations performed on the program by debuggers or tools in real time. They can be used to collect data related to debugging operations, including but not limited to specific data on debugging behaviors such as breakpoint setting, memory read / write, register access, and single-step execution. Through this data, detailed monitoring and analysis of debugging behavior in the system can be performed, thereby identifying potential malware or attack behaviors.

[0057] In some embodiments, the first security component can determine whether abnormal operational behavior exists based on data collected from monitoring points of the second security component and the decision-making method of the security detection strategy. In some embodiments, the monitoring points and the decision-making methods of the security detection strategy can have a one-to-one correspondence. One monitoring point corresponds to one decision-making method of the security detection strategy, and different monitoring points correspond to different decision-making methods of the security detection strategy.

[0058] For example, the second security component can send data collected from process monitoring points to the first security component. This data may include information such as process creation, termination, resource usage, execution path, and parent process information. The first security component performs detailed analysis of the process data using a decision-making method based on the security monitoring strategy for the process to determine whether there are any abnormal operations. For example, if a process frequently creates child processes, and the execution path of these child processes is abnormal, it may indicate malware or unauthorized process behavior.

[0059] The reason for separating "implementation-decision" in the above method is, on the one hand, to consider development convenience and efficiency. Specifically, developing security components for the user space of the first device is relatively convenient, as the user space development environment is more user-friendly, and debugging tools and resources are more abundant. Complex decision-making logic can be developed and tested in user space, avoiding the development difficulties brought about by directly integrating complex logic into kernel space. Kernel space development is more difficult, mainly because the debugging and maintenance costs of kernel code are high, and any code defect can lead to a blue screen, which in turn can cause the entire system to crash. In contrast, code defects in user space software usually only cause the crash of a single software and do not affect the stability of the entire system.

[0060] On the other hand, security is a concern. Specifically, relying solely on the first security component in user space makes it vulnerable to being deceived by malicious cheat programs that masquerade as kernel modules. For example, the first security component in user space might need to detect whether a memory address in user space has been modified. A malicious cheat program could modify this address by masquerading as a kernel module, and the first security component in user space would be unaware of this abnormal operation. The method described above, by combining the first and second security components, can form a multi-layered protection mechanism between kernel space and user space. The second security component sets up monitoring points in kernel space to collect critical data in real time, while the first security component in user space performs complex decision analysis based on this critical data, thereby achieving security protection for both the kernel space and user space of the first device.

[0061] For example, in the above example, suppose the user space of the first device needs to detect whether a certain memory address has been modified. Through the combination of the first and second security components, the second security component sets up memory monitoring points in the kernel space to collect data on memory usage and modification operations in real time, and sends this data to the first security component. The first security component analyzes this data in user space to determine if any abnormal operation behavior exists. Even if a malicious cheat program attempts to modify the memory address by masquerading as a kernel module, the second security component can still capture these operations because the kernel space lacks the corresponding permissions and operation records. This captured operation data will be identified and responded to by the first security component.

[0062] Step 230: During the operation of the first application in the virtual user space, the first security component monitors at least one operation performed on the first application in the user space of the first device to obtain first action sequence information; and the second security component monitors at least one operation performed on the first application in the kernel space of the first device to obtain second action sequence information, and sends the second action sequence information to the first security component.

[0063] At least one operation performed on the first application refers to a specific operation or request performed by the user during the operation of the first application. Operations can include file operations, process operations, network operations, permission operations, system call operations, debugging operations, etc. Specifically, file operations refer to operations such as reading, writing, modifying, and deleting files related to the first application. For example, a user opens a file in a document editor, edits its content, and saves it. Process operations refer to operations such as creating, executing, and terminating processes related to the first application. For example, when a user creates a new task, the first application creates a new process, or the user terminates a running process. Network operations refer to network requests initiated by the user through the first application, including file upload and download. For example, a user accesses a website and sends data in a browser, or uses a file transfer tool to upload and download files. Permission operations refer to the user's requests for and use of permissions in the first application, including permission requests, permission grants, and permission revocation. For example, the application requests access to the user's camera and microphone, and the user chooses to allow or deny. System call operations refer to system-level operations initiated by the user through the first application, such as accessing devices, managing memory, and executing kernel functions. For example, an application might request access to a hardware device or call a system function. Debugging refers to the process by which users utilize debugging tools to analyze and obtain the running state, internal logic, and data information of a primary application.

[0064] It is understood that operational behaviors can include normal operational behaviors and abnormal operational behaviors. Normal operational behaviors refer to actions performed by the user according to the expected operating procedures and application specifications, such as opening a file, editing text, and saving a file in a document editor. For example, normal operational behaviors include browsing web pages, filling out forms, and submitting requests in a browser. Abnormal operational behaviors refer to behaviors that deviate from normal operational behaviors and may threaten or interfere with the system or application, such as attempting to access sensitive data without authorization, attempting to execute malicious code, or deleting important system files. For example, abnormal operational behaviors include attempting to bypass authentication mechanisms or using debugging tools for large-scale data scraping. The problem this application aims to solve is to identify abnormal operational behaviors to ensure the reliable and secure operation of the first application.

[0065] The first behavior sequence information refers to the specific data information collected by monitoring user space operations, and the second behavior sequence information refers to the specific data information collected by monitoring kernel space operations. By combining the first and second security components, security protection for both the user space and kernel space of the first device can be achieved. It can be understood that since the entire virtualized runtime environment (including virtual user space and virtual kernel space) runs in the user space of the first device, the first behavior sequence information is obtained by monitoring user operations in user space, and the second behavior sequence information is obtained by monitoring user operations in kernel space. The first security component combines the first and second behavior sequence information for comprehensive analysis and anomaly detection, thereby achieving security protection for the first application.

[0066] Step 240: The first security component determines whether there is any abnormal operation behavior targeting the first application based on the first line sequence information and the second line sequence information.

[0067] In some embodiments, if the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it determines that there is abnormal operation behavior for the first application, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is abnormal.

[0068] In some embodiments, the first behavior sequence information may include data information corresponding to debugging behavior in user space collected by the first security component at a debugging behavior monitoring point. The second behavior sequence information may include data information corresponding to debugging behavior in kernel space collected by the second security component at a debugging behavior monitoring point. If the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal debugging behavior, it determines that there is abnormal operation behavior targeting the first application.

[0069] For example, the data information corresponding to the above debugging behaviors may include at least one of the following: breakpoint setting, memory read / write, register access, single-step execution, debugger commands, process state changes, exception handling, environment variables, and parameters. Specifically, breakpoint setting records the breakpoint location set by the debugger in the program, as well as the context information when the breakpoint is triggered. Memory read / write is used to monitor the debugger's read and write operations on the target process's memory, recording information such as memory address, read / write size, and data content. Register access records the debugger's access operations to the target process's registers, including register name, access type (read / write), and access value. Single-step execution monitors the debugger's single-step execution operations, recording the program execution path, context information for each step, and involved instructions. Debugger commands record debugging commands sent by the debugger, such as continue execution, pause execution, and display the call stack. Process state changes monitor the state changes of the target process during debugging, such as pause, resume, and terminate. Exception handling records the debugger's handling information for exceptions in the target process, such as exception type, exception address, and handling result. Environment variables and parameters are used to record the environment variables set by the debugger and the parameters passed to the target process. For example, the above-mentioned abnormal debugging behavior may include a virtual process frequently performing single-step execution on a critical code path, and these behavioral patterns are inconsistent with normal debugging behavior.

[0070] The above method enables the first security component to perform comprehensive analysis and anomaly detection by combining the first and second behavioral sequence information, thereby identifying abnormal operational behaviors and achieving security protection for the first application. Specifically, by monitoring debugging behavior in the user space and kernel space of the first device, the first and second behavioral sequence information can be obtained. The first security component combines these two behavioral sequence information for comprehensive analysis and anomaly detection, identifying abnormal debugging behaviors and thus achieving security protection for the first application.

[0071] In summary, the technical solution provided in this application, targeting scenarios where applications run in a virtualized environment, loads a first security component and a second security component into a first device. These two components monitor user operations performed on the first application in the user space and kernel space of the first device, respectively, thereby obtaining first and second behavior sequence information. This first and second behavior sequence information comprehensively reflects the user's specific operational behavior at both the user and kernel levels. Then, by comprehensively analyzing the first and second behavior sequence information, the first security component can effectively identify abnormal operational behaviors, thereby achieving security protection for the first application.

[0072] The following describes the specific implementation method for security protection of the first application when the virtualized runtime instance includes multiple security levels.

[0073] In some embodiments, the virtualized runtime instance includes multiple security levels. When the virtualized runtime instance corresponds to different security levels, the first security component and the second security component can monitor different types of user operations. It is understood that when the virtualized runtime instance corresponds to a low security level, it indicates a lower level of security protection for the first application. In this case, the first and second security components can only detect and protect against basic user operations. These basic user operations may include debugging behavior. Therefore, the first and second security components monitor debugging behavior to perform anti-debugging protection, which refers to protection against debugging behavior.

[0074] When the virtualization instance corresponds to a high security level, it indicates a high level of security protection for the first application. Therefore, in addition to monitoring and protecting against the basic user operations mentioned above, the first and second security components can also monitor and protect against advanced user operations. These advanced operations can include at least one of the following operations on the first application: memory operations, file operations, and process operations. The first and second security components perform memory protection, file protection, and process protection by monitoring memory operations, file operations, and process operations. Memory operations refer to operations performed on the memory area of ​​the first application, including memory reading, writing, allocation, release, and copying. Memory protection refers to preventing malicious code injection, memory leaks, buffer overflows, and other attacks by monitoring and protecting these memory operations, ensuring the integrity and security of the first application's memory area. File operations refer to operations performed on files related to the first application, including file reading, writing, creation, deletion, and permission modification. File protection refers to preventing unauthorized access, tampering, and deletion of files by monitoring and protecting these file operations, ensuring the integrity and security of the first application's files. Process operations refer to actions performed on the processes related to the first application, including process startup, termination, suspension, resumption, and resource allocation. Process protection, therefore, refers to monitoring and protecting these process operations to prevent abnormal process startup or termination, thereby ensuring the integrity and security of the first application's process runtime environment. The security protection types corresponding to the different security levels mentioned above are merely illustrative and are not intended to limit the scope of this application.

[0075] In some embodiments, the security level corresponding to the virtualization runtime instance includes a first security level and a second security level. The virtualization runtime instance of the first security level is used to monitor the external behavior sequence information of the first application, and the virtualization runtime instance of the second security level is used to monitor the internal behavior sequence information of the first application. The external behavior sequence information is used to indicate the operation behavior on external data of the first application, and the internal behavior sequence information is used to indicate the operation behavior on internal data of the first application.

[0076] It is understandable that the aforementioned low security level corresponds to the first security level, and the high security level corresponds to the second security level. When the security level corresponding to the virtualization instance is the first security level (i.e., the low security level), since the low security level can only monitor operations on external data of the first application, that is, it cannot obtain memory operations, file operations, process operations, etc., of the first application, the first and second security components can only provide basic protection, such as anti-debugging protection, but cannot provide comprehensive memory protection, file protection, and process protection. When the security level corresponding to the virtualization instance is the second security level (i.e., the high security level), since it is necessary to obtain the internal data of the first application in the virtualization environment, on the one hand, it is necessary to load a third security component in the first application. That is, when the security level corresponding to the virtualization instance is the second security level, the third security component is used to monitor at least one operation behavior performed on the first application in the virtual user space and virtual kernel space to obtain the third behavior sequence information. On the other hand, if more reliable security protection is required for the first application, it is also necessary to establish a communication connection between the first security component and the third security component. For details, please see below.

[0077] In some embodiments, such as Figure 4 As shown, a third security component is loaded in the first application; the third security component monitors at least one operation behavior performed on the first application in the virtual user space and virtual kernel space to obtain third behavior sequence information; the third security component determines whether there is any abnormal operation behavior on the first application based on the third behavior sequence information.

[0078] The third-order sequence information refers to the specific data information obtained by the third security component in the virtual user space and virtual kernel space by monitoring at least one operation performed on the first application. For example, the operation in the virtual user space can include at least one of the following: file operations, network communication, system calls, memory operations, and process management. File operations refer to operations such as file creation, reading, writing, and deletion. Network communication refers to operations such as establishing network connections, sending and receiving data. System calls refer to system call records in user space, including information such as the call type, parameters, and return value. Memory operations refer to operations such as memory allocation, release, reading, and writing. Process management refers to operations such as process creation, destruction, and scheduling. For example, the operation in the virtual kernel space can include at least one of the following: kernel function calls, interrupt handling, memory management, process management, device driver operations, and exception handling. Kernel function calls refer to function call records in kernel space, including information such as the call type, parameters, and return value. Interrupt handling refers to interrupt triggering and processing records. Memory management refers to operations such as kernel memory allocation, release, reading, and writing. Process management refers to operations such as process creation, destruction, and scheduling in kernel space. Device driver operations refer to the call records of device drivers. Exception handling refers to exception handling records in kernel space. By monitoring the above operations and recording the specific data information of these operations, the third-party security component can obtain the sequence information of the third action.

[0079] In some embodiments, the third security component can implement multiple security protections for the first application based on different monitored operational behaviors. For example, the third security component can monitor and protect against the aforementioned basic user operations and advanced user operations to provide one of the following security protections: memory protection, file protection, process protection, and anti-debugging protection. For example, the third security component can monitor memory read, write, allocation, and release operations against the first application; when it detects malicious code injection, memory leaks, and buffer overflows, it determines that abnormal operational behavior exists. For example, the third security component can monitor process start, termination, suspension, and resumption operations; when it detects abnormal process start or termination, it determines that abnormal operational behavior exists.

[0080] In some embodiments, the first device stores first characteristic information of a virtualized running instance, which is used to determine the type of the virtualized running environment. The second characteristic information corresponding to the virtualized running instance at a first time is obtained through a third security component. The first time refers to any time during the operation of the first application. The second characteristic information is used to indicate the type of the virtualized running environment corresponding to the first time. The third security component determines whether there is any abnormal operation behavior targeting the virtualized running environment based on the first characteristic information and the second characteristic information.

[0081] It is understandable that there is a one-to-one correspondence between virtualization runtime instances and their corresponding primary characteristic information; that is, one virtualization runtime instance corresponds to one primary characteristic information, and different virtualization runtime instances can correspond to different primary characteristic information. If the primary characteristic information of a virtualization runtime instance changes during the execution of the first application, it indicates the existence of abnormal operation behavior. This abnormal operation behavior would involve unauthorized alteration of the characteristic information of the virtualization runtime environment. Such alteration may threaten the secure operation of the first application.

[0082] In some embodiments, the first feature information may include at least one of the following: file information, process information, and system attribute information. The file information indicates specific files included in the virtualization instance, such as file names. The process information indicates specific processes included in the virtualization instance, such as a process's unique identifier, process name, process priority, process scheduling priority, and process state. The system attribute information may include the operating system version (e.g., the operating system version running on the virtualization instance, such as Android), the device model simulated by the virtualization instance, and the screen resolution (the screen resolution of the device simulated by the virtualization instance). This application does not limit the specific content included in the first feature information.

[0083] In some embodiments, a third security component compares the first and second feature information. If the second feature information matches the first feature information, it is determined that there is no abnormal operation targeting the virtualization runtime environment; if the second feature information does not match the first feature information, it is determined that there is abnormal operation targeting the virtualization runtime environment. For example, the third security component obtains the second feature information. When the file information in the second feature information changes compared to the first feature information, such as when a new file appears in the second feature information, it is determined that there is abnormal operation targeting the virtualization runtime environment. For example, when the second feature information contains information about process creation or destruction indicating that a new process has been started or some processes have been terminated in the virtualization environment, it is determined that there is abnormal operation targeting the virtualization runtime environment.

[0084] In the above method, by comparing the first feature information and the second feature information through the third security component, changes in the virtualization operating environment can be identified in a timely manner during the operation of the first application, which is beneficial to improving system security.

[0085] In some embodiments, the third security component only collects internal data of the virtualization runtime environment to identify abnormal operation behavior. This method has a potential drawback: if a cheat program disguises itself as the kernel space of the first device and performs abnormal operations on the internal data of the virtualization runtime environment, the third security component cannot identify these abnormal operations due to the lack of data information from the kernel space and user space of the first device. In this case, embodiments of this application provide a comprehensive solution combining the first, second, and third security components. Specifically, as follows... Figure 4 As shown, the third security component and the first security component have a communication connection. The third security component sends the third action sequence information to the first security component. The first security component determines whether there is any abnormal operation behavior against the first application based on the third action sequence information and the second action sequence information.

[0086] In this scenario, the first, second, and third security components simultaneously enable the security protection corresponding to the second security level, such as memory protection, file protection, process protection, and anti-debugging protection. For example, regarding memory protection, the third security component can monitor memory operation behavior of the first application. For instance, the third security component can monitor memory read and write operations in real time to detect abnormal memory access patterns (such as out-of-bounds access or illegal writes). Simultaneously, the first and second security components also perform similar monitoring operations at memory monitoring points. For example, the first and second security components can set monitoring points in specific memory address regions to monitor memory operations in those regions in real time, ensuring no unauthorized access or tampering occurs. Furthermore, the third security component monitors the memory operations of the first application and generates third-line sequence information. This third-line sequence information may include operation type (e.g., read, write), operation object (e.g., memory address), and operation time. Similarly, the second security component monitors memory operations in the kernel space of the first device and generates second-line sequence information. The first security component monitors memory operations in the user space of the first device and generates first-line sequence information.

[0087] The second security component then sends the detected second behavior sequence information to the first security component, and the third security component sends the detected third behavior sequence information to the first security component. The first security component integrates the first, second, and third behavior sequence information for anomaly detection. This can be done by comparing the data with predefined normal behavior patterns or using machine learning models to detect abnormal behavior. For example, it can detect continuous illegal memory write operations or abnormally frequent memory read operations. Finally, based on the analysis results, a detailed memory operation behavior report is generated, including which operations were normal, which were abnormal, and the specific details of the abnormal operations (such as operation time, user, and target).

[0088] The above method utilizes a virtualized runtime environment that operates independently and in isolation. The third security component can send internal data from the virtualized runtime environment to the first security component, enabling the first security component to comprehensively utilize the third line sequence information along with the previously acquired first and second line sequence information, thereby achieving more comprehensive and in-depth security protection for the first application.

[0089] Please refer to Figure 5 This illustrates a flowchart of a security protection method for an application provided in another embodiment of this application. The executing entity for each step of this method can be a first device, which can be a computer device, for example, the computer device can be... Figure 1 The terminal device 10 may include the following steps (S1 to S4).

[0090] Step S1: Determine whether to enable security system management, which is used to provide security protection for the first application.

[0091] Step S2: With security system management enabled, determine the security levels corresponding to the first and second security components according to requirements. For example, when the security level corresponding to the first and second security components is the second security level, then the first and second security components enable memory protection, file protection, process protection, and anti-debugging protection. Then execute the following steps S3-S4. For example, when the security level corresponding to the first and second security components is the first security level, then the first and second security components enable anti-debugging protection, and steps S3-S4 are not executed.

[0092] Step S3: Establish a secure communication component, that is, load the third secure component, and establish a communication connection between the third secure component and the first secure component and / or establish a communication connection between the third secure component and the second secure component.

[0093] Step S4: The third security component can also monitor the virtualization runtime environment based on the first feature information to determine whether there are any anomalies in the virtualization runtime environment.

[0094] In some embodiments, such as Figure 4 As shown, the third security component and the second security component also have a communication connection; the third security component sends the third action sequence information to the second security component; the second security component forwards the third action sequence information to the first security component; the first security component determines whether there is any abnormal operation behavior against the first application based on the third action sequence information received from the third security component and the third action sequence information received from the second security component.

[0095] In some embodiments, the first security component compares the third behavior sequence information received from the third security component with the third behavior sequence information received from the second security component. When the content contained in the third behavior sequence information received from the third security component is consistent with that contained in the third behavior sequence information received from the second security component, it is determined that there is no abnormal operation behavior targeting the first application. When the content contained in the third behavior sequence information received from the third security component is inconsistent with that contained in the third behavior sequence information received from the second security component, it indicates that the third behavior sequence information has been tampered with, and it is determined that there is abnormal operation behavior targeting the first application.

[0096] In some embodiments, the third security component sends the third action sequence information to both the second and first security components. When the first security component does not receive the third action sequence information, it may be because the third action sequence information is intercepted by the plug-in program, and at this time, it is determined that there is abnormal operation behavior.

[0097] In some embodiments, the third security component may also send the third line sequence information to the second security component. When the third line sequence information sent by the third security component to the first security component is intercepted or not successfully received, the second security component may forward the third line sequence information to the first security component to ensure the transmission of the third line sequence information.

[0098] The above method, on the one hand, enhances the reliability and redundancy of information transmission through the forwarding function of the second security component. Even if the direct transmission of the third security component fails in certain situations, the first security component can still obtain the third-line sequence information through the second security component. This multi-path information transmission mechanism not only improves the overall stability of the system but also ensures secure operation in various complex environments. On the other hand, by comparing the third-line sequence information received by the first and second security components, the integrity and authenticity of the information can be ensured, preventing tampering or loss of information during transmission.

[0099] In some embodiments, in response to a startup command for a first application, the security level corresponding to the first application is compared with the security level corresponding to the virtualized runtime instance; if the security level corresponding to the first application and the security level corresponding to the virtualized runtime instance match, the first application is started; if the security level corresponding to the first application and the security level corresponding to the virtualized runtime instance do not match, the first application is not started.

[0100] A launch command for the first application refers to any operation or request that triggers the system to launch the first application. For example, a user can send a request to launch the first application directly to the system through a graphical user interface, such as clicking the first application icon or entering a launch command in the command-line interface.

[0101] In some embodiments, the security level may include the first security level (which may be a low security level) and the second security level (which may be a high security level). When the security level of the first application is lower than or equal to that of the virtualization instance, it is determined that the security level corresponding to the first application and the security level corresponding to the virtualization instance match. When the security level of the first application is higher than that of the virtualization instance, it is determined that the security level corresponding to the first application and the security level corresponding to the virtualization instance do not match. For example, the low security level can be denoted as V1, and the high security level as V2. When the security level corresponding to the first application is V1 or V2, and the security level corresponding to the virtualization instance is V2, then the two match. When the security level corresponding to the first application is V1, and the security level corresponding to the virtualization instance is V1, then the two match. When the security level corresponding to the first application is V1, and the security level corresponding to the virtualization instance is V2, then the two do not match.

[0102] The above method, by comparing the security levels of the first application and the virtualized runtime instance, enables the system to effectively control the startup process of the first application, ensuring that it runs in an environment matching its security level. This mechanism not only improves the overall security of the system but also ensures that appropriate and corresponding security protection can be provided to the first application based on its security requirements.

[0103] Please refer to Figure 6 The diagram illustrates a startup verification of a first application according to an embodiment of this application. It may include the following steps: (1) When the first application (APP) is about to start in the virtual user space, a third security component sends startup information to the first security component, the startup information indicating the security level corresponding to the first application.

[0104] (2) The first security component queries the configuration information stored on the server side, which is used to indicate the security level corresponding to the virtualization running instance of the first device.

[0105] (3) The first security component performs a startup verification for the first application based on the security level corresponding to the virtualization runtime instance and the security level corresponding to the first application. If the first application passes the startup verification, it is started; if the first application fails the startup verification, it is not started.

[0106] In some embodiments, if any one of the first security component, the second security component, and the third security component determines that there is abnormal operation behavior, it sends the abnormal information corresponding to the abnormal operation behavior to the other security components.

[0107] In some embodiments, any one of the first security component, the second security component, and the third security component monitors user operation behavior in real time. When a security component detects abnormal operation behavior (such as unauthorized access, data tampering, malicious software execution, etc.), it immediately generates and records the corresponding abnormal information and sends the abnormal information to other security components.

[0108] The above method reduces the impact on system security when a single security component fails by working together with multiple security components.

[0109] In some embodiments, such as Figure 7 As shown, if any one of the first security component, the second security component, or the third security component determines that there is an abnormal operation, it sends the abnormal information corresponding to the abnormal operation to the server. The server then uses the abnormal information to determine the processing information corresponding to the abnormal operation.

[0110] The abnormal information corresponding to the abnormal operation refers to the detailed data and logs related to that abnormal operation. This information may include timestamps, operation type, operation user, operation object, exception type, exception level, etc.

[0111] The processing information may include at least one of the following: penalty information, remediation information, security policy adjustment information, and notification information. Penalty information refers to punitive measures taken against abnormal operational behavior, such as disabling user accounts, restricting access permissions, and issuing alerts. Remediation information provides suggestions for resolving abnormal operational behavior, such as vulnerability patching and system updates. Security policy adjustment information includes adjustments to current security policies based on abnormal operational behavior to prevent similar incidents from recurring. Notification information notifies relevant administrators or users about the abnormal operational behavior, ensuring they can take timely action.

[0112] In some embodiments, the server uses a machine learning model to determine the penalty information corresponding to the abnormal operation based on the anomaly information. Specifically, the machine learning model can be a neural network model used for processing classification tasks, which outputs the corresponding penalty category or penalty level based on the input anomaly information. For example, the output may be "disable account", "restrict access", or "send alarm notification".

[0113] In some embodiments, the server uses a machine learning model to determine repair information corresponding to the abnormal operation behavior based on the anomaly information. Specifically, the machine learning model can be a neural network model used to process regression tasks, which outputs corresponding repair information, such as specific parameters of the repair strategy, based on the input anomaly information.

[0114] In some embodiments, the server used to determine the processing information corresponding to the abnormal operation behavior based on the abnormal information may be the same server as the server used to store configuration information and the server used to provide background services for the client of the first application, or they may not be the same server. This application does not limit this.

[0115] The above method involves sending abnormal information to a server, which can then perform in-depth analysis and processing using a machine learning model to generate corresponding processing information.

[0116] The technical solution provided in this application can be applied to anti-fraud scenarios for PC-based mobile virtualization applications. The mobile application can be an Android application or an iOS (iPhone Operating System) application; this application does not limit the application to either. This description uses an Android application as an example. Please refer to... Figure 8 This illustrates a flowchart of a security protection method for an application provided in another embodiment of this application. The execution entity for each step of this method can be a first device; for example, the first device could be... Figure 1 The terminal device 10 in the method may include at least one of the following steps 810 to 840.

[0117] Step 810: In the PC user space, create a virtualized runtime instance corresponding to the Android application. The virtualized runtime instance is used to provide a virtualized runtime environment for the Android application. The virtualized runtime environment includes the Android virtual user space and the Android virtual kernel space. The Android application runs in the Android virtual user space.

[0118] PC user space refers to the user mode in a PC operating system, while PC kernel space refers to the kernel mode in a PC operating system. The operating system kernel can directly access system resources and hardware, and is responsible for managing hardware devices, memory allocation, process scheduling, and other low-level operations. This PC operating system can be Windows, Linux, or other PC operating systems; this application does not limit its scope.

[0119] Android applications can be Android games, Android social applications, Android office applications, and this application does not limit this. The aforementioned Android virtual user space provides an isolated and secure runtime environment for Android applications, storing application code and data, and interacting with the virtual kernel through system call interfaces. The Android virtual kernel space is responsible for handling system call requests, managing virtual machine resources and hardware emulation, and ensuring that Android applications can perform their tasks in a stable and efficient runtime environment.

[0120] In some embodiments, a virtualization runtime instance includes a virtualization engine and a virtualization backend; creating a virtualization runtime instance corresponding to an Android application may include the following steps: creating a virtualization engine corresponding to the Android application, the virtualization engine being used to schedule hardware and software resources provided by the virtualization backend; creating a virtualization backend corresponding to the virtualization engine, the virtualization backend referring to the hardware and software resources that support the operation of the virtualization engine.

[0121] A virtualized runtime instance for an Android application refers to a simulated Android runtime environment created in the PC user space. This environment provides the Android application with runtime conditions that conform to the Android operating system specifications. Using the above method, the virtualization engine and virtualization backend can dynamically allocate the necessary resources to the Android application according to its specific needs, ensuring its smooth operation and thus guaranteeing the normal functioning of the Android application.

[0122] Step 820: Load the PC user security component in the PC user space and the PC kernel security component in the PC kernel space. The PC user security component and the PC kernel security component are used to provide security protection for the PC user space and the PC kernel space. The PC user security component and the PC kernel security component have a communication connection.

[0123] Step 830: During the operation of the Android application in the Android virtual user space, the PC user security component monitors at least one operation performed on the Android application in the PC user space to obtain first operation sequence information; and the PC kernel security component monitors at least one operation performed on the Android application in the PC kernel space to obtain second operation sequence information, and sends the second operation sequence information to the PC kernel security component.

[0124] At least one action performed on an Android application refers to a specific operation or request made by a user during the operation of the Android application. Actions can include normal actions and abnormal actions. For example, when the application is an Android game, normal actions for an Android game can include tapping the screen, swiping the screen, selecting in-game options, entering game commands, loading resources, etc. Abnormal actions can include malicious attacks, attempts to illegally modify game data, unauthorized execution of external scripts, abnormal memory access, unauthorized system call attempts, etc.

[0125] Step 840: The PC user security component determines whether there is any abnormal operation behavior targeting the Android application based on the first line sequence information and the second line sequence information.

[0126] In some embodiments, if the PC user security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it is determined that there is abnormal operation behavior for the Android application, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is abnormal.

[0127] The following describes the specific implementation method for security protection of Android applications when the virtualized runtime instance includes multiple security levels.

[0128] In some embodiments, the security level corresponding to the virtualized running instance includes a first security level and a second security level. The virtualized running instance of the first security level is used to monitor the external behavior sequence information of the Android application, and the virtualized running instance of the second security level is used to monitor the internal behavior sequence information of the Android application. The external behavior sequence information is used to indicate the operation behavior on external data of the Android application, and the internal behavior sequence information is used to indicate the operation behavior on internal data of the Android application.

[0129] In some embodiments, such as Figure 9 As shown, the Android application loads an Android security component; the Android security component monitors at least one operation behavior performed on the Android application in the Android virtual user space and Android virtual kernel space to obtain third behavior sequence information; the third security component determines whether there is any abnormal operation behavior on the Android application based on the third behavior sequence information.

[0130] For example, operations in the Android virtual user space can include user interface operations such as clicking buttons, swiping the screen, entering text, and selecting menu items; system call requests from applications such as file operations, network communication, permission requests, and resource management; and internal state changes within the application such as object creation, data updates, thread scheduling, and timer triggering. For example, operations in the Android virtual kernel space can include kernel-level system call processing such as device driver calls, memory management, process scheduling, and interrupt handling; and simulated virtual device behaviors such as screen input, camera operations, sensor data simulation, and calls to the Hardware Abstraction Layer (HAL). By monitoring these operations and recording their specific data, the Android security component can obtain third-party sequence information.

[0131] In some embodiments, the PC stores first characteristic information of the virtualization runtime instance, which is used to determine the type of the virtualization runtime environment. The second characteristic information corresponding to the virtualization runtime instance at a first time is obtained through the Android security component. The first time refers to any time during the operation of the Android application. The second characteristic information is used to indicate the type of the virtualization runtime environment corresponding to the first time. The third security component determines whether there is any abnormal operation behavior targeting the virtualization runtime environment based on the first and second characteristic information.

[0132] It is understandable that there is a one-to-one correspondence between an Android virtualization runtime instance and its corresponding first feature information. That is, one Android virtualization runtime instance corresponds to one first feature information, and different Android virtualization runtime instances can correspond to different first feature information.

[0133] In some embodiments, such as Figure 9 As shown, there is a communication connection between the Android security component and the PC user security component. The Android security component sends the third-line sequence information to the PC user security component. The PC user security component then determines whether there is any abnormal operation behavior targeting the Android application based on the third-line sequence information and the second-line sequence information.

[0134] In some embodiments, such as Figure 9 As shown, there is also a communication connection between the Android security component and the PC kernel security component; the Android security component sends the third-line sequence information to the PC kernel security component; the PC kernel security component forwards the third-line sequence information to the PC user security component; the PC user security component determines whether there is any abnormal operation behavior against the Android application based on the third-line sequence information received from the Android security component and the third-line sequence information received from the PC kernel security component.

[0135] In some embodiments, in response to a launch command for an Android application, the security level corresponding to the Android application is compared with the security level corresponding to the virtualization instance; if the security level corresponding to the Android application and the security level corresponding to the virtualization instance match, the Android application is launched; if the security level corresponding to the Android application and the security level corresponding to the virtualization instance do not match, the Android application is not launched.

[0136] In some embodiments, if any one of the PC user security component, PC kernel security component, and Android security component determines that there is abnormal operation behavior, it sends the abnormal information corresponding to the abnormal operation behavior to other security components.

[0137] In some embodiments, if any one of the PC user security component, PC kernel security component, and Android security component determines that there is abnormal operation behavior, it sends the abnormal information corresponding to the abnormal operation behavior to the server, and the server uses the abnormal information to determine the processing information corresponding to the abnormal operation behavior.

[0138] For details not covered above, please refer to the corresponding descriptions above.

[0139] In summary, the technical solution provided in this application, targeting scenarios where Android applications run in an Android virtualization runtime environment, loads a PC user security component and a PC kernel security component into the PC. These components monitor user actions performed on the Android application in the PC user space and PC kernel space, respectively, thereby obtaining first and second action sequence information. This first and second action sequence information comprehensively reflects the user's specific actions at both the user and kernel levels. Then, by comprehensively analyzing the first and second action sequence information, the PC user security component can effectively identify abnormal actions, thus achieving security protection for the Android application.

[0140] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0141] Please refer to Figure 10 This diagram illustrates a block diagram of a security protection device for an application provided in one embodiment of this application. The device 1000 may include: a creation module 1010, a loading module 1020, a first monitoring module 1030, and a determination module 1040.

[0142] The creation module 1010 is used to create a virtualized runtime instance corresponding to a first application in the user space of the first device. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space.

[0143] The loading module 1020 is used to load a first security component in the user space of the first device and a second security component in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device. The first security component and the second security component have a communication connection.

[0144] The first monitoring module 1030 is configured to, during the running of the first application in the virtual user space, monitor at least one operation behavior performed on the first application in the user space of the first device through the first security component to obtain first behavior sequence information; and to monitor at least one operation behavior performed on the first application in the kernel space of the first device through the second security component to obtain second behavior sequence information, and send the second behavior sequence information to the first security component.

[0145] The determination module 1040 is used to determine, through the first security component, whether there is any abnormal operation behavior targeting the first application based on the first behavior sequence information and the second behavior sequence information.

[0146] In some embodiments, the determining module 1040 is configured to determine that there is abnormal operation behavior for the first application when the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is the abnormal operation behavior.

[0147] In some embodiments, the first application loads a third security component; the device 1000 further includes: a second monitoring module ( Figure 10 (Not shown in the image).

[0148] The second monitoring module is used to monitor at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space through the third security component, and obtain third behavior sequence information; and to determine whether there is any abnormal operation behavior on the first application based on the third behavior sequence information through the third security component.

[0149] In some embodiments, the third security component and the first security component have a communication connection, and the second monitoring module is used to send the third behavior sequence information to the first security component through the third security component; the first security component determines whether there is any abnormal operation behavior against the first application based on the third behavior sequence information and the second behavior sequence information.

[0150] In some embodiments, the third security component and the second security component also have a communication connection; the second monitoring module is used to send the third behavior sequence information to the second security component through the third security component; to forward the third behavior sequence information to the first security component through the second security component; and to determine whether there is any abnormal operation behavior against the first application through the first security component based on the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component.

[0151] In some embodiments, the security level corresponding to the virtualization runtime instance includes a first security level and a second security level. The virtualization runtime instance with the first security level is used to monitor the external behavior sequence information of the first application, and the virtualization runtime instance with the second security level is used to monitor the internal behavior sequence information of the first application. The external behavior sequence information is used to indicate operation behavior on external data of the first application, and the internal behavior sequence information is used to indicate operation behavior on internal data of the first application. The second monitoring module is used to perform the step of monitoring at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space by the third security component to obtain the third behavior sequence information when the security level corresponding to the virtualization runtime instance is the second security level.

[0152] In some embodiments, the second monitoring module is configured to, in response to a startup command for the first application, compare the security level corresponding to the first application with the security level corresponding to the virtualization instance; if the security level corresponding to the first application and the security level corresponding to the virtualization instance match, then the first application is started; if the security level corresponding to the first application and the security level corresponding to the virtualization instance do not match, then the first application is not started.

[0153] In some embodiments, the first device stores first characteristic information of the virtualization runtime instance, the first characteristic information being used to determine the type of the virtualization runtime environment; the second monitoring module is used to obtain second characteristic information corresponding to the virtualization runtime instance at a first time through the third security component, the first time referring to any time during the operation of the first application, the second characteristic information being used to indicate the type of the virtualization runtime environment corresponding to the first time; and the third security component determines whether there is any abnormal operation behavior targeting the virtualization runtime environment based on the first characteristic information and the second characteristic information.

[0154] In some embodiments, the device 1000 further includes: a transmitting module ( Figure 10 (Not shown in the image).

[0155] The sending module is used for at least one of the following: when any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, sending abnormal information corresponding to the abnormal operation behavior to other security components; when any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, sending abnormal information corresponding to the abnormal operation behavior to the server, wherein the server is used to determine processing information corresponding to the abnormal operation behavior based on the abnormal information.

[0156] In some embodiments, the virtualization runtime instance includes a virtualization engine and a virtualization backend; the creation module 1010 is used to create a virtualization engine corresponding to the first application, the virtualization engine is used to schedule the hardware and software resources provided by the virtualization backend; and to create the virtualization backend corresponding to the virtualization engine, the virtualization backend referring to the hardware and software resources that support the operation of the virtualization engine.

[0157] The technical solution provided in this application addresses scenarios where applications run in a virtualized environment. It loads a first security component and a second security component into a first device. These two components monitor user actions performed on the first application in the user space and kernel space of the first device, respectively, obtaining first and second action sequence information. This first and second action sequence information comprehensively reflects the user's specific actions at both the user and kernel levels. Then, by comprehensively analyzing the first and second action sequence information, the first security component effectively identifies abnormal actions, thereby achieving security protection for the first application.

[0158] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when implementing its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0159] Please refer to Figure 11 The diagram shows a structural block diagram of a computer device 1100 provided in one embodiment of this application.

[0160] Typically, computer device 1100 includes a processor 1110 and a memory 1120.

[0161] Processor 1110 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1110 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1110 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1110 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1110 may also include an AI processor for handling computational operations related to machine learning.

[0162] The memory 1120 may include one or more computer-readable storage media, which may be non-transitory. The memory 1120 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1120 are used to store a computer program configured to be executed by one or more processors to implement the security protection method for the aforementioned application.

[0163] In some embodiments, a computer-readable storage medium is also provided, wherein a computer program is stored therein, the computer program being loaded and executed by a processor to implement the security protection method for the application described above.

[0164] Optionally, the computer-readable storage medium may include: ROM (Read-Only Memory), RAM (Random-Access Memory), SSD (Solid State Drives), or optical disc, etc. The random access memory may include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0165] In some embodiments, a computer program product is also provided, the computer program product including a computer program stored in a computer-readable storage medium, and a processor reading from the computer-readable storage medium and executing the computer program to implement the above-described security protection method for the application.

[0166] It should be understood that "multiple" as used herein refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. Furthermore, the step numbers described herein are merely illustrative of one possible execution order. In some other embodiments, the steps may not be executed in numerical order, such as two steps with different numbers being executed simultaneously, or two steps with different numbers being executed in the reverse order of the illustration. This application does not limit this.

[0167] The above description is merely an exemplary embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for protecting the security of an application, characterized in that, The method includes: In the user space of the first device, a virtualized runtime instance corresponding to the first application is created. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space. A first security component is loaded in the user space of the first device, and a second security component is loaded in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device, and there is a communication connection between the first security component and the second security component. During the operation of the first application in the virtual user space, the first security component monitors at least one operation performed on the first application in the user space of the first device to obtain first action sequence information; and the second security component monitors at least one operation performed on the first application in the kernel space of the first device to obtain second action sequence information, and sends the second action sequence information to the first security component. The first security component determines whether there is any abnormal operation behavior targeting the first application based on the first behavior sequence information and the second behavior sequence information.

2. The method according to claim 1, characterized in that, The step of determining whether there is any abnormal operation behavior targeting the first application by the first security component based on the first behavior sequence information and the second behavior sequence information includes: If the first security component detects that at least one of the first behavior sequence information and the second behavior sequence information includes abnormal behavior information, it determines that there is abnormal operation behavior for the first application, wherein the abnormal behavior information refers to behavior information indicating that the operation behavior is the abnormal operation behavior.

3. The method according to claim 1 or 2, characterized in that, The first application loads a third security component; the method further includes: The third security component monitors at least one operational behavior performed on the first application in the virtual user space and the virtual kernel space to obtain third behavior sequence information. The third security component determines whether there is any abnormal operation behavior targeting the first application based on the third behavior sequence information.

4. The method according to claim 3, characterized in that, The third security component and the first security component have a communication connection, and the method further includes: The third action sequence information is sent to the first security component through the third security component; The first security component determines whether there is any abnormal operation behavior targeting the first application based on the third behavior sequence information and the second behavior sequence information.

5. The method according to claim 3 or 4, characterized in that, The third security component and the second security component also have a communication connection; the method further includes: The third action sequence information is sent to the second security component via the third security component; The third action sequence information is forwarded to the first security component through the second security component; The first security component determines whether there is any abnormal operation behavior targeting the first application based on the third behavior sequence information received from the third security component and the third behavior sequence information received from the second security component.

6. The method according to any one of claims 3 to 5, characterized in that, The security levels corresponding to the virtualization runtime instance include a first security level and a second security level. The virtualization runtime instance of the first security level is used to monitor the external behavior sequence information of the first application, and the virtualization runtime instance of the second security level is used to monitor the internal behavior sequence information of the first application. The external behavior sequence information is used to indicate the operation behavior on external data of the first application, and the internal behavior sequence information is used to indicate the operation behavior on internal data of the first application. The method further includes: When the security level corresponding to the virtualized running instance is the second security level, the step of monitoring at least one operation behavior performed on the first application in the virtual user space and the virtual kernel space by the third security component to obtain the third behavior sequence information is performed.

7. The method according to claim 6, characterized in that, The method further includes: In response to the launch command for the first application, the security level corresponding to the first application is compared with the security level corresponding to the virtualization runtime instance; If the security level of the first application matches the security level of the virtualization instance, then the first application is started. If the security level of the first application does not match the security level of the virtualization instance, the first application will not be started.

8. The method according to any one of claims 3 to 7, characterized in that, The first device stores first characteristic information of the virtualization runtime instance, the first characteristic information being used to determine the type of the virtualization runtime environment, and the method further includes: The third security component obtains the second feature information corresponding to the virtualization runtime instance at a first time, where the first time refers to any time during the execution of the first application, and the second feature information is used to indicate the type of the virtualization runtime environment corresponding to the first time. The third security component determines whether there are any abnormal operational behaviors targeting the virtualization runtime environment based on the first feature information and the second feature information.

9. The method according to any one of claims 3 to 8, characterized in that, The method further includes at least one of the following: If any one of the first security component, the second security component, and the third security component determines that the abnormal operation behavior exists, the abnormal information corresponding to the abnormal operation behavior is sent to the other security components. If any one of the first security component, the second security component, or the third security component determines that the abnormal operation behavior exists, it sends the abnormal information corresponding to the abnormal operation behavior to the server. The server is used to determine the processing information corresponding to the abnormal operation behavior based on the abnormal information.

10. The method according to any one of claims 1 to 9, characterized in that, The virtualization runtime instance includes a virtualization engine and a virtualization backend; Creating a virtualized runtime instance corresponding to the first application in the user space of the first device includes: Create a virtualization engine corresponding to the first application, the virtualization engine being used to schedule the hardware and software resources provided by the virtualization backend; Create the virtualization backend corresponding to the virtualization engine. The virtualization backend refers to the hardware and software resources that support the operation of the virtualization engine.

11. A security protection device for an application, characterized in that, The device includes: A creation module is used to create a virtualized runtime instance corresponding to a first application in the user space of the first device. The virtualized runtime instance is used to provide a virtualized runtime environment for the first application. The virtualized runtime environment includes a virtual user space and a virtual kernel space. The first application runs in the virtual user space. A loading module is used to load a first security component in the user space of the first device and a second security component in the kernel space of the first device. The first security component and the second security component are used to provide security protection for the user space and the kernel space of the first device. The first security component and the second security component have a communication connection. The first monitoring module is configured to, during the process of the first application running in the virtual user space, monitor at least one operation behavior performed on the first application in the user space of the first device through the first security component to obtain first behavior sequence information; and to monitor at least one operation behavior performed on the first application in the kernel space of the first device through the second security component to obtain second behavior sequence information, and send the second behavior sequence information to the first security component. The determination module is used to determine, through the first security component, whether there is any abnormal operation behavior targeting the first application based on the first behavior sequence information and the second behavior sequence information.

12. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing a computer program that is loaded and executed by the processor to implement the method as claimed in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which is loaded and executed by a processor to implement the method as described in any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes a computer program that is loaded and executed by a processor to implement the method as described in any one of claims 1 to 10.

Images