Application updating processing method, application store cloud and readable storage medium

Abstract

The invention discloses an application updating processing method, an application store cloud and a readable storage medium. The method is applied to an application store cloud, and comprises the steps that the application store cloud receives related malicious information of a target application, and the related malicious information is obtained after the target application is detected as a malicious application by a target terminal device; the application store cloud judges whether the target application is subjected to hot update or whole package update of a non-application store channel according to the related malicious information; and if yes, the application store cloud pushes the related malicious information to other terminal devices installed with the target application for safety prompting. Through the above mode, the discovery rate of the application store cloud for malicious hot update behaviors is improved, and the timely prevention of other terminal devices for corresponding applications is improved.

Description

Technical Field

[0001] The present application relates to the technical field of application update, and in particular to a method for processing application updates, an application store cloud, and a readable storage medium. Background Art

[0002] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0003] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the terminal device application store. After reaching the terminal device, it uses hot update behavior to download and run malicious code modules, endangering the data and property security of the terminal device. Summary of the invention

[0004] The present application provides an application update processing method, an application store cloud, and a readable storage medium, which can improve the detection rate of malicious hot update behaviors by the application store cloud and improve the timely prevention of corresponding applications by other terminal devices.

[0005] In a first aspect, the present application provides a method for processing application updates, which is applied to an application store cloud. The method includes: the application store cloud receives relevant malicious information of a target application, and the relevant malicious information is obtained after the target application is detected as a malicious application by a target terminal device; the application store cloud determines whether the target application has been hot updated or updated in a whole package through a non-application store channel based on the relevant malicious information; if so, the application store cloud pushes the relevant malicious information to the remaining terminal devices that have installed the target application for security prompts.

[0006] In a second aspect, the present application provides an application store cloud, which includes a processor and a memory and a communication module coupled to the processor, the communication module being used to communicate with a terminal device; wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the method provided in the first aspect.

[0007] In a third aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method provided in the first aspect.

[0008] The beneficial effects of the present application are as follows: Different from the prior art, the application update processing method, application store cloud and readable storage medium provided by the present application, on the one hand, have the terminal device report the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the detection rate of malicious hot updating behavior by the application store cloud; on the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] in:

[0011] Figure 1 It is a flowchart of an embodiment of a method for processing application updates provided by the present application;

[0012] Figure 2 It is a flowchart of another embodiment of the processing method for application update provided by the present application;

[0013] Figure 3 It is a flowchart of another embodiment of the processing method for application update provided by the present application;

[0014] Figure 4 It is a flowchart of another embodiment of the processing method for application update provided by the present application;

[0015] Figure 5 It is a flowchart of another embodiment of the processing method for application update provided by the present application;

[0016] Figure 6 It is a structural diagram of an embodiment of an application store cloud provided by the present application;

[0017] Figure 7 It is a structural schematic diagram of an embodiment of an electronic device provided by the present application;

[0018] Figure 8 It is a structural schematic diagram of an embodiment of a computer-readable storage medium provided by the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It will be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only some but not all structures related to the present application are shown in the drawings. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0020] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0021] With the intelligence of terminal devices, terminal devices can install various types of applications to provide convenience for users. Most applications use the application hot update solution to achieve the purpose of application fault repair, or update code modules and resources. The current mainstream hot update method is that the application will actively download the corresponding patch file when it is running, and then merge the original file with the patch file on the terminal device, or place a new patch file in the directory for subsequent new function calls.

[0022] In this process, malicious applications can use hot update technology to successfully bypass the security detection of application software before it is put on the shelves in the terminal device application store. After reaching the terminal device, it uses hot update behavior to download and run malicious code modules, endangering the data and property security of the terminal device.

[0023] Most of the current terminal equipment manufacturers do not conduct targeted detection or restrictions on application hot update behavior. Most application stores do not restrict the listing of applications with hot update behavior. The patch files used for application hot update are downloaded by the application on the terminal device from the application's own server and directly reach the terminal device. The application store has no perception of the distribution of patch files and can only rely on manual discovery and acquisition of patch files. Subsequently, the entire application after the hot update using the patch file is subjected to security detection.

[0024] App stores mainly rely on manual discovery of patch files to trigger security detection of hot-updated apps. This detection mechanism has low application coverage and detection efficiency. In addition, when apps download, install, and execute malicious code on terminal devices through hot-update, app stores are difficult to detect in a timely manner and cannot provide timely feedback to other terminal devices.

[0025] Based on this, this application proposes that the terminal device report the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the detection rate of malicious hot updating behavior by the application store cloud. On the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security.

[0026] Please refer to any of the following technical solutions for details.

[0027] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of a method for processing application updates provided by the present application. Applied to the application store cloud, the method includes:

[0028] Step 11: The application store cloud receives the relevant malicious information of the target application. The relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device.

[0029] In some embodiments, each terminal device is provided with an application store application corresponding to the application store cloud. Users can download the corresponding application from the application store cloud through the application store application, install and use it. And corresponding security application software is installed on the terminal device, such as one or more applications such as security manager, security guard or system manager. The security application software can perform security detection on the applications on the terminal device according to a preset period to determine whether these applications are malicious applications. When a malicious application is detected on the terminal device, the relevant malicious information of the application is sent to the application store cloud through the application store on the terminal device.

[0030] In some embodiments, the relevant malicious information may be a first version number of a target application in a target terminal device.

[0031] In some embodiments, the relevant malicious information may be the first code file identifier of the target application in the target terminal device. The first code file identifier is obtained based on the code file of the target application. For example, a hash calculation is performed on the code file to obtain a corresponding hash value, and this hash value is used as the first code file identifier. That is, the code file identifier of the present application is unique. If the content in the code file is modified, the corresponding code file identifier will also change.

[0032] In some embodiments, the relevant malicious information may be the first version number and the first code file identifier of the target application in the target terminal device. After receiving the relevant malicious information, the application store cloud indicates to the application store cloud that the target application is detected as a malicious application.

[0033] In other embodiments, the relevant malicious information also includes a malicious detection result. The malicious detection result is used to indicate to the application store cloud that the target application is detected as a malicious application.

[0034] Step 12: The app store cloud determines whether the target app has been hot-updated or updated in its entirety through a non-app store channel based on the relevant malicious information.

[0035] If the target application has been hot-updated or updated in a whole package from a non-app store channel in the corresponding target terminal device, the information in the relevant malicious information received by the app store cloud will be different from the corresponding information in the app store cloud, and it can be determined that the target application has been hot-updated or updated in a whole package from a non-app store channel. When it is determined that the target application has been hot-updated or updated in a whole package from a non-app store channel, execute step 13. When it is determined that the target application has not been hot-updated or updated in a whole package from a non-app store channel, it indicates that the malicious situation caused by the non-update of the target application requires additional processing.

[0036] Step 13: The app store cloud pushes the relevant malicious information to other terminal devices that have the target app installed as a security reminder.

[0037] Because the same application may be used by multiple terminal devices, that is, multiple terminal devices have the same target application installed. And because of the differences in the network and usage of different terminal devices (such as different security detection timings of security application software), it is possible that other terminals have not yet detected that the application is a malicious application. After the application store cloud determines that the target application has been hot-updated or the whole package has been updated through a non-application store channel, it can push the relevant malicious information to the other terminal devices that have installed the target application for security prompts, so that the other terminal devices can monitor the update of the target application, and when it is detected that the target application has been hot-updated or the whole package has been updated through a non-application store channel, restrict the access to resources and perform security detection on the target application.

[0038] That is, when the other terminal devices receive the relevant malicious information of the target application, they will monitor the update of the target application installed by themselves, and when it is detected that the target application has been hot-updated or the whole package has been updated through a non-app store channel, the target application will be restricted in access to resources and security checks will be performed. Since the hot update of the application or the whole package update through a non-app store channel is imperceptible to the user, when it is detected that the target application has been hot-updated or the whole package has been updated through a non-app store channel, it may have been updated. Therefore, in order to ensure the security of the terminal device, the target application is restricted in access to resources and the updated target application is security checked. For example, the target application is restricted from accessing security data, user data, and sensitive resources such as finance and privacy in the terminal device.

[0039] In this embodiment, on the one hand, the terminal device reports the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the application store cloud's detection rate of malicious hot updating behavior. On the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security.

[0040] See also Figure 2 , Figure 2 This is a flow chart of another embodiment of the processing method for application updates provided by the present application. Applied to the application store cloud, the method includes:

[0041] Step 21: The application store cloud receives the relevant malicious information of the target application. The relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device.

[0042] Step 21 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0043] In this embodiment, the relevant malicious information may include the first version number of the target application in the target terminal device.

[0044] Step 22: The application store cloud determines whether the target application has been hot-updated or fully updated through a non-application store channel according to the first version number and the second version number in the application store cloud.

[0045] When an application is updated, the version number is usually used to determine whether there is a change. For example, if the version number before the application is updated is A1 and the version number after the update is A2, then the application has been updated.

[0046] The second version number in the application store cloud is the version number corresponding to the target application in the application store cloud. That is, when the terminal device downloads and installs the application from the application store cloud, the version number of the application is the second version number.

[0047] Based on this, the app store cloud determines whether the target application has been hot updated or updated in a whole package through a non-app store channel according to the first version number and the second version number in the app store cloud. If a hot update or a whole package update through a non-app store channel has been performed, step 23 is executed.

[0048] That is, if the first version number and the second version number are the same, it means that the target application has not been hot-updated or updated in a whole package through a non-app store channel. If the first version number and the second version number are different, it means that the target application has been hot-updated or updated in a whole package through a non-app store channel.

[0049] Step 23: The app store cloud pushes the relevant malicious information to other terminal devices that have the target app installed as a security reminder.

[0050] Step 23 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0051] In this embodiment, on the one hand, the terminal device reports the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the application store cloud's detection rate of malicious hot updating behavior. On the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security.

[0052] Furthermore, by comparing the version numbers, it is determined whether a hot update or a whole package update through a non-app store channel has been performed.

[0053] See also Figure 3 , Figure 3 This is a flow chart of an embodiment of a method for processing application updates provided by the present application. Applied to the application store cloud, the method includes:

[0054] Step 31: The application store cloud receives the relevant malicious information of the target application, and the relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device.

[0055] Step 31 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0056] In this embodiment, the relevant malicious information may include the first code file identifier of the target application in the target terminal device. The first code file identifier is obtained based on the code file of the target application. For example, a hash calculation is performed on the code file to obtain a corresponding hash value, and the hash value is used as the first code file identifier. That is, the code file identifier of the present application is unique. If the content in the code file is modified, the corresponding code file identifier will also change.

[0057] It can be understood that the code file is a code file for application operation and does not contain user data and other content generated during the use of the application.

[0058] Step 32: The application store cloud determines whether the target application has been hot-updated or fully updated through a non-application store channel according to the first code file identifier and the second code file identifier in the application store cloud.

[0059] After the application is updated, the code file usually changes, such as adding some code and / or reducing some code. Therefore, the code file identifier corresponding to the code file will also change before and after the application is updated.

[0060] The second code file identifier in the application store cloud is the code file identifier of the code file corresponding to the target application in the application store cloud. That is, if the terminal device downloads and installs the application from the application store cloud, the application corresponds to the second code file identifier.

[0061] Based on this, the application store cloud determines whether the target application has been hot updated or updated in a whole package through a non-application store channel according to the first code file identifier and the second code file identifier in the application store cloud. If a hot update or a whole package update through a non-application store channel has been performed, step 33 is executed.

[0062] That is, if the first code file identifier and the second code file identifier are the same, it means that the target application has not been hot-updated or updated in a whole package through a non-app store channel. If the first code file identifier and the second code file identifier are different, it means that the target application has been hot-updated or updated in a whole package through a non-app store channel.

[0063] Step 33: The app store cloud pushes the relevant malicious information to other terminal devices that have the target app installed as a security reminder.

[0064] Step 33 has the same or similar technical solution as any embodiment of the present application, and will not be repeated here.

[0065] In this embodiment, on the one hand, the terminal device reports the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the application store cloud's detection rate of malicious hot updating behavior. On the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security.

[0066] Furthermore, by comparing the code file identifier, it is determined whether a hot update or a whole package update through a non-app store channel has been performed.

[0067] See also Figure 4 , Figure 4 This is a flow chart of an embodiment of a method for processing application updates provided by the present application. Applied to the application store cloud, the method includes:

[0068] Step 41: The application store cloud receives the relevant malicious information of the target application, and the relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device.

[0069] Step 41 has the same or similar technical solution as any embodiment of the present application and will not be described in detail here.

[0070] In this embodiment, the relevant malicious information may include the first version number and the first code file identifier of the target application in the target terminal device. After receiving the relevant malicious information, the application store cloud is used to indicate to the application store cloud that the target application is detected as a malicious application.

[0071] Step 42: The application store cloud determines whether the target application has been hot-updated or fully updated through a non-application store channel based on the first version number and the second version number in the application store cloud, and the first code file identifier and the second code file identifier in the application store cloud.

[0072] In some embodiments, if the first version number and the second version number are different, it means that the target application has been hot-updated or the entire package has been updated through a non-application store channel.

[0073] In some embodiments, if the first code file identifier and the second code file identifier are different, it means that the target application has been hot-updated or the entire package has been updated through a non-application store channel.

[0074] In some embodiments, the first version number and the second version number are the same, and the first code file identifier and the second code file identifier are different, which also indicates that the target application has been hot-updated or updated as a whole package through a non-application store channel.

[0075] In some embodiments, the first code file identifier and the second code file identifier are the same, and the first version number and the second version number are different, which also indicates that the target application has been hot-updated or updated in its entirety through a non-application store channel.

[0076] In some embodiments, the first code file identifier and the second code file identifier are different, and the first version number and the second version number are different, which also indicates that the target application has been hot-updated or updated in a whole package through a non-application store channel.

[0077] If it is determined in step 42 that a hot update or a whole package update of a non-app store channel has been performed, then steps 43 and 44 are executed. If it is determined in step 42 that a hot update or a whole package update of a non-app store channel has not been performed, then the corresponding judgment result is fed back to the target terminal device, so that the target terminal device restricts access to resources of the application and provides an uninstall reminder.

[0078] Step 43: The application store cloud pushes the relevant malicious information to other terminal devices that have the target application installed to provide security prompts.

[0079] If it is prompted that the target application of other terminal devices may have malicious hot update behavior, prompt the other terminal devices to focus on monitoring the target application. If the other terminal devices detect the hot update of the target application during the key monitoring period, restrict the access to resources of the target application and perform security detection to confirm whether the hot update of the target application is malicious; and report to the application store in time when malicious results are detected. It can be understood that the code files for hot updates of different terminal devices may be different or the same. That is, terminal device A may use patch file a for hot update, and terminal device B may use patch file b for hot update. Patch file a and patch file b are different patch files. Therefore, when reporting to the application store, it is necessary to report the corresponding malicious information.

[0080] Step 43 has the same or similar technical solution as any embodiment of the present application, and will not be described in detail here.

[0081] Step 44: In response to the target application being hot-updated or being updated in a whole package through a non-application store channel, the application store cloud sends a notification message to the application development end corresponding to the target application; wherein the notification message is used to inform the application development end to feedback the code file corresponding to the first code file identifier.

[0082] Because the application code files involved in the update are provided by the application development end, and the applications in the application store cloud are also provided by the application development end, when the application store cloud detects that the target application of the target terminal device has been hot updated or the whole package updated through a non-application store channel, it sends a notification message to the application development end corresponding to the target application to inform the application development end to feedback the code file corresponding to the first code file identifier. And it can also inform the application development end to explain the relevant situation, confirm the application hot update and application maliciousness, and provide feedback.

[0083] There is no sequence distinction between step 44 and step 43, and they can be performed simultaneously or asynchronously.

[0084] Further, in some embodiments, see Figure 5 After sending a notification message to the application development end corresponding to the target application, the following process can be performed:

[0085] Step 51: The application store cloud receives the code file sent by the application development end.

[0086] The code file is a code file corresponding to the first code file identifier.

[0087] Step 52: The application store cloud performs a security check on the code file and obtains a security check result.

[0088] Step 53: The application store cloud pushes the security detection results to the target terminal device and other terminal devices.

[0089] In some embodiments, the application store cloud pushes the security detection results to the target terminal device and other terminal devices, so that when the security detection results indicate that the target application is a malicious application, the target terminal device and other terminal devices restrict resource access to the target application and provide an uninstall option.

[0090] In some embodiments, the application store cloud pushes the security detection results to the target terminal device and other terminal devices, so that the target terminal device and other terminal devices can lift the resource restriction access to the target application when the security detection results indicate that the target application is a non-malicious application.

[0091] Step 54: The application store cloud responds to the security detection result indicating that the code file is malicious code and removes the target application from the shelves.

[0092] The target application will be removed from the App Store cloud. Terminal devices that do not have the target application installed will not be able to download the target application. This can prevent terminal devices that do not have the target application installed from downloading the target application from the App Store and then turning it into a malicious application through hot updates, thereby endangering the data and privacy security of the terminal devices.

[0093] In some embodiments, the application store cloud can perform an update security score on the application development end corresponding to the target application based on the historical malicious information and historical security detection results of the target application. For example, a message is pushed to the user on the terminal device asking whether the application has been updated, and relevant user reviews of the team's application are monitored. For application development ends with low scores, the application hot update behavior of all applications developed by them is monitored in detail.

[0094] In one application scenario, once the security software on the terminal device mentioned in this application detects a malicious application, it will feed back the relevant malicious information of the malicious application to the application store cloud.

[0095] The app store cloud compares the app's listing information with the actual information on the terminal device to determine whether the app has been hot-updated or updated as a whole package without going through the app store channel.

[0096] If so, the app store cloud will notify the corresponding developer on the app development side to provide feedback within a specified period of time to confirm the hot update and maliciousness of the app. At the same time, the app store cloud will promptly push the relevant malicious information of the received app to all terminal devices that have installed the app, prompting the app to have possible malicious hot update behavior.

[0097] After receiving the corresponding code files fed back by the application development end, the app store cloud detects and confirms whether the application is malicious, and feeds back the detection results to all terminal devices.

[0098] After receiving the prompt information from the application store cloud, the security application software of the terminal device will uninstall or monitor the target application accordingly.

[0099] Furthermore, the app store cloud will score the developer team corresponding to the application development end based on historical reporting and security detection results, and include teams with low scores in the scope of focus on hot update behaviors, such as sending push notifications to users to ask whether there are any updates to the application, and monitoring relevant user reviews of the team's application.

[0100] Specifically, after a terminal device discovers a malicious application, it reports it to the application store using the following process:

[0101] Step 1: Once the security application software on the terminal device detects that the target application is a malicious application during the routine security detection process, the relevant malicious information of the target application, such as the software version number of the target application, the hash value of the code file (code file identifier), the malicious results of the application detection, etc., will be fed back to the application store cloud.

[0102] Step 2: The app store cloud compares the current information of the target app on the store with the information reported by the security app, and determines whether the target app may have been hot-updated or updated as a whole package without going through the app store channel based on the software version number and hash value.

[0103] For example, the application version number on the app store cloud and on the terminal device is the same, but the corresponding code file hash values ​​in the two places are different, and the target application may have been hot-updated; or the application version number and code file hash value in the two places are different, and the target application may have been hot-updated, or the application may have updated the entire package by itself.

[0104] Specifically, the App Store cloud uses the following process to detect and provide feedback on target apps that are suspected to be malicious apps:

[0105] Step 3: The app store cloud notifies the application developer of the target application, requiring it to provide the code file corresponding to the code file hash value within a specified period of time, and to explain the relevant situation, confirming the hot update of the application and the maliciousness of the application.

[0106] Step 4: At the same time, the application store cloud will receive the reported malicious information and promptly push feedback to the security application software on all terminal devices that have installed the target application, prompting that the target application may have malicious hot update behavior.

[0107] Step 5: After receiving the code file corresponding to the code file hash value fed back by the application developer, the application store cloud performs a security check on the code file to confirm whether it is malicious code, and feeds back the test results to the security application software on all terminal devices that have installed the target application.

[0108] Step 6: If the app store cloud detects and confirms that the code file corresponding to the code file hash value is malicious code, the target app is promptly removed from the shelves.

[0109] Specifically, the terminal device performs security processing using the following process:

[0110] Step 7: During the period between when any terminal device receives a prompt from the application store cloud that the target application may have malicious hot update behavior and receives the final detection result from the application store cloud, the security application software focuses on monitoring the target application based on the prompt information received from the application store, and detects whether the target application performs a hot update based on the hot update identification behavior (such as code file changes).

[0111] When the terminal device detects a hot update, it restricts resource access to the target application and performs security checks to confirm whether the hot update of the target application is malicious; and when malicious results are detected, they are reported to the application store cloud in a timely manner.

[0112] Step 8: After the terminal device receives the final detection result from the app store cloud: if the app store cloud confirms that the target application is malware, the security application software will promptly restrict resource access to the target application and ask the user whether to uninstall the malicious application;

[0113] If the application store cloud confirms that the target application is a normal application, the security application software will release the key monitoring of the target application.

[0114] Step 9: The app store cloud will score the hot update security of the developer team corresponding to the application development end of the application based on the historical application reports and test results. For teams with low scores, the hot update behavior of the application will be monitored, such as sending push notifications to users to ask whether there is an update for the application, and monitoring the relevant user reviews of the team's application.

[0115] See also Figure 6 , Figure 6 1 is a schematic diagram of the structure of an embodiment of an application store cloud provided by the present application. The application store cloud 60 includes a processor 61, a memory 62 and a communication module 63 coupled to the processor 61, and the communication module 63 is used to communicate with the terminal device;

[0116] The memory is used to store the computer program, and the processor is used to execute the computer program to implement the following method:

[0117] The app store cloud receives relevant malicious information about the target application. The relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device. The app store cloud determines whether the target application has been hot-updated or updated as a whole package through a non-app store channel based on the relevant malicious information. If so, the app store cloud pushes the relevant malicious information to other terminal devices that have installed the target application as a security prompt.

[0118] It can be understood that the processor 61 is used to execute a computer program to implement the method of any of the above embodiments.

[0119] See also Figure 7 , Figure 7 1 is a schematic diagram of the structure of an embodiment of an electronic device provided in the present application. The electronic device 110 may be, for example, the above-mentioned terminal device or application store cloud 60. The electronic device 110 may include: a memory 112, a processor (Central Processing Unit, CPU) 111, a circuit board (not shown in the figure), a power circuit and a microphone 123. The circuit board is placed inside the space surrounded by the shell; the processor 111 and the memory 112 are arranged on the circuit board; the power circuit is used to supply power to various circuits or devices of the electronic device; the memory 112 is used to store executable program code; the processor 111 runs the computer program corresponding to the executable program code by reading the executable program code stored in the memory 112 to implement the method of any of the above embodiments.

[0120] The electronic device may also include: a peripheral interface 114, an RF (Radio Frequency) circuit 116, an audio circuit 117, a speaker 122, a power management chip 119, an input / output (I / O) subsystem 120, other input / control devices 121, a display 113 and an external port 115. These components communicate through one or more communication buses or signal lines 118.

[0121] The memory 112 can be accessed by the processor 111, the peripheral interface 114, etc. The memory 112 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more disk storage devices, flash memory devices, or other volatile solid-state storage devices. The peripheral interface 114 can connect the input and output peripherals of the device to the processor 111 and the memory 112.

[0122] The I / O subsystem 120 can connect the input and output peripherals on the device, such as the display 113 and other input / control devices 121, to the peripheral interface 114. The I / O subsystem 120 may include a display controller 1201 and one or more input controllers 1202 for controlling other input / control devices 121. Among them, the one or more input controllers 1202 receive electrical signals from other input / control devices 121 or send electrical signals to other input / control devices 121. Other input / control devices 121 may include physical buttons (press buttons, rocker buttons, etc.), dials, slide switches, joysticks, and click wheels. It is worth noting that the input controller 1202 can be connected to any of the following: a keyboard, an infrared port, a USB interface, and a pointing device such as a mouse.

[0123] The display 113 is an input interface and an output interface between the user electronic device and the user, and displays visual output to the user. The visual output may include graphics, text, icons, videos, etc.

[0124] The display controller 1201 in the I / O subsystem 120 receives an electrical signal from the display 113 or sends an electrical signal to the display 113. The display 113 detects contact on the touch screen, and the display controller 1201 converts the detected contact into interaction with a user interface object displayed on the display 113, that is, realizes human-computer interaction. The user interface object displayed on the display 113 may be an icon for running a game, an icon for connecting to a corresponding network, etc.

[0125] The RF circuit 116 is mainly used to establish communication between the mobile phone and the wireless network (i.e., the network side) to realize data reception and transmission between the mobile phone and the wireless network. For example, sending and receiving short messages, emails, etc. Specifically, the RF circuit 116 receives and sends RF signals, which are also called electromagnetic signals. The RF circuit 116 converts electrical signals into electromagnetic signals or converts electromagnetic signals into electrical signals, and communicates with the communication network and other devices through the electromagnetic signals. The RF circuit 116 may include known circuits for performing these functions, including but not limited to antenna systems, RF transceivers, one or more amplifiers, tuners, one or more oscillators, digital signal processors, CODEC (COder-DECoder, codec) chipsets, Subscriber Identity Module (SIM), etc.

[0126] The audio circuit 117 is mainly used to receive audio data from the peripheral interface 114, convert the audio data into an electrical signal, and send the electrical signal to the speaker 122. The speaker 122 is used to restore the voice signal received by the mobile phone from the wireless network through the RF circuit 116 to sound and play the sound to the user. The power management chip 119 is used to provide power supply and power management for the processor 111, the I / O subsystem 120 and the hardware connected to the peripheral interface 114.

[0127] See also Figure 8 , Figure 8 1 is a schematic diagram of a computer readable storage medium according to an embodiment of the present application. The computer readable storage medium 150 stores a computer program 151. When the computer program 151 is executed by a processor, the following method is implemented:

[0128] The app store cloud receives relevant malicious information about the target application. The relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device. The app store cloud determines whether the target application has been hot-updated or updated as a whole package through a non-app store channel based on the relevant malicious information. If so, the app store cloud pushes the relevant malicious information to other terminal devices that have installed the target application as a security prompt.

[0129] It can be understood that when the computer program 151 is executed by a processor, it can also implement the method of any of the above embodiments.

[0130] To summarize, the application update processing method, application store cloud, and readable storage medium provided by the present application, on the one hand, have the terminal device report the security detection results to the application store cloud, so that the application store cloud can timely detect the behavior of hot updating malicious code and improve the application store cloud's detection rate of malicious hot update behavior; on the other hand, the application malicious information involved in the detection results reported by the terminal device received by the application store cloud is promptly fed back to the remaining terminal devices, so that the remaining terminal devices can timely guard against suspected malicious applications and improve overall security.

[0131] Furthermore, in this application, the application store cloud obtains the corresponding code files from the application development end and performs security checks to confirm the accuracy of the results reported by the terminal device and improve the security of the solution.

[0132] Furthermore, in this application, the app store cloud uses historical data to score the app development side, and takes targeted measures to detect app hot update behavior, which can increase the discovery rate of app hot update behavior and improve the security of the solution.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only illustrative, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0134] If the integrated units in the above other embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program codes.

[0135] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for processing application updates, characterized in that: Applied to the application store cloud, the method includes: The application store cloud receives the relevant malicious information of the target application, wherein the relevant malicious information is obtained after the target application is detected as a malicious application by the target terminal device; The application store cloud determines whether the target application has been hot-updated or updated in a whole package through a non-application store channel according to the relevant malicious information; If so, the application store cloud will push the relevant malicious information to other terminal devices that have the target application installed for security prompts.

2. The method according to claim 1, characterized in that The relevant malicious information includes a first version number and / or a first code file identifier of the target application; The application store cloud determines whether the target application has been hot-updated or updated in a whole package through a non-application store channel according to the relevant malicious information, including: The application store cloud determines whether the target application has been hot updated or the entire package updated through a non-application store channel based on the first version number and the second version number in the application store cloud, and / or the first code file identifier and the second code file identifier in the application store cloud.

3. The method according to claim 2, characterized in that In response to the target application being hot-updated or fully updated through a non-application store channel, the application store cloud sends a notification message to the application development end corresponding to the target application; wherein the notification message is used to inform the application development end to feedback the code file corresponding to the first code file identifier.

4. The method according to claim 3, characterized in that After sending the notification message to the application development end corresponding to the target application, the method includes: The application store cloud receives the code file sent by the application development end; The application store cloud performs a security check on the code file to obtain a security check result; The application store cloud pushes the security detection result to the target terminal device and the remaining terminal devices.

5. The method according to claim 4, characterized in that In response to the security detection result indicating that the code file is malicious code, the application store cloud removes the target application.

6. The method according to claim 4, characterized in that The application store cloud pushes the security detection result to the target terminal device and the remaining terminal devices, including: The application store cloud pushes the security detection result to the target terminal device and the remaining terminal devices, so that when the security detection result indicates that the target application is a malicious application, the target terminal device and the remaining terminal devices restrict resource access to the target application and provide an uninstall option.

7. The method according to claim 1, characterized in that The application store cloud pushes the relevant malicious information to other terminal devices installed with the target application for security prompts, including: The application store cloud pushes the relevant malicious information to the remaining terminal devices that have installed the target application as a security reminder, so that the remaining terminal devices monitor the update of the target application, and upon detecting that the target application has been hot-updated or updated as a whole package through a non-application store channel, restricts access to resources and performs security checks on the target application.

8. The method according to claim 1, characterized in that The method further comprises: The application store cloud updates the security score of the application development end corresponding to the target application based on the historical malicious information and historical security detection results of the target application.

9. An application store cloud, characterized in that: The application store cloud includes a processor, a memory and a communication module coupled to the processor, and the communication module is used to communicate with the terminal device; The memory is used to store a computer program, and the processor is used to execute the computer program to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 8.

Images