Method and system for safely identifying unknown application program and electronic equipment

Abstract

The invention provides a method and a system for performing security identification on an unknown application program and electronic equipment, and relates to the technical field of security identification. Performing preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application contrast library table, and determining the application function security of the unknown application; and running the unknown application program, checking and comparing a preliminary risk detection result obtained after the preliminary risk detection processing with the running data of the unknown application program, and detecting the running safety of the unknown application program in user interaction so as to perform safety identification on the unknown application program. The security identification accuracy of the unknown application program is improved.

Description

Technical Field

[0001] The present application relates to the field of security identification technology, and in particular to a method, system and electronic device for securely identifying unknown applications. Background Art

[0002] In today's digital age, various applications such as social networking, shopping, entertainment and work have become an indispensable part of people's daily lives. However, with the advancement of technology, the use of various applications also poses risks in terms of data security and user privacy protection.

[0003] Since not all applications on the market follow and adopt relatively safe data processing methods, for example, some application manufacturers have many considerations and adopt private encryption methods to improve efficiency. In this case, the risk of data being maliciously intercepted and modified is further increased. Summary of the invention

[0004] The purpose of this application is to provide a method, system and electronic device for securely identifying unknown applications, so as to alleviate the above-mentioned technical problems existing in the prior art.

[0005] In a first aspect, the present invention provides a method for securely identifying an unknown application, the method comprising:

[0006] Create a reference table of known applications;

[0007] Perform preliminary risk detection on the application package files corresponding to unknown applications based on the known application reference library table to determine the application function security of unknown applications;

[0008] Run unknown applications, verify and compare the preliminary risk detection results obtained after preliminary risk detection with the running data of the unknown applications, detect the running security of the unknown applications in user interaction, and safely identify the unknown applications.

[0009] In an optional implementation, a preliminary risk detection process is performed on the application package file corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application, including:

[0010] Decompile unknown applications to detect whether they have been hardened.

[0011] Loading a known application comparison library table, and performing a matching check based on application keywords and uniform resource locators in the known application comparison library table;

[0012] If no match is found, the header program name in the known application comparison library table is compared to determine whether the known application comparison library table contains relevant information of the unknown application.

[0013] In an optional embodiment, the method further comprises:

[0014] If the unknown application does not match the application keyword and uniform resource locator in the known application comparison library table, determine whether it contains the ENCRYPTED keyword;

[0015] If included, the code encryption characteristics corresponding to the unknown application are determined.

[0016] In an optional embodiment, the method further comprises:

[0017] Search the System.load() method in the code of the unknown application to determine whether the corresponding System.load() keyword is included in the decompiled code;

[0018] If so, it is determined that the encryption mode of the unknown application cannot be determined through the code.

[0019] In an optional embodiment, the method further comprises:

[0020] Search the code of unknown applications for one or more of the keywords encrypted, AES, or decrypt;

[0021] The encryption and decryption function logic of the code is determined according to the search results, and the encryption method of the unknown application is determined according to the encryption and decryption function logic.

[0022] In an optional implementation, the preliminary risk detection result obtained after the preliminary risk detection process is verified and compared with the operation data of the unknown application to detect the operation security of the unknown application in user interaction, including:

[0023] Install unknown applications and perform user simulation operations;

[0024] Extracting preliminary risk detection results obtained after preliminary risk detection processing;

[0025] Perform base conversion on the query keywords;

[0026] Compare the query keywords and simulation test data after base conversion with the running data of the unknown application program simulated by the user to locate the occurrence position of the query keywords in the network message data;

[0027] The encryption method of the unknown application is determined according to the positioning information, and the operation security of the unknown application in user interaction is detected based on the encryption method.

[0028] In an optional embodiment, the method further comprises:

[0029] If the query keyword corresponding to the positioning information corresponds to a hexadecimal value, the network message is traversed repeatedly for multiple times and the corresponding offset position is output, and the offset position is used to compare whether the keyword is a key feature code.

[0030] In a second aspect, the present invention provides a system for securely identifying unknown applications, the system comprising:

[0031] Create a module for creating a reference library table of known applications;

[0032] A preliminary detection module is used to perform preliminary risk detection processing on the application package files corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application;

[0033] The operation detection module is used to run unknown applications. The preliminary risk detection results obtained after the preliminary risk detection process are verified and compared with the operation data of the unknown applications to detect the operation security of the unknown applications in user interaction so as to safely identify the unknown applications.

[0034] In a third aspect, the present invention provides an electronic device comprising a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the method for securely identifying unknown applications of any of the aforementioned implementations.

[0035] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the method for securely identifying unknown applications of any of the aforementioned implementations.

[0036] The method, system and electronic device for securely identifying unknown applications provided by the present application have the following beneficial effects:

[0037] By performing preliminary risk detection on unknown applications, we can directly search and inspect the source code of the APP, and preliminarily analyze potential application security vulnerabilities and more dangerous and non-compliant data processing methods; further, by running unknown applications and simulating the operation of unknown applications, we can observe some operating prompts, user interactions, data storage and other real performance analysis, so as to more comprehensively and accurately identify the security of unknown applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A flowchart of a method for securely identifying unknown applications provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of a static analysis provided in an embodiment of the present application;

[0041] Figure 3 A flow chart of a dynamic analysis provided in an embodiment of the present application;

[0042] Figure 4 A flowchart for overall security identification of unknown applications provided in an embodiment of the present application;

[0043] Figure 5 A structural diagram of a system for securely identifying unknown applications provided in an embodiment of the present application;

[0044] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0046] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0047] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0048] The present application embodiment provides a method for securely identifying unknown applications. Figure 1 As shown, the method mainly includes the following steps:

[0049] Step S110, creating a known application comparison library table.

[0050] In one implementation, a new database can be created to create a different library table of SDK package names and corresponding interfaces known in the current market before other analysis. In actual applications, the default structured configuration file can be used to write a simple comparison program to compare the interface keywords, such as:

[0051] "TXSDK":{"sdkname":{},"sdkkeyword":{getapi,getUser..}}....

[0052] In a specific implementation, the following specific means may also be used to compare interface keywords:

[0053] First, find an SDK with a large number of users and good market feedback on the Internet and download it. Traverse the path name under the com directory directly for the downloaded SDK, and use all the traversed file names as the header of a table. Compare the SDK names according to abbreviations, full spellings, English, etc., and manually judge those with large differences. Then fill in the name of sdkname. For each SDK, you need to traverse the files in the src directory, search for obvious keywords such as getapi, apiopen, and then save them directly in sdkkeyword. You only need to compare the keywords that appear in sdkkeyword with the key headers contained in the message in the dynamic analysis (such as URL). If the URL is not matched, continue to compare sdkname to avoid some SDKs that contain corresponding names in the message (the standard message format is more common in HTTP's USER-AGENT), and the problem that private protocols cannot determine the location, and improve accuracy through traversal comparison.

[0054] Step S120 , performing preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application.

[0055] In one embodiment, the preliminary risk monitoring process uses static analysis to directly search and inspect the source code of unknown applications, such as direct source code search and use of reverse engineering methods, and check the injection of various SDKs called, to preliminarily analyze potential application security vulnerabilities and more dangerous and non-compliant data processing methods.

[0056] Step S130, running the unknown application, verifying and comparing the preliminary risk detection result obtained after the preliminary risk detection process with the running data of the unknown application, detecting the running security of the unknown application in user interaction, so as to safely identify the unknown application.

[0057] In one implementation, running an unknown application is to dynamically analyze the unknown application, that is, to simulate the running of the application in a laboratory environment, observe the running prompts of the unknown application during running, and analyze the real performance of user interaction and data storage. By analyzing the overall running status of the unknown application, the sequential interface calls of different operations of the unknown application during use are parsed.

[0058] For ease of understanding, the specific technical means adopted in the embodiments of the present application are described in detail below.

[0059] In one embodiment, the above-mentioned preliminary risk detection processing of the application package file corresponding to the unknown application based on the known application reference library table to determine the application function security of the unknown application may include the following steps 1.1 to 1.3 when implemented:

[0060] Step 1.1, decompile the unknown application to detect whether the unknown application has been hardened. Decompile the unknown application to determine whether the unknown APP has been hardened. If the unknown application has been hardened, the source code cannot be obtained. If it has not been hardened, the source code of the unknown APP can be directly accessed for traversal search.

[0061] Step 1.2, load the known application reference library table, and perform matching verification based on the application keywords and uniform resource locators in the known application reference library table. In actual applications, you can query the data contained in the pre-created known application reference library table, and keep the hit data in the local database. The data includes URL, keywords (including variable names, types and other feature values), and output the package name and line number where the keywords and URLs appear. At this time, you can confirm the SDK name and corresponding SDK interface integrated by the unknown application.

[0062] Step 1.3, if no match is found, compare the header program name in the known application comparison library table to determine whether the known application comparison library table contains relevant information about the unknown application. Considering that some SDKs will contain corresponding names in the message (the standard message format is more common in HTTP's USER-AGENT), and the private protocol does not determine the location, traverse and compare sdkname to determine whether the known application comparison library table contains relevant information about the unknown application.

[0063] In addition, if there is a URL hit, the URL can also be saved for later use. At the same time, the keywords that appear in the package name, such as "im, chat, etc.", can be used for classification in subsequent analysis, and you can understand what operations the APP may involve.

[0064] In one implementation, considering that some APP manufacturers use a simpler encryption method, keyword searches such as "encrypted" can generally be used to quickly find encryption features in the code. Therefore, when the unknown application does not match the application keyword and uniform resource locator in the known application reference library table, it can be determined whether the ENCRYPTED keyword is included; if it is included, the code encryption feature corresponding to the unknown application is determined. This feature can then be used to further check the function call relationship to confirm whether it can be directly decrypted.

[0065] In addition, in an optional implementation, the System.load() method can be searched in the code of the unknown application to determine whether the corresponding System.load() keyword is included in the code of the decompilation operation. If it is included, it is determined that the method cannot be directly viewed in a static manner, and the encryption method of the unknown application cannot be determined through the code.

[0066] In practical applications, considering that the keywords encrypted, AES, and decrypt are keywords with very high calling frequencies of key encryption and decryption functions, in one implementation, one or more of the keywords encrypted, AES, or decrypt can be searched in the code of an unknown application; the encryption and decryption function logic of the code is determined based on the search results, and the encryption method of the unknown application is determined based on the encryption and decryption function logic.

[0067] The above preliminary risk monitoring process is to perform static analysis on unknown applications. Figure 2 A flowchart of static analysis is shown. First, the APK file of the unknown application is uploaded to a specific directory, the relevant program is executed, the APK file is decompiled, and the SDK-related database is loaded, and then it is determined whether there is a hit with the corresponding keywords and URLs in the SDK database. If so, the corresponding hit field information is output. If not, it is determined whether it contains keywords such as ENCRTPT. If contained, the corresponding hit field information is output. If not contained, the static analysis is terminated.

[0068] Furthermore, the preliminary risk detection result obtained after the preliminary risk detection process is verified and compared with the operation data of the unknown application to detect the operation security of the unknown application in user interaction. In the specific implementation, the following steps 2.1 to 2.5 may be included:

[0069] Step 2.1, installing the unknown application and performing user use simulation operation. In one example, the unknown application can be installed on a laboratory machine to perform user use simulation operation.

[0070] Step 2.2, extracting the preliminary risk detection results obtained after the preliminary risk detection process. In practical applications, the URL or other keywords that have appeared in the data message generated by the unknown application can be used for searching.

[0071] Step 2.3, perform base conversion processing on the query keywords. For example, the base conversion processing can be binary or hexadecimal encoding, etc. By performing base conversion processing, it can cover the situation that some APP manufacturers convert bases to save transmission bytes, so that subsequent comparisons can be more accurate and comprehensive.

[0072] Step 2.4, comparing the query keyword and the simulated test data after the base conversion with the running data of the user using the simulated operation of the unknown application program to locate the occurrence position of the query keyword in the network message data;

[0073] Step 2.5, determining the encryption method of the unknown application according to the positioning information, and detecting the operation security of the unknown application in user interaction based on the encryption method.

[0074] Furthermore, if the query keyword corresponding to the positioning information corresponds to a hexadecimal value, the network message is traversed repeatedly for multiple times and the corresponding offset position is output, and the offset position is used to compare whether the keyword is a key feature code.

[0075] In addition, if the query keyword does not appear in the network message data, the above static analysis can be further performed to check whether there is a System.load() method call. If the operation behavior is similar to the method name called in the method (usually a .so file), it means that the data is privately encrypted and cannot be directly obtained. If not, continue to use the static method to check.

[0076] The above-mentioned running of the unknown application program for verification and comparison is to dynamically analyze the unknown application program. Figure 3 A flow chart of dynamic analysis is shown. In specific implementation, the unknown application (unknown APP) can be automatically installed to a certain experimental machine first, the output content of the static analysis mentioned above can be extracted, the output content can be converted into various forms of expression (that is, base conversion processing can be performed), and the verification and comparison can be performed with the data message stream of the unknown APP in operation to determine whether there is a hit. If so, the position of the hit keyword including the offset and other data can be recorded. If there is no hit, it can be returned to check whether the static analysis contains the code of keywords such as encrypt, analyze whether it contains other feature codes, whether it can be cracked, and finally end the dynamic analysis.

[0077] In summary, Figure 4 A method for securely identifying unknown applications in an embodiment of the present application as a whole is shown. First, the static analysis module is used to perform the above-mentioned static analysis processing, and then the dynamic analysis module is used to perform the above-mentioned dynamic analysis processing to determine whether to output the analysis results. If output, the output results are manually reviewed to improve the accuracy of the results. If not output, the static analysis processing is returned and re-performed, and so on.

[0078] In summary, the embodiments of the present application can directly search and check the source code of the APP by performing preliminary risk detection on unknown applications, and preliminarily analyze potential application security vulnerabilities and more dangerous and non-compliant data processing methods; further, by running unknown applications and simulating the operation of unknown applications, some operating prompts, user interactions, and data storage are observed and analyzed, thereby more comprehensively and accurately identifying the security of unknown applications.

[0079] Based on the above method embodiment, the present application embodiment also provides a system for securely identifying unknown applications, see Figure 5 As shown, the system mainly includes the following parts:

[0080] A creation module 510, used to create a known application program comparison library table;

[0081] A preliminary detection module 520 is used to perform preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application;

[0082] The operation detection module 530 is used to run unknown applications, verify and compare the preliminary risk detection results obtained after the preliminary risk detection process with the operation data of the unknown applications, detect the operation security of the unknown applications in user interaction, and safely identify the unknown applications.

[0083] In a feasible implementation manner, the preliminary detection module 520 is used to:

[0084] Decompile unknown applications to detect whether they have been hardened.

[0085] Loading a known application comparison library table, and performing a matching check based on application keywords and uniform resource locators in the known application comparison library table;

[0086] If no match is found, the header program name in the known application comparison library table is compared to determine whether the known application comparison library table contains relevant information of the unknown application.

[0087] In a feasible implementation manner, the system further includes: a first judgment module, configured to:

[0088] If the unknown application does not match the application keyword and uniform resource locator in the known application comparison library table, determine whether it contains the ENCRYPTED keyword;

[0089] If included, the code encryption characteristics corresponding to the unknown application are determined.

[0090] In a feasible implementation manner, the system further includes: a second judgment module, configured to:

[0091] Search the System.load() method in the code of the unknown application to determine whether the corresponding System.load() keyword is included in the decompiled code;

[0092] If so, it is determined that the encryption mode of the unknown application cannot be determined through the code.

[0093] In a feasible implementation manner, the system further includes: a search module, configured to:

[0094] Search the code of unknown applications for one or more of the keywords encrypted, AES, or decrypt;

[0095] The encryption and decryption function logic of the code is determined according to the search results, and the encryption method of the unknown application is determined according to the encryption and decryption function logic.

[0096] In a feasible implementation manner, the operation detection module 530 is used to:

[0097] Install unknown applications and perform user simulation operations;

[0098] Extracting preliminary risk detection results obtained after preliminary risk detection processing;

[0099] Perform base conversion on the query keywords;

[0100] Compare the query keywords and simulation test data after base conversion with the running data of the unknown application program simulated by the user to locate the occurrence position of the query keywords in the network message data;

[0101] The encryption method of the unknown application is determined according to the positioning information, and the operation security of the unknown application in user interaction is detected based on the encryption method.

[0102] In a feasible implementation manner, the system further includes: a traversal module, configured to:

[0103] If the query keyword corresponding to the positioning information corresponds to a hexadecimal value, the network message is traversed repeatedly for multiple times and the corresponding offset position is output, and the offset position is used to compare whether the keyword is a key feature code.

[0104] The system for securely identifying unknown applications provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for parts not mentioned in the embodiment of the system for securely identifying unknown applications, reference may be made to the corresponding contents in the aforementioned method embodiment for securely identifying unknown applications.

[0105] The present application also provides an electronic device, such as Figure 6As shown, it is a schematic diagram of the structure of the electronic device, wherein the electronic device 100 includes a processor 61 and a memory 60, the memory 60 stores computer executable instructions that can be executed by the processor 61, and the processor 61 executes the computer executable instructions to implement any of the above-mentioned methods for securely identifying unknown applications.

[0106] exist Figure 6 In the illustrated embodiment, the electronic device further includes a bus 62 and a communication interface 63 , wherein the processor 61 , the communication interface 63 and the memory 60 are connected via the bus 62 .

[0107] Among them, the memory 60 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 63 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 62 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 62 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0108] The processor 61 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 61. The above processor 61 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor 61 reads the information in the memory and combines its hardware to complete the steps of the method for securely identifying unknown applications in the aforementioned embodiment.

[0109] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned method for securely identifying unknown applications. The specific implementation can be found in the aforementioned method embodiment, which will not be repeated here.

[0110] The method, system and computer program product of an electronic device for securely identifying unknown applications provided in the embodiments of the present application include a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods in the previous method embodiments. The specific implementation can be found in the method embodiments, which will not be repeated here.

[0111] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0112] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0113] In the description of the present application, it should be noted that the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0114] In the description of this application, it should also be noted that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for securely identifying unknown applications, characterized in that: The method comprises: Create a reference table of known applications; Performing preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application; Run the unknown application, verify and compare the preliminary risk detection result obtained after the preliminary risk detection process with the running data of the unknown application, detect the running security of the unknown application in user interaction, so as to safely identify the unknown application.

2. The method for securely identifying unknown applications according to claim 1, characterized in that: Performing preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application comparison library table to determine the application function security of the unknown application includes: Decompiling the unknown application to detect whether the unknown application is reinforced; Loading the known application comparison library table, and performing a matching check based on the application keywords and uniform resource locators in the known application comparison library table; If no match is found, the header program name in the known application comparison library table is compared to determine whether the known application comparison library table contains relevant information of the unknown application.

3. The method for securely identifying unknown applications according to claim 2, characterized in that: The method further comprises: If the unknown application does not match the application keyword and uniform resource locator in the known application comparison library table, determine whether it contains the ENCRYPTED keyword; If included, determine the code encryption feature corresponding to the unknown application.

4. The method for securely identifying unknown applications according to claim 1, characterized in that: The method further comprises: Searching for the System.load() method in the code of the unknown application program, and determining whether the corresponding System.load() keyword is included in the code of the decompilation operation; If so, it is determined that the encryption method of the unknown application cannot be determined through the code.

5. The method for securely identifying unknown applications according to claim 4, characterized in that: The method further comprises: Searching the code of the unknown application for one or more of the keyword encrypted, the keyword AES, or the keyword decrypt; The encryption and decryption function logic of the code is determined according to the search results, and the encryption method of the unknown application is determined according to the encryption and decryption function logic.

6. The method for securely identifying unknown applications according to claim 1, characterized in that: The preliminary risk detection result obtained after the preliminary risk detection process is verified and compared with the operation data of the unknown application to detect the operation security of the unknown application in user interaction, including: Install the unknown application and perform user usage simulation operations; Extracting preliminary risk detection results obtained after the preliminary risk detection process; Perform base conversion on the query keywords; Compare the query keyword and the simulated test data after base conversion with the operation data of the unknown application program simulated by the user to locate the occurrence position of the query keyword in the network message data; An encryption method of the unknown application is determined according to the positioning information, and the operation security of the unknown application in user interaction is detected based on the encryption method.

7. The method for securely identifying unknown applications according to claim 6, characterized in that: The method further comprises: If the query keyword corresponding to the positioning information corresponds to a hexadecimal value, the network message is traversed repeatedly for multiple times and the corresponding offset position is output, and the offset position is used to compare whether the keyword is a key feature code.

8. A system for securely identifying unknown applications, characterized in that: The system comprises: Create a module for creating a reference library table of known applications; A preliminary detection module, used to perform preliminary risk detection processing on the application package file corresponding to the unknown application based on the known application comparison library table, and determine the application function security of the unknown application; The operation detection module is used to run the unknown application, verify and compare the preliminary risk detection result obtained after the preliminary risk detection processing with the operation data of the unknown application, detect the operation security of the unknown application in user interaction, so as to safely identify the unknown application.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the method for securely identifying unknown applications as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to implement the method for securely identifying unknown applications as described in any one of claims 1 to 7.

Images