Risk detection method and device for application program, electronic equipment and storage medium

Abstract

The invention provides an application risk detection method and device, electronic equipment and a storage medium. The invention relates to the technical field of computers, in particular to the technical field of software testing, and can be used for diversified scenes such as query and detection of black application programs and security detection of the application programs. According to the specific implementation scheme, a to-be-detected application program is received; performing static code detection on the application program to obtain a static detection result; performing dynamic behavior monitoring on the application program to obtain a dynamic detection result; and generating a risk detection result based on the static detection result and the dynamic detection result. According to the disclosure of the scheme, the efficiency and accuracy of risk analysis can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of software testing technology, and can be used in diversified scenarios such as query and detection of black market applications, security detection of applications, and more specifically to a risk detection method, device, electronic device, and storage medium for applications. Background Art

[0002] Traditional risk analysis usually relies on multiple independent analysis tools. The installation and configuration of each tool increases the complexity of the operation, and there may be compatibility issues between different tools, affecting the efficiency and accuracy of the overall analysis. Summary of the invention

[0003] The present disclosure provides a method, device, electronic device and storage medium for detecting risks of an application program.

[0004] According to one aspect of the present disclosure, a risk detection method for an application is provided, comprising:

[0005] receiving an application to be detected;

[0006] Perform static code detection on the application and obtain static detection results;

[0007] Perform dynamic behavior monitoring on the application and obtain dynamic detection results;

[0008] Generate risk detection results based on static detection results and dynamic detection results.

[0009] According to another aspect of the present disclosure, there is provided a risk detection device for an application program, comprising:

[0010] A receiving module, used for receiving an application to be detected;

[0011] Static detection module, used to perform static code detection on the application and obtain static detection results;

[0012] Dynamic detection module, used to monitor the dynamic behavior of the application and obtain dynamic detection results;

[0013] The first generating module is used to generate risk detection results based on static detection results and dynamic detection results.

[0014] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0018] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0019] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0020] The solution disclosed in the present invention can solve the problems of complex operation, low efficiency and inaccurate judgment in the existing software risk analysis process, and improve the efficiency and accuracy of risk analysis.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0023] Figure 1 is a flowchart of a risk detection method for an application according to an embodiment of the present disclosure;

[0024] Figure 2 is a framework diagram of a risk detection tool according to an embodiment of the present disclosure;

[0025] Figure 3 is an architectural diagram of a dynamic search process according to an embodiment of the present disclosure;

[0026] Figure 4 It is a schematic diagram of the call chain tracing and network request analysis process according to an embodiment of the present disclosure;

[0027] Figure 5 is a schematic diagram of the structure of a risk detection device for an application according to an embodiment of the present disclosure;

[0028] Figure 6 is a schematic diagram of a risk detection scenario according to an embodiment of the present disclosure;

[0029] Figure 7 The present invention is a block diagram of an electronic device for implementing the method for risk detection of an application program according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0031] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The term "at least one" in this article means any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C. The terms "first" and "second" in this article refer to multiple similar technical terms and distinguish them. They do not mean to limit the order or to limit them to only two. For example, the first feature and the second feature refer to two types / two features. The first feature can be one or more, and the second feature can also be one or more.

[0032] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0033] Before introducing the technical solutions of the embodiments of the present disclosure, the technical terms that may be used in the present disclosure are further explained:

[0034] Static code detection: Analyze source code to find potential security vulnerabilities and code defects without running the application.

[0035] Dynamic behavior monitoring: During the operation of an application, its behavior is monitored and analyzed in real time to detect abnormal behavior and security threats.

[0036] Risk score: A quantitative indicator that represents the potential security risk of an application.

[0037] Risk Detection Report: A report that lists in detail all security issues, vulnerabilities, and abnormal behaviors found during static and dynamic detection, and provides corresponding repair suggestions and improvement measures.

[0038] In related technologies, multiple tools are needed to detect whether an application (Application, APP) contains risks or illegal activities. In actual operation, there are still many limitations and shortcomings, which are specifically manifested in the following aspects:

[0039] (1) Scattered tools and low integration: The current risk analysis process usually relies on multiple independent tools, such as packet capture tools, hook injection tools, kernel monitoring tools, etc. The lack of a unified integration platform between tools leads to complex operations, and the compatibility and data transmission efficiency of different tools are low, affecting the overall fluency of the analysis process.

[0040] (2) Complex operation and high threshold: Many analysis tools require professional configuration and usage experience, especially kernel monitoring, shelling and dynamic analysis. The operation steps are cumbersome and the technical requirements are high. It is difficult for non-professionals to successfully complete the entire risk analysis process, which limits the widespread application of the technology.

[0041] (3) Low analysis efficiency and long time consumption: Multi-tool collaboration often takes a long time to process and analyze data. Especially when facing large or complex applications, the analysis efficiency is obviously insufficient and it is difficult to meet the needs of rapid evaluation in actual business.

[0042] (4) Inaccurate risk assessment: The update of the black market feature database is delayed, and it is impossible to identify new or variant malicious behaviors in a timely manner. In addition, the risk scoring mechanism is relatively rough, and it is difficult to accurately distinguish different types of risk behaviors, which may lead to missed reports or false reports.

[0043] (5) Lack of dynamic behavior analysis: Although static analysis can provide a certain basis for risk assessment, it lacks effective monitoring and analysis of the dynamic behavior of the application at runtime. In particular, the detection capability of complex dynamic loading or self-modifying code is limited, resulting in blind spots in the analysis results.

[0044] In order to at least partially solve one or more of the above-mentioned problems and other potential problems, the present disclosure proposes a risk detection method for an application program, which can solve the problems of complex operation, low efficiency and inaccurate judgment in the existing risk analysis process, and improve the efficiency and accuracy of risk analysis.

[0045] The present disclosure provides a method for detecting risk of an application program. Figure 1 1 is a flow chart of a risk detection method for an application according to an embodiment of the present disclosure. The risk detection method for an application can be applied to a risk detection device. The risk detection device is located in a personal computer terminal. In some possible implementations, the risk detection method for an application can also be implemented by a processor calling a computer-readable instruction stored in a memory. Figure 1 As shown, the risk detection methods of this application include:

[0046] S101, receiving an application to be detected;

[0047] S102, performing static code detection on the application to obtain a static detection result;

[0048] S103, performing dynamic behavior monitoring on the application to obtain dynamic detection results;

[0049] S104: Generate a risk detection result based on the static detection result and the dynamic detection result.

[0050] In the embodiment of the present disclosure, the application received in S101 is assumed to be a black industry APP. Black industry APP generally refers to those applications used for illegal activities, fraud, malicious advertising, data theft, etc.

[0051] In the disclosed embodiments, static code detection is to analyze the source code to find potential security holes and code defects without running the program. Static code detection usually involves in-depth inspection of the syntax, semantics, structure, etc. of the code.

[0052] In the disclosed embodiment, dynamic behavior monitoring is to monitor and analyze the behavior of a program in real time during its operation. Dynamic behavior monitoring usually involves capturing its network activities, file operations, process behaviors, etc. while the application is running, and comparing them with known security threat patterns. In the disclosed embodiment, the results of dynamic behavior monitoring will be used as dynamic detection results.

[0053] It should be noted that the present disclosure does not limit the execution order of S102 and S103. S102 may be performed before S103, S102 may be performed after S103, and S102 and S103 may be performed simultaneously.

[0054] For example, suppose there is a black market APP called "Malicious Mining", which will occupy system resources for mining activities without the user's knowledge. The risk detection webpage is opened on the personal computer (PC). After detecting that the black market APP has been dragged to the preset area, static code detection and dynamic behavior monitoring are performed on the black market APP. In the static detection stage, suspicious code fragments and encryption algorithms may be found in the black market APP; in the dynamic detection stage, abnormal behaviors such as the black market APP communicating with the mining pool on the network and occupying a large amount of central processing unit (CPU) and memory resources may be monitored. Finally, a risk score and risk detection report are generated based on the detection results, prompting the user or security team that the black market APP has serious security risks, and recommending immediate uninstallation or repair.

[0055] The technical solution of the disclosed embodiment can comprehensively and quickly discover potential security issues in applications by combining static code detection and dynamic behavior monitoring, thereby improving the efficiency and accuracy of risk analysis. Risk detection helps to timely discover and fix security issues, reduce the risk of application attacks or abuse, and enhance security.

[0056] In some embodiments, the risk detection result includes a risk score and a risk detection report; the risk detection method of the application includes:

[0057] S105. In response to receiving a risk score query request for the application, outputting a risk score of the application;

[0058] S106: In response to receiving a risk detection report query request for the application, output a risk detection report for the application.

[0059] The present disclosure does not limit the execution order of S105 and S106. S105 can be performed before S106, S105 can be performed after S106, and S105 and S106 can be performed simultaneously.

[0060] In some implementations, when a user or security team needs to know the risk score of an application, the risk score can be obtained through a query interface, which helps to quickly assess the security of the application and decide whether further investigation or repair is needed.

[0061] In some implementations, when a user or security team needs to learn more about a security issue of an application, they can obtain a complete risk detection report through the query interface. The report will provide detailed detection results, problem descriptions, repair suggestions and other information to help users or security teams develop targeted repair plans.

[0062] In this way, by outputting the risk score, users or security teams can quickly understand the security level of the application. Since the risk detection report provides detailed detection results and repair suggestions, by outputting the risk detection report, users or security teams can develop targeted repair plans and security strategies to reduce potential security risks.

[0063] In some embodiments, before performing dynamic behavior monitoring or static code detection, the method also includes: detecting whether the application is protected by a shell; if it is detected that the application is protected by a shell, unshelling the application to extract the original file cluster of the application, which is used for static or dynamic analysis.

[0064] In the disclosed embodiment, shell protection is a code protection technology that prevents reverse engineering and tampering by compressing, encrypting or obfuscating codes.

[0065] In the disclosed embodiment, the unpacking operation is a process of restoring a shell-protected application to an original, unshelled code or file cluster.

[0066] In the disclosed embodiment, the original file cluster refers to the original code or file set of the application program extracted after the de-shelling operation, which is used for subsequent static code detection or dynamic behavior monitoring.

[0067] In some implementations, before dynamic behavior monitoring or static code detection, it is first detected whether the application to be detected is protected by a shell, for example, by analyzing the binary structure, entry point, code segment features, etc. of the application to identify the shell protection.

[0068] In some implementations, if it is detected that the application is protected by a shell, then an unshelling operation is performed. After successful unshelling, the original file clusters of the application are extracted, and these file clusters are used for subsequent static code detection or dynamic behavior monitoring.

[0069] For example, suppose there is a black market APP called "Malicious Advertising Plug-in", which uses shell protection to hide its malicious behavior. After detecting that the APP is protected by shell, use a professional shell removal tool to remove the shell. After the shell removal is successful, the original file cluster of the APP is extracted, and static code detection and dynamic behavior monitoring are performed on it. In the static detection stage, suspicious advertising code and malicious behavior triggering logic are found in the APP; in the dynamic detection stage, abnormal behaviors such as frequent sending of advertising requests and occupying system resources in the background are monitored. Finally, a risk score and risk detection report are generated based on the detection results, prompting users or security teams that the APP has serious security risks, and recommending immediate uninstallation or repair.

[0070] In this way, by unpacking the application, the original code of the application can be restored, thereby avoiding the interference of shell protection on static code detection and dynamic behavior monitoring, and improving the accuracy and reliability of detection. By adding unpacking operations, the scope of application of the detection method can be expanded, the detection capability of such applications with shell protection can be enhanced, and potential security issues in applications with shell protection can be discovered and handled in a timely manner, which helps reduce the risk of application attacks or abuse and improves overall security.

[0071] In some embodiments, performing static code detection on an application to obtain a static detection result may include: unpacking a compressed package of the application to obtain multiple component files included in the application; analyzing the multiple component files to obtain a static detection result of the application; wherein the static detection result is a first type of security risk detection result obtained by analyzing without running the application.

[0072] In the disclosed embodiment, a compression package is a technology for packaging multiple files or folders into a single file. A compression package is usually used to save storage space, facilitate file transmission, or protect files from being easily modified.

[0073] In the disclosed embodiment, component files are files that constitute the various independent parts or modules of the application program, and these files may include source code, configuration files, resource files, etc.

[0074] In the embodiment of the present disclosure, the first type of security risk detection results are factors or conditions found during the static code detection process that may cause security issues in the application. These results usually include information such as the description of the problem, severity, possible impact, and repair suggestions.

[0075] In some implementations, the unpacking operation can be completed by a professional decompression tool or script to ensure that all component files contained in the application can be accurately extracted. This step is a prerequisite for static code detection. Only by obtaining the source code or analyzable component files of the application can the subsequent analysis work be better performed. Through steps such as unpacking, analyzing component files, and generating static detection results, the development team can discover and fix potential security risks in the early stages of the software development life cycle, thereby improving the security and code quality of the application.

[0076] In some implementations, the source code is analyzed in depth through automated tools to discover potential security vulnerabilities, programming errors, bad coding habits, and other issues. This step does not require running the application, but rather discovers potential problems by analyzing the structure, syntax, and semantics of the code. During the analysis process, the focus can be on security vulnerabilities, performance bottlenecks, logical errors, and other aspects in the code, as well as whether the corresponding programming specifications and best practices are followed.

[0077] In some embodiments, the static detection results include the first type of security risk detection results found without parsing the running application. The static detection results are usually presented in the form of a report, which includes a list of problems found, the severity of the problems, possible impacts, and repair suggestions.

[0078] For example, suppose there is an application called "Safe Payment APP", and the development team decides to perform static code detection on it. First, the development team opens the risk detection webpage on the PC, drags the APP to the preset area, and unpacks the compressed package of the APP on the risk detection webpage to obtain multiple component files including source code, configuration files, resource files, etc.; then, these component files are analyzed in depth. During the detection process, several potential security risks were found, such as uninitialized variables, resource leaks, and possible Structured Query Language (SQL) injection vulnerabilities. The development team promptly repaired the problem based on the detection results and retested and verified it. In the end, the security of the APP was significantly improved and the code quality was optimized.

[0079] In this way, through static code detection, logical errors, performance bottlenecks, bad coding habits and other problems in the code can be discovered, and repair suggestions can be given, which will help the development team improve code quality and reduce the workload of later debugging and repair. Static code detection can help the development team find and correct problems in the coding stage, thereby avoiding investing more time and resources in the later testing and maintenance stages, which helps reduce the maintenance cost of the application.

[0080] In some embodiments, dynamic behavior monitoring of an application is performed to obtain dynamic detection results, including: sending the application to a terminal in a preset detection environment so that the terminal can install the application; in response to receiving a test instruction for a target task, forwarding the test instruction to the terminal where the application has been installed to instruct the terminal to perform the test task for the application; analyzing the task execution data returned by the terminal to generate dynamic detection results, which include second-category security risk detection results that occur when the application is running.

[0081] In the disclosed embodiment, dynamic behavior monitoring is a technical means for real-time monitoring of the behavior of an application during operation. By simulating a real user environment, dynamic behavior monitoring can discover potential security risks of an application in different scenarios.

[0082] In the disclosed embodiment, the detection environment is a specific environment set up for dynamic behavior monitoring, which usually simulates the usage scenarios and conditions of real users to ensure the accuracy of the detection results.

[0083] In the embodiment of the present disclosure, the test instruction is an instruction for instructing the terminal to execute a specific test task. The test instruction usually includes the specific test task to be executed and related parameters.

[0084] In the disclosed embodiment, the task execution data is the data collected during the terminal's execution of the test task. These data may include the running status of the application, resource usage, network requests and responses, etc., for subsequent analysis and detection.

[0085] In the disclosed embodiment, the second type of security risk is different from the first type of security risk found in static code detection. The second type of security risk occurs during the operation of the application and may involve aspects such as abuse of application permissions, data leakage, and malicious behavior.

[0086] In some embodiments, in order to simulate a real user environment, the application to be tested is sent to a terminal under a preset test environment to ensure the accuracy of the test results. For example, multiple test scenarios are designed according to the test requirements, and each scenario represents a specific usage environment or condition; a corresponding test scenario indication is generated for each terminal to be tested, and these indications detail the test scenario in which the terminal should run the application to be tested, and how to configure relevant parameters to simulate the scenario. The test scenario indication is sent to multiple terminals to be tested via a network or other communication methods. After each terminal to be tested receives the test scenario indication, it configures and runs the application to be tested in the specified test scenario according to the requirements in the indication.

[0087] In some implementations, when a test instruction for a target task is received, the test instruction is forwarded to the terminal where the application has been installed. The test instruction generally includes the specific test task to be performed and related parameters. After receiving the test instruction, the terminal will perform the test task for the application according to the instruction requirements.

[0088] In some implementations, during the process of executing the test task on the terminal, task execution data is collected in real time. Such data may include the running status of the application, resource usage, network requests and responses, etc. The collected task execution data is analyzed to discover the second type of security risks that may occur when the application is running. These risks may involve aspects such as abuse of application permissions, data leakage, and malicious behavior.

[0089] In some implementations, a dynamic detection result is generated based on the analysis result. The dynamic detection result is usually presented in the form of a report, which includes a list of discovered security risks, the severity of the problem, possible impacts, and repair suggestions.

[0090] For example, suppose there is an application called "Smart Social APP" and the development team decides to monitor its dynamic behavior. First, the "Smart Social APP" to be tested is sent to the terminal in the preset detection environment, and the application is installed on the terminal. Then, the corresponding test instructions are generated by simulating scenarios such as user login, message sending, and dynamic browsing, and sent to the terminal where the application has been installed. During the execution of the test task by the terminal, task execution data is collected in real time, such as the application's memory usage, CPU usage, network requests and responses, etc. After analysis, it was found that the application had a risk of data leakage when sending messages, that is, sensitive data was not encrypted. Based on the dynamic detection results, the development team promptly fixed the problem and re-tested and verified it. In the end, the security of the application was significantly improved.

[0091] In this way, dynamic behavior monitoring can monitor the behavior of applications in real time during operation and promptly identify potential security risks. By simulating real user environments, dynamic behavior monitoring can comprehensively detect the behavior of applications in different scenarios to ensure the accuracy of the detection results. Once a security risk is discovered, dynamic behavior monitoring can quickly generate detection results and provide repair suggestions to help the development team quickly locate and fix the problem. Dynamic behavior monitoring can effectively improve the security of applications and reduce the risks caused by security risks.

[0092] In some embodiments, analyzing the task execution data returned by the terminal includes at least one of the following:

[0093] Analyze various data packets generated by applications during data transmission to identify hidden abnormal data packets, malicious traffic, and suspicious interaction behaviors;

[0094] Analyze the application's modification behavior on system environment variables and file systems;

[0095] Analyze application behavior at the kernel level.

[0096] In the disclosed embodiments, a data packet is a basic unit of data in network communication, which includes header information and data content of the data and is used for transmission and exchange in the network.

[0097] In the embodiments of the present disclosure, system environment variables refer to variables in the operating system used to store global data such as system configuration information, user information, path information, etc. These variables can be read and modified by application programs.

[0098] In the disclosed embodiments, the file system is a structure in the operating system for storing and managing data. It provides operation interfaces such as file creation, deletion, modification, and access, and is an important bridge for interaction between applications and data.

[0099] In the disclosed embodiments, the kernel layer refers to the core part of the operating system, which is responsible for the core functions of the system such as resource management, process scheduling, interrupt handling, etc. The behavior of the application at the kernel layer usually involves direct access and operation of system resources.

[0100] In some embodiments, the various types of data packets generated by the application during the data transmission process are analyzed, including: first, capturing all network data packets generated by the application during operation. This can be achieved by installing a network packet capture tool on the terminal, or using a professional network analysis tool to remotely capture packets. Then, the captured data packets are parsed to extract key information such as the header information, data content, source address, and destination address of the data packets. Finally, the data packets are deeply analyzed to identify hidden abnormal data packets, malicious traffic, and suspicious interactive behaviors. For example, by checking the signature, encryption method, data length, and other features of the data packet, it can be identified whether there are malicious behaviors such as forgery, tampering, or injection attacks.

[0101] In some embodiments, analyzing the application's modification behavior on the system environment variables and the file system includes: monitoring the application's access and modification behavior on the system environment variables during operation. This can be achieved by setting a system hook or access control list to record all operations of the application on the system environment variables. Monitor the application's read and write behavior on the file system. Including file creation, deletion, modification, access and other operations. The monitoring tool or logging function of the file system can be used to capture these behaviors. The captured modification behavior is analyzed to determine whether it is legal or there is a potential security risk. For example, if the application modifies the system's key configuration files or deletes user data without the user's authorization, it may be considered malicious behavior.

[0102] In some embodiments, analyzing the behavior of the application at the kernel level includes: using a kernel debugger or performance analysis tool to monitor the behavior of the application at the kernel level. This includes the application's occupation of system resources, the calling of kernel modules, the execution of system calls, etc. The captured kernel behavior is deeply analyzed to identify whether there is abnormal or malicious behavior. For example, if the application frequently calls system calls to obtain sensitive information or perform illegal operations, it may be regarded as malicious behavior at the kernel level.

[0103] For example, suppose there is an application called "Financial Assistant". When performing security testing on it, the task execution data is analyzed through the following steps: By capturing all data packets generated by the application during data transmission, it is found that one of the data packets has a forged signature and is identified as malicious traffic. By monitoring the application's changes to system environment variables and file systems, it is found that the application has modified system configuration files without user authorization, which is identified as a potential security risk. By using a kernel debugger to monitor the application's behavior at the kernel level, it is found that the application frequently calls system calls to obtain user sensitive information, which is identified as malicious behavior at the kernel level. Based on the above analysis results, it is concluded that the risk level of the "Financial Assistant" application is high.

[0104] In this way, by comprehensively analyzing the performance of applications in data transmission, system environment variables, file system modification, and kernel-level behavior, potential security threats can be discovered and prevented in a timely manner, improving the security of applications. Monitoring and analyzing application behavior helps to promptly discover and repair problems that may cause system crashes or data corruption, thereby enhancing system stability.

[0105] In some embodiments, during the dynamic monitoring and analysis process, the risk detection method also includes: generating a network request list containing all captured network requests based on the task execution data; in response to receiving a modification operation on the target network data in the network request list, reconstructing the network request according to the modification operation, and displaying the details of the modified network data.

[0106] In the embodiment of the present disclosure, the network request list records a detailed information list of all network requests generated by the application.

[0107] In the embodiment of the present disclosure, the modification operation is an action to modify the target network data in the network request list, such as modifying the request parameters, request header, request body, etc.

[0108] In some specific implementations, when analyzing task execution data, all network requests generated by the application are first captured. This can be achieved by installing a network monitoring tool on the terminal or using a proxy server. The captured network requests are sorted into a network request list, which contains detailed information of each network request, such as the request uniform resource locator (URL), request method, request header, request body, etc.

[0109] In some specific implementations, when a modification operation is received for the target network data in the network request list, the network request is reconstructed according to the specific content of the modification operation (such as modification of request parameters, request headers, request bodies, etc.). The modification operation can be triggered by a user interface (such as button clicks, text input, etc.) or executed by an automated script or tool.

[0110] In some specific implementations, after the network request is reconstructed, the modified network data details are displayed.

[0111] For example, suppose there is an application called "Online Shopping APP". When performing security inspection on it, the network requests were analyzed and modified through the following steps: All network requests generated by the application were captured and a network request list was generated. A request for the transmission of sensitive data was found in the network request list, and it was decided to modify it. The network request was reconstructed by modifying the sensitive data value in the request parameter. The details of the modified network data were displayed, including the call chain list. In the call chain list, an abnormal function call was found, which called an external application programming interface (Application Programming Interface, API) and transmitted sensitive data. By viewing the complete call process of the target call chain, the cause of the sensitive data leakage was determined and repaired.

[0112] In this way, by capturing and analyzing network requests, potential malicious network activities can be discovered and blocked in a timely manner, such as data leakage, man-in-the-middle attacks, etc. At the same time, by modifying network requests and reconstructing them, different attack scenarios can be simulated to test the defense capabilities of the application.

[0113] In some embodiments, displaying the modified network data details includes: outputting a list of call chains available for viewing; and in response to receiving a viewing request for a target call chain in the call chain list, outputting a complete calling process of the target call chain.

[0114] In the disclosed embodiment, the call chain records the sequence of all function or method calls from the time when the application initiates a network request to the time when the request is finally completed.

[0115] In the disclosed embodiment, the call chain list includes a list of multiple call chains, and each call chain records a complete path from the application initiating a network request to completing the request.

[0116] In the disclosed embodiment, the complete calling process includes detailed information of each calling point in the target calling chain, including function name, parameters, return value, etc., which is used to show the complete execution process of the calling chain.

[0117] In some specific implementations, when a request for viewing a target call chain in the call chain list is received, the complete call process of the target call chain is output, which can be achieved by displaying the hierarchy of the call chain and detailed information of each call point (such as function name, parameters, return value, etc.).

[0118] In this way, by providing an intuitive user interface and detailed call chain information, developers can more easily understand and analyze the behavior of network requests, thereby improving the user experience. Displaying the modified network data details and call chain list helps developers quickly locate and fix problems related to network requests. This can greatly improve debugging efficiency and shorten problem fixing time. By analyzing and modifying network requests, and displaying the modified network data details and call chain information, the security, debugging capabilities and user experience of the application can be greatly improved.

[0119] Figure 2 The framework diagram of the risk detection tool is shown as Figure 2 As shown, the risk detection tool includes a user layer, a business function layer, a core capability layer and an underlying service layer. Among them, the user layer supports Android application package (Android application package, APK) files, binary archive (Android Archive, AAR) files of Android library projects and files in preset compressed file formats. In actual applications, users can directly drag the APK file of the application to be detected, or the AAR file or the file in the preset compressed file format of the core code to the preset detection box. Among them, the business function layer includes decompilation, APK unpacking, code viewing, static search, call chain tracing, call chain analysis, dynamic search, Hook class / method, Artificial Intelligence (Artificial Intelligence, AI) analysis, packet capture network interface, network interface analysis, network interface call chain tracing, network interface replay and other functions. In actual applications, users can view and choose to use a certain business function separately, or they can choose not to select a function separately, and the system will automatically execute all functions in the business function layer. Among them, the core capability layer includes capabilities such as decompilation, unpacking, dynamic debugging and network packet capture. Among them, the underlying service layer includes services such as decompilation services, unpacking services of various manufacturers, Hook services and network services. It should be noted that, Figure 2 The architecture diagram of the risk detection tool shown is only for reference. In actual applications, the file types supported by the user layer can be adjusted as needed, business functions can be increased or decreased as needed, core functions can be increased or decreased as needed, and underlying services can be increased or decreased as needed, which will not be repeated here.

[0120] Figure 3 The architecture diagram of the dynamic search process is shown as Figure 3As shown, the architecture diagram includes the user operation layer, the functional module layer and the base capability layer; wherein, the user operation layer can support the following operations: focus on the specified classes and methods to automatically generate Hook code; select classes and methods for Hook; search for data generated when the APP is executed, and associate it with specific methods; search for page data and network data. Among them, the functional module supports the following functions: generate Hook code; specify classes and methods to execute Hook; data search; AI analysis. Among them, the base capabilities include Hook system key API; dynamic library Hook; page data monitoring; network data monitoring. It should be noted that, Figure 3 The architecture diagram shown is only schematic. In actual applications, the user operation layer can be adjusted according to needs to support various functions and their corresponding functional modules and base capabilities, which will not be repeated here.

[0121] Figure 4 The call chain tracing and network request analysis process is shown, as Figure 4 As shown, the process includes:

[0122] S401: Network packet capture;

[0123] Risk detection tools capture data packets transmitted in the network.

[0124] S402: Capture packet list, select any network request;

[0125] After successfully capturing packets, the risk detection tool will generate a list of all captured network requests. Users can select one or more network requests of interest from this list for further analysis.

[0126] S403: Display network data details;

[0127] After the user selects a network request, the risk detection tool will display detailed information about the request, including but not limited to the request header, response header, request body, response body, and transmitted metadata.

[0128] S404: whether to modify the network data, if yes, execute S405, if no, execute S408;

[0129] When analyzing network data, the user may need to simulate certain modifications to test the reaction of the application or service. This step asks the user whether the captured network data needs to be modified.

[0130] S405: whether to replay the network request, if not, execute S406; if yes, execute S407;

[0131] If the user chooses to modify the network data, the next step is to decide whether to resend (or "replay") the modified network request.

[0132] S406: other operations;

[0133] If the user chooses not to replay the network request, it means that the user may want to perform other operations, such as saving the modified data, generating a report, or performing further static analysis.

[0134] S407: re-requesting display of network data according to the modified content, and then executing S408;

[0135] If the user chooses to replay the network request, the risk detection tool will reconstruct and send the request based on the modifications made by the user, and then display the details of the modified network data.

[0136] S408: tracing calling method;

[0137] This step allows users to trace back and view the calling methods that trigger network requests, and understand the background code or method call chain that triggers these requests.

[0138] S409: Check the call chain;

[0139] Users can choose to view the entire call chain to understand all the steps and processes from the initial method call to the final network request.

[0140] S410: View any method in the call chain;

[0141] This step allows the user to select and view any method in the call chain and perform a deeper analysis on a specific method or node.

[0142] S411: AI analyzes the selected method.

[0143] To provide deeper analysis and insights, risk detection tools can integrate AI capabilities to automatically analyze user-selected methods. AI can provide information about the method’s behavior, performance, potential issues, and interactions with other methods.

[0144] In this way, the risk detection tool starts from network packet capture, through detailed data display and modification, to call chain tracing and AI analysis, to provide users with a comprehensive and in-depth network data analysis and debugging environment.

[0145] In some embodiments, risk detection results are generated based on static detection results and dynamic detection results, including: inputting the static detection results and the dynamic detection results into a pre-trained risk assessment model to obtain a risk detection report output by the risk assessment model, wherein the risk assessment model is used to perform a comprehensive risk assessment based on multi-dimensional static detection results and multi-dimensional dynamic detection results to generate risk detection results, which include a risk score and a risk detection report.

[0146] In the disclosed embodiment, the static detection result is the result obtained after scanning the source code using a static code analysis tool, including information on code quality, potential defects, security vulnerabilities, etc.

[0147] In the disclosed embodiment, the dynamic detection result is behavioral data captured by a dynamic testing tool or an actual running application, including performance data, abnormal data, user interaction data, etc.

[0148] In the disclosed embodiment, the risk assessment model is a model for comprehensively processing and analyzing static and dynamic detection results to evaluate the security and stability of the application program. The model can output a risk score and a risk detection report.

[0149] In the disclosed embodiment, the risk score is a quantitative indicator calculated by the risk assessment model based on static and dynamic detection results, and is used to reflect the security risk and stability level of the application.

[0150] In the disclosed embodiment, the risk detection report is a detailed report generated by the risk assessment model, which includes information such as a detailed description of the risk, possible impacts, and recommended remediation measures.

[0151] In some specific implementations, professional static code analysis tools are used to scan the source code to obtain static detection results on code quality, potential defects, security vulnerabilities, etc. Dynamic detection results are obtained by capturing the behavior data of the application at runtime, including performance data, abnormal data, user interaction data, etc., through dynamic testing tools or actual running of the application.

[0152] In some specific implementations, a suitable risk assessment model is selected or constructed according to the assessment objectives and business needs. The model should be capable of processing multi-dimensional static and dynamic detection results and be able to output risk scores and risk detection reports. The risk assessment model is trained using historical data and expert knowledge so that it can accurately assess the risk level reflected by static and dynamic detection results.

[0153] In some embodiments, the collected static detection results and dynamic detection results are used as inputs into a pre-trained risk assessment model; the risk assessment model comprehensively processes and analyzes the input detection results, and calculates the risk score according to the preset evaluation criteria and algorithms. The risk assessment model also generates a risk detection report, which contains a detailed description of the risk, possible impacts, recommended remediation measures and other information. The development team or security experts interpret the generated risk detection report to understand the risk points and recommended measures in the report. According to the risk score and the recommendations in the report, formulate corresponding remediation plans and safety measures to reduce or eliminate potential risks.

[0154] For example, suppose there is an application called "Financial APP" and the development team decides to conduct a risk assessment on it. The development team drags the application to the risk detection webpage on the PC. The risk detection webpage first uses a static code analysis tool to scan the source code and obtains static detection results on code quality, potential defects, etc.; then, the dynamic testing tool is used to capture the behavior data of the application at runtime and obtain dynamic detection results; next, the static and dynamic detection results are input into the pre-trained risk assessment model to obtain a risk score and risk detection report. The report points out that the application has a high-risk SQL injection vulnerability and gives detailed repair suggestions. According to the recommendations in the report, the development team repaired the application and re-evaluated the risk to ensure the security of the application.

[0155] In this way, by combining static and dynamic detection results, the risk assessment model can more comprehensively reflect the security and stability of the application and improve the accuracy of the assessment. Using pre-trained risk assessment models for risk assessment can greatly shorten the assessment time and improve the efficiency of the assessment. The detailed information and recommended measures in the risk detection report can provide targeted guidance to the development team, helping them to quickly locate and repair potential security vulnerabilities and defects. Through continuous risk assessment and repair work, the security protection capabilities of the application can be continuously improved and security risks can be reduced.

[0156] It should be understood that Figures 2 to 4 The schematic diagram shown is only exemplary and not restrictive, and it is scalable, and those skilled in the art can Figures 2 to 4 Various obvious changes and / or substitutions can be made to the examples, and the resulting technical solutions still fall within the scope of the disclosure of the embodiments of the present disclosure.

[0157] The present disclosure provides a risk detection device for an application program, such as Figure 5 As shown, the risk detection device may include: a receiving module 501, used to receive an application to be detected; a static detection module 502, used to perform static code detection on the application to obtain a static detection result; a dynamic detection module 503, used to perform dynamic behavior monitoring on the application to obtain a dynamic detection result; a first generation module 504, used to generate a risk detection result based on the static detection result and the dynamic detection result.

[0158] In some embodiments, the risk detection result includes a risk score and a risk detection report; the risk detection device further includes: a first output module ( Figure 5 ), for outputting the risk score of the application in response to receiving a risk score query request for the application; a second output module ( Figure 5 ), for outputting a risk detection report of an application in response to receiving a query request for a risk detection report of an application.

[0159] In some embodiments, the risk detection device further includes: a shell detection module ( Figure 5 ), used to detect whether the application has shell protection before dynamic behavior monitoring or static code detection; shell removal module ( Figure 5 ), is used to de-shell the application program when it is detected that the application program has shell protection, so as to extract the original file cluster of the application program, and the original file cluster is used for static or dynamic analysis.

[0160] In some embodiments, the static detection module 502 is used to: unpack the compressed package of the application to obtain multiple component files included in the application; analyze the multiple component files to obtain the static detection result of the application; wherein the static detection result is a first type of security risk detection result obtained by analyzing without running the application.

[0161] In some embodiments, the dynamic detection module 503 is used to: send the application to a terminal under a preset detection environment so that the terminal can install the application; in response to receiving a test instruction for a target task, forward the test instruction to the terminal where the application has been installed to instruct the terminal to perform the test task for the application; analyze the task execution data returned by the terminal to generate a dynamic detection result, which includes a second type of security risk detection result that occurs when the application is running.

[0162] In some embodiments, the dynamic detection module 503 is used to: analyze various types of data packets generated by the application during data transmission to identify hidden abnormal data packets, malicious traffic, and suspicious interactive behaviors; analyze the application's changes to system environment variables and file systems; and analyze the application's behavior at the kernel level.

[0163] In some embodiments, the risk detection device further includes: a second generation module ( Figure 5 ), used to generate a network request list containing all captured network requests according to the task execution data; a reconstruction module ( Figure 5 ), for responding to receiving a modification operation on the target network data in the network request list, and reconstructing the network request according to the modification operation; a third output module ( Figure 5 (not shown in the figure) is used to display the modified network data details.

[0164] In some embodiments, the third output module ( Figure 5(not shown) for: outputting a list of call chains available for viewing; and in response to receiving a viewing request for a target call chain in the call chain list, outputting a complete calling process of the target call chain.

[0165] In some embodiments, the first generation module 504 is used to: input static detection results and dynamic detection results into a pre-trained risk assessment model to obtain a risk detection report output by the risk assessment model, wherein the risk assessment model is used to perform a comprehensive risk assessment based on multi-dimensional static detection results and multi-dimensional dynamic detection results to generate a risk score and a risk detection report.

[0166] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0167] The risk detection device for an application program of the disclosed embodiment can solve the problems of complex operation, low efficiency, and inaccurate judgment in the existing software risk analysis process, and improve the efficiency and accuracy of risk analysis.

[0168] The present disclosure provides a schematic diagram of a risk detection scenario, such as Figure 6 shown.

[0169] As mentioned above, the test method provided by the embodiment of the present disclosure is applied to electronic devices. Electronic devices are intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices.

[0170] Specifically, the electronic device can perform the following operations:

[0171] receiving an application to be detected;

[0172] Perform static code detection on the application and obtain static detection results;

[0173] Perform dynamic behavior monitoring on the application and obtain dynamic detection results;

[0174] Generate risk scores and risk detection reports based on static detection results and dynamic detection results;

[0175] In response to receiving a risk score query request for an application, outputting a risk score of the application;

[0176] In response to receiving a risk detection report query request for an application, a risk detection report of the application is output.

[0177] It should be understood that Figure 6 The scene diagram shown is only illustrative and not restrictive. Those skilled in the art can Figure 6 Various obvious changes and / or substitutions can be made to the examples, and the resulting technical solutions still fall within the scope of the disclosure of the embodiments of the present disclosure.

[0178] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0179] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0180] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0181] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 to a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0182] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0183] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the risk detection method of the application. For example, in some embodiments, the risk detection method of the application may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the risk detection method of the application described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to execute the risk detection method of the application program in any other appropriate manner (eg, by means of firmware).

[0184] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a dedicated or general-purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0185] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0186] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0187] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0188] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: Local Area Networks (LANs), Wide Area Networks (WANs), and the Internet.

[0189] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0190] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0191] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A risk detection method for an application, comprising: receiving an application to be detected; Performing static code detection on the application to obtain a static detection result; Performing dynamic behavior monitoring on the application to obtain dynamic detection results; A risk detection result is generated based on the static detection result and the dynamic detection result.

2. The method according to claim 1, wherein: The risk detection result includes a risk score and a risk detection report, and the method further includes: In response to receiving a risk score query request for the application, outputting the risk score of the application; and In response to receiving a risk detection report query request for the application, the risk detection report of the application is output.

3. The method according to claim 1, wherein: Before dynamic behavior monitoring or static code detection, it also includes: Detecting whether the application is protected by a shell; When it is detected that the application is protected by a shell, the application is unshelled to extract the original file cluster of the application, and the original file cluster is used for static or dynamic analysis.

4. The method according to claim 1 or 3, wherein: The performing static code detection on the application to obtain a static detection result includes: Unpacking the compressed package of the application to obtain multiple component files included in the application; The multiple component files are analyzed to obtain a static detection result of the application; wherein the static detection result is a first type of security risk detection result obtained by analyzing without running the application.

5. The method according to claim 1 or 3, wherein: The dynamic behavior monitoring of the application to obtain dynamic detection results includes: Sending the application to a terminal in a preset detection environment so that the terminal can install the application; In response to receiving a test instruction for a target task, forwarding the test instruction to the terminal on which the application has been installed to instruct the terminal to execute the test task for the application; The task execution data returned by the terminal is analyzed to generate a dynamic detection result, wherein the dynamic detection result includes a second type of security risk detection result that occurs when the application is running.

6. The method according to claim 5, wherein: The analyzing the task execution data returned by the terminal includes at least one of the following: Analyze various data packets generated by the application during data transmission to identify hidden abnormal data packets, malicious traffic, and suspicious interaction behaviors; Analyze the modification behavior of the application program on the system environment variables and the file system; Analyze the behavior of the application at the kernel level.

7. The method according to claim 5, further comprising: generating a network request list including all captured network requests according to the task execution data; In response to receiving a modification operation on the target network data in the network request list, the network request is reconstructed according to the modification operation, and the modified network data details are displayed.

8. The method according to claim 7, wherein: The modified network data details are displayed, including: The output contains a list of call chains that can be viewed; In response to receiving a viewing request for a target call chain in the call chain list, a complete calling process of the target call chain is output.

9. The method according to claim 1, wherein: The generating the risk detection result based on the static detection result and the dynamic detection result includes: The static detection results and the dynamic detection results are input into a pre-trained risk assessment model to obtain the risk detection report output by the risk assessment model, wherein the risk assessment model is used to perform a comprehensive risk assessment based on the multi-dimensional static detection results and the multi-dimensional dynamic detection results to generate the risk detection results.

10. A risk detection device for an application, comprising: A receiving module, used for receiving an application to be detected; A static detection module, used to perform static code detection on the application to obtain a static detection result; A dynamic detection module, used to monitor the dynamic behavior of the application program and obtain dynamic detection results; The first generating module is used to generate a risk detection result based on the static detection result and the dynamic detection result.

11. The device according to claim 10, wherein: The risk detection result includes a risk score and a risk detection report, and the device further includes: A first output module, configured to output the risk score of the application in response to receiving a risk score query request for the application; and The second output module is configured to output the risk detection report of the application in response to receiving a risk detection report query request for the application.

12. The apparatus according to claim 10, further comprising: A shell detection module, used to detect whether the application has shell protection before dynamic behavior monitoring or static code detection; The shell removal module is used to remove the shell from the application program when detecting that the application program is protected by a shell, so as to extract the original file cluster of the application program, and the original file cluster is used for static or dynamic analysis.

13. The device according to claim 10 or 12, wherein: The static detection module is used to: Unpacking the compressed package of the application to obtain multiple component files included in the application; The multiple component files are analyzed to obtain a static detection result of the application; wherein the static detection result is a first type of security risk detection result obtained by analyzing without running the application.

14. The device according to claim 10 or 12, wherein: The dynamic detection module is used for: Sending the application to a terminal in a preset detection environment so that the terminal can install the application; In response to receiving a test instruction for a target task, forwarding the test instruction to the terminal on which the application has been installed to instruct the terminal to execute the test task for the application; The task execution data returned by the terminal is analyzed to generate a dynamic detection result, wherein the dynamic detection result includes a second type of security risk detection result that occurs when the application is running.

15. The device according to claim 14, wherein: The dynamic detection module is also used for: Analyze various data packets generated by the application during data transmission to identify hidden abnormal data packets, malicious traffic, and suspicious interaction behaviors; Analyze the modification behavior of the application program on the system environment variables and the file system; Analyze the behavior of the application at the kernel level.

16. The device according to claim 14, wherein: The device also includes: A second generating module, configured to generate a network request list including all captured network requests according to the task execution data; A reconstruction module, configured to, in response to receiving a modification operation on target network data in the network request list, reconstruct the network request according to the modification operation; The third output module is used to display the modified network data details.

17. The device according to claim 16, wherein: The third output module is further used for: The output contains a list of call chains that can be viewed; In response to receiving a viewing request for a target call chain in the call chain list, a complete calling process of the target call chain is output.

18. The device according to claim 10, wherein: The first generating module is further used for: The static detection results and the dynamic detection results are input into a pre-trained risk assessment model to obtain the risk detection report output by the risk assessment model, wherein the risk assessment model is used to perform a comprehensive risk assessment based on the multi-dimensional static detection results and the multi-dimensional dynamic detection results to generate the risk detection results.

19. An electronic device comprising: at least one processor; as well as a memory communicatively connected to at least one processor; wherein, The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are for causing a computer to execute a method according to any one of claims 1-9.

21. A computer program product comprising a computer program stored on a storage medium, the computer program implementing the method according to any one of claims 1 to 9 when executed by a processor.

Images