Client application privacy compliance detection method and device

Abstract

The invention relates to the technical field of privacy compliance, and provides a client application privacy compliance detection method and device. The method comprises the following steps: receiving a client application privacy compliance detection request; determining a target application according to the client application privacy compliance detection request; performing an interaction test on the target application to trigger all to-be-tested functions in the target application; monitoring the target application in the interaction test process in real time by using a monitoring interface arranged at the client to obtain an interface calling log, interface content and interface switching time of the target application; determining execution time of the to-be-tested functions according to the interface switching time and a test sequence of the to-be-tested functions; according to the interface calling log and the interface content, whether the interface calling condition corresponding to the execution time of each function to be tested meets the privacy compliance requirement or not is judged, and a privacy compliance detection result is obtained. According to the embodiment of the invention, the privacy compliance detection precision can be improved.

Description

Technical Field

[0001] This specification relates to the field of privacy compliance technology, and in particular to a method and device for detecting privacy compliance of client applications. Background Art

[0002] User privacy compliance detection of mobile client applications is a test for whether mobile client applications collect user personal privacy information. The existing technology uses attack framework hook technology to detect whether Android client applications have system-level application interface call behaviors. Specifically, the attack framework software injects the running target application software process and uses hook functions to detect various event messages in the Android client system or process to detect whether the application software in the Android client collects user personal information. However, the existing technology can only determine whether application interface call behavior occurs when the client application is running, and determine whether the client application collects user personal privacy information through application interface call behavior. There is a defect that it cannot determine whether the time when the client application collects user personal privacy information occurs during the user's use of specified business functions. Therefore, a client application privacy compliance detection method is urgently needed. Summary of the invention

[0003] Given that current technology can only determine whether an application interface call occurs when a client application is running, and determine whether the client application collects the user's personal privacy information through the application interface call behavior, there is a defect that it is impossible to determine whether the time when the client application collects the user's personal privacy information occurs during the time period when the user uses a specified business function. This solution is proposed to overcome the above problem or at least partially solve the above problem.

[0004] On the one hand, an object of some embodiments of this specification is to provide a client application privacy compliance detection method, the method comprising:

[0005] Receive client application privacy compliance detection requests;

[0006] Determine a target application according to the client application privacy compliance detection request;

[0007] Performing interactive testing on the target application to trigger all functions to be tested in the target application;

[0008] Use the monitoring interface set at the client to monitor the target application in real time during the interactive test to obtain the interface call log, interface content and interface switching time of the target application;

[0009] Determining the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested;

[0010] According to the interface call log and the interface content, determine whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, and obtain the privacy compliance test result.

[0011] Furthermore, an interactive test is performed on the target application to trigger all functions to be tested in the target application, including:

[0012] Obtain all the to-be-tested functions of the target application and the test sequence corresponding to the to-be-tested functions by matching from a preset function detection table;

[0013] Initializing the current client so that the interface of the client is at the upper level interface that triggers the function to be tested;

[0014] The target application is run, and the function buttons in the function to be tested are triggered according to the test sequence to implement interactive testing.

[0015] Furthermore, the target application is monitored in real time during the interactive test using a monitoring interface provided at the client to obtain the interface call log, interface content, and interface switching time of the target application, including:

[0016] During the interactive test, each time a function button in the current interface is triggered, the monitoring interface is used to record the time of each triggering of the function button, thereby determining the interface switching time according to the time of triggering the function button, and the monitoring interface is used to intercept the interface when and after the function button is triggered to obtain the interface content;

[0017] The monitoring interface is used to obtain the interface call log of the target application during the interactive test.

[0018] Furthermore, the interface call log includes at least one or more of an interface identifier, an interface verification information, a call time, an Internet Protocol address, and a return status.

[0019] Further, determining the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested includes:

[0020] Sorting the interface switching times in chronological order to obtain a sorting result;

[0021] Matching the sorting result with the test order corresponding to the function to be tested to obtain a matching result;

[0022] Based on the matching result, the execution time of the function to be tested is determined using the interface switching time.

[0023] Furthermore, according to the interface call log and the interface content, it is determined whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, and a privacy compliance test result is obtained, including:

[0024] According to the call time in the interface call log and the timestamp corresponding to the interface content, filter the interface call log and the interface content corresponding to the execution time of each function to be tested from the interface call log and the interface content;

[0025] Determine the interface range allowed to be called within the execution time of each function to be tested based on the interface content corresponding to the execution time of each function to be tested;

[0026] Extract the interface information in the interface call log corresponding to the execution time of each function to be tested, and determine whether the interface information extracted from the execution time of each function to be tested is within the range of interfaces allowed to be called within the execution time of each function to be tested. If not, it is determined that it does not comply with the privacy compliance requirements. If so, it is determined that it complies with the privacy compliance requirements.

[0027] On the other hand, some embodiments of this specification further provide a client application privacy compliance detection device, the device comprising:

[0028] A receiving module, used to receive a client application privacy compliance detection request;

[0029] A target application determination module, used to determine the target application according to the client application privacy compliance detection request;

[0030] A test module, used to perform interactive testing on the target application to trigger all functions to be tested in the target application;

[0031] The monitoring module is used to monitor the target application in real time during the interactive test by using the monitoring interface set at the client, and obtain the interface call log, interface content and interface switching time of the target application;

[0032] An execution time determination module, used to determine the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested;

[0033] The judgment module is used to judge whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements based on the interface call log and the interface content, and obtain the privacy compliance detection result.

[0034] On the other hand, some embodiments of the present specification further provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is executed by the processor, the instructions of the above method are executed.

[0035] On the other hand, some embodiments of the present specification further provide a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor of a computer device, the instructions of the above method are executed.

[0036] On the other hand, some embodiments of the present specification further provide a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor of a computer device, the instructions of the above method are executed.

[0037] One or more technical solutions provided by some embodiments of this specification have at least the following technical effects:

[0038] The embodiments of the present specification automatically receive a client application privacy compliance detection request to determine the target application to be tested for privacy compliance, and then perform interactive testing on the target application. On the basis of triggering all the functions to be tested in the target application, the target application is monitored when executing the function, and the interface call log, interface content and interface switching time of the target application are obtained. Since the execution time of the function to be tested cannot be directly obtained when testing the function to be tested, the execution time of the function to be tested can be quickly determined according to the interface switching time and the test order of the function to be tested, and the interface call situation corresponding to the execution time of each function to be tested can be quickly and accurately determined according to the interface call log and interface content, and it is judged whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, thereby accurately judging whether the client application's collection of user privacy behavior meets the reasonable functional scenario requirements, and improving the accuracy of privacy compliance detection.

[0039] The above description is only an overview of the technical solutions of some embodiments of this specification. In order to more clearly understand the technical means of some embodiments of this specification, they can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of some embodiments of this specification more obvious and easy to understand, the specific implementation methods of some embodiments of this specification are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate some embodiments of this specification or technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or prior art descriptions. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0041] Figure 1 A schematic diagram of an implementation system of a client application privacy compliance detection method in some embodiments of this specification is shown;

[0042] Figure 2 A flowchart of a client application privacy compliance detection method in some embodiments of this specification is shown;

[0043] Figure 3 A schematic diagram of steps for interactive testing of a target application in some embodiments of this specification;

[0044] Figure 4 A schematic diagram of the steps of performing real-time monitoring of a target application in some embodiments of this specification;

[0045] Figure 5 A schematic diagram of the steps of determining the execution time of a function to be tested in some embodiments of this specification;

[0046] Figure 6 A schematic diagram of steps for obtaining privacy compliance detection results in some embodiments of this specification;

[0047] Figure 7 This is a structural diagram of a client application privacy compliance detection device in some embodiments of this specification;

[0048] Figure 8 This is a schematic diagram of the computer device structure provided in some embodiments of this specification.

[0049] [Description of Reference Numerals]

[0050] 101. Terminal;

[0051] 102. Server;

[0052] 701, receiving module;

[0053] 702. Target application determination module;

[0054] 703. Test module;

[0055] 704, monitoring module;

[0056] 705, execution time determination module;

[0057] 706. Judgment module;

[0058] 802. Computer equipment;

[0059] 804, processor;

[0060] 806. Memory;

[0061] 808, driving mechanism;

[0062] 810, input / output interface;

[0063] 812. Input device;

[0064] 814. Output device;

[0065] 816. Presentation equipment;

[0066] 818. Graphical user interface;

[0067] 820, network interface;

[0068] 822, communication link;

[0069] 824. Communication bus. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in some embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on some embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0071] It should be noted that the terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0072] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of relevant laws and regulations.

[0073] It should be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0074] like Figure 1 The diagram is a schematic diagram of an implementation system of a client application privacy compliance detection method according to an embodiment of the present invention, which may include: a terminal 101 and a server 102. The terminal 101 and the server 102 communicate with each other through a network, which may include a local area network (LAN), a wide area network (WAN), the Internet or a combination thereof, and is connected to a website, a user device (such as a computing device) and a back-end system. A staff member may send a client application privacy compliance detection request to the server 102 through the terminal 101. After receiving the client application privacy compliance detection request, the server 102 establishes a communication link with the target application in the terminal 101 to perform privacy compliance detection on the target application, obtain a privacy compliance detection result, and send the privacy compliance detection result to the terminal 101, so that the staff member can process the business according to the privacy compliance detection result.

[0075] In the embodiments of this specification, the server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN, Content Delivery Network), and big data and artificial intelligence platforms.

[0076] In an optional embodiment, the terminal 101 may include but is not limited to electronic devices such as self-service terminal devices, desktop computers, tablet computers, laptop computers, smart wearable devices, etc. Optionally, the operating system running on the electronic device may include but is not limited to Android system, IOS system, Linux, Windows, etc. Of course, the terminal 101 is not limited to the above-mentioned electronic devices with a certain entity, and it can also be software running in the above-mentioned electronic devices.

[0077] In addition, it should be noted that Figure 1What is shown is only an application environment provided by the present disclosure. In actual application, multiple terminals 101 may be included, and this specification does not limit this.

[0078] Figure 2 It is a flowchart of a client application privacy compliance detection method provided by an embodiment of the present invention. This specification provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or device product is executed, it can be executed in the order or in parallel according to the method shown in the embodiment or the accompanying drawings. Specifically, Figure 2 As shown, applied to the above-mentioned server side, the method may include:

[0079] S201: receiving a client application privacy compliance detection request;

[0080] S202: Determine a target application according to the client application privacy compliance detection request;

[0081] S203: performing interactive testing on the target application to trigger all functions to be tested in the target application;

[0082] S204: Using the monitoring interface set at the client to monitor the target application in real time during the interactive test, and obtain the interface call log, interface content and interface switching time of the target application;

[0083] S205: Determine the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested;

[0084] S206: According to the interface call log and the interface content, determine whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, and obtain a privacy compliance test result.

[0085] The embodiments of the present specification automatically receive a client application privacy compliance detection request to determine the target application to be tested for privacy compliance, and then perform interactive testing on the target application. On the basis of triggering all the functions to be tested in the target application, the target application is monitored when executing the function, and the interface call log, interface content and interface switching time of the target application are obtained. Since the execution time of the function to be tested cannot be directly obtained when testing the function to be tested, the execution time of the function to be tested can be quickly determined according to the interface switching time and the test order of the function to be tested, and the interface call situation corresponding to the execution time of each function to be tested can be quickly and accurately determined according to the interface call log and interface content, and it is judged whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, thereby accurately judging whether the client application's collection of user privacy behavior meets the reasonable functional scenario requirements, and improving the accuracy of privacy compliance detection.

[0086] It can be understood that, in some embodiments, the target application can be one or more applications, and the interactive testing process of the target application at least includes operating the function buttons in the target application. Furthermore, in some embodiments, the function buttons are not explicit, but implicit, for example, when sliding the screen, the function buttons are reflected as the entire screen. The interface call log of the target application includes at least one or more of the interface identifier, interface verification information, call time, Internet Protocol address, and return status, and usually includes the call time and interface identifier. The interface content refers to the screenshot of the client when interacting with the target application. The interface switching time refers to all the interface switching times when all the functions to be tested in the target application are triggered, which can be obtained by OCR recognition of the screenshot time in the interface content. In some embodiments, the method of identifying time through OCR may have the problem of high resource cost. Therefore, the interface switching time can also be obtained from the client by obtaining the client's synchronous clock information when the interface switches. The functions to be tested can be one or more, but usually there are multiple and large numbers. The test order of the functions to be tested can be regarded as a directed graph connected by nodes, and each node represents a function button. However, a function button may be triggered multiple times during interactive testing. For example, some functions to be tested have parallel functions to be tested. At this time, some function buttons are triggered multiple times. This also means that a function button can correspond to one or more nodes in the directed graph connected by nodes. Furthermore, when the target application executes each function to be tested, the range of interfaces allowed to be called may be different. Therefore, by judging whether the interface call corresponding to the execution time of each function to be tested meets the privacy compliance requirements, the privacy compliance detection results can be obtained quickly and accurately.

[0087] See attached Figure 3In some embodiments, performing interactive testing on the target application to trigger all functions to be tested in the target application may include:

[0088] S301: Obtain all to-be-tested functions of the target application and the test sequence corresponding to the to-be-tested functions from a preset function detection table;

[0089] S302: Initializing the current client so that the interface of the client is at the upper level interface that triggers the function to be tested;

[0090] S303: Run the target application, and trigger the function buttons in the function to be tested according to the test sequence to implement interactive testing.

[0091] It can be understood that, in some embodiments, the functions to be tested corresponding to different target applications and the test order corresponding to the functions to be tested are different. The function detection table stores all the functions that need to be tested of the target application to fully guarantee the sufficiency and completeness of the target application during interactive testing. Before performing the interactive test, the application first completes the initialization of the current client to ensure that the target application is not running at this time, so that the client interface is in the upper-level interface of the function to be tested. In some embodiments, other applications need to be closed to avoid the interface calls of other applications from interfering with the current privacy compliance detection process. When running the target application, click the function buttons in the function to be tested one by one according to the test order. In some embodiments, in order to ensure the reliability of the interactive test, the interval time between adjacent function buttons in the triggering test order is greater than the preset interval time. In order to ensure the efficiency of submitting the interactive test, the interval time between adjacent function buttons in the triggering test order can also be set according to the return time of the successful response receipt message corresponding to the trigger request in the client, for example, it can be set to be later than the time when the successful response receipt message is returned, and the time difference between the time when the successful response receipt message is returned is the preset time difference.

[0092] See attached Figure 4 In some embodiments, the target application is monitored in real time during the interactive test using a monitoring interface provided at the client to obtain the interface call log, interface content, and interface switching time of the target application, which may include:

[0093] S401: During the interactive test, each time a function button in the current interface is triggered, the monitoring interface is used to record the time of each triggering of the function button, thereby determining the interface switching time according to the time of triggering the function button, and the monitoring interface is used to intercept the interface when and after the function button is triggered to obtain the interface content;

[0094] S402: Utilize the monitoring interface to obtain the interface call log of the target application during the interactive test.

[0095] It can be understood that, in some embodiments, a monitoring interface is set at the client, which can be a monitoring interface built into the client that can be called by the outside world, or it can be a third-party interface arranged by the outside world, and the third-party interface is connected and communicated with the client in real time, and the start time and completion time of the operation when executing the interface switching operation are determined by recording the time of each triggering of the function button (that is, the return time of the successful response receipt message), so that the start time and / or completion time are used as the interface switching time. Furthermore, in some embodiments, after intercepting the interface content, the face recognition engine can be used to perform irreversible mosaic masking on the face in the interface content, and the document recognition engine can be used to perform irreversible mosaic masking on the document information in the interface content, so as to fully ensure the privacy compliance in the privacy compliance detection process.

[0096] See attached Figure 5 In some embodiments, determining the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested may include:

[0097] S501: sorting the interface switching times in order to obtain a sorting result;

[0098] S502: Match the sorting result with the test sequence corresponding to the function to be tested to obtain a matching result;

[0099] S503: Based on the matching result, determine the execution time of the function to be tested using the interface switching time.

[0100] It can be understood that, in some embodiments, a function to be tested may include triggering one or more function buttons. For example, the function to be tested is to query the weather, and the function buttons involved include checking today's temperature, checking future temperature, checking future rainfall, etc. The test sequence usually includes multiple nodes, and each node represents triggering a function button. When matching the sorting result with the test sequence corresponding to the function to be tested, if the interactive test process of the target application is very smooth and there is no retry process, then the interface switching time corresponds to the node corresponding to the test sequence one by one, and direct matching is sufficient when matching. However, due to network abnormalities and other reasons, there may be a retry process in the interactive test process of the target application. At this time, there may be multiple interface switching times corresponding to a function button, including one or more unfinished interface switching times and a completed interface switching time. At this time, each function The button corresponds to the interface switching time (some function buttons may correspond to a set of interface switching times). The latest time in the set of interface switching times is used as the interface switching time to be sorted, and then the interface switching time is sorted in chronological order. This ensures that when each function to be tested is tested, the division of the interface switching time will not lead to the problem of missing interface calls when the subsequent statistics of the interface calls corresponding to the execution time of each function to be tested are in progress. The test order and the interface switching time in the matching result are always one-to-one corresponding. Then, based on the matching result, all the execution time involved in the function to be tested is divided into multiple segments to distinguish the execution time of different functions to be tested. It can also be further divided according to the multiple nodes corresponding to each function to be tested to distinguish the execution time of the multiple nodes corresponding to each function to be tested, thereby realizing the accurate division of the execution time of the function to be tested.

[0101] See attached Figure 6 In some embodiments, judging whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements based on the interface call log and the interface content, and obtaining the privacy compliance detection result may include:

[0102] S601: Filtering the interface call log and the interface content corresponding to the execution time of each function to be tested from the interface call log and the interface content according to the call time in the interface call log and the timestamp corresponding to the interface content;

[0103] S602: Determine the interface range allowed to be called within the execution time of each function to be tested according to the interface content corresponding to the execution time of each function to be tested;

[0104] S603: Extract the interface information in the interface call log corresponding to the execution time of each function to be tested, and determine whether the interface information extracted from the execution time of each function to be tested is within the range of interfaces allowed to be called within the execution time of each function to be tested. If not, it is determined that it does not comply with the privacy compliance requirements. If so, it is determined that it complies with the privacy compliance requirements.

[0105] It can be understood that in some embodiments, after obtaining the execution time of each function to be tested, the interface call log and interface content corresponding to the execution time of each function to be tested are first filtered according to the call time in the interface call log and the timestamp corresponding to the interface content, so as to facilitate the subsequent determination of the range of interfaces allowed to be called within the execution time of each function to be tested according to the interface content corresponding to the execution time of each function to be tested, and the extraction of interface information in the interface call log corresponding to the execution time of each function to be tested, so as to quickly and accurately determine whether the interface information extracted from the execution time of each function to be tested is within the range of interfaces allowed to be called within the execution time of each function to be tested, and obtain refined privacy compliance detection results.

[0106] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0107] Corresponding to the above-mentioned client application privacy compliance detection method, some embodiments of this specification also provide a client application privacy compliance detection device, referring to Figure 7 As shown, in some embodiments, the apparatus may include:

[0108] The receiving module 701 is used to receive a client application privacy compliance detection request;

[0109] A target application determination module 702 is used to determine a target application according to the client application privacy compliance detection request;

[0110] A testing module 703 is used to perform interactive testing on the target application to trigger all functions to be tested in the target application;

[0111] The monitoring module 704 is used to monitor the target application in real time during the interactive test by using the monitoring interface set at the client, and obtain the interface call log, interface content and interface switching time of the target application;

[0112] An execution time determination module 705, used to determine the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested;

[0113] The judgment module 706 is used to judge whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements based on the interface call log and the interface content, and obtain the privacy compliance detection result.

[0114] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0115] It should be noted that in the embodiments of this specification, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user and fully authorized by all parties.

[0116] It should be noted that the computer program product described in this specification (this application) is a software product that mainly implements the method described in this specification (this application) through a computer program.

[0117] The embodiments of this specification also provide a computer device. Figure 8 As shown, in some embodiments of the present specification, the computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs) or graphics processing units (GPUs), and each processing unit may implement one or more hardware threads. The computer device 802 may also include any memory 806, which is used to store any kind of information such as code, settings, data, etc. In a specific embodiment, the computer program on the memory 806 and can be run on the processor 804, when the computer program is run by the processor 804, the instructions of the method described in any of the above embodiments may be executed. Non-limiting, for example, the memory 806 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory may use any technology to store information. Further, any memory may provide volatile or non-volatile retention of information. Further, any memory may represent a fixed or removable component of the computer device 802. In one case, when the processor 804 executes an associated instruction stored in any memory or a combination of memories, the computer device 802 may perform any operation of the associated instruction. The computer device 802 also includes one or more drive mechanisms 808 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0118] The computer device 802 may also include an input / output interface 810 (I / O) for receiving various inputs (via input devices 812) and for providing various outputs (via output devices 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface 818 (GUI). In other embodiments, the input / output interface 810 (I / O), input device 812, and output device 814 may not be included, and the computer device 802 may be used as a computer device in a network. The computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0119] The communication link 822 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0120] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), computer-readable storage media, and computer program products of some embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processor to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processor generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processor to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processor so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] In a typical configuration, a computer device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0125] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computer device. As defined in this specification, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0126] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may take the form of complete hardware embodiments, complete software embodiments or embodiments combining software and hardware. Moreover, the embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0127] The present specification embodiments may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present specification embodiments may also be practiced in distributed computing environments where tasks are performed by remote processors connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0128] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0129] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0130] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of this specification. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0131] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A client application privacy compliance detection method, characterized in that: The method comprises: Receive client application privacy compliance detection requests; Determine a target application according to the client application privacy compliance detection request; Performing interactive testing on the target application to trigger all functions to be tested in the target application; Use the monitoring interface set at the client to monitor the target application in real time during the interactive test to obtain the interface call log, interface content and interface switching time of the target application; Determining the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested; According to the interface call log and the interface content, determine whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, and obtain the privacy compliance test result.

2. The method according to claim 1, characterized in that Performing interactive testing on the target application to trigger all functions to be tested in the target application includes: Obtain all the to-be-tested functions of the target application and the test sequence corresponding to the to-be-tested functions by matching from a preset function detection table; Initializing the current client so that the interface of the client is at the upper level interface that triggers the function to be tested; The target application is run, and the function buttons in the function to be tested are triggered according to the test sequence to implement interactive testing.

3. The method according to claim 1, characterized in that The target application is monitored in real time during the interactive test using the monitoring interface provided at the client to obtain the interface call log, interface content, and interface switching time of the target application, including: During the interactive test, each time a function button in the current interface is triggered, the monitoring interface is used to record the time of each triggering of the function button, thereby determining the interface switching time according to the time of triggering the function button, and the monitoring interface is used to intercept the interface when and after the function button is triggered to obtain the interface content; The monitoring interface is used to obtain the interface call log of the target application during the interactive test.

4. The method according to claim 1, characterized in that The interface call log includes at least one or more of an interface identifier, interface verification information, call time, Internet Protocol address, and return status.

5. The method according to claim 4, characterized in that Determining the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested includes: Sorting the interface switching times in order to obtain a sorting result; Matching the sorting result with the test order corresponding to the function to be tested to obtain a matching result; Based on the matching result, the execution time of the function to be tested is determined using the interface switching time.

6. The method according to claim 1, characterized in that According to the interface call log and the interface content, determine whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements, and obtain the privacy compliance test results, including: According to the call time in the interface call log and the timestamp corresponding to the interface content, filter the interface call log and the interface content corresponding to the execution time of each function to be tested from the interface call log and the interface content; Determine the interface range allowed to be called within the execution time of each function to be tested based on the interface content corresponding to the execution time of each function to be tested; Extract the interface information in the interface call log corresponding to the execution time of each function to be tested, and determine whether the interface information extracted from the execution time of each function to be tested is within the range of interfaces allowed to be called within the execution time of each function to be tested. If not, it is determined that it does not comply with the privacy compliance requirements. If so, it is determined that it complies with the privacy compliance requirements.

7. A client application privacy compliance detection device, characterized in that: The device comprises: A receiving module, used to receive a client application privacy compliance detection request; A target application determination module, used to determine the target application according to the client application privacy compliance detection request; A test module, used to perform interactive testing on the target application to trigger all functions to be tested in the target application; The monitoring module is used to monitor the target application in real time during the interactive test by using the monitoring interface set at the client, and obtain the interface call log, interface content and interface switching time of the target application; An execution time determination module, used to determine the execution time of the function to be tested according to the interface switching time and the test order of the function to be tested; The judgment module is used to judge whether the interface call situation corresponding to the execution time of each function to be tested meets the privacy compliance requirements based on the interface call log and the interface content, and obtain the privacy compliance detection result.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the computer program is executed by the processor, the computer program executes the instructions of the method according to any one of claims 1 to 6.

9. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of a computer device, the computer program executes instructions of the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program executes instructions of the method according to any one of claims 1 to 6.

Images