Method and device for detecting sensitive behavior of software development kit (SDK) and electronic equipment

Abstract

The invention discloses a method for detecting sensitive behaviors of a software development kit (SDK). The method comprises the following steps: acquiring a to-be-detected SDK file; analyzing and converting the software development kit SDK file to obtain at least one target format file; matching each target format file with a preset sensitive detection item; and for each target format file, determining that the software development kit SDK executes a sensitive behavior under the condition that the target format file is matched with the sensitive detection item.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a method, device and electronic device for detecting sensitive behaviors of a software development kit (SDK). Background Art

[0002] In the Android operating system, software development can be performed by creating and building applications using a software development kit (SDK). Considering that there are sensitive behaviors in the execution process of the SDK, it is necessary to monitor the sensitive behaviors by detecting them to ensure the security of sensitive information.

[0003] However, the detection of SDK sensitive behaviors in related technologies has the problem of incomplete coverage, resulting in missed detections. Summary of the invention

[0004] The embodiments of the present application provide a method, device and electronic device for detecting sensitive behaviors of a software development kit (SDK), which can solve the problem of incomplete coverage and missed detection in the related art when detecting sensitive behaviors of SDK.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting sensitive behaviors of a software development kit SDK, the method comprising: obtaining a software development kit SDK file to be detected; parsing and converting the software development kit SDK file to obtain at least one target format file; matching each of the target format files with preset sensitive detection items; for each of the target format files, when the target format file matches the sensitive detection item, determining that the software development kit SDK performs sensitive behaviors.

[0006] In the second aspect, an embodiment of the present application provides a device for detecting sensitive behaviors of a software development kit SDK, the device comprising: an acquisition module, used to acquire a software development kit SDK file to be detected; a processing module, used to parse and convert the software development kit SDK file to obtain at least one target format file; a matching module, used to match each of the target format files with preset sensitive detection items; a determination module, used to determine, for each of the target format files, that the software development kit SDK performs sensitive behaviors when the target format file matches the sensitive detection items.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method for detecting sensitive behaviors of a software development kit SDK as described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method for detecting sensitive behaviors of a software development kit SDK as described in the first aspect are implemented.

[0009] In the fifth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method for detecting sensitive behaviors of a software development kit SDK as described in the first aspect.

[0010] In an embodiment of the present application, a software development kit SDK file to be detected is obtained, and the software development kit SDK file is parsed and converted to obtain at least one target format file; each of the target format files is matched with a preset sensitive detection item; for each of the target format files, when the target format file matches the sensitive detection item, it is determined that the software development kit SDK executes a sensitive behavior, so that all target format files of the SDK file are matched with the preset sensitive detection items to comprehensively determine whether the SDK file has sensitive behavior. When the target format file matches the preset sensitive detection item, it can be determined that the behavior executed by the target format file is a sensitive behavior, and then it can be determined that the SDK file executes the sensitive behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flowchart of a method for detecting SDK sensitive behavior provided in an embodiment of the present application;

[0012] Figure 2 It is a structural diagram of a device for detecting SDK sensitive behavior provided in an embodiment of the present application;

[0013] Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0015] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0016] In conjunction with the accompanying drawings, the method, device and electronic device for detecting sensitive behaviors of a software development kit (SDK) provided in the embodiments of the present application are described in detail through specific embodiments and their application scenarios.

[0017] Figure 1 A flow chart of a method for detecting SDK sensitive behavior provided by an embodiment of the present application is shown. The method can be executed by an electronic device, and the electronic device can include: a server and / or a terminal device. Figure 1 , the method may include the following steps:

[0018] Step 102, obtaining the SDK file to be detected.

[0019] Among them, since the SDK file is stored in the resource (assets) file set when a new Android project is created, the software development kit SDK file to be detected can be obtained from the resource file set of the new Android project.

[0020] Step 104: parse and convert the SDK file to obtain at least one target format file.

[0021] SDK can include components such as compiler, debugger, documentation, sample code and library files to help developers develop on a specific platform or framework. When creating a new Android project, the SDK file is packaged as a jar file and distributed to the resource file set for use. In order to fully detect the SDK file, it is necessary to process the SDK file to fully detect each calling class in the SDK file, so as to accurately determine the sensitive behavior of the SDK.

[0022] Step 106: Match each of the target format files with preset sensitive detection items.

[0023] Among them, sensitive detection items have been preset in the development of Android engineering projects, which are used to match the files to be detected to determine whether there are sensitive behaviors when running the files to be detected.

[0024] Step 108: for each of the target format files, when the target format file matches the sensitive detection item, determining that the SDK executes a sensitive behavior.

[0025] In an embodiment of the present application, a software development kit SDK file to be detected is obtained, and the software development kit SDK file is parsed and converted to obtain at least one target format file; each of the target format files is matched with a preset sensitive detection item; for each of the target format files, when the target format file matches the sensitive detection item, it is determined that the software development kit SDK executes sensitive behavior, so that all target format files of the SDK file are matched with the preset sensitive detection items to comprehensively determine whether the SDK file has sensitive behavior, so that for each target format file, when the target format file matches the preset sensitive detection item, it can be determined that the execution behavior contained in the target format file is a sensitive behavior, and then it can be determined that the SDK file executes sensitive behavior.

[0026] In one implementation, the sensitive detection item includes a sensitive behavior function; the above-mentioned step 106 of matching each of the target format files with the preset sensitive detection items may include: comparing the behavior function in each of the target format files with the sensitive behavior function in the preset sensitive detection item to determine whether the behavior function is a sensitive behavior function.

[0027] In an embodiment of the present application, sensitive detection items are pre-set in a newly created Android project, which may include sensitive behavior functions. Each target format file obtained by SDK parsing and conversion also includes a behavior function, and each behavior is implemented by calling each behavior function when developing software. Therefore, by comparing the behavior functions in each of the target format files with the sensitive behavior functions in the preset sensitive detection items, it can be determined whether the behavior function is a sensitive behavior function, thereby determining whether there is program content in the SDK file that executes sensitive behaviors.

[0028] In one implementation, the above step 104 performs parsing and conversion processing on the SDK file to obtain at least one target format file, which may include:

[0029] Step 1, decompress the SDK file to obtain at least one data packet;

[0030] Step 2, obtaining at least one class file from each of the data packets;

[0031] Step 3, converting each of the class files into a target format file;

[0032] Wherein, the target format file includes a smali file.

[0033] In an embodiment of the present application, before detecting the SDK file, the SDK file is first processed in a certain manner, specifically including decompressing the software development kit SDK file to obtain at least one data packet, obtaining at least one class file from each of the data packets, and converting each of the class files into a target format file, thereby converting the SDK file into a target format file that is easier to search and judge, such as a smali file, so that by matching and analyzing the obtained smali file with the preset sensitive detection items, it is possible to determine that the software development kit SDK performs sensitive behavior when the smali file matches the preset sensitive detection items, and the efficiency of detecting sensitive behaviors of the software development kit SDK can also be improved.

[0034] In one implementation, after determining in the above step 108 that the SDK executes a sensitive behavior, the method may further include: obtaining behavior data of the SDK executing the sensitive behavior.

[0035] In an embodiment of the present application, the target format file is obtained by parsing and converting the acquired SDK file to be detected, and matched with the preset sensitive detection items. When the target format file matches the sensitive detection items, it is determined that the SDK performs the sensitive behavior, and then the behavior data of the SDK performing the sensitive behavior is obtained, so that the obtained behavior data can be checked to ensure whether the behavior data of the sensitive behavior is complete and accurate, and does not leak sensitive information.

[0036] It should be noted that the method for detecting SDK-sensitive behavior provided in the embodiments of the present application can be executed by a device for detecting SDK-sensitive behavior, or a control module in the device for detecting SDK-sensitive behavior for executing the method for detecting SDK-sensitive behavior. In the embodiments of the present application, the device for detecting SDK-sensitive behavior provided in the embodiments of the present application is explained by taking the method for detecting SDK-sensitive behavior executed by a device for detecting SDK-sensitive behavior as an example.

[0037] Figure 2 is a schematic diagram of a structure of a device for detecting SDK sensitive behavior provided in an embodiment of the present application. Figure 2 As shown, the device 200 includes: an acquisition module 21, a processing module 22, a matching module 23 and a determination module 24.

[0038] Among them, the acquisition module 21 is used to obtain the SDK file to be detected; the processing module 22 is used to parse and convert the SDK file to obtain at least one target format file; the matching module 23 is used to match each of the target format files with the preset sensitive detection items; the determination module 24 is used to determine that the SDK performs sensitive behavior for each of the target format files when the target format file matches the sensitive detection item.

[0039] In one implementation, the sensitive detection item includes a sensitive behavior function; the matching module 23 can be used to compare the behavior function in each of the target format files with the sensitive behavior function in the preset sensitive detection item to determine whether the behavior function is a sensitive behavior function.

[0040] In one implementation, the processing module 22 can be used to: decompress the software development kit SDK file to obtain at least one data packet; obtain at least one class file from each of the data packets; convert each of the class files into a target format file; wherein the target format file includes a smali file.

[0041] In one implementation, the acquisition module 21 may also be used to: acquire behavior data of the software development kit SDK executing the sensitive behavior.

[0042] The device for detecting SDK sensitive behavior in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device, and for example, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., and the embodiment of the present application does not make specific limitations.

[0043] The device for detecting SDK sensitive behavior in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0044] The device for detecting SDK sensitive behavior provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0045] Based on the same technical concept, an embodiment of the present application further provides an electronic device, which is used to execute the above-mentioned method for detecting SDK sensitive behavior. Figure 3 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor (processor) 301, a communication interface (Communications Interface) 302, a memory (memory) 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304. The processor 301 may call a computer program stored in the memory 303 and executable on the processor 301 to perform the following steps:

[0046] Obtain the SDK file to be detected; parse and convert the SDK file to obtain at least one target format file; match each target format file with a preset sensitive detection item; for each target format file, when the target format file matches the sensitive detection item, determine that the SDK performs a sensitive behavior. The specific execution steps can refer to the various steps of the above-mentioned method embodiment for detecting SDK sensitive behavior, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0047] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0048] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0049] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0050] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0051] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned method embodiment for detecting SDK sensitive behavior is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0052] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0053] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment for detecting SDK sensitive behaviors, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0054] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0055] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0056] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0057] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for detecting sensitive behaviors of a software development kit SDK, characterized in that: include: Get the software development kit SDK file to be tested; Parsing and converting the software development kit SDK file to obtain at least one target format file; Matching each of the target format files with preset sensitive detection items; For each of the target format files, when the target format file matches the sensitive detection item, it is determined that the software development kit SDK executes the sensitive behavior.

2. The method according to claim 1, characterized in that The sensitive detection items include sensitive behavior functions; and matching each of the target format files with preset sensitive detection items includes: The behavior functions in each of the target format files are compared with the sensitive behavior functions in the preset sensitive detection items to determine whether the behavior functions are sensitive behavior functions.

3. The method according to claim 1, characterized in that The step of parsing and converting the software development kit SDK file to obtain at least one target format file includes: Decompressing the software development kit SDK file to obtain at least one data packet; Obtaining at least one class file from each of the data packets; Convert each of the class files into a target format file; Wherein, the target format file includes a smali file.

4. The method according to claim 1, characterized in that: After determining that the software development kit SDK executes the sensitive behavior, the method further includes: Obtain behavior data of the software development kit SDK executing the sensitive behavior.

5. A device for detecting sensitive behaviors of a software development kit SDK, characterized in that: include: An acquisition module is used to acquire the software development kit SDK file to be detected; A processing module, used for parsing and converting the software development kit SDK file to obtain at least one target format file; A matching module, used for matching each of the target format files with preset sensitive detection items; A determination module is used to determine, for each target format file, whether the software development kit SDK executes a sensitive behavior when the target format file matches the sensitive detection item.

6. The device according to claim 5, characterized in that The sensitive detection items include sensitive behavior functions; The matching module is used to compare the behavior functions in each of the target format files with the sensitive behavior functions in the preset sensitive detection items to determine whether the behavior functions are sensitive behavior functions.

7. The device according to claim 5, characterized in that The processing module is used for: Decompressing the software development kit SDK file to obtain at least one data packet; Obtaining at least one class file from each of the data packets; Convert each of the class files into a target format file; Wherein, the target format file includes a smali file.

8. The device according to claim 5, characterized in that The acquisition module is also used for: Obtain behavior data of the software development kit SDK executing the sensitive behavior.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the method for detecting sensitive behaviors of a software development kit SDK as described in any one of claims 1 to 4 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the steps of the method for detecting sensitive behaviors of a software development kit SDK as described in any one of claims 1 to 4 are implemented.

Images