Illegal interception method and device and electronic equipment

Abstract

The invention relates to the technical field of violation interception, and particularly provides a violation interception method and device and electronic equipment. The method comprises the following steps: extracting content data corresponding to at least one target layer by adopting a data extraction mode corresponding to the at least one target layer in a target application program; the at least one target layer comprises at least one of the following items: a control layer, an application layer and a system layer; performing violation identification on the content data to obtain target content data with violation; and executing violation interception operation for the target content data. Therefore, the security of the application display content is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of illegal interception, and particularly to a method, device and electronic device for illegal interception. Background Art

[0002] With the development of intelligent terminal technology, there are more and more various applications (i.e., application programs). How to ensure the security of the content displayed by the applications has become a technical problem to be solved.

[0003] Under the related technology, usually during the production process of application content, the uploaded content is audited, or during the application installation process, the application is audited through the audit mechanism of the application market.

[0004] However, since the application content (such as the display content of the application page) is usually updated continuously, therefore, by adopting the above methods, there may be illegal content (such as violent content) in the application content. Therefore, it is difficult to ensure that the content displayed by the application is always secure. Summary of the Invention

[0005] To solve the above technical problems, embodiments of the present disclosure provide a method, device and electronic device for illegal interception.

[0006] On the one hand, embodiments of the present disclosure provide a method for illegal interception, including:

[0007] Adopting the data extraction methods respectively corresponding to at least one target layer in the target application program to extract the content data respectively corresponding to at least one target layer; at least one target layer includes at least one of the following: control layer, application layer and system layer;

[0008] Performing illegal identification on each content data to obtain the target content data with illegal situations;

[0009] Performing an illegal interception operation on the target content data.

[0010] In one implementation manner, the content data corresponding to the control layer is control information, the content data of the application layer is the application display content, and the content data corresponding to the system layer is a display list.

[0011] In one implementation manner, adopting the data extraction methods respectively corresponding to at least one target layer in the target application program to extract the content data respectively corresponding to at least one target layer includes:

[0012] If the control layer is the target layer in the target application program, then adopt at least one of the following:

[0013] Adopting Document Object Model operations to obtain the control information of the target application program;

[0014] Obtain the control information of the target application through the class for invoking control information;

[0015] Adopt a control positioning method to determine the controls of the target application, and adopt a method for obtaining control objects to obtain the control information of the target application based on the controls of the target application;

[0016] Traverse the control tree of the control layer to determine the controls of the target application, obtain the control acquisition interface corresponding to the controls of the target application from the device system, and obtain the control information of the target application through the control acquisition interface.

[0017] In one implementation, adopt the data extraction methods corresponding to at least one target layer in the target application to extract the content data corresponding to at least one target layer, including:

[0018] If the application layer is a target layer in the target application, then adopt at least one of the following:

[0019] Adopt off-screen rendering technology to obtain the application display content of the application layer;

[0020] Adopt the call interface corresponding to the application layer to extract the application display content of the application layer;

[0021] Monitor the application layer through the breakpoints pre-set for the target application to obtain the monitored application display content of the application layer;

[0022] According to the storage address corresponding to the application display content, obtain the application display content of the application layer from the database;

[0023] Obtain the application display content of the application layer through the log file;

[0024] Obtain the application display content of the application layer from the data stream output by the system layer.

[0025] In one implementation, adopt the data extraction methods corresponding to at least one target layer in the target application to extract the content data corresponding to at least one target layer, including:

[0026] If the system layer is a target layer in the target application, then adopt at least one of the following:

[0027] Access the system layer by accessing the system interface to obtain the display list in the system layer; the display list contains graphic elements;

[0028] Obtain the display list in the system layer through the log file;

[0029] Retrieve the display list in the system layer from the database by showing the storage address corresponding to the display list.

[0030] In one implementation, before identifying violations in each content data and obtaining the target content data with violations, the method further includes:

[0031] If it is detected that the target application plays audio, extract the audio stream of the audio.

[0032] Perform speech recognition on the audio stream to obtain the audio text.

[0033] Determine the audio text as the content data to be identified for violations.

[0034] In one implementation, identifying violations in each content data and obtaining the target content data with violations includes:

[0035] According to the violation identification strategy, for each content data, perform the following steps:

[0036] If the content data contains text data, perform text analysis on the text data through the text analysis sub-model in the violation identification model to obtain the text analysis result.

[0037] If the content data contains image data, perform image recognition on the image data through the image recognition sub-model in the violation identification model to obtain the image recognition result.

[0038] If any one of the text analysis result and the image recognition result indicates a violation, determine that the content data is in violation.

[0039] In one implementation, the violation identification model is stored locally and / or in the cloud server.

[0040] In one implementation, before identifying violations in each content data and obtaining the target content data with violations, it includes:

[0041] According to the violation monitoring strategy, determine the monitoring scope and the protocols to be monitored.

[0042] Within the monitoring scope, according to the network monitoring methods corresponding to the respective protocols to be monitored, perform network monitoring on the communication of the target application to obtain network monitoring data.

[0043] According to the violation identification strategy, perform violation identification on the network monitoring data to obtain the violation identification result.

[0044] In one implementation, the network monitoring data includes the protocol logs corresponding to the respective protocols to be monitored.

[0045] According to the violation recognition strategy, the network monitoring data is recognized for violations to obtain the violation recognition results, including:

[0046] For each protocol log respectively, the following steps are executed:

[0047] Extract the communication address information and the transmitted data from the protocol log;

[0048] If the communication address information contains the specified address information, it is determined that there is a communication address violation;

[0049] If the transmitted data contains the specified keyword, it is determined that there is a communication content violation.

[0050] In one implementation, for the target content data, a violation interception operation is performed, including:

[0051] For each target content data respectively, the following steps are executed:

[0052] According to the violation recognition result of the target content data, determine the content type and the violation type;

[0053] According to the violation interception strategy, determine the violation interception method corresponding to the content type, the violation type and the current application scenario;

[0054] Intercept and process the target content data according to the violation interception method.

[0055] In one implementation, the violation interception method includes at least one of the following: preventing content display, muting processing, and warning notification;

[0056] Preventing content display includes at least one of the following: partial interface occlusion, overall interface occlusion;

[0057] Among them, partial interface occlusion is used to occlude the partial application interface containing the target content data, and overall interface occlusion is used to occlude the entire application interface.

[0058] In one implementation, the method further includes:

[0059] Send the violation warning information of the target content data to the associated control device;

[0060] Among them, the violation warning information includes at least one of the following: the violation recognition result, and the violation interception method.

[0061] In one implementation, the method further includes:

[0062] If a policy management instruction is received, update at least one of the following according to the policy management instruction:

[0063] Violation monitoring strategy, violation identification strategy, and violation interception strategy;

[0064] The violation monitoring strategy is used to determine the target layer and its corresponding data extraction method;

[0065] The violation identification strategy is used to determine the way of violation identification;

[0066] The policy management instruction is issued by at least one of the following devices: a local device, a cloud server, and an associated control device.

[0067] On the one hand, an embodiment of the present disclosure provides a device for intercepting violations, including:

[0068] An extraction unit, configured to extract content data corresponding to at least one target layer by using a data extraction method corresponding to each of at least one target layer in a target application; the at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer;

[0069] An identification unit, configured to perform violation identification on each content data to obtain target content data with violations;

[0070] An interception unit, configured to perform a violation interception operation on the target content data.

[0071] In one implementation, the content data corresponding to the control layer is control information, the content data of the application layer is application display content, and the content data corresponding to the system layer is a display list.

[0072] In one implementation, the extraction unit is configured to:

[0073] If the control layer is a target layer in the target application, then at least one of the following is adopted:

[0074] Adopt the Document Object Model operation to obtain the control information of the target application;

[0075] Obtain the control information of the target application through a class for calling control information;

[0076] Adopt a control positioning method to determine the controls of the target application, and adopt a method for obtaining control objects to obtain the control information of the target application based on the controls of the target application;

[0077] Traverse the control tree of the control layer to determine the controls of the target application, obtain a control acquisition interface corresponding to the controls of the target application from the device system, and obtain the control information of the target application through the control acquisition interface.

[0078] In one implementation, the extraction unit is configured to:

[0079] If the application layer is the target layer in the target application, at least one of the following is adopted:

[0080] Adopt off-screen rendering technology to obtain the application display content of the application layer;

[0081] Adopt the call interface corresponding to the application layer to extract the application display content of the application layer;

[0082] Monitor the application layer through breakpoints set in advance for the target application to obtain the monitored application display content of the application layer;

[0083] According to the storage address corresponding to the application display content, obtain the application display content of the application layer from the database;

[0084] Obtain the application display content of the application layer through the log file;

[0085] Obtain the application display content of the application layer from the data stream output by the system layer.

[0086] In one implementation, the extraction unit is used for:

[0087] If the system layer is the target layer in the target application, at least one of the following is adopted:

[0088] Access the system layer by accessing the system interface to obtain the display list in the system layer; the display list contains graphic elements;

[0089] Obtain the display list in the system layer through the log file;

[0090] According to the storage address corresponding to the display list, obtain the display list in the system layer from the database.

[0091] In one implementation, the recognition unit is further used for:

[0092] If it is detected that the target application plays audio, extract the audio stream of the audio;

[0093] Perform speech recognition on the audio stream to obtain the audio text;

[0094] Determine the audio text as the content data to be recognized for violations.

[0095] In one implementation, the recognition unit is used for:

[0096] According to the violation recognition policy, for each content data, perform the following steps:

[0097] If the content data contains text data, perform text analysis on the text data through the text analysis sub-model in the violation recognition model to obtain the text analysis result;

[0098] If the content data includes image data, the image data is subjected to image recognition by the image recognition sub-model in the violation recognition model to obtain an image recognition result;

[0099] If any one of the text analysis result and the image recognition result indicates a violation, it is determined that the content data is in violation.

[0100] In one implementation, the violation recognition model is stored locally and / or in a cloud server.

[0101] In one implementation, the recognition unit is further configured to:

[0102] Determine a monitoring scope and a protocol to be monitored according to a violation monitoring policy;

[0103] Within the monitoring scope, network monitoring is performed on the communication of the target application according to the network monitoring methods corresponding to the protocols to be monitored respectively, to obtain network monitoring data;

[0104] According to a violation recognition policy, violation recognition is performed on the network monitoring data to obtain a violation recognition result.

[0105] In one implementation, the network monitoring data includes protocol logs corresponding to the protocols to be monitored respectively;

[0106] The recognition unit is configured to:

[0107] For each protocol log, the following steps are performed:

[0108] Extract communication address information and transmitted data from the protocol log;

[0109] If the communication address information includes specified address information, it is determined that there is a communication address violation;

[0110] If the transmitted data includes specified keywords, it is determined that there is a communication content violation.

[0111] In one implementation, the interception unit is configured to:

[0112] For each target content data, the following steps are performed:

[0113] Determine the content type and the violation type according to the violation recognition result of the target content data;

[0114] Determine the violation interception method corresponding to the content type, the violation type, and the current application scenario according to a violation interception policy;

[0115] Intercept and process the target content data according to the violation interception method.

[0116] In one implementation, the illegal interception method includes at least one of the following: preventing content display, muting, and warning notification;

[0117] Preventing content display includes at least one of the following: partial interface occlusion, and overall interface occlusion;

[0118] Among them, partial interface occlusion is used to occlude the partial application interface containing the target content data, and overall interface occlusion is used to occlude the entire application interface.

[0119] In one implementation, the interception unit is further configured to:

[0120] Send an illegal alarm message of the target content data to an associated control device;

[0121] Among them, the illegal alarm message includes at least one of the following: illegal identification result, and illegal interception method.

[0122] In one implementation, the interception unit is further configured to:

[0123] If a policy management instruction is received, update at least one of the following according to the policy management instruction:

[0124] Illegal monitoring policy, illegal identification policy, and illegal interception policy;

[0125] The illegal monitoring policy is used to determine the target layer and its corresponding data extraction method;

[0126] The illegal identification policy is used to determine the illegal identification method;

[0127] The policy management instruction is issued by at least one of the following devices: a local device, a cloud server, and an associated control device.

[0128] On the one hand, an electronic device is provided in an embodiment of the present disclosure, including:

[0129] A processor; and

[0130] A memory storing computer instructions, the computer instructions being used to cause the processor to execute the steps of the method provided in any of the various optional implementation manners of the above-mentioned illegal interception.

[0131] On the one hand, a computer-readable storage medium is provided in an embodiment of the present disclosure, storing computer instructions, the computer instructions being used to cause a computer to execute the steps of the method provided in any of the various optional implementation manners of the above-mentioned illegal interception.

[0132] On the one hand, embodiments of the present disclosure provide a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the steps of the method provided in any of the various alternative implementations of the above-mentioned violation interception.

[0133] The method for violation interception in the embodiments of the present disclosure includes extracting content data corresponding to at least one target layer by using a data extraction method corresponding to each of the at least one target layer in a target application; the at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer; performing violation identification on each content data to obtain target content data with violations; and performing a violation interception operation on the target content data. In this way, the security of the application display content is improved. Description of the Drawings

[0134] Figure 1 It is a flowchart of a method for violation interception in the embodiments of the present disclosure.

[0135] Figure 2 It is a schematic diagram of an application level in the embodiments of the present disclosure.

[0136] Figure 3 It is an example layout diagram of a violation identification model in the embodiments of the present disclosure.

[0137] Figure 4 It is a schematic diagram of network monitoring in the embodiments of the present disclosure.

[0138] Figure 5 It is a schematic architecture diagram of policy management in the embodiments of the present disclosure.

[0139] Figure 6 It is a flowchart of a method for handling application violations in the embodiments of the present disclosure.

[0140] Figure 7 It is a structural block diagram of a device for violation interception in the embodiments of the present disclosure. Detailed Embodiments

[0141] Next, the technical solutions of the present disclosure will be clearly and completely described in conjunction with the accompanying drawings. Obviously, the described embodiments are some, but not all, of the embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts fall within the scope of protection of the present disclosure. In addition, the technical features involved in different embodiments of the present disclosure described below can be combined with each other as long as they do not conflict with each other.

[0142] In the related art, usually during the production process of application content, the uploaded application content is audited, or during the application installation process, the application is audited through the audit mechanism of the application market. However, since application content is usually constantly updated, therefore, adopting the above methods cannot ensure that the application content is always secure.

[0143] Based on the deficiencies of the above related art, in the embodiments of the present disclosure, a method, device, and electronic device for illegal interception are provided, aiming to improve the security of the application display content.

[0144] In the embodiments of the present disclosure, a method for illegal interception is provided. This method can be applied to an electronic device. The present disclosure does not limit the type of the electronic device, which can be any device type suitable for implementation, such as a terminal device and a server, etc. The present disclosure will not elaborate on this.

[0145] Refer to Figure 1 As shown, it is a flowchart of a method for illegal interception in the embodiments of the present disclosure. Below, in combination with Figure 1 This method will be described. The specific implementation process of this method is as follows:

[0146] Step 101: Extract the content data corresponding to at least one target layer by using the data extraction method corresponding to each of at least one target layer in the target application program; the target layer includes at least one of the following: the control layer, the application layer, and the system layer.

[0147] In one implementation, a monitoring module is set in the electronic device, and this monitoring module is independent of each application program. Then, the monitoring module can be started, and the monitoring module obtains the illegal monitoring policy, and according to the illegal monitoring policy, determines the target layer and the data extraction method corresponding to each target layer. Then, enter each target layer respectively, and extract the content data corresponding to at least one target layer by using the data extraction method corresponding to each of at least one target layer in the target application program.

[0148] Among them, the content data corresponding to the control layer is control information, the content data of the application layer is the application display content, and the content data corresponding to the system layer is the display list. The target layer may further include a display layer. The content data corresponding to the display layer may be the interface display content.

[0149] Furthermore, to improve the accuracy of illegal identification, the number of target layers can also be increased. For example, the target layer can include at least two, at least three, or all of the above items.

[0150] Optionally, the target application(s) can be one or more, and can be the currently running applications, such as the foreground running applications and the background running applications. In actual applications, the target application, the target layer, and their corresponding content data can all be set according to the actual application scenario, and no restrictions are imposed here.

[0151] Refer to Figure 2 As shown, it is a schematic diagram of an application layer. Figure 2 In it, in the system of the electronic device, the display of the application interface of the target application is hierarchical. From top to bottom, they are the control layer, the application layer, the system layer, and the display layer for final output display in sequence.

[0152] Among them, the control layer has the position, content information, and display information of the display controls. These information are defined by the developer and handed over to the system of the electronic device for unified measurement and management. The system can obtain the control text information and control image information of the controls from the control layer. For example, the control text information can include at least one of the following items: control prompt information and the text information within the control.

[0153] In the application layer, each application has a separate canvas. The system measures the parameters passed in from the control layer according to the capabilities of the device hardware (such as screen size and pixel density, etc.), and then layouts and draws the controls in the control layer.

[0154] In the system layer, it involves merging multiple layers of canvases of the system or applications, especially the processing of multiple interfaces. After this processing, a corresponding display list (Displaylist) will be generated later, and then it will be handed over to the hardware synthesis block of the Graphics Processing Unit (GPU) or the Hardware Composer (HWC) for calculation and processing of the relevant display buffer (Buffer).

[0155] The display layer is essentially a buffer for temporarily storing and transmitting display data. This buffer can be located in the memory or video memory. When it is sent to the display hardware, the user can see the relevant interface display.

[0156] In one implementation, if the control layer is the target layer in the target application, any one of the following methods can be adopted:

[0157] Method 1: Use the Document Object Model operation to obtain the control information of the target application;

[0158] Method 2: Determine the control information of the target application through the class for calling control information;

[0159] Method 3: Use the control positioning method to obtain the controls of the target application, and use the method for obtaining control objects to obtain the control information of the target application based on the controls of the target application;

[0160] Method 4: Traverse the control tree of the control layer to determine the controls of the target application, obtain the control acquisition interface corresponding to the controls of the target application from the device system, and obtain the control information of the target application through the control acquisition interface.

[0161] Optionally, the control information may include control text information and / or control image information.

[0162] In one implementation, the system uses the Accessibility Application Programming Interface (API) and the View tree traversal technology to traverse the control tree and obtain the control information.

[0163] In one implementation, if the application layer is the target layer in the target application, any one of the following methods can be used:

[0164] Method 1: Use off-screen rendering technology to obtain the application display content of the application layer;

[0165] In one implementation, the system uses Rendering APIs to capture the drawing operations of the application layer. If it is determined that the drawing operations of the application layer are captured, the complete application display content is obtained through Off-screen Rendering.

[0166] Method 2: Use the call interface corresponding to the application layer to extract the application display content of the application layer;

[0167] Method 3: Monitor the application layer through the breakpoints pre-set for the target application to obtain the application display content of the monitored application layer;

[0168] Method 3: Obtain the application display content of the application layer from the database according to the storage address corresponding to the application display content;

[0169] Method 4: Obtain the application display content of the application layer through the log file;

[0170] Method 5: Obtain the application display content of the application layer from the data stream output by the system layer.

[0171] In one implementation, if the system layer is the target layer in the target application, any one of the following methods can be used:

[0172] Method 1: Access the system layer by accessing the system interface to obtain the display list in the system layer; the display list contains graphic elements.

[0173] In one implementation, obtain the merged DisplayBuffer data through a display management tool. Optionally, the display management tool can be SurfaceFlinger (Surface Compositor).

[0174] Method 2: Obtain the display list in the system layer through a log file.

[0175] Method 3: Obtain the display list in the system layer from the database through the storage address corresponding to the display list.

[0176] Further, if the target layer includes a display layer, the interface display content of the display layer can be captured by taking a screen shot.

[0177] Among them, the captured interface display content is image data. Optionally, when taking a screen shot, screen capture technology can be used, or the DisplayBuffer data can be directly accessed, or the frame buffer content can be rendered and captured by using SurfaceView or OpenGL ES, etc.

[0178] Further, the audio played by the target application can also be extracted.

[0179] In one implementation, if it is detected that the target application plays audio, extract the audio stream of the audio; perform speech recognition on the audio stream to obtain audio text; determine the audio text as the content data to be identified for violations.

[0180] In one application scenario, capture the audio played in the target application. If it is determined that the application plays audio is captured, record the audio stream, and perform text conversion on the audio stream through a speech recognition model to obtain audio text.

[0181] Optionally, the screen content can be obtained in real time, or the audio stream can be recorded, through the MediaProjection API or AudioRecord.

[0182] Step 102: Identify violations for each content data to obtain the target content data with violations.

[0183] In one implementation, identify violations for each content data to obtain the respective violation identification results for each content data, and based on each violation identification result, screen out the target content data with violations from each content data.

[0184] Among them, the violation recognition result indicates whether the content data is in violation. The data types of each content data are divided into text type and image type. Therefore, different methods can be used for recognition according to different data types, and the violation recognition result includes text analysis result and image recognition result.

[0185] In one implementation, when performing violation recognition on each content data, according to the violation recognition strategy, the following steps can be executed for each content data respectively:

[0186] S1021: If the content data contains text data, the text data is analyzed through the text analysis sub-model in the violation recognition model to obtain the text analysis result.

[0187] For example, if the content data is control information and the text data is the control text information in the control information, the text analysis sub-model can be a language processing model. Through the language processing model, the control text information can be initially classified and the violation content can be recognized. For example, it contains specified violation keywords.

[0188] Another example is that if the text data is audio text, the semantic analysis of the audio text can be performed through the language processing model to determine whether the audio text contains violation content.

[0189] S1022: If the content data contains image data, the image data is recognized through the image recognition sub-model in the violation recognition model to obtain the image recognition result.

[0190] S1023: If any one of the text analysis result and the image recognition result indicates a violation, it is determined that the content data is in violation.

[0191] Furthermore, if the content data contains various types of data such as audio and video, the multi-modal recognition model in the violation recognition model can also be used to perform multi-modal recognition on the content data to obtain the multi-modal recognition result, and then determine whether the content data is in violation.

[0192] Among them, the violation recognition model is stored in the local and / or cloud server. Optionally, the violation recognition model can be an Artificial Intelligence (AI) model. The violation recognition model can be an open-source model or a commercial large model. In practical applications, the commercial large model can be set according to the actual application scenario and is not limited here.

[0193] For example, if the image data is a graphic element in DisplayBuffer and the image recognition sub-model is built based on an object detection algorithm, the sensitive content in it can be recognized through the image recognition sub-model, and the violation judgment can be made in combination with the context information.

[0194] For another example, if the image data is a screenshot image of the interface display content and the image recognition sub-model can be a large-scale image and video classification model, then the large-scale image and video classification model can be used to deeply analyze the screenshot image to identify whether it is a violative image or video.

[0195] Refer to Figure 3 As shown, it is a layout example diagram of a violative recognition model. Figure 3 In this figure, a cloud model (i.e., a violative recognition model deployed in the cloud) is deployed based on cloud data in the cloud, and an edge model (i.e., a violative recognition model deployed locally) is deployed based on device data on the local electronic device. When applying, the two are fused, that is, the cloud model and the edge model are combined to make a violative judgment to obtain a comprehensive violative recognition result, and subsequently, corresponding monitoring suggestions can also be provided according to the violative interception policy.

[0196] Furthermore, the network access of the target application can be monitored so as to judge whether there is a violation by combining the access content in subsequent steps.

[0197] In one implementation, according to the violative monitoring policy, the monitoring scope and the protocols to be monitored are determined; within the monitoring scope, according to the network monitoring methods corresponding to each protocol to be monitored, the communication of the target application is network-monitored to obtain network monitoring data; according to the violative recognition policy, the network monitoring data is violatively recognized to obtain a violative recognition result.

[0198] Optionally, the protocols to be monitored may include at least one of the following items:

[0199] Domain Name System (DNS) protocol, Hyper Text Transfer Protocol (HTTP) protocol, File Transfer Protocol (FTP) protocol, Transmission Control Protocol (TCP) protocol, User Datagram Protocol (UDP) protocol, Domain Name System (DNS).

[0200] Optionally, the monitoring scope may include application network monitoring and / or whole-device network monitoring. Application network monitoring may include at least one of the following items: performance monitoring (such as throughput monitoring), error detection, resource utilization, and log analysis. Whole-device network monitoring may include at least one of the following items: network traffic monitoring, device status monitoring, storage monitoring, and server monitoring.

[0201] In one implementation, the network connection and communication data of the target application can also be monitored only through the user identification (UID) of the target application.

[0202] Among them, the network monitoring data includes protocol logs corresponding to each protocol to be monitored. Optionally, the protocol log can be a sniffing log.

[0203] In one implementation, the following steps can also be performed for each protocol log:

[0204] Extract the communication address information and transmission data from the protocol log; if the communication address information contains the specified address information, it is determined that there is a communication address violation; if the specified keyword is included in the transmission data, it is determined that there is a communication content violation.

[0205] Refer to Figure 4 shown, which is a schematic diagram of network monitoring. Figure 4 It includes an application layer, a transport layer, a network layer, a sniffing log, and network monitoring. The protocols to be monitored involved in the application layer include: HTTP protocol, FTP protocol, and DNS protocol. The protocols to be monitored in the transport layer include TCP protocol and UDP protocol. The protocol to be monitored in the network layer includes IP protocol. Then, the sniffing logs corresponding to each protocol to be monitored in the application layer, transport layer, and network layer can be obtained, and the network monitoring module can perform violation analysis on each sniffing log respectively.

[0206] In the embodiments of the present disclosure, the network access monitoring of the target application is mainly directed to the plaintext data of the target application, mainly involving information related to the Uniform Resource Locator (URL) of the target application and HTTP plaintext data. The basic principle is that when the target application uses plaintext communication, devices such as routers and switches in the network may intercept the communication data, and then based on the intercepted communication data, a network attack can be launched on the target application. Generally, in order to reduce the risk of plaintext transmission of applications, applications usually use encrypted transmission methods to protect the network transmission content. However, there are still many applications that use plaintext transmission for reasons of development cost or security policies. Therefore, from the user's perspective, they will still be interfered by illegal content due to the application being attacked by the network. For this reason, in the embodiments of the present disclosure, the monitoring is mainly directed to the transmitted plaintext data, such as plaintext DNS access, plaintext HTTP access, plaintext TCP type, and plaintext UDP type transmissions.

[0207] In this way, protocol logs to be monitored at different levels can be obtained separately, and each protocol log can be asynchronously identified and processed by the network monitoring module. For example, keyword identification and Internet Protocol (IP) identification can be used to determine whether a network packet involves a violation.

[0208] Step 103: Perform a violation interception operation on the target content data.

[0209] In one implementation, when performing Step 103, the following steps can be performed for each target content data respectively:

[0210] According to the violation identification result of the target content data, determine the content type and the violation type; according to the violation interception policy, determine the violation interception method corresponding to the content type, the violation type, and the current application scenario; and perform interception processing on the target content data according to the violation interception method.

[0211] Among them, the violation interception method includes at least one of the following: preventing content display, muting, and warning notification; preventing content display includes at least one of the following: partial interface occlusion and overall interface occlusion; partial interface occlusion is used to occlude the local application interface containing the target content data, and overall interface occlusion is used to occlude the entire application interface.

[0212] Optionally, the violation interception method can also include network processing of the application (such as network interception), adjustment of the application operation (such as application exit), audio replacement, and notifying the management personnel, etc., which are not limited here.

[0213] For example, some insecure websites can be filtered in advance; later, if security risks are detected in the interface and the content involves network access, the corresponding network access addresses will be added to the firewall management list, so as to reduce the entry of insecure content from the terminal data source and improve the system security.

[0214] Optionally, the violation interception method can be pre-configured by at least one of the local, cloud, and associated control devices, can also be controlled in real time by the user, and can also be controlled in real time by other users (such as parents) through the associated control device.

[0215] In one implementation, the current violation identification result and multiple recommended violation interception methods that can be selected can be displayed in real time through the display device, and then, according to the user's selection operation, the violation content display behavior can be processed in real time in the violation interception method selected by the user.

[0216] In one implementation, a violation warning message of target content data is sent to an associated control device; wherein, the violation warning message includes at least one of the following: a violation identification result and a violation interception method.

[0217] For example, the associated control device is a terminal device of parents (such as a mobile phone), and parents can, in this way, perform violation control and violation monitoring on the electronic devices of children (such as a mobile phone or a tablet).

[0218] Among them, the application scenario can be a network environment. Optionally, the application scenario can include: an office network, a home network, and a public network. In actual applications, the type of the application scenario can be set according to the actual application scenario, and no limitation is made here.

[0219] Since the requirements for application monitoring and violation handling in different application scenarios are usually different, therefore, the violation monitoring policy can also include a scenario recognition policy, and the current application scenario can be recognized according to the scenario recognition policy. Different monitoring frequencies and depths can be set for different application scenarios.

[0220] For example, in a high-risk public network environment, the monitoring of network data may be strengthened. And, different violation interception methods can be set for different application scenarios. Thus, when the application scenario changes, the electronic device can adjust its own monitoring and violation handling behaviors according to the new application scenario, so as to ensure good monitoring and violation handling effects in different application scenarios.

[0221] Furthermore, the violation monitoring policy, the violation identification policy, and the violation interception policy can be managed through any one of local configuration, cloud configuration, and the associated control device, such as deletion and update.

[0222] In this way, the flexibility of policy data configuration is increased. Cloud configuration is convenient for unified management and large-scale deployment of policy data, while local configuration or associated control device configuration can meet the personalized needs in specific scenarios.

[0223] In one implementation, if a policy management instruction is received, at least one of the following is updated according to the policy management instruction: the violation monitoring policy, the violation identification policy, and the violation interception policy.

[0224] Among them, the violation monitoring policy is used to determine the target layer and its corresponding data extraction method; the violation identification policy is used to determine the method of violation identification; the policy management instruction is issued by at least one of the following devices: a local device, a cloud server, and an associated control device.

[0225] For example, when the device starts up, the policy data in the cloud is synchronized in real time. The policy data includes violation monitoring policies, violation identification policies, and violation interception policies.

[0226] See Figure 5 As shown, it is a schematic diagram of the architecture of policy management. Figure 5 It includes a local electronic device, the cloud, and terminal devices. The electronic device includes: a local policy module, a monitoring module, and a violation handling module. The cloud includes a cloud policy module. Users can send policy management instructions to the cloud through the terminal device. The cloud policy module in the cloud configures and operates on the stored policy data according to the policy management instructions. When the electronic device starts up, the policy data in the cloud policy module can be synchronized to the local policy module to update the local policy data. Among them, the policy data includes violation monitoring policies and violation interception policies. The violation monitoring policy may also include a scenario recognition policy, which is used to identify the current application scenario and classify the monitored data types. The monitoring module includes interface text monitoring, interface image monitoring, audio monitoring, video monitoring, and network monitoring. Classified by the object of violation, the violation handling module includes application handling, interface display handling, audio-video stream handling, and network data handling.

[0227] In this way, when the electronic device starts up, the policy data in the cloud can be synchronized, so as to ensure that the policy data of the electronic device is always up-to-date, avoiding monitoring and violation handling vulnerabilities caused by inconsistent versions of the policy data.

[0228] Furthermore, users or devices at different levels may also have different policy configuration permissions. For example, administrators may have full policy configuration and modification permissions, while ordinary users may only have viewing and partial configuration permissions.

[0229] Furthermore, different policy data can also be set for different target application programs. For example, the violation monitoring policy, violation identification policy, and violation interception policy can each be one or more. Then, the violation monitoring policy, violation identification policy, and violation interception policy can be combined in various ways, so as to obtain various policy data and allocate different policy data for different target application programs.

[0230] For example, different violation monitoring policies can be set for different target application programs, and different violation monitoring policies can monitor different data types, such as text, video, image, audio, and network, etc.

[0231] For another example, different violation interception policies can be set for different target application programs, and different violation interception methods can be adopted for different violation interception policies. For example, the violation interception method can be automatic processing, prompting the user to process, reporting to the administrator, etc. It is also possible to determine the risk level and type of the violation, and set different violation interception policies for different risk levels and types.

[0232] Refer to Figure 6 As shown, it is a flowchart of a method for handling application violations. Figure 6 In this case, a monitoring module is set in the electronic device, and this monitoring module is independent of each application. Then, the monitoring module can be started, and the monitoring module obtains the violation monitoring policy. According to the violation monitoring policy, the target layer and the data extraction method corresponding to each target layer are determined. Among them, the target layer includes the control layer, the application layer, the system layer, and the display layer. The content data corresponding to each target layer includes: the control information of the control layer, the application display content of the application layer, the display list in the system layer, and the interface display content of the display layer. Then, the obtained content data is identified by the violation recognition model to obtain the violation content data, and the corresponding violation interception operation is executed.

[0233] In the embodiments of the present disclosure, the content data of multiple target layers in the target application program can be extracted, the violation content data in each content data can be identified, and network monitoring can be performed to obtain the network violation result. Moreover, corresponding violation interception operations can be performed on the violation content data and the network violation result, which improves the security of the application display content, can achieve the balance between content display security and device power consumption performance. Furthermore, it is applied to a monitoring module independent of each application, does not need to invade the target application program, and can adaptively set the monitoring content, violation recognition policy, and violation interception policy in combination with the application scenario, with strong flexibility. Further, the violation recognition model can also be set locally in the electronic device, so that the monitoring and maintenance of application display security can be realized even without networking.

[0234] Based on the same inventive concept, an apparatus for intercepting violations is also provided in the embodiments of the present disclosure. Since the principle of the above-mentioned apparatus and device for solving problems is similar to that of a method for intercepting violations, the implementation of the above-mentioned apparatus can refer to the implementation of the method, and the repeated parts will not be described again. The apparatus can be applied to an electronic device. The present disclosure does not limit the type of the electronic device, and it can be any device type suitable for implementation, such as a terminal device and a server, etc., which will not be described in detail in the present disclosure. The apparatus embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logically meaningful apparatus, it is formed by the processor of the electronic device where it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running.

[0235] Refer to Figure 7 As shown, it is a structural block diagram of a device for illegal interception in an embodiment of the present disclosure. In some embodiments, the device for illegal interception in the examples of the present disclosure includes:

[0236] An extraction unit 701, configured to extract content data corresponding to at least one target layer by using a data extraction method corresponding to each of at least one target layer in a target application; the at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer;

[0237] An identification unit 702, configured to perform illegal identification on each content data to obtain target content data with violations;

[0238] An interception unit 703, configured to perform an illegal interception operation on the target content data.

[0239] In one embodiment, the content data corresponding to the control layer is control information, the content data of the application layer is application display content, and the content data corresponding to the system layer is a display list.

[0240] In one embodiment, the extraction unit 701 is configured to:

[0241] If the control layer is a target layer in the target application, then use at least one of the following:

[0242] Use the Document Object Model operation to obtain the control information of the target application;

[0243] Obtain the control information of the target application through a class for calling control information;

[0244] Use a control positioning method to determine the controls of the target application, and use a method for obtaining control objects to obtain the control information of the target application based on the controls of the target application;

[0245] Traverse the control tree of the control layer to determine the controls of the target application, obtain a control acquisition interface corresponding to the controls of the target application from the device system, and obtain the control information of the target application through the control acquisition interface.

[0246] In one embodiment, the extraction unit 701 is configured to:

[0247] If the application layer is a target layer in the target application, then use at least one of the following:

[0248] Use off-screen rendering technology to obtain the application display content of the application layer;

[0249] Use a call interface corresponding to the application layer to extract the application display content of the application layer;

[0250] Monitor the application layer through breakpoints pre-set for the target application to obtain the application display content of the monitored application layer;

[0251] Obtain the application display content of the application layer from the database according to the storage address corresponding to the application display content;

[0252] Obtain the application display content of the application layer through the log file;

[0253] Obtain the application display content of the application layer from the data stream output by the system layer.

[0254] In one implementation, the extraction unit 701 is used for:

[0255] If the system layer is the target layer in the target application, at least one of the following items is adopted:

[0256] Access the system layer by accessing the system interface to obtain the display list in the system layer; the display list contains graphic elements;

[0257] Obtain the display list in the system layer through the log file;

[0258] Obtain the display list in the system layer from the database according to the storage address corresponding to the display list.

[0259] In one implementation, the recognition unit 702 is further used for:

[0260] If it is detected that the target application plays audio, extract the audio stream of the audio;

[0261] Perform speech recognition on the audio stream to obtain the audio text;

[0262] Determine the audio text as the content data to be recognized for violations.

[0263] In one implementation, the recognition unit 702 is used for:

[0264] According to the violation recognition policy, for each content data, perform the following steps:

[0265] If the content data contains text data, perform text analysis on the text data through the text analysis sub-model in the violation recognition model to obtain the text analysis result;

[0266] If the content data contains image data, perform image recognition on the image data through the image recognition sub-model in the violation recognition model to obtain the image recognition result;

[0267] If any one of the text analysis result and the image recognition result indicates a violation, determine that the content data is in violation.

[0268] In one implementation, the violation identification model is stored in a local and / or cloud server.

[0269] In one implementation, the identification unit 702 is further configured to:

[0270] Determine a monitoring scope and protocols to be monitored according to a violation monitoring policy;

[0271] Within the monitoring scope, perform network monitoring on the communication of the target application according to the network monitoring methods corresponding to the respective protocols to be monitored, and obtain network monitoring data;

[0272] Perform violation identification on the network monitoring data according to a violation identification policy to obtain a violation identification result.

[0273] In one implementation, the network monitoring data includes protocol logs corresponding to the respective protocols to be monitored;

[0274] The identification unit 702 is configured to:

[0275] For each protocol log, perform the following steps:

[0276] Extract communication address information and transmitted data from the protocol log;

[0277] If the communication address information contains specified address information, determine that there is a communication address violation;

[0278] If the transmitted data contains a specified keyword, determine that there is a communication content violation.

[0279] In one implementation, the interception unit 703 is configured to:

[0280] For each piece of target content data, perform the following steps:

[0281] Determine a content type and a violation type according to the violation identification result of the target content data;

[0282] Determine a violation interception method corresponding to the content type, the violation type, and the current application scenario according to a violation interception policy;

[0283] Intercept and process the target content data according to the violation interception method.

[0284] In one implementation, the violation interception method includes at least one of the following: preventing content display, muting, and warning notification;

[0285] Preventing content display includes at least one of the following: partial interface occlusion, overall interface occlusion;

[0286] Among them, local interface occlusion is used to occlude the local application interface containing the target content data, and overall interface occlusion is used to occlude the entire application interface.

[0287] In one implementation, the interception unit 703 is further configured to:

[0288] Send a violation warning message of the target content data to the associated control device;

[0289] Among them, the violation warning message includes at least one of the following: a violation identification result and a violation interception method.

[0290] In one implementation, the interception unit 703 is further configured to:

[0291] If a policy management instruction is received, update at least one of the following according to the policy management instruction:

[0292] A violation monitoring policy, a violation identification policy, and a violation interception policy;

[0293] The violation monitoring policy is used to determine the target layer and its corresponding data extraction method;

[0294] The violation identification policy is used to determine the method of violation identification;

[0295] The policy management instruction is issued by at least one of the following devices: a local device, a cloud server, and an associated control device.

[0296] The method for violation interception in the embodiments of the present disclosure includes extracting the content data corresponding to at least one target layer respectively by using the data extraction method corresponding to each of at least one target layer in the target application program; at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer; performing violation identification on each content data to obtain target content data with violations; and performing a violation interception operation on the target content data. In this way, the security of the application display content is improved.

[0297] In the embodiments of the present disclosure, an electronic device is further provided, including:

[0298] A processor; and

[0299] A memory storing computer instructions, and the computer instructions are used to cause the processor to execute the method of any of the above embodiments.

[0300] In the embodiments of the present disclosure, a computer-readable storage medium is provided, storing computer instructions, and the computer instructions are used to cause a computer to execute the method of any of the above embodiments.

[0301] Embodiments of the present disclosure also provide a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device implements the method according to any of the above embodiments.

Claims

1. A method for illegal interception, characterized in that: The method comprises: Adopting a data extraction method corresponding to at least one target layer in a target application to extract content data corresponding to the at least one target layer; the at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer; Identify violations of each content data and obtain target content data with violations; An illegal interception operation is performed on the target content data.

2. The method according to claim 1, characterized in that The content data corresponding to the control layer is control information, the content data of the application layer is application display content, and the content data corresponding to the system layer is a display list.

3. The method according to claim 2, characterized in that The extracting the content data corresponding to the at least one target layer in the target application using the data extraction method corresponding to the at least one target layer respectively includes: If the control layer is the target layer in the target application, at least one of the following is adopted: Using document object model operation to obtain control information of the target application; Obtaining the control information of the target application by using a class for calling the control information; Using a control positioning method to determine the control of the target application, and using a control object acquisition method to acquire control information of the target application based on the control of the target application; The control tree of the control layer is traversed to determine the control of the target application, and a control acquisition interface corresponding to the control of the target application is obtained from the device system, and control information of the target application is obtained through the control acquisition interface.

4. The method according to claim 2, characterized in that: The extracting the content data corresponding to the at least one target layer in the target application using the data extraction method corresponding to the at least one target layer respectively includes: If the application layer is the target layer in the target application, at least one of the following is adopted: Using off-screen rendering technology to obtain application display content of the application layer; Using the calling interface corresponding to the application layer, extracting the application display content of the application layer; The application layer is monitored by using breakpoints pre-set for the target application program to obtain application display content of the monitored application layer; Acquiring the application display content of the application layer from a database according to a storage address corresponding to the application display content; Obtaining application display content of the application layer through log files; The application display content of the application layer is obtained from the data stream output by the system layer.

5. The method according to claim 2, characterized in that: The extracting the content data corresponding to the at least one target layer in the target application using the data extraction method corresponding to the at least one target layer respectively includes: If the system layer is the target layer in the target application, at least one of the following is adopted: Accessing the system layer by accessing the system interface, obtaining a display list in the system layer; the display list includes graphic elements; Obtaining a display list in the system layer through a log file; The display list in the system layer is obtained from a database through a storage address corresponding to the display list.

6. The method according to claim 1, characterized in that Before identifying violations of each content data and obtaining target content data with violations, the method further includes: If it is detected that the target application is playing audio, extracting the audio stream of the audio; Performing speech recognition on the audio stream to obtain an audio text; The audio text is determined as content data to be identified as violation.

7. The method according to any one of claims 1 to 6, characterized in that: The step of identifying violations of each content data and obtaining target content data having violations includes: According to the violation identification strategy, for each content data, perform the following steps: If the content data includes text data, performing text analysis on the text data through the text analysis sub-model in the violation identification model to obtain a text analysis result; If the content data includes image data, performing image recognition on the image data through the image recognition sub-model in the violation recognition model to obtain an image recognition result; If any one of the text analysis result and the image recognition result indicates a violation, it is determined that the content data is in violation.

8. The method according to claim 7, characterized in that The violation identification model is stored locally and / or in a cloud server.

9. The method according to any one of claims 1 to 6, characterized in that: Before identifying violations of each content data and obtaining target content data with violations, the following steps are included: Determine the monitoring scope and protocols to be monitored based on the violation monitoring strategy; Within the monitoring range, according to the network monitoring methods corresponding to the protocols to be monitored, the communication of the target application is monitored through network monitoring to obtain network monitoring data; According to the violation identification strategy, violation identification is performed on the network monitoring data to obtain a violation identification result.

10. The method according to claim 9, characterized in that The network monitoring data includes protocol logs corresponding to each protocol to be monitored; The step of performing violation identification on the network monitoring data according to the violation identification strategy to obtain a violation identification result includes: For each protocol log, perform the following steps: Extracting communication address information and transmission data from the protocol log; If the communication address information includes designated address information, it is determined that there is a communication address violation; If the transmission data contains the specified keyword, it is determined that there is a violation of the communication content.

11. The method according to any one of claims 1 to 6, characterized in that: The performing of the illegal interception operation on the target content data includes: For each target content data, perform the following steps: Determining the content type and the violation type according to the violation identification result of the target content data; According to the violation interception strategy, determine the violation interception method corresponding to the content type, the violation type and the current application scenario; The target content data is intercepted and processed according to the illegal interception method.

12. The method according to claim 11, characterized in that The violation interception method includes at least one of the following: blocking content display, muting processing, and warning notification; The blocking of content display includes at least one of the following: partial interface occlusion, overall interface occlusion; The local interface shielding is used to shield the local application interface containing the target content data, and the overall interface shielding is used to shield the entire application interface.

13. The method according to claim 11, characterized in that The method further comprises: Sending violation warning information of the target content data to the associated control device; The violation warning information includes at least one of the following items: a violation identification result, and a violation interception method.

14. The method according to claim 11, characterized in that The method further comprises: If a policy management instruction is received, at least one of the following items is updated according to the policy management instruction: Violation monitoring strategies, violation identification strategies, and violation interception strategies; The violation monitoring strategy is used to determine the target layer and its corresponding data extraction method; The violation identification strategy is used to determine the method of violation identification; The policy management instruction is issued by at least one of the following devices: a local device, a cloud server, and an associated control device.

15. A device for intercepting illegal activities, characterized in that: The device comprises: An extraction unit, configured to extract content data corresponding to at least one target layer in a target application using a data extraction method corresponding to the at least one target layer; the at least one target layer includes at least one of the following: a control layer, an application layer, and a system layer; An identification unit, used to identify violations of each content data and obtain target content data with violations; The interception unit is used to perform an illegal interception operation on the target content data.

16. An electronic device, characterized in that: include: processor; as well as A memory storing computer instructions, wherein the computer instructions are used to enable the processor to execute the method according to any one of claims 1 to 14.

Images