SDK (Software Development Kit) dynamic security compliance detection method, device and equipment and storage medium

Abstract

The invention relates to an SDK (Software Development Kit) dynamic security compliance detection method. The method comprises the following steps: acquiring a to-be-detected file; performing file integrity check on the to-be-detected file, and allocating a unique identifier to the to-be-detected file when the to-be-detected file passes the integrity check; creating a detection task of the to-be-detected file based on the unique identifier, and sending the detection task to a detection engine; calling a static detection module to perform static detection on the to-be-detected file through the detection engine to obtain a static detection result; sending the detection task to a dynamic detection device through the detection engine so as to dynamically detect the to-be-detected file through the dynamic detection device according to the detection task; receiving a dynamic detection result from the dynamic detection device; and generating a detection report based on the static detection result and the dynamic detection result.

Description

Technical Field

[0001] This application relates to the field of security detection technologies, and particularly to a method, apparatus, device, and storage medium for dynamically detecting the security and compliance of an SDK. Background Art

[0002] With the rapid development of the mobile Internet and smartphone applications, the software development industry has attached unprecedented importance to security and compliance. User privacy and data protection have become the core concerns of enterprises, especially in applications involving the processing of sensitive information (such as personal identity information, financial data, etc.). Facing the constantly updated laws and regulations (such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), etc.), enterprises must ensure that the third-party SDKs (software development kits) they use comply with strict security and compliance standards. This need has given rise to an urgent requirement for efficient and reliable compliance detection methods to ensure that enterprises remain compliant and protect user data in a rapidly changing regulatory environment.

[0003] In related technologies, security and compliance detection rely on static analysis tools or manual reviews. However, these methods have limitations. Static analysis is difficult to capture runtime security vulnerabilities, and manual review is time-consuming and laborious, prone to omissions, and is not flexible enough in the face of rapidly changing compliance requirements and cannot provide real-time monitoring and feedback.

[0004] Therefore, it is necessary to provide a method, apparatus, device, and storage medium for dynamically detecting the security and compliance of an SDK. Summary of the Invention

[0005] This application provides a method, apparatus, and storage medium for dynamically detecting the security and compliance of an SDK, which can monitor the behavior of the SDK in real time during software operation and quickly identify potential security hazards and compliance risks. Through continuous learning and detection method updates, it can adapt to the latest compliance requirements, thereby significantly improving the security and compliance detection efficiency of the SDK.

[0006] In a first aspect, this application provides a method for dynamically detecting the security and compliance of an SDK, the method comprising:

[0007] Obtain a file to be detected;

[0008] Perform a file integrity check on the file to be detected, and when the file to be detected passes the integrity check, assign a unique identifier to it;

[0009] Create a detection task for the file to be detected based on the unique identifier and send the detection task to a detection engine;

[0010] The detection engine calls the static detection module to perform static detection on the file to be detected, and obtains the static detection result;

[0011] The detection engine sends the detection task to the dynamic detection device, so that the dynamic detection device performs dynamic detection on the file to be detected according to the detection task;

[0012] Receive the dynamic detection result from the dynamic detection device;

[0013] Generate a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion, detected problems and problem handling suggestions for the file to be detected.

[0014] In some embodiments, the performing a file integrity check on the file to be detected includes:

[0015] Perform a hash calculation on the file to be detected to obtain a hash value;

[0016] Determine whether the hash value is consistent with the hash value of the original file;

[0017] If so, determine that the file to be detected passes the integrity check.

[0018] In some embodiments, the detection engine calls the static detection module to perform static detection on the file to be detected, and obtains the static detection result, including:

[0019] The static detection module extracts the source code and resource files of the file to be detected;

[0020] Based on the source code and the resource files, perform code structure analysis to obtain a code structure detection result;

[0021] Based on the source code and the resource files, perform security vulnerability detection to obtain a security vulnerability detection result;

[0022] Based on the code structure detection result and the security vulnerability detection result, determine the static detection result; wherein, the static detection result includes the detected problem vulnerabilities and the severity rating scores of the problem vulnerabilities.

[0023] In some embodiments, the dynamic detection device performs dynamic detection on the file to be detected according to the detection task, including:

[0024] Deploy the file to be detected on the dynamic detection device to determine the application to be detected;

[0025] Control the operation of the dynamic detection device to run the detection program through the API interface using the detection engine;

[0026] Use the detection program to monitor the running status of the application to be detected and collect running data;

[0027] Perform anomaly recognition based on the running data, and determine the dynamic detection result according to the result of the anomaly recognition; wherein, the dynamic detection result includes the number of detected abnormal behaviors and the number of data flow leaks.

[0028] In some embodiments, the method further includes:

[0029] Based on the static detection result and the dynamic detection result, perform comprehensive evaluation through a weighted decision model to obtain a comprehensive detection report; wherein, the comprehensive detection report includes the score of each detection dimension, the comprehensive detection score, and recommended measures;

[0030] Display the comprehensive detection report in the form of a visual analysis chart.

[0031] In some embodiments, the method further includes:

[0032] Receive feedback suggestions from the user on the comprehensive detection report;

[0033] Optimize the detection process based on the feedback suggestions; wherein, the optimization method includes optimizing at least one of the method for performing static detection and the method for performing dynamic detection.

[0034] In some embodiments, the performing comprehensive evaluation through a weighted decision model based on the static detection result and the dynamic detection result to obtain a comprehensive detection report includes:

[0035] Based on the static detection result and the dynamic detection result, determine the comprehensive detection score through the following weighted decision model:

[0036]

[0037] Wherein, S is the comprehensive detection score, W1 is the weight coefficient of static detection, W2 is the weight coefficient of dynamic detection, m1 is the number of problem vulnerabilities in the static detection result, P1 is the problem vulnerability severity rating score in the static detection result, N1 is the total number of detection items in the static detection, m2 is the number of behavioral anomalies in the dynamic detection result, n2 is the number of data flow leaks in the dynamic detection result, and N2 is the total number of detection items in the dynamic detection.

[0038] In a second aspect, the present application provides an SDK dynamic security compliance detection device, and the device includes:

[0039] An acquisition module for acquiring a file to be detected;

[0040] An integrity check module for performing a file integrity check on the file to be detected and, when the file to be detected passes the integrity check, assigning a unique identifier to it;

[0041] A task module for creating a detection task for the file to be detected based on the unique identifier and sending the detection task to a detection engine;

[0042] A static detection module for calling the static detection module through the detection engine to perform a static detection on the file to be detected and obtaining a static detection result;

[0043] A dynamic detection module for sending the detection task to a dynamic detection device through the detection engine so that the dynamic detection device performs a dynamic detection on the file to be detected according to the detection task;

[0044] A receiving module for receiving a dynamic detection result from the dynamic detection device;

[0045] A report generation module for generating a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion for the file to be detected, the detected problems, and problem handling suggestions.

[0046] In a third aspect, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete mutual communication through the communication bus;

[0047] The memory is used for storing a computer program;

[0048] The processor, when executing the program stored on the memory, implements the steps of the SDK dynamic security compliance detection method described in any embodiment of the first aspect.

[0049] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the SDK dynamic security compliance detection method described in any embodiment of the first aspect are implemented.

[0050] The above technical solutions provided by the embodiments of the present application have the following advantages compared with the prior art: (1) Compared with traditional detection tools that can only process specific applications or formats, it can effectively cover the vast majority of application programs in the mainstream application market. It ensures the security and reliability of applications, reduces the risk of security incidents caused by undetected potential vulnerabilities, and enhances users' trust in the security of applications; (2) It realizes a one-stop service for static detection and dynamic detection, saves labor costs, and improves detection efficiency. By combining static detection and dynamic detection on a unified platform, the process of application security detection is simplified. In traditional methods, different tools and processes are usually required for static and dynamic analysis respectively, increasing labor input and operational complexity. The present invention not only reduces the number of operation steps but also reduces human intervention through automated task scheduling, thus significantly reducing labor costs; (3) Through optimized algorithms and efficient resource management, the present invention can shorten the detection time of a single APK file from more than one hour to 20 - 30 minutes. This significant improvement means that developers can obtain feedback in a shorter time, thus accelerating the application iteration and update process. In addition, the improvement in detection speed also makes large-scale application review feasible, which is particularly important for application markets that require frequent updates and quick launches. While improving efficiency, the platform also ensures the detection quality, so that fast detection does not come at the cost of sacrificing quality; (4) Through optimized algorithms and parallel processing technologies, the energy consumption is significantly reduced. Compared with traditional detection methods one by one, it can effectively reduce the power and computing resources required for system operation; (5) Through precise dynamic detection and static analysis, potential security hazards can be identified and processed in a timely manner, preventing malicious software and non-compliant applications from flowing into the market, fundamentally reducing the leakage and abuse of user data, helping to protect user privacy and information security, and indirectly promoting the healthy development of the entire digital ecological environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments consistent with the present invention and used together with the specification to explain the principles of the present invention.

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

[0053] Figure 1 It is the overall structure diagram of a dynamic security compliance detection method for an SDK provided by the embodiments of the present application;

[0054] Figure 2Schematic flow diagram of an SDK dynamic security compliance detection method provided by an embodiment of the present application;

[0055] Figure 3 Schematic flow diagram of the static detection method provided by an embodiment of the present application;

[0056] Figure 4 Schematic flow diagram of the dynamic detection method provided by an embodiment of the present application;

[0057] Figure 5 Schematic structural diagram of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0058] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Apparently, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application.

[0059] Figure 1 Overall structure diagram of an SDK dynamic security compliance detection system provided by an embodiment of the present application. As Figure 1 shown, its main functional components include the MinIO service, the detection engine, and the mobile device, which are respectively used to implement file integrity check, static detection, and dynamic detection in the present application. It should be noted that Figure 1 for the purpose of exemplification, those skilled in the art can replace each module with other modules that can implement the corresponding functions without departing from the main idea of the present invention. For example, the mobile phone can be replaced by a tablet computer, etc., and the detection engine service can include various services, such as the hook technology, etc. Correspondingly, the MinIO service can also be replaced by other services.

[0060] The MinIO service includes a file upload management module, a task distribution management module, and a load balancing module.

[0061] The MinIO service can be used to complete file storage and management and feedback the file upload status to the detection engine when the user requests to upload a file to MinIO through API calls.

[0062] The detection engine includes a static detection module, a dynamic detection module, and a data management module. The detection engine is used to receive the file transmitted by MinIO, analyze the file through the static detection module to generate a static detection report; at the same time, perform analysis on the mobile phone through the dynamic detection module to generate a dynamic detection report; all results are stored in the database.

[0063] The mobile device includes a deeply customized ROM and a device management APK. The mobile device installs a deeply customized ROM to support dynamic detection; the device management APK is responsible for network connection, exception maintenance, and application management, and reports the running status to the detection engine.

[0064] Exemplarily, the user can initiate a file detection through the CAICT detection platform and upload the file to be detected to the CAICT detection platform. The CAICT detection platform distributes the detection task to the MinIO service through the task distribution service, and at the same time stores the file to be detected in the ftp file server for downloading. In this way, only the detection task needs to be distributed, which can reduce the file transmission and improve the detection efficiency.

[0065] After receiving the detection task, the MinIO service first performs a file integrity check on the file to be detected, and when the check passes, it sends the detection task to the detection engine.

[0066] After receiving the detection task, the detection engine first downloads the file to be detected from the ftp file server and performs static detection. While performing static detection, the detection task can be sent to the mobile device for dynamic detection. By executing static detection and dynamic detection in parallel, the detection efficiency can be improved.

[0067] After the mobile device finishes the dynamic detection, it reports the dynamic detection result to the detection engine service. The detection engine service returns the dynamic detection result and the static detection result to the MinIO service together. The MinIO service summarizes various detection results and returns them to the task distribution service, and then reports them to the CAICT detection platform for the user.

[0068] Multiple users can execute multiple detection tasks simultaneously, which can improve the detection efficiency.

[0069] Figure 2 It is a schematic flowchart of a method for SDK dynamic security and compliance detection provided by an embodiment of this application. As Figure 2 shown, the method for SDK dynamic security and compliance detection may include the following operations:

[0070] Step 201, obtain the file to be detected.

[0071] The file to be detected refers to the SDK file or application file to be detected, including source code, binary file, configuration file, etc. For example, the APK file of an Android application or the installation package of a certain SDK.

[0072] The file to be detected is the object to be detected, and the goal is to check its security and compliance.

[0073] In some embodiments, the file to be detected can be loaded from the target storage location into the detection system through the file input interface. For example, the file can be obtained by selecting file upload, automatic import, etc.

[0074] Step 202: Perform a file integrity check on the file to be detected, and assign a unique identifier to it when the file to be detected passes the integrity check.

[0075] File integrity check refers to verifying the integrity of the file to be detected to ensure that the file has not been tampered with or damaged during transmission or storage. Common checking methods include checksum, hash value calculation, etc. For example, calculate the MD5 or SHA-256 hash value of the file and compare it with the pre-stored hash value. If the two are the same, it means the file has not been tampered with.

[0076] In some embodiments, performing a file integrity check on the file to be detected includes: calculating the hash value of the file to be detected; determining whether the hash value is the same as the hash value of the original file; if so, determining that the file to be detected passes the integrity check.

[0077] The hash value of the original file refers to the hash value of the known file stored in the database or other reliable sources, which can be considered as the hash value of the original version of the file. Before the file is uploaded or transmitted, a hash calculation can be performed to store the original hash value.

[0078] The unique identifier is to assign a globally unique identifier to the file to be detected, and a UUID (Universally Unique Identifier) or other form of unique ID can be used to ensure the traceability and uniqueness of the detection task.

[0079] In some embodiments, generate a unique identifier (UUID) for the file that passes the integrity check and associate it with the file, which can be used for the tracking and recording of subsequent detection tasks.

[0080] Step 203: Create a detection task for the file to be detected based on the unique identifier and send the detection task to the detection engine.

[0081] The detection task refers to the specific task generated for the file to be detected, including static detection, dynamic detection, etc., and includes all detection steps and objectives of the task. For example, create a task for the file "APK-1234567890", and this task includes subtasks such as static analysis and dynamic behavior monitoring.

[0082] The detection engine refers to the core component used to execute various detection tasks.

[0083] In some embodiments, a detection task can be created based on the unique identifier of a file, and the detailed information of the task (such as file path, detection items, etc.) is sent to a detection engine for processing.

[0084] Step 204: Invoke a static detection module through the detection engine to perform static detection on the file to be detected, and obtain a static detection result.

[0085] Static detection refers to analyzing the source code or binary file of the file to be detected without running the file, and is used to discover problems such as security vulnerabilities and privacy risks in the code. For example, by analyzing the source code of an SDK, the static detection module may find an SQL injection vulnerability.

[0086] In some embodiments, the detection engine invokes a static detection module to perform static detection operations such as syntax analysis and vulnerability scanning on the file to be detected, and generates a static detection result.

[0087] For more descriptions about static detection, reference can be made to Figure 3 the description.

[0088] Step 205: Send the detection task to a dynamic detection device through the detection engine, so that the dynamic detection device performs dynamic detection on the file to be detected according to the detection task.

[0089] A dynamic detection device refers to a device or environment that simulates the execution of a file to be detected and monitors its behavior in real time in a running environment.

[0090] A dynamic detection device refers to a device with a deeply customized ROM and a device management APK. For example, Figure 1 a mobile phone. In some embodiments, the dynamic detection device can also be any other device with dynamic detection capabilities, and this embodiment does not limit this.

[0091] In some embodiments, the detection engine sends the detection task to a dynamic detection device, starts the execution of the file to be detected, and monitors its runtime behavior in real time, such as memory leaks, data leaks, malicious behaviors, etc., and performs dynamic detection to obtain a dynamic detection result.

[0092] For more descriptions about dynamic detection, reference can be made to Figure 4 the description.

[0093] Step 206: Receive the dynamic detection result from the dynamic detection device.

[0094] The dynamic detection result refers to the result obtained by simulating the execution of a file and monitoring the file behavior during the dynamic detection process. The dynamic detection result includes runtime exceptions of the application, resource usage, etc. For example, during the dynamic detection of a certain APK file, it may be found that the application has unauthorized access when accessing a certain sensitive API.

[0095] The detection engine can obtain real-time monitoring data and analysis results from the dynamic detection device, store and mark relevant problems.

[0096] Step 207, generate a detection report based on the static detection result and the dynamic detection result.

[0097] The detection report is a summary of the security and compliance status of the file to be detected, including the conclusions of static and dynamic detections, problem descriptions, handling suggestions, etc. For example, the report can include SQL injection problems found in static detection, memory leak problems found in dynamic detection, and privacy risks pointed out in compliance analysis.

[0098] In some embodiments, the static detection result and the dynamic detection result can be merged to generate a comprehensive report.

[0099] Wherein, the detection report includes one or more of the SDK security compliance detection conclusion of the file to be detected, the detected problems, and the problem handling suggestions.

[0100] The DK security compliance detection conclusion refers to the overall performance summary of the SDK to be detected in terms of security and compliance.

[0101] The detected problems refer to specific security problems or compliance problems, including code vulnerabilities, privacy leaks, etc.

[0102] The problem handling suggestions refer to the solutions or improvement measures provided for the discovered problems.

[0103] Figure 3 It is a schematic flowchart of the static detection method provided by the embodiments of this application. As Figure 3 shown, this process can include the following operations.

[0104] Step 301, extract the source code and resource files of the file to be detected through the static detection module.

[0105] The static detection module is a tool module for analyzing program code without executing the program, and it can include a code parser, a syntax analyzer, etc.

[0106] Source code refers to the original code text of a program, which is the code file written by developers and is usually written in programming languages such as Java, Python, etc. Resource files are various non-code files used together with the source code, such as images, configuration files, layout files, etc. For example, in an Android application, the source code files may include.java or.kt files, while the resource files may include.xml layout files, image files, etc.

[0107] In some embodiments, the static detection module can read the content of the file to be detected, parse the file structure, extract and classify the source code files and resource files, and store the extracted source code and resource files into a specific data structure for subsequent analysis.

[0108] Step 302, perform code structure analysis based on the source code and the resource files to obtain a code structure detection result.

[0109] Code structure analysis refers to the structural parsing of the source code to understand the hierarchical structure of the code, the relationships between modules, dependency relationships, etc.

[0110] The code structure detection result refers to the code organization information obtained through structural analysis, including relationship diagrams of classes, methods, and modules, etc.

[0111] For example, by parsing the source code of an Android application, it can be found that it contains multiple Activity classes, and each Activity class contains references to several methods and UI elements.

[0112] In some embodiments, a parser can be used to parse the source code, generate an Abstract Syntax Tree (AST), analyze the AST, extract code structure information such as the definitions of classes and methods, the organizational relationships of modules, and finally generate a code structure detection report to record the detailed information of the code structure.

[0113] Step 303, perform security vulnerability detection based on the source code and the resource files to obtain a security vulnerability detection result.

[0114] The security vulnerability detection result refers to the specific security problems found during the detection process and their detailed information, including the type of vulnerability, the scope of impact, the code location, etc.

[0115] For example, in the source code of an Android application, the detection may find that there is unhandled user input in a certain Activity class, which may lead to SQL injection attacks.

[0116] In some embodiments, the source code and resource files can be scanned and analyzed, and a rule engine or machine learning model can be used to detect common security vulnerabilities; the detailed information of each vulnerability is recorded, including the type, location, and possible impact of the vulnerability; and a security vulnerability detection report is generated, listing all the detected security vulnerabilities.

[0117] Step 304, based on the code structure detection result and the security vulnerability detection result, determine the static detection result.

[0118] The static detection result refers to a comprehensive static analysis report of the file to be detected formed by combining the code structure detection result and the security vulnerability detection result. Among them, the static detection result includes the detected problem vulnerabilities and the severity rating scores of the problem vulnerabilities.

[0119] A problem vulnerability is a security problem found during the detection process, including the specific vulnerability and its detailed description.

[0120] The severity rating score of a problem vulnerability is a score for the severity of each vulnerability, and a standard scoring system such as CVSS scoring can be used. For example, an SQL injection vulnerability may be rated as high severity with a score of 9.0 (out of 10).

[0121] Figure 4 It is a schematic flowchart of the dynamic detection method provided by the embodiments of the present application. As Figure 4 shown, this process may include the following operations.

[0122] Step 401, deploy the file to be detected on the dynamic detection device to determine the application to be detected.

[0123] The dynamic detection device refers to a hardware or virtualized device specifically used to execute application programs, monitor their behaviors, and collect running data. The dynamic detection device can simulate the running environment of the application and capture the behaviors of the application program in real time. For example, Figure 1 the mobile phone login shown in

[0124] The application to be detected refers to the target application program deployed on the dynamic detection device, usually the application software or service to be analyzed.

[0125] In some embodiments, the file to be detected (such as an APK file) can be transferred to the dynamic detection device; the file is installed and started on the device to determine the running environment and functions of the application program.

[0126] Step 402, use the detection engine to control the dynamic detection device to run the detection program through the API interface.

[0127] An API interface is a standardized interface for communication between different software systems, allowing one system to call the functions of another system.

[0128] The dynamic detection device operation detection program refers to a series of detection task programs running on the dynamic detection device, which can collect data and monitor application behavior during the application running process.

[0129] For example, the detection engine starts the monitoring program on the device through the API interface and begins to track the execution process of the application in real time.

[0130] In some embodiments, the detection programs to be executed can be selected through the control interface of the detection engine (such as memory monitoring, API call tracing, etc.); using the API interface, the corresponding programs on the device are started to monitor various data during the application running process and conduct behavior analysis.

[0131] Step 403: Use the detection program to monitor the running status of the application to be detected and collect running data.

[0132] The running status refers to the behavioral characteristics shown by the application to be detected during the execution process, such as memory occupancy, CPU usage rate, file access situation, etc.

[0133] The running data refers to various data collected during the application running period, including but not limited to log information, network requests, file operations, memory access, etc.

[0134] After the detection program starts running, it can monitor the running behavior of the application in real time and collect all relevant running data about the application, such as network requests, memory usage, file operations, API calls, etc.

[0135] Step 404: Based on the running data, perform anomaly identification, and determine the dynamic detection result according to the result of the anomaly identification.

[0136] Among them, the dynamic detection result includes the number of detected abnormal behaviors and the number of data flow leaks. Abnormal behavior refers to behaviors that do not meet expectations found during the dynamic detection process, such as illegal memory access, file tampering, etc. Data flow leak refers to the behavior that sensitive data (such as personal information, account passwords, etc.) is leaked or spread without authorization during the application running process. For example, it is detected that an application sends a large amount of user private information to an external server during running, or there is a memory leak and other behaviors.

[0137] Anomaly identification refers to analyzing the running data of the application program to detect abnormal or suspicious behaviors different from the expected behaviors, such as memory overflow, illegal access, abnormal network requests, etc.

[0138] The dynamic detection result is an analysis result based on anomaly recognition to determine whether there are potential security threats or behaviors that do not meet expectations in the application. For example, if it is detected that an application attempts to access unauthorized system resources or a memory overflow anomaly occurs, it can be determined that there is a security risk.

[0139] In some embodiments, anomaly detection can be performed on the collected running data, using a rule base or a machine learning model to identify anomaly patterns; comparing the behavior of the application with the normal running mode to identify possible security vulnerabilities or abnormal behaviors; generating a dynamic detection result report according to the anomaly type and severity, recording all detected abnormal behaviors and their impacts.

[0140] In some embodiments, the method further includes: based on the static detection result and the dynamic detection result, performing a comprehensive evaluation through a weighted decision model to obtain a comprehensive detection report; wherein, the comprehensive detection report includes the scores of each detection dimension, the comprehensive detection score, and recommended measures; presenting the comprehensive detection report in the form of a visual analysis chart.

[0141] The score of a detection dimension refers to the score obtained after evaluating each detection dimension (such as code security, application performance, data privacy, etc.). The score reflects the risk level of each aspect. For example, a certain detection dimension may be "memory leak detection", and the score of this dimension is 8 / 10, indicating a relatively high medium risk in this aspect.

[0142] The comprehensive detection score is a total score obtained after comprehensively evaluating all detection dimensions, representing the overall security, compliance, or performance situation. For example, the comprehensive score may be 85 / 100, indicating that the system is generally secure but there is still room for improvement.

[0143] The recommended measures refer to providing targeted improvement suggestions according to the comprehensive detection result to help users repair or improve the discovered problems. For example, if a memory leak problem is detected, the recommended measures may include optimizing the part of the code for memory management or strengthening the monitoring of memory usage.

[0144] The comprehensive evaluation through a weighted decision model based on the static detection result and the dynamic detection result to obtain a comprehensive detection report includes:

[0145] In some embodiments, based on the static detection result and the dynamic detection result, the comprehensive detection score can be determined through the weighted decision model shown in the following formula (1).

[0146]

[0147] Wherein, S is the comprehensive detection score, W1 is the weight coefficient of static detection, W2 is the weight coefficient of dynamic detection, m1 is the number of problem vulnerabilities in the static detection result, P1 is the severity rating score of the problem vulnerabilities in the static detection result, N1 is the total number of detection items in the static detection, m2 is the number of behavioral anomalies in the dynamic detection result, n2 is the number of data flow leaks in the dynamic detection result, and N2 is the total number of detection items in the dynamic detection.

[0148] Visual analysis charts are a method of presenting data in a graphical way, including bar charts, pie charts, radar charts, etc. Charts enable users to intuitively understand the content of the detection report and identify potential problems in the system. For example, the score ratios of each detection dimension can be presented using a pie chart, and the results of the comprehensive evaluation can be shown using a radar chart, facilitating users to conduct comparative analysis on the scores of each dimension.

[0149] Furthermore, it is also possible to receive feedback suggestions from users on the comprehensive detection report; based on the feedback suggestions, optimize the detection process; wherein, the optimization methods include optimizing at least one of the method for performing static detection and the method for performing dynamic detection.

[0150] User feedback refers to the opinions, suggestions or questions about the detection report put forward by users based on their usage experience, detection results and actual needs after receiving the comprehensive detection report. Feedback can be about detection accuracy, report usability, rationality of detection dimensions, etc. For example, users can feedback that "a certain specific vulnerability was not captured by the static detection" or "the report format is difficult to understand".

[0151] Feedback suggestions refer to the improvement opinions provided by users on the comprehensive detection report, including opinions on aspects such as the detection process, algorithms, user interface, etc. For example, user feedback can point out that the static detection does not cover specific security vulnerabilities or the response time of some dynamic detections is relatively long.

[0152] Optimizing the detection process means adjusting and improving the existing static detection and dynamic detection methods to improve their accuracy, efficiency or user experience. For example, by optimizing the static detection method, it can capture vulnerabilities more accurately, or improve the response speed of dynamic detection.

[0153] Optimization of static detection can include improving the rule base of the static analysis tool or enhancing its detection ability for specific vulnerabilities (such as increasing the ability to identify new types of vulnerabilities), thereby enhancing the accuracy and coverage of static detection.

[0154] Optimization of dynamic detection can include increasing the response speed of the dynamic detection system or improving its monitoring ability for complex behaviors, such as timely detection of memory leaks, malicious code behaviors, etc.

[0155] As Figure 5 shown in the figure, an embodiment of the present application provides an electronic device, including a processor 111, a communication interface 112, a memory 113, and a communication bus 114. Among them, the processor 111, the communication interface 112, and the memory 113 complete mutual communication through the communication bus 114.

[0156] The memory 113 is used to store computer programs;

[0157] In an embodiment of the present application, when the processor 111 is used to execute the program stored on the memory 113, it implements the method for SDK dynamic security compliance detection provided by any one of the foregoing method embodiments, including:

[0158] Obtain the file to be detected;

[0159] Perform a file integrity check on the file to be detected, and assign a unique identifier to it when the file to be detected passes the integrity check;

[0160] Create a detection task for the file to be detected based on the unique identifier, and send the detection task to the detection engine;

[0161] Call the static detection module through the detection engine to perform a static detection on the file to be detected, and obtain a static detection result;

[0162] Send the detection task to the dynamic detection device through the detection engine, so that the dynamic detection device performs a dynamic detection on the file to be detected according to the detection task;

[0163] Receive a dynamic detection result from the dynamic detection device;

[0164] Generate a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion for the file to be detected, the detected problems, and the problem handling suggestions.

[0165] An embodiment of the present application also provides an SDK dynamic security compliance detection device, and the device includes:

[0166] An acquisition module, configured to acquire a file to be detected;

[0167] An integrity check module, configured to perform a file integrity check on the file to be detected, and assign a unique identifier to it when the file to be detected passes the integrity check;

[0168] A task module, configured to create a detection task for the file to be detected based on the unique identifier, and send the detection task to the detection engine;

[0169] The static detection module is used to statically detect the file to be detected through the detection engine invoking the static detection module, and obtain the static detection result;

[0170] The dynamic detection module is used to send the detection task to the dynamic detection device through the detection engine, so that the dynamic detection device dynamically detects the file to be detected according to the detection task;

[0171] The receiving module is used to receive the dynamic detection result from the dynamic detection device;

[0172] The report generation module is used to generate a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion of the file to be detected, the detected problems, and the problem handling suggestions.

[0173] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the SDK dynamic security compliance detection method provided in any of the foregoing method embodiments are implemented.

[0174] It should be noted that in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the element.

[0175] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for dynamically detecting SDK security compliance, characterized in that The method includes: Obtain the file to be detected; Perform file integrity check on the file to be detected, and assign a unique identifier to it when the file to be detected passes the integrity check; Create a detection task for the file to be detected based on the unique identifier, and send the detection task to the detection engine; Call the static detection module through the detection engine to perform static detection on the file to be detected, and obtain the static detection result; Send the detection task to the dynamic detection device through the detection engine, so that the dynamic detection device performs dynamic detection on the file to be detected according to the detection task; Receive the dynamic detection result from the dynamic detection device; Generate a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion of the file to be detected, the detected problems, and the problem handling suggestions.

2. The method according to claim 1, characterized in that, The performing file integrity check on the file to be detected includes: Perform hash calculation on the file to be detected to obtain a hash value; Determine whether the hash value is consistent with the hash value of the original file; If so, determine that the file to be detected passes the integrity check.

3. The method according to claim 1, wherein The calling the static detection module through the detection engine to perform static detection on the file to be detected and obtain the static detection result includes: Extract the source code and resource files of the file to be detected through the static detection module; Perform code structure analysis based on the source code and the resource files to obtain the code structure detection result; Perform security vulnerability detection based on the source code and the resource files to obtain the security vulnerability detection result; Determine the static detection result based on the code structure detection result and the security vulnerability detection result; wherein, the static detection result includes the detected problem vulnerabilities and the severity rating scores of the problem vulnerabilities.

4. The method according to claim 3, wherein The performing dynamic detection on the file to be detected by the dynamic detection device according to the detection task includes: Deploy the file to be detected on the dynamic detection device to determine the application to be detected; Use the detection engine to control the dynamic detection device to run the detection program through the API interface; Use the detection program to monitor the running status of the application to be detected and collect running data; Perform anomaly recognition based on the running data, and determine the dynamic detection result according to the result of the anomaly recognition; wherein, the dynamic detection result includes the number of detected abnormal behaviors and the number of data flow leaks.

5. The method according to claim 4, characterized in that, The method further includes: Perform comprehensive evaluation through a weighted decision-making model based on the static detection result and the dynamic detection result to obtain a comprehensive detection report; wherein, the comprehensive detection report includes the scores of each detection dimension, the comprehensive detection score, and the recommended measures; Display the comprehensive detection report in the form of a visual analysis chart.

6. The method according to claim 5, characterized in that The method further includes: Receive the feedback suggestions from the user on the comprehensive detection report; Optimize the detection process based on the feedback suggestions; wherein, the optimization method includes optimizing at least one of the method for performing static detection and the method for performing dynamic detection.

7. The method according to claim 5, wherein Based on the static detection result and the dynamic detection result, a comprehensive evaluation is carried out through a weighted decision-making model to obtain a comprehensive detection report, including: Based on the static detection result and the dynamic detection result, the comprehensive detection score is determined through the following weighted decision-making model: Where S is the comprehensive detection score, W1 is the weight coefficient of static detection, W2 is the weight coefficient of dynamic detection, m1 is the number of problem vulnerabilities in the static detection result, P1 is the severity rating score of the problem vulnerabilities in the static detection result, N1 is the total number of detection items in the static detection, m2 is the number of behavioral anomalies in the dynamic detection result, n2 is the number of data flow leaks in the dynamic detection result, and N2 is the total number of detection items in the dynamic detection.

8. An SDK dynamic security compliance detection device, characterized in that, The device includes: An acquisition module, configured to acquire a file to be detected; An integrity check module, configured to perform a file integrity check on the file to be detected, and assign a unique identifier to it when the file to be detected passes the integrity check; A task module, configured to create a detection task for the file to be detected based on the unique identifier and send the detection task to a detection engine; A static detection module is configured to call the static detection module through the detection engine to perform static detection on the file to be detected and obtain a static detection result; A dynamic detection module, configured to send the detection task to a dynamic detection device through the detection engine, so that the dynamic detection device performs dynamic detection on the file to be detected according to the detection task; A receiving module, configured to receive a dynamic detection result from the dynamic detection device; A report generation module, configured to generate a detection report based on the static detection result and the dynamic detection result; wherein, the detection report includes one or more of the SDK security compliance detection conclusion for the file to be detected, the detected problems, and problem handling suggestions.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete communication with each other through the communication bus; The memory is used to store a computer program; When the processor is used to execute the program stored on the memory, it implements the steps of the SDK dynamic security compliance detection method described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the SDK dynamic security compliance detection method described in any one of claims 1-7.

Images