Privacy leakage prevention method and device, equipment, storage medium and program product

Abstract

The invention provides a privacy leakage prevention method and device, equipment, a storage medium and a program product, and the method comprises the steps: intercepting a network request initiated by a target application program, and analyzing the network request to obtain a target domain name; judging whether the target domain name is contained in an access list or not; forwarding the network request to the target domain name in response to determining that the admission list contains the target domain name; and in response to determining that the admission list does not contain the target domain name, performing fuzzification processing on the network request to obtain a fuzzified network request, and forwarding the fuzzified network request to the target domain name. According to the method and the device, the network request initiated by the application program is analyzed, so that the network request with risks is fuzzified, the fuzzified network request is forwarded, and privacy leakage is prevented.

Description

Technical field

[0001] The present disclosure relates to the technical field of privacy protection, and in particular, to a method, device, equipment, storage medium and program product for preventing privacy leakage. Background technique

[0002] This section aims to provide background or context for the embodiments of the present disclosure stated in the claims. The description herein is not admitted to be prior art merely by virtue of being included in this section.

[0003] Third-party libraries play a crucial role in the development of application programs. They provide a series of functions and services, enabling developers to quickly implement complex functions, thereby accelerating the development process and improving the efficiency of application programs.

[0004] However, behind these conveniences, there are also some security and privacy issues that cannot be ignored. Summary of the Invention

[0005] In view of this, an object of the present disclosure is to provide a method, device, equipment, storage medium and program product for preventing privacy leakage, which can at least solve one of the technical problems in the related art to a certain extent.

[0006] Based on the above object, a first aspect of an exemplary embodiment of the present disclosure provides a method for preventing privacy leakage, including:

[0007] Intercept a network request initiated by a target application program, and parse the network request to obtain a destination domain name;

[0008] Determine whether the destination domain name is included in an access list;

[0009] In response to determining that the destination domain name is included in the access list, forward the network request to the destination domain name;

[0010] In response to determining that the destination domain name is not included in the access list, perform fuzzification processing on the network request to obtain a fuzzified network request, and forward the fuzzified network request to the destination domain name.

[0011] In some exemplary embodiments, the performing fuzzification processing on the network request to obtain a fuzzified network request includes:

[0012] Perform data generalization, replacement and obfuscation on the network request, retain the format and structure of the network request, and remove sensitive information in the network request.

[0013] In some exemplary embodiments, after determining that the destination domain name is not included in the access list, the method further includes:

[0014] Determine whether the prohibited list contains the destination domain name;

[0015] In response to determining that the prohibited list contains the destination domain name, perform obfuscation processing on the network request to obtain the obfuscated network request, and forward the obfuscated network request to the destination domain name;

[0016] In response to determining that the prohibited list does not contain the destination domain name, determine whether the network request contains sensitive data;

[0017] In response to determining that the network request does not contain the sensitive data, forward the network request to the destination domain name;

[0018] In response to determining that the network request contains the sensitive data, determine whether the network request is sent to a third-party library;

[0019] In response to determining that the network request is not sent to the third-party library, forward the network request to the destination domain name;

[0020] In response to determining that the network request is sent to the third-party library, perform obfuscation processing on the network request to obtain the obfuscated network request, and forward the obfuscated network request to the destination domain name.

[0021] In some exemplary embodiments, determining whether the network request contains sensitive data includes:

[0022] Input the network request into a pre-constructed first text classification model, and obtain the sensitive data judgment result output by the text classification model.

[0023] In some exemplary embodiments, determining whether the network request is sent to a third-party library includes:

[0024] Input the network request into a pre-constructed second text classification model, and obtain the third-party library judgment result output by the text classification model.

[0025] In some exemplary embodiments, after determining that the network request is sent to the third-party library, the method further includes:

[0026] Install the target application in a test environment;

[0027] Detect the target application to obtain the list of third-party libraries corresponding to the application;

[0028] Run the target application to obtain the test network requests initiated by the target application until a target test network request with the same destination domain name as the network request is obtained;

[0029] Trace the call stack corresponding to the target test network request, and determine whether the target test network request originates from a third-party library included in the list of third-party libraries;

[0030] In response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, update the target domain name to the blacklist;

[0031] In response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, update the target domain name to the whitelist.

[0032] Based on the same inventive concept, a second aspect of the exemplary embodiments of the present disclosure provides a privacy leakage prevention device, including:

[0033] A network request interception and parsing module, configured to intercept a network request initiated by a target application program and parse the network request to obtain a destination domain name;

[0034] A destination domain name judgment module, configured to judge whether the destination domain name is included in the whitelist;

[0035] A network request direct forwarding module, configured to forward the network request to the destination domain name in response to determining that the destination domain name is included in the whitelist;

[0036] A network request obfuscation and forwarding module, configured to perform obfuscation processing on the network request to obtain an obfuscated network request and forward the obfuscated network request to the destination domain name in response to determining that the destination domain name is not included in the whitelist.

[0037] Based on the same inventive concept, a third aspect of the exemplary embodiments of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, the method described in the first aspect is implemented.

[0038] Based on the same inventive concept, a fourth aspect of the exemplary embodiments of the present disclosure provides a non-transitory computer-readable storage medium, and the non-transitory computer-readable storage medium stores computer instructions for causing a computer to execute the method described in the first aspect.

[0039] Based on the same inventive concept, a fifth aspect of the exemplary embodiments of the present disclosure provides a computer program product, including computer program instructions, and when the computer program instructions run on a computer, the computer is caused to execute the method described in the first aspect.

[0040] As can be seen from the above, the privacy leakage prevention method, device, equipment, storage medium and program product provided by the embodiments of the present disclosure, the method includes: intercepting a network request initiated by a target application program, parsing the network request to obtain a destination domain name; determining whether the destination domain name is included in an access list; in response to determining that the destination domain name is included in the access list, forwarding the network request to the destination domain name; in response to determining that the destination domain name is not included in the access list, performing obfuscation processing on the network request to obtain an obfuscated network request, and forwarding the obfuscated network request to the destination domain name. The present disclosure analyzes the network requests initiated by application programs, thereby performing obfuscation processing on the risky network requests and forwarding the obfuscated network requests, preventing the leakage of privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the following will briefly introduce the drawings required for use in the description of the embodiments or related technologies. Obviously, the drawings in the following description are only the embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0042] Figure 1 A schematic diagram of an application scenario of the privacy leakage prevention method provided by an exemplary embodiment of the present disclosure;

[0043] Figure 2 A schematic flowchart of the privacy leakage prevention method provided by an exemplary embodiment of the present disclosure;

[0044] Figure 3 Another schematic flowchart of the privacy leakage prevention method provided by an exemplary embodiment of the present disclosure;

[0045] Figure 4 A schematic structural diagram of the privacy leakage prevention device provided by an exemplary embodiment of the present disclosure;

[0046] Figure 5 Another schematic structural diagram of the privacy leakage prevention device provided by an exemplary embodiment of the present disclosure;

[0047] Figure 6 A schematic structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0048] It can be understood that before using the technical solutions disclosed in the embodiments of the present application, the types, usage scopes, usage scenarios, etc. of the personal information involved in the present application should be informed to users and user authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0049] For example, when responding to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested by the user will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, an application program, a server, or a storage medium that performs the operations of the technical solution of this application based on the prompt message.

[0050] As an optional but non-limiting implementation manner, the manner of sending a prompt message to the user in response to receiving an active request from the user may be, for example, in the form of a pop-up window, and the prompt message may be presented in text in the pop-up window. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0051] It can be understood that the above process of notifying and obtaining user authorization is only illustrative and does not limit the implementation manner of this application. Other manners that comply with relevant laws and regulations can also be applied to the implementation manner of this application.

[0052] It can be understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of corresponding laws, regulations and related provisions.

[0053] To make the purpose, technical solution and advantages of this disclosure clearer and more understandable, the principles and spirit of this disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are only given to enable those skilled in the art to better understand and then implement this disclosure, rather than limiting the scope of this disclosure in any way. On the contrary, these embodiments are provided to make this disclosure more thorough and complete, and to be able to convey the scope of this disclosure completely to those skilled in the art.

[0054] In this article, it should be understood that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

[0055] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should have the ordinary meanings understood by those of ordinary skill in the field to which the present disclosure belongs. The "first", "second" and similar terms used in the embodiments of the present disclosure do not denote any order, quantity or importance, but are only used to distinguish different components. Words such as "including" or "comprising" mean that the elements or objects appearing before this word cover the elements or objects listed after this word and their equivalents, without excluding other elements or objects. Words such as "connected" or "linked" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Upper", "lower", "left", "right", etc. are only used to represent relative position relationships. When the absolute position of the object being described changes, the relative position relationship may also change accordingly. The article "a" or "an" before an element does not exclude the existence of multiple such elements.

[0056] Next, with reference to several representative embodiments of the present disclosure, the principles and spirit of the present disclosure will be explained in detail.

[0057] As described in the background art, third-party libraries play a crucial role in the development of application programs (such as Android application programs). They provide a series of functions and services, enabling developers to quickly implement complex functions, thereby accelerating the development process and improving the efficiency of application programs.

[0058] However, the inventors of the present disclosure have found that behind these conveniences, there are also some security and privacy issues that cannot be ignored.

[0059] First of all, third-party libraries usually run in the same process as the host application program, which means they share the same running environment and permissions. This design allows third-party libraries to access all resources and data of the host application program, including users' privacy information. When users grant certain permissions to an application program, they may not be aware that these permissions also apply to the third-party libraries embedded in the application program.

[0060] Secondly, the privacy policies and data processing methods of third-party libraries are often beyond the control of application developers. Developers may not fully understand how third-party libraries process user data, including data collection, storage, sharing and use. This may lead to the access or abuse of user data by third-party libraries without sufficient protection.

[0061] In reality, user privacy leakage behaviors caused by third-party libraries exist on a large scale.

[0062] In related technologies, for the privacy leakage problems that may be caused by third-party libraries, they are mainly divided into two major categories of solutions:

[0063] The first solution focuses on monitoring and analyzing the behavior of an application in a test environment to verify whether there is any privacy leakage caused by third - party libraries. The implementation steps of this solution include:

[0064] Using Android reverse engineering techniques to accurately locate the interfaces in the application for initiating network requests;

[0065] Through technical means such as memory injection and code hooking, extracting the call stack information of the interfaces at runtime;

[0066] Applying request interception technology to capture the request data sent out by the application;

[0067] Analyzing the captured request content, checking whether it contains sensitive privacy information, and tracing the originator of the request in combination with the stack information to determine whether it is caused by a third - party library.

[0068] The inventors of the present disclosure found that the following problems exist:

[0069] Android reverse engineering techniques usually need to be implemented separately for each specific application. This process is not only complex and challenging, but also highly dependent on the experience and skills of technical personnel;

[0070] This method is mainly carried out in a specific test environment. Although its detection results can prompt developers to improve the application, it cannot directly guarantee the privacy security of users during actual use.

[0071] The second solution aims to fundamentally restrict third - party libraries in Android applications by using static bytecode rewriting technology to identify and modify calls to private data access APIs. This method provides a solution for users, where all privacy - related operations will be directed to an API of a protection system, and this API will enforce security policies to impose corresponding restrictions on these operations. The specific implementation steps include:

[0072] Intercepting the init() method of DexClassLoader called by the third - party library to capture the files containing dynamically loaded code downloaded remotely;

[0073] Sending the captured files to a trusted server for decompilation, rewriting, and recompilation of the code to generate new files;

[0074] Sending the new files back to the application for re - loading. At this time, the security policies will be enforced at runtime.

[0075] The inventors of the present disclosure found that there are some limitations that restrict its wide application:

[0076] It requires application developers to perform deployment during the development stage, with a complex operation process and difficulty in large-scale promotion;

[0077] It only checks the interfaces that call sensitive data, without performing necessary checks and processing on the privacy data actively provided by users to the App;

[0078] It makes significant modifications to native applications, which may affect the applicability and compatibility of the applications.

[0079] To solve the above problems, the present disclosure provides a privacy leakage prevention solution, which specifically includes:

[0080] Intercept the network requests initiated by the target application, parse the network requests to obtain the destination domain names; determine whether the destination domain names are included in the access list; in response to determining that the destination domain names are included in the access list, forward the network requests to the destination domain names; in response to determining that the destination domain names are not included in the access list, perform fuzzification processing on the network requests to obtain fuzzified network requests, and forward the fuzzified network requests to the destination domain names.

[0081] The present disclosure analyzes the network requests initiated by the application, thereby performing fuzzification processing on the risky network requests and forwarding the fuzzified network requests, preventing the leakage of privacy.

[0082] After introducing the basic principle of the present disclosure, the following specifically introduces various non-limiting implementation manners of the present disclosure.

[0083] Refer to Figure 1 , which is a schematic diagram of an application scenario of the privacy leakage prevention method provided by an exemplary embodiment of the present disclosure.

[0084] In this application scenario, it includes a terminal device 101, a server 102, and a data storage system 103. Among them, the terminal device 101, the server 102, and the data storage system 103 can all be connected through a wired or wireless communication network to achieve data interaction.

[0085] The terminal device 101 can be an electronic device near the user side with data transmission and multimedia input / output functions, including but not limited to a desktop computer, a mobile phone, a mobile computer, a tablet computer, a media player, a smart wearable device, a personal digital assistant (PDA), or other electronic devices capable of implementing the above functions, etc. The electronic device can include a processor and a display screen with touch input function, the display screen is used to present a graphical user interface, the graphical user interface can display an application interface, and the processor is used to process application data, generate a graphical user interface, and control the display of the graphical user interface on the display screen.

[0086] Both the server 102 and the data storage system 103 can be independent physical servers, or server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0087] In some exemplary embodiments, the privacy leakage prevention method can run on the terminal device 101.

[0088] When the privacy leakage prevention method runs on the terminal device 101, the terminal device 101 is used to provide privacy leakage prevention services to the user of the terminal device 101. A client that communicates with the terminal device 101 is installed in the terminal device 101, and the user can specify at least one target application through the client. The terminal device 101 intercepts the network request initiated by the target application, parses the network request to obtain the destination domain name; determines whether the destination domain name is included in the access list; in response to determining that the destination domain name is included in the access list, forwards the network request to the destination domain name; in response to determining that the destination domain name is not included in the access list, performs fuzzy processing on the network request to obtain a fuzzy network request, and forwards the fuzzy network request to the destination domain name.

[0089] In some exemplary embodiments, the server 102 can assist the terminal device 101 in implementing the privacy leakage prevention method. Specifically:

[0090] Install the target application in the test environment; detect the target application to obtain the list of third-party libraries corresponding to the application; run the target application to obtain the test network requests initiated by the target application until a target test network request identical to the destination domain name of the network request is obtained; trace the call stack corresponding to the target test network request to determine whether the target test network request originates from a third-party library included in the list of third-party libraries; in response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, update the target domain name to the blacklist; in response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, update the target domain name to the access list.

[0091] The data storage system 103 is used to assist the terminal device 101 and the server 102 in storing data.

[0092] The following combination Figure 1The application scenarios will be used to describe the privacy leakage prevention method according to the exemplary embodiments of the present disclosure. It should be noted that the above application scenarios are only shown for the convenience of understanding the spirit and principle of the present disclosure, and the embodiments of the present disclosure are not limited in this regard. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0093] Reference Figure 2 , which is a schematic flowchart of a privacy leakage prevention method provided by an exemplary embodiment of the present disclosure.

[0094] The privacy leakage prevention method includes the following steps:

[0095] Step S210: Intercept a network request initiated by a target application program, and parse the network request to obtain the destination domain name.

[0096] Next, the determination method of the target application program will be introduced in combination with the application scenario. Specifically:

[0097] As an example, the terminal device displays a list of all installed application programs (Apps) on the terminal device through a graphical user interface. Each application program provides two states: tracked / untracked, and the initial default is untracked. The user can select the application program that needs privacy protection from the list and record it as the target application program, and change its state to tracked, and start executing the privacy protection task for the target application program.

[0098] As an example, the terminal device displays an on / off control page and an App selection management page through a graphical user interface. In the App selection management page, a list of all installed application programs on the user device is displayed. Each application provides two states: tracked / untracked, and the initial default is untracked. The user can select the application program that needs privacy protection from the list and change its state to tracked. Subsequently, activate the protection state in the on / off control page and start executing the privacy protection task.

[0099] As an example, the user can run this solution in the background after starting to execute the privacy protection task, and at the same time use other application programs normally, and the privacy protection function will continue to run in the background.

[0100] Next, the interception and parsing methods of the network request will be introduced. Specifically:

[0101] As an example, the NetBare technology can be utilized to achieve instant interception and parsing of network requests. NetBare is a network packet capture and injection tool library for the Android system, which utilizes virtual gateway technology to implement the monitoring and management of network communication. Developers can freely customize the virtual gateway to perform various operations such as interception, parsing, and injection of network packets. The core of NetBare is based on VPN technology, which forwards network packets to a local proxy server and then intercepts and distributes them through the virtual gateway.

[0102] As an example, in the Android system, the VPNService can be used to intercept the traffic of the network requests of the target application and parse the access data from the network requests. In this way, the network requests of the target application can be comprehensively monitored and analyzed, so as to obtain the destination domain name of the network request.

[0103] As an example, by controlling the DNS resolution process, the interception of network requests and the parsing of the destination domain name can be achieved. Specifically, the DNS requests of the target application can be redirected to a custom DNS server, which will resolve the requested domain name.

[0104] Step S220: Determine whether the destination domain name is included in the access list.

[0105] In specific implementation, if the destination domain name is in the access list, it indicates that the network request is secure, and the network request will not be obfuscated and will be directly forwarded to the destination domain name, that is, step S230 is executed;

[0106] If the destination domain name is not in the access list, it indicates that the network request may be dangerous, and the network request will be obfuscated and then forwarded to the destination domain name, that is, step S240 is executed.

[0107] Step S230: In response to determining that the destination domain name is included in the access list, forward the network request to the destination domain name.

[0108] In specific implementation, if the destination domain name is in the access list, it indicates that the network request is secure, and the network request will not be obfuscated and will be directly forwarded to the destination domain name.

[0109] It should be noted that the network request will not be obfuscated or otherwise processed, but the network request can be optimized to improve its processing efficiency.

[0110] Step S240: In response to determining that the destination domain name is not included in the access list, obfuscate the network request to obtain an obfuscated network request, and forward the obfuscated network request to the destination domain name.

[0111] In specific implementation, if the destination domain name is not in the access list, it indicates that the network request may be dangerous. After performing obfuscation processing on the network request, the network request is forwarded to the destination domain name.

[0112] In specific implementation, the purpose of obfuscation processing is to hide privacy information to protect the privacy information from being leaked.

[0113] In some exemplary embodiments, the obfuscating the network request to obtain an obfuscated network request includes:

[0114] Performing data generalization, replacement, and obfuscation on the network request, retaining the format and structure of the network request, and removing sensitive information from the network request.

[0115] In the above exemplary embodiments, for network requests whose destination domain names are not in the access list, obfuscation processing is performed. However, there are also different situations for network requests whose destination domain names are not in the access list. To further improve the processing efficiency, the present disclosure performs different processing for different situations. Specifically:

[0116] In some exemplary embodiments, after determining that the access list does not contain the destination domain name, the method further includes:

[0117] Determining whether the destination domain name is included in the blacklist;

[0118] In response to determining that the destination domain name is included in the blacklist, obfuscating the network request to obtain the obfuscated network request, and forwarding the obfuscated network request to the destination domain name;

[0119] In response to determining that the destination domain name is not included in the blacklist, determining whether the network request contains sensitive data;

[0120] In response to determining that the network request does not contain the sensitive data, forwarding the network request to the destination domain name;

[0121] In response to determining that the network request contains the sensitive data, determining whether the network request is sent to a third-party library;

[0122] In response to determining that the network request is not sent to the third-party library, forwarding the network request to the destination domain name;

[0123] In response to determining that the network request is sent to the third-party library, obfuscating the network request to obtain the obfuscated network request, and forwarding the obfuscated network request to the destination domain name.

[0124] Reference Figure 3, which is a schematic flowchart of a privacy leakage prevention method provided by an exemplary embodiment of the present disclosure.

[0125] The privacy leakage prevention method includes the following steps:

[0126] Step S310: Intercept a network request initiated by a target application, and parse the network request to obtain a destination domain name.

[0127] Step S320: Determine whether the destination domain name is included in an access list.

[0128] If the destination domain name is included in the access list, execute step S330.

[0129] If the destination domain name is not included in the access list, execute step S340.

[0130] Step S330: Forward the network request / the obfuscated network request to the destination domain name.

[0131] Step S340: Determine whether the destination domain name is included in a blacklist.

[0132] If the destination domain name is included in the blacklist, first execute step S350, and then execute step S330.

[0133] If the destination domain name is not included in the blacklist, execute step S360.

[0134] Step S350: Perform obfuscation processing on the network request to obtain the obfuscated network request.

[0135] Step S360: Determine whether the network request contains sensitive data.

[0136] If the network request contains sensitive data, execute step S370.

[0137] If the network request does not contain sensitive data, execute step S330.

[0138] In some exemplary embodiments, determining whether the network request contains sensitive data includes:

[0139] Input the network request into a pre-constructed first text classification model, and obtain a sensitive data judgment result output by the text classification model.

[0140] Specifically, refer to Figure 1, a large amount of training data is stored in the data storage system 103. Each piece of training data includes a network request sample and the corresponding sensitive data judgment result of the network request sample. The server 102 can train the first text classification model based on the large amount of training data, so that the first text classification model can perform sensitive data judgment on the input network request. The sources of the training data include, but are not limited to, existing databases, data crawled from the Internet, or data uploaded when the user uses the client. When the accuracy rate output by the first text classification model reaches a certain requirement, the server 102 can provide sensitive data judgment services to users based on the first text classification model. At the same time, the server 102 can also continuously optimize the first text classification model based on the newly added training data.

[0141] Step S370, determine whether the network request is sent to a third-party library.

[0142] If the network request is not sent to a third-party library, execute step S330.

[0143] If the network request is sent to a third-party library, first execute step S350, and then execute step S330.

[0144] In some exemplary embodiments, determining whether the network request is sent to a third-party library includes:

[0145] Input the network request into a pre-constructed second text classification model to obtain the third-party library judgment result output by the text classification model.

[0146] Specifically, refer to Figure 1 , a large amount of training data is stored in the data storage system 103. Each piece of training data includes a network request sample and the corresponding third-party library judgment result of the network request sample. The server 102 can train the second text classification model based on the large amount of training data, so that the second text classification model can perform third-party library judgment on the input network request. The sources of the training data include, but are not limited to, existing databases, data crawled from the Internet, or data uploaded when the user uses the client. When the accuracy rate output by the second text classification model reaches a certain requirement, the server 102 can provide third-party library judgment services to users based on the second text classification model. At the same time, the server 102 can also continuously optimize the second text classification model based on the newly added training data.

[0147] Specifically, the first text classification model and the second text classification model can be a model that can perform multiple types of tasks, or two modules of a model. Specifically, the text classification model of the embodiments of the present disclosure can be applied to scenarios such as sensitive data judgment and third-party library judgment. The text classification model can be trained based on different training data respectively to obtain text classification models applied to different scenarios.

[0148] As an example, both the first text classification model and the second text classification model can be CNN-LSTM models.

[0149] As an example, when performing sensitive data judgment and / or third-party library judgment, feature selection can be performed first, followed by preprocessing (such as removing stop words and tokenization), then feature extraction (such as based on TF-IDF technology), and finally, a text classification model is used to perform sensitive data judgment and / or third-party library judgment.

[0150] In the above exemplary embodiments, considering that there are also different situations for network requests whose destination domain names are not in the access list, in order to further improve the processing efficiency, the present disclosure makes different treatments for different situations. On this basis, the present disclosure also provides an update method for the access list and the blacklist. Specifically:

[0151] In some exemplary embodiments, after determining that the network request is sent to the third-party library, the method further includes:

[0152] Install the target application in a test environment;

[0153] Detect the target application and obtain the list of third-party libraries corresponding to the application;

[0154] Run the target application and obtain the test network requests initiated by the target application until a target test network request with the same destination domain name as the network request is obtained;

[0155] Trace the call stack corresponding to the target test network request and determine whether the target test network request originates from a third-party library included in the list of third-party libraries;

[0156] In response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, update the target domain name to the blacklist;

[0157] In response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, update the target domain name to the access list.

[0158] Specifically, if the network request is sent to a third-party library, determine the information of the network request and the information of the target application, and execute step S380.

[0159] Step S380: Install the target application in a test environment.

[0160] Step S390: Detect the target application and obtain the list of third-party libraries corresponding to the application.

[0161] Step S3100: Run the target application and obtain the test network requests initiated by the target application until a target test network request with the same destination domain name as the network request is obtained.

[0162] Step S3110: Trace the call stack corresponding to the target test network request and determine whether the target test network request originates from a third-party library included in the list of third-party libraries.

[0163] If the target test network request does not originate from a third-party library included in the list of third-party libraries, execute Step S3120.

[0164] If the target test network request originates from a third-party library included in the list of third-party libraries, execute Step S3130.

[0165] Step S3120: In response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, update the target domain name to the access list.

[0166] Send the updated access list to be used in Step S320.

[0167] Step S3130: In response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, update the target domain name to the blacklist.

[0168] Send the updated blacklist to be used in Step S340.

[0169] Specifically, referring to Figure 1 , the terminal device 101 implements the above Steps S310 to S370. The user only needs to install and authorize the program product corresponding to Steps S310 to S370, and by installing the security certificate with one click, the deployment can be completed. The server 102 implements the above Steps S380 to S3130, and the server 102 is a remote security server.

[0170] As can be seen from the above, the privacy leakage prevention method provided by the embodiments of the present disclosure includes: intercepting the network requests initiated by the target application, parsing the network requests to obtain the destination domain names; determining whether the access list contains the destination domain names; in response to determining that the access list contains the destination domain names, forwarding the network requests to the destination domain names; in response to determining that the access list does not contain the destination domain names, performing fuzzy processing on the network requests to obtain fuzzy network requests, and forwarding the fuzzy network requests to the destination domain names.

[0171] The present disclosure analyzes network requests initiated by an application, thereby performing obfuscation processing on network requests with risks and forwarding the obfuscated network requests, preventing the leakage of privacy.

[0172] It should be noted that the method of the embodiments of the present disclosure can be executed by a single device, such as a computer or a server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In such a distributed scenario, one of the multiple devices can only execute one or more steps of the method of the embodiments of the present disclosure, and these multiple devices will interact with each other to complete the described method.

[0173] It should be noted that some embodiments of the present disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the above embodiments and still achieve the desired result. Additionally, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired result. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0174] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present disclosure also provides a privacy leakage prevention device.

[0175] Refer to Figure 4 , which is a schematic structural diagram of a privacy leakage prevention device provided by an exemplary embodiment of the present disclosure.

[0176] The privacy leakage prevention device includes the following modules:

[0177] A network request interception and parsing module 410, configured to intercept network requests initiated by a target application and parse the network requests to obtain a destination domain name;

[0178] A destination domain name determination module 420, configured to determine whether the destination domain name is included in an access list;

[0179] [[ID=Z8]]A network request direct forwarding module 430, configured to forward the network request to the destination domain name in response to determining that the destination domain name is included in the access list;

[0180] A network request obfuscation and forwarding module 440, configured to perform obfuscation processing on the network request to obtain an obfuscated network request and forward the obfuscated network request to the destination domain name in response to determining that the destination domain name is not included in the access list.

[0181] In some exemplary embodiments, the network request obfuscation and forwarding module 440 is specifically configured to:

[0182] Perform data generalization, replacement, and obfuscation on the network request, retain the format and structure of the network request, and remove sensitive information from the network request.

[0183] In some exemplary embodiments, the network request obfuscation and forwarding module 440 is further configured to:

[0184] Determine whether the destination domain name is included in the blacklist;

[0185] In response to determining that the destination domain name is included in the blacklist, perform obfuscation processing on the network request to obtain the obfuscated network request, and forward the obfuscated network request to the destination domain name;

[0186] In response to determining that the destination domain name is not included in the blacklist, determine whether the network request contains sensitive data;

[0187] In response to determining that the network request does not contain the sensitive data, forward the network request to the destination domain name;

[0188] In response to determining that the network request contains the sensitive data, determine whether the network request is sent to a third-party library;

[0189] In response to determining that the network request is not sent to the third-party library, forward the network request to the destination domain name;

[0190] In response to determining that the network request is sent to the third-party library, perform obfuscation processing on the network request to obtain the obfuscated network request, and forward the obfuscated network request to the destination domain name.

[0191] In some exemplary embodiments, the network request obfuscation and forwarding module 440 is further configured to:

[0192] Input the network request into a pre-constructed first text classification model to obtain a sensitive data judgment result output by the text classification model.

[0193] In some exemplary embodiments, the network request obfuscation and forwarding module 440 is further configured to:

[0194] Input the network request into a pre-constructed second text classification model to obtain a third-party library judgment result output by the text classification model.

[0195] In some exemplary embodiments, the network request obfuscation and forwarding module 440 is further configured to:

[0196] Install the target application in a test environment;

[0197] Detect the target application and obtain a list of third-party libraries corresponding to the application;

[0198] Run the target application and obtain the test network requests initiated by the target application until a target test network request with the same destination domain name as the network request is obtained;

[0199] Trace the call stack corresponding to the target test network request and determine whether the target test network request originates from a third-party library included in the list of third-party libraries;

[0200] In response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, update the target domain name to the blacklist;

[0201] [[ID=IS]]In response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, update the target domain name to the whitelist.

[0202] Reference Figure 5 , which is a schematic structural diagram of a privacy leakage prevention device provided by an exemplary embodiment of the present disclosure.

[0203] A privacy leakage prevention device, including the following modules:

[0204] A network request processing module 510, configured to intercept network requests and forward network requests;

[0205] Among them, after intercepting a network request, parse the network request to obtain a destination domain name and privacy-related fields;

[0206] The network request processing module 510 is configured with a whitelist and a blacklist:

[0207] The whitelist is used to determine whether the destination domain name is included in the whitelist;

[0208] The blacklist is used to determine whether the destination domain name is included in the blacklist.

[0209] When the destination domain name is included in the whitelist, forward the network request;

[0210] When the destination domain name is included in the blacklist, it indicates that the network request involves privacy, and send the privacy-related network request to the obfuscation processing module 530;

[0211] When neither the whitelist nor the blacklist includes the destination domain name, send the network request to the text classification and judgment module 520.

[0212] The text classification and judgment module 520 is configured to determine whether the network request contains sensitive data and whether the network request is sent to a third-party library.

[0213] Among them, a text classification model is configured in the text classification and judgment module 520:

[0214] The text classification model is used to determine whether the network request contains sensitive data and whether the network request is sent to a third-party library, and feedback the judgment result to the network request processing module 510.

[0215] The obfuscation processing module 530 is configured to perform obfuscation processing on the privacy-related network request.

[0216] Among them, a network request obfuscation processing logic is configured in the obfuscation processing module 530:

[0217] The network request obfuscation processing logic is used to perform obfuscation processing on the privacy-related network request, and feedback the processed obfuscated network request to the network request processing module 510.

[0218] The remote interaction and update module 540 is configured to obtain the updated allow list and deny list.

[0219] Among them, receiving the network request determined by the text classification model specifically refers to the network request determined to be sent to a third-party library.

[0220] Perform remote interaction with the server to obtain the updated allow list and deny list, and feedback the updated allow list and deny list to the network request processing module 510.

[0221] For the convenience of description, when describing the above device, it is divided into various modules according to functions for separate description. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0222] The device in the above embodiment is used to implement the corresponding privacy leakage prevention method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0223] Based on the same inventive concept, corresponding to the method in any of the above embodiments, the present disclosure further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, it implements the privacy leakage prevention method described in any of the above embodiments.

[0224] Figure 6FIG. 0 shows a more specific schematic diagram of the hardware structure of the electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. Among them, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other inside the device through the bus 1050.

[0225] The processor 1010 may be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0226] The memory 1020 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0227] The input / output interface 1030 is used to connect to an input / output module to implement information input and output. The input / output module may be configured as a component in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Among them, the input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0228] The communication interface 1040 is used to connect to a communication module (not shown in the figure) to implement communication interaction between this device and other devices. Among them, the communication module may implement communication in a wired manner (such as USB, network cable, etc.) or in a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0229] The bus 1050 includes a path for transmitting information between various components of the device (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0230] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device may also only include the components necessary to implement the solution of the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0231] The electronic device of the above embodiment is used to implement the corresponding privacy leakage prevention method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0232] The memory 1020 stores machine-readable instructions executable by the processor 1010. When the electronic device runs, the processor 1010 communicates with the memory 1020 through the bus 1030, so that the processor 1010 executes the following instructions when running:

[0233] Intercept the network request initiated by the target application program, and parse the network request to obtain the destination domain name;

[0234] Determine whether the destination domain name is included in the access list;

[0235] In response to determining that the destination domain name is included in the access list, forward the network request to the destination domain name;

[0236] In response to determining that the destination domain name is not included in the access list, perform fuzzy processing on the network request to obtain a fuzzy network request, and forward the fuzzy network request to the destination domain name.

[0237] In a possible implementation manner, in the instructions executed by the processor 1010, the performing fuzzy processing on the network request to obtain a fuzzy network request includes:

[0238] Perform data generalization, replacement, and confusion on the network request, retain the format and structure of the network request, and remove sensitive information in the network request.

[0239] In a possible implementation manner, in the instructions executed by the processor 1010, after determining that the destination domain name is not included in the access list, the method further includes:

[0240] Determine whether the destination domain name is included in the blacklist;

[0241] In response to determining that the destination domain name is included in the blacklist, perform fuzzy processing on the network request to obtain the fuzzy network request, and forward the fuzzy network request to the destination domain name;

[0242] In response to determining that the prohibited list does not contain the destination domain name, determine whether the network request contains sensitive data;

[0243] In response to determining that the network request does not contain the sensitive data, forward the network request to the destination domain name;

[0244] In response to determining that the network request contains the sensitive data, determine whether the network request is sent to a third-party library;

[0245] In response to determining that the network request is not sent to the third-party library, forward the network request to the destination domain name;

[0246] In response to determining that the network request is sent to the third-party library, perform fuzzing processing on the network request to obtain the fuzzed network request, and forward the fuzzed network request to the destination domain name.

[0247] In a possible implementation, among the instructions executed by the processor 1010, determining whether the network request contains sensitive data includes:

[0248] Input the network request into a pre-constructed first text classification model, and obtain the sensitive data judgment result output by the text classification model.

[0249] In a possible implementation, among the instructions executed by the processor 1010, determining whether the network request is sent to a third-party library includes:

[0250] Input the network request into a pre-constructed second text classification model, and obtain the third-party library judgment result output by the text classification model.

[0251] In a possible implementation, among the instructions executed by the processor 1010, after determining that the network request is sent to the third-party library, the method further includes:

[0252] Install the target application in a test environment;

[0253] Detect the target application, and obtain the list of third-party libraries corresponding to the application;

[0254] Run the target application, and obtain the test network requests initiated by the target application until a target test network request with the same destination domain name as the network request is obtained;

[0255] Trace the call stack corresponding to the target test network request, and determine whether the target test network request originates from a third-party library included in the list of third-party libraries;

[0256] In response to determining that the target test network request originates from a third-party library included in the third-party library list, update the target domain name to the blacklist;

[0257] In response to determining that the target test network request does not originate from a third-party library included in the third-party library list, update the target domain name to the whitelist.

[0258] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present disclosure further provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the privacy leakage prevention method described in any of the above embodiments.

[0259] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0260] The above non-transitory computer-readable storage medium can be any available medium or data storage device accessible by a computer, including but not limited to magnetic memory (such as floppy disks, hard disks, magnetic tapes, magneto-optical discs (MO), etc.), optical memory (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drives (SSD)), etc.

[0261] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to execute the privacy leakage prevention method described in any of the above exemplary method embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0262] Based on the same inventive concept, corresponding to the privacy leakage prevention method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to execute the privacy leakage prevention method. Corresponding to the execution subjects corresponding to the respective steps in the respective embodiments of the privacy leakage prevention method, the processor that executes the corresponding steps can belong to the corresponding execution subject.

[0263] The computer program product of the above embodiment is used to cause the computer and / or the processor to execute the privacy leakage prevention method described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0264] Those skilled in the art know that the embodiments of the present disclosure can be implemented as a system, a method, or a computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to as "circuit", "module", or "system" in this article. In addition, in some embodiments, the present disclosure can also be implemented in the form of a computer program product in one or more computer-readable media, which contain computer-readable program code.

[0265] Any combination of one or more computer-readable media can be adopted. The computer-readable media can be computer-readable signal media or computer-readable storage media. The computer-readable storage media can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive examples) of the computer-readable storage media can include, for example: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage media can be any tangible medium that contains or stores a program, which can be used by or in combination with an instruction execution system, apparatus, or device.

[0266] A computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device.

[0267] The program code contained on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0268] The computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0269] It should be understood that each block of the flowchart and / or block diagram, and combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine. These computer program instructions, when executed by a computer or other programmable data processing device, produce a device that implements the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0270] These computer program instructions can also be stored in a computer-readable medium that can cause a computer or other programmable data processing device to operate in a particular manner. In this way, the instructions stored in the computer-readable medium produce a product that includes an instruction device for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0271] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices, so that a series of operation steps are performed on the computer, other programmable data processing apparatus, or other devices to generate a computer-implemented process, thereby enabling the instructions executed on the computer or other programmable apparatus to provide a process for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0272] In addition, although the operations of the method of the present disclosure are described in a specific order in the drawings, this does not require or imply that the operations must be performed in that specific order, or that all of the illustrated operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart may be reordered. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution.

[0273] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. Among them, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the above-mentioned module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, as well as the combination of blocks in the block diagram or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0274] It should be noted that although several modules or units of devices for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the characteristics and functions of the two or more modules or units described above may be embodied in one module or unit. Conversely, the characteristics and functions of one module or unit described above may be further divided and embodied by multiple modules or units.

[0275] Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the present application (including the claims) is limited to these examples; under the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of brevity.

[0276] In addition, for the sake of simplicity of explanation and discussion, and in order not to make the embodiments of the present application difficult to understand, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Further, the devices may be shown in block diagram form in order to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (i.e., these details should be entirely within the understanding of those skilled in the art). In cases where specific details (such as circuits) are set forth to describe exemplary embodiments of the present application, it will be apparent to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with variations of these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0277] Although the present application has been described in connection with specific embodiments of the present application, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art based on the foregoing description. For example, other memory architectures (such as dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0278] The embodiments of the present application are intended to cover all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application shall be included within the protection scope of the present application.

[0279] Although the spirit and principles of the present disclosure have been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the specific embodiments disclosed, and the division of each aspect does not mean that the features in these aspects cannot be combined for benefit. This division is only for the convenience of expression. The present disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. The scope of the appended claims is to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions.

Claims

1. A privacy leakage prevention method, characterized in that, including: intercepting a network request initiated by a target application, and parsing the network request to obtain a destination domain name; judging whether the destination domain name is included in an access list; in response to determining that the destination domain name is included in the access list, forwarding the network request to the destination domain name; in response to determining that the destination domain name is not included in the access list, performing obfuscation processing on the network request to obtain an obfuscated network request, and forwarding the obfuscated network request to the destination domain name.

2. The method according to claim 1, wherein The performing obfuscation processing on the network request to obtain an obfuscated network request includes: performing data generalization, replacement and confusion on the network request, preserving the format and structure of the network request, and removing sensitive information in the network request.

3. The method according to claim 1, wherein After the response to determining that the destination domain name is not included in the access list, the method further includes: judging whether the destination domain name is included in a blacklist; in response to determining that the destination domain name is included in the blacklist, performing obfuscation processing on the network request to obtain the obfuscated network request, and forwarding the obfuscated network request to the destination domain name; in response to determining that the destination domain name is not included in the blacklist, judging whether the network request contains sensitive data; in response to determining that the network request does not contain the sensitive data, forwarding the network request to the destination domain name; in response to determining that the network request contains the sensitive data, judging whether the network request is sent to a third-party library; in response to determining that the network request is not sent to the third-party library, forwarding the network request to the destination domain name; in response to determining that the network request is sent to the third-party library, performing obfuscation processing on the network request to obtain the obfuscated network request, and forwarding the obfuscated network request to the destination domain name.

4. The method according to claim 3, wherein The judging whether the network request contains sensitive data includes: inputting the network request into a pre-constructed first text classification model, and obtaining a sensitive data judgment result output by the text classification model.

5. The method according to claim 3, characterized in that, The judging whether the network request is sent to a third-party library includes: inputting the network request into a pre-constructed second text classification model, and obtaining a third-party library judgment result output by the text classification model.

6. The method according to claim 3, wherein After the response to determining that the network request is sent to the third-party library, the method further includes: installing the target application in a test environment; detecting the target application to obtain a list of third-party libraries corresponding to the application; running the target application to obtain a test network request initiated by the target application until a target test network request with the same destination domain name as the network request is obtained; tracing a call stack corresponding to the target test network request, and judging whether the target test network request originates from a third-party library included in the list of third-party libraries; in response to determining that the target test network request originates from a third-party library included in the list of third-party libraries, updating the destination domain name to the blacklist; in response to determining that the target test network request does not originate from a third-party library included in the list of third-party libraries, updating the destination domain name to the access list.

7. A privacy leakage prevention device, characterized in that, including: A network request interception and parsing module, configured to intercept network requests initiated by a target application and parse the network requests to obtain destination domain names; A destination domain name judgment module, configured to judge whether the destination domain name is included in an access list; A network request direct forwarding module, configured to forward the network request to the destination domain name in response to determining that the destination domain name is included in the access list; A network request obfuscation and forwarding module, configured to perform obfuscation processing on the network request to obtain an obfuscated network request and forward the obfuscated network request to the destination domain name in response to determining that the destination domain name is not included in the access list.

8. An electronic device, characterized in that, Comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 6 when executing the program.

9. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions for causing a computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, Including computer program instructions, when the computer program instructions run on a computer, causing the computer to execute the method according to any one of claims 1 to 6.

Images