Method for preventing application program from being tracked and debugged through cloud collaboration

Abstract

The embodiment of the invention provides a method for preventing application programs from being tracked and debugged through cloud collaboration. The method comprises the steps of obtaining a program header table, and combining a quasi-execution program with the program header table to obtain an execution program. And then, loading and running the executive program, monitoring whether the executive program is subjected to abnormal tracking debugging or not in the running process in real time according to the terminal system type, and if the executive program is monitored to be subjected to abnormal tracking debugging in the running process, directly sending a process ending signal to the application program, and reporting tracking debugging information to the cloud platform. In this way, the terminal application program can be effectively prevented from being tracked and debugged, and the stability and reliability of overall program operation are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information technology security, and more particularly to a cloud-based collaborative method for preventing an application from being tracked and debugged. Background Art

[0002] In today's digital age, applications on smart devices have experienced explosive growth, encompassing a wide range of high-value products, including popular games and video software. However, these applications face severe security threats, with some hackers frequently cracking them for free and pirated use. Currently, cracking applications primarily relies on reverse engineering of the executable program, which can be categorized as static debugging or dynamic debugging. Static debugging often utilizes disassembly tools to view the underlying code, while dynamic debugging is performed while the program is running. Attackers use tools to track the program, view, and modify memory code and data to achieve cracking. This is a common and effective method for reverse engineering. To combat reverse engineering, developers often employ code obfuscation techniques, including static obfuscation (such as symbol renaming and control flow obfuscation) and dynamic obfuscation (such as spikes and heartbeat mechanisms). However, these methods have numerous vulnerabilities, failing to prevent attackers from obtaining executable code for static debugging or dynamic debugging.

[0003] Therefore, there is an urgent need for a method to prevent applications from being tracked and debugged, so as to fundamentally ensure the security of applications. Summary of the Invention

[0004] According to an embodiment of the present application, a cloud-based collaborative solution for preventing applications from being tracked and debugged is provided, which can provide efficient threat detection and response capabilities while ensuring the security of program operation.

[0005] In a first aspect of the present application, a method for cloud-based collaborative prevention of application programs from being tracked and debugged is provided. The method comprises: Get the program header table, merge the quasi-executable program with the program header table, and obtain the execution program; Load and run the execution program, and monitor in real time whether the execution program encounters any abnormalities during operation according to the terminal system type; If it is detected that the executed program is subject to abnormal tracking and debugging during operation, a process termination signal is directly sent to the application, and the tracking and debugging information is reported to the cloud platform.

[0006] In one possible implementation, obtaining a program header table includes: Send a request to the cloud platform to obtain the program header table; After receiving the program header table request, the cloud platform encrypts the program header table using asymmetric encryption and sends the encrypted program header table to the terminal; The terminal decrypts the encrypted program header table to obtain the program header table.

[0007] In a possible implementation, the quasi-executable program is obtained by merging and compiling the status monitoring program and the application source code.

[0008] In one possible implementation, real-time monitoring of whether an execution program encounters abnormal tracking and debugging during operation is performed based on the terminal system type, including: When the terminal system type is Linux system, the ptrace function, the TracerPid field in the process status file, the inotify mechanism, and the SIGTRAP signal are used to determine whether the executed program is subject to abnormal tracking and debugging during operation.

[0009] In a possible implementation, real-time monitoring of whether an execution program encounters abnormal tracking and debugging during operation based on the terminal system type further includes: When the terminal system type is Android system, the mmaps file information is used to determine whether there is a hook tool injection file; If there is a hook tool injection file, the execution program will be subjected to abnormal tracking debugging during operation.

[0010] In one possible implementation, the method further includes: Integrate and analyze the tracking and debugging information reported by different terminals to determine whether there is a risk of coordinated attack; If there is a risk of coordinated attack, the cloud platform sends a process termination signal to the application program that has the risk of coordinated attack.

[0011] In one possible implementation, the method further includes: The security threat information database is queried to determine whether abnormal tracking and debugging is in a high-incidence period. If abnormal tracking and debugging is in a high-incidence period, an abnormal tracking and debugging reminder message is sent to the application of each terminal.

[0012] In a second aspect of the present application, a device for cloud-based collaborative prevention of application program tracking and debugging is provided. The device comprises: An acquisition module is used to obtain a program header table, merge the quasi-executable program with the program header table, and obtain an execution program; The monitoring module is used to load and run the execution program, and monitor in real time whether the execution program suffers from abnormal tracking and debugging during the operation according to the terminal system type; The end process module, when it detects that the executed program is subject to abnormal tracking and debugging during operation, directly sends an end process signal to the application and reports the tracking and debugging information to the cloud platform.

[0013] In a third aspect of the present application, an electronic device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor implements the above method when executing the program.

[0014] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect of the present application is implemented.

[0015] The present invention provides a method for cloud-based collaborative protection against application tracking and debugging. The method obtains a program header table, merges the quasi-executable program with the program header table, and obtains an executable program. The executable program is then loaded and run, and the execution process is monitored in real time based on the terminal system type to determine whether the program is subject to abnormal tracking and debugging. If such abnormal tracking and debugging is detected, a process termination signal is directly sent to the application, and the tracking and debugging information is reported to the cloud platform. This method combines the advantages of local real-time protection with cloud-based collaborative management, ensuring program security while providing efficient threat detection and response capabilities.

[0016] It should be understood that the contents described in the Summary of the Invention are not intended to limit the key or important features of the embodiments of the present application, nor are they intended to limit the scope of the present application. Other features of the present application will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein: Figure 1 Flowchart of a method for cloud-based collaboration to prevent an application from being tracked and debugged according to an embodiment of the present application; Figure 2 is a schematic diagram of the structure of an execution program according to an embodiment of the present application; Figure 3 This is an architectural diagram of cloud platform management according to an embodiment of the present application; Figure 4 A block diagram of a device for cloud-based collaboration to prevent an application from being tracked and debugged according to an embodiment of the present application; Figure 5 A schematic diagram of the structure of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0018] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of the present disclosure.

[0019] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0020] Figure 1 Flowchart of a method for cloud-based collaborative prevention of application programs from being tracked and debugged according to an embodiment of the present application. Figure 1 : S101, obtaining a program header table, merging the quasi-executable program with the program header table, and obtaining an execution program.

[0021] An executable program is compiled from source code into target code that can be run on a machine. For example, in the widely used Linux and Android operating systems, the executable files generated by source code compilation are ELF files. ELF files consist of four parts: an ELF header, a program header table, sections, and a section header table. The ELF header, at the beginning of an ELF file, stores key information about the entire file, including but not limited to the file type, machine type, and entry point. This information is crucial for the operating system to correctly identify and process the ELF file. The program header table is responsible for accurately mapping the contents of the executable file into memory. It not only contains necessary metadata but also records detailed information about each section. It consists of multiple entries, each of which provides a detailed description of the characteristics of a section, such as the load address (which specifies the starting location of the section in memory), the file offset (which determines the starting offset of the section within the file), and the memory size (which defines the memory size of the section). Before a program runs, the program header table precisely maps different sections of the executable file, such as the code segment for storing program instructions and the data segment for storing initialized data, to corresponding locations in memory. For example, in an ELF-formatted executable file, the program header table maps the init section, the text section (which stores the actual program code), and the rodata section (a read-only data section) to read-only memory segments to ensure the security and stability of this data. It also maps the data section (initialized data segment) and the bss section (uninitialized data segment) to read-write memory segments to accommodate data read and write operations during program execution. Therefore, the program header table plays an indispensable role in the loading and execution of a program.

[0022] In this embodiment, the program header table is separated from the execution program. When the terminal needs to run the application, the program header table is obtained and the program header table and the quasi-executable program are merged, which effectively prevents attackers from statically debugging the application.

[0023] Optionally, obtain the program header table, including: Send a request to the cloud platform to obtain the program header table; After receiving the program header table request, the cloud platform encrypts the program header table using asymmetric encryption and sends the encrypted program header table to the terminal; The terminal decrypts the encrypted program header table to obtain the program header table.

[0024] Asymmetric encryption is a technology that uses a pair of keys (public and private) for encryption and decryption. The public key is used to encrypt data, while the private key is used to decrypt it. The core of asymmetric encryption is that data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. This feature ensures data security during transmission. Even if the public key is disclosed, the private key cannot be directly derived. Using asymmetric encryption for program header table transmission can effectively prevent malicious tracking programs from obtaining the program header table.

[0025] In one possible implementation, the cloud platform and the terminal work together, and the program header table and the quasi-executable program are both stored on the cloud platform. The terminal first loads the quasi-executable program from the cloud platform and saves it locally. When the execution program needs to be run, it sends a request to the cloud platform to obtain the program header table, decrypts the encrypted program header table, merges the program header table and the quasi-executable program, and obtains a complete execution program.

[0026] In this embodiment, the security of the program header table during transmission is guaranteed by asymmetric encryption, which provides a basis for subsequent synthesis and execution of the program.

[0027] Optionally, the quasi-executable program is obtained by merging and compiling the status monitoring program and the application source code.

[0028] Figure 2 is a schematic diagram of the structure of the execution program according to an embodiment of the present application, such as Figure 2 As shown: The execution program consists of a program header table and a quasi-execution program. The quasi-execution program is compiled by merging the state monitoring program and the application source code. The state monitoring program, as a child process, is used to monitor the running status of the application. In the state monitoring program, additional monitoring can be performed on the application itself to monitor various abnormal tracking and debugging operations in real time, such as whether the application is being tracked, whether there is memory access, whether there is hook tool injection, etc. In addition, when the state monitoring program detects that the execution program is subject to abnormal tracking and debugging during operation, it can send a process termination signal to the application main process. It can also directly call the kill command (used to terminate the running process) to terminate the execution process or program subject to abnormal tracking and debugging.

[0029] In this embodiment, the quasi-executable program includes a status monitoring program and an application program, which can ensure that real-time security monitoring can be performed from the moment the quasi-executable program is loaded into the terminal, thereby ensuring the security of the execution program in the terminal.

[0030] S102, loading and running the execution program, and monitoring in real time whether the execution program suffers from abnormal tracking and debugging during the running process according to the terminal system type.

[0031] In this embodiment, it is possible to flexibly respond to security requirements in different operating systems or environments, thereby ensuring the security of different operating systems and improving user experience.

[0032] Optionally, real-time monitoring is performed based on the terminal system type to determine whether the executed program encounters abnormal tracking and debugging during operation, including: When the terminal system type is Linux system, the ptrace function, the TracerPid field in the process status file, the inotify mechanism, and the SIGTRAP signal are used to determine whether the executed program is subject to abnormal tracking and debugging during operation.

[0033] In Linux, due to its inherent mechanism, a process can only be attached once. Therefore, this application implements real-time monitoring of the executing program process from two perspectives: first, creating a new program process; second, utilizing the program itself to prevent debugging tools from attaching to the executing program, thereby blocking debugging. First, the ptrace function is a powerful system call function in Linux. It allows one process (denoted as a tracer) to monitor and control another process (denoted as a tracee), and can inspect and modify the data in the tracee process's memory and registers. Since a program can only be traced and debugged by one process while it is running, the ptrace function can be used to determine whether the program is being traced and debugged. If the ptrace function returns successfully, it indicates that the program is not currently being traced. Conversely, if the return result indicates an exception, it is likely that the program is already being traced. Second, the status information of an executing process is uniquely identified. When a process is being traced, the TracerPid field in the corresponding process's status file (the file that records the execution process's status information) changes. Specifically, when the executing process is in normal operation (not being traced or debugged), the default value of the TracerPid field is 0. Once the executing process is being traced or debugged, the value of this field changes to the PID of the tracing process. This means that by polling the status file and reading the value of the TracerPid field, it is possible to accurately determine whether the executing process is currently being debugged. Furthermore, the inotify mechanism in the Linux system is a file system event monitoring mechanism that allows the executing program to monitor file system changes, such as file creation, deletion, and modification. Therefore, by using a monitoring function combined with the inotify mechanism to monitor the proc directory (a pseudo-file system that stores a series of special files in the current kernel running state and can view and modify system hardware and process information), it is possible to determine whether a debugging process is accessing memory through the proc file, thereby promptly capturing any such accesses by the debugging process to the application's memory. Specifically, the monitoring function monitors the proc directory to determine whether it is blocked. If a debugging process attempts to read or write to the executing program's memory through the proc file system, the monitoring function stops blocking. Finally, the SIGTRAP signal is a debug signal typically triggered when a program reaches a specific breakpoint or trap instruction. If the program is being traced, the SIGTRAP signal is sent to the debugger. Specifically, a signal handler is set in the status monitoring program, and the signal is then triggered. If the program receives the signal, it indicates that the program is not being traced and debugged. If it fails to receive the signal, it indicates that the program is being traced.

[0034] In this embodiment, specific real-time monitoring is performed on the execution program of the Linux system, which effectively prevents the Linux system from suffering from abnormal tracking and debugging.

[0035] Optionally, real-time monitoring of whether the executed program encounters abnormal tracking and debugging during operation based on the terminal system type may further include: When the terminal system type is Android system, the mmaps file information is used to determine whether there is a hook tool injection file; If there is a hook tool injection file, the execution program will be subjected to abnormal tracking debugging during operation.

[0036] In the Android system, attackers often use hooking tools, such as the Xposed hooking tool, to achieve reverse engineering. These tools replace key files, intercept all Java function calls, and allow for module extensions to implement various functions. Custom code in these modules can alter function call behavior, maliciously modifying the Android system and the original functionality of the executed program, posing a serious security threat to the system and applications. Furthermore, the Android system replicates a process through the Zygote process (which loads the system's core libraries) to run the application. The application process then has a complete copy of the Zygote process, including the hooking tool's related files, effectively injecting the hooking tool into the application process. When an application process is injected with a hooking tool, or is running on a mobile device at risk of injection, the process memory of the executed program contains the corresponding hooking tool's injected files. By reading the Android system's mmaps file (which contains process-mapped memory areas and access permissions), it is possible to determine whether the application process has loaded the hooking tool's injected files and, therefore, whether the executed program has been subjected to abnormal tracing and debugging.

[0037] In this embodiment, a specific hooking tool is injected into the execution program of the Android system for real-time monitoring, which effectively prevents the Android system from suffering from abnormal tracking and debugging.

[0038] S103: If it is detected that the executed program is subjected to abnormal tracking and debugging during operation, a process termination signal is directly sent to the application program, and the tracking and debugging information is reported to the cloud platform.

[0039] In one possible implementation, if an executing program is found to be subject to abnormal tracing and debugging during execution, the system's main process can send a kill command (used to terminate the running process) to terminate the executing process, thereby preventing tracing and debugging. Furthermore, a self-destruct command can be used to directly turn the terminal into a "faulty machine," rendering it inoperable, thus blocking malicious tracing and debugging at the device level.

[0040] Figure 3 This is an architectural diagram of cloud platform management according to an embodiment of the present application, such as Figure 3 As shown: The cloud platform stores the program header table and quasi-executable programs required for program execution and connects to N different terminals, where N is the number of terminals connected to the cloud platform. Each terminal is controlled by a terminal management program. The execution program in the terminal consists of a status monitoring program and an application program. The status monitoring program monitors the terminal system for any application anomalies, tracking and debugging them, ensuring the stable and secure operation of the application in the terminal system.

[0041] In this embodiment, the terminals are systematically managed through the cloud platform, cloud-based collaborative control of different terminals is achieved, the complexity of security management is simplified, and the stability and reliability of the overall system are improved.

[0042] Optionally, the method further comprises: Integrate and analyze the tracking and debugging information reported by different terminals to determine whether there is a risk of coordinated attack; If there is a risk of coordinated attack, the cloud platform sends a process termination signal to the application program that has the risk of coordinated attack.

[0043] The terminal devices include but are not limited to desktop computers, laptops and tablet computers, and the tracing and debugging information includes but is not limited to tracing and debugging type, tracing and debugging time and affected applications.

[0044] For example, in an enterprise network environment, there are multiple branch terminals, each running various business applications such as financial software, office automation software, and customer relationship management software, all connected to the enterprise's cloud platform. When the financial software program running on branch terminal A encounters an abnormal tracing and debugging error, and the tracing and debugging information indicates a memory access anomaly, the status monitoring program, upon detecting this information, reports the tracing and debugging information to the cloud platform. Simultaneously, if the office automation software program running on branch B encounters a file injection with a hooking tool, its status monitoring program will also quickly send tracing and debugging information, including the specific location of the hook, the functions involved, and the time of occurrence, to the cloud platform. After receiving these tracing and debugging information reported by different terminals, the cloud platform initiates a consolidated analysis mechanism. First, the tracing and debugging information is categorized and organized, grouping those occurring within the same timeframe. Then, using data analysis algorithms, the correlation between the abnormal tracing and debugging errors is analyzed. For example, if two abnormal tracing and debugging behaviors occur in different applications on different branch terminals, but the tracing and debugging occur very close together, and the tracing and debugging methods (memory access anomaly and hooking behavior) are often used together in certain malicious tracing and debugging strategies, the cloud platform will determine that there is a risk of coordinated attack. Data analysis algorithms include, but are not limited to, clustering algorithms and Bayesian network algorithms. Upon determining the risk of a coordinated attack, the cloud platform immediately sends a process termination signal to the applications at risk: the financial software in branch terminal A, the office automation software in branch terminal B, and the financial software and office automation software in other branch terminals connected to the cloud platform. Upon receiving the termination signal, both applications swiftly execute the termination operation, thereby avoiding potentially more serious consequences of a coordinated attack, such as data leakage and system failure.

[0045] In this embodiment, by integrating the tracking and debugging information of different terminals, the risk of coordinated attacks is accurately identified, thereby enhancing the security of the overall system.

[0046] Optionally, the method further comprises: The security threat information database is queried to determine whether abnormal tracking and debugging is in a high-incidence period. If abnormal tracking and debugging is in a high-incidence period, an abnormal tracking and debugging reminder message is sent to the application of each terminal.

[0047] For example, the financial software in branch terminal C is injected with a hook tool file. By comparing it with the security threat information database, it is found that the abnormal tracking and debugging of the financial software injected with the hook tool is at its peak. Then the cloud platform sends abnormal tracking and debugging reminder information to the application of each terminal to prevent the financial software of other terminals from suffering the same malicious tracking and debugging.

[0048] The contents of the security threat information database may be shown in the following table:

[0049] In this embodiment, the security threat information library is used to timely determine whether the tracking and debugging information is in a high-incidence period, and abnormal tracking and debugging reminder information is sent to each terminal application, effectively reducing the risk of the application being tracked and debugged.

[0050] According to the embodiments of the present disclosure, the following technical effects are achieved: 1) By saving the program header table to the cloud platform, attackers cannot obtain the complete application execution code, effectively preventing static debugging; 2) It can perform real-time monitoring based on the terminal system type, flexibly responding to security requirements in different operating systems or environments, and improving the universality and compatibility of the solution; 3) Utilizing the cloud platform for centralized management, monitoring, and analysis simplifies the complexity of security management while improving the stability and reliability of the overall system.

[0051] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0052] The above is an introduction to the method embodiment. The following is a device embodiment to further illustrate the solution described in this application.

[0053] Figure 4 A block diagram of a cloud-based collaborative device for preventing an application from being tracked and debugged according to an embodiment of the present application is shown. Figure 4 Shown include: An acquisition module 401 is used to acquire a program header table, merge the quasi-executable program with the program header table, and obtain an execution program; The monitoring module 402 is used to load and run the execution program, and monitor in real time whether the execution program encounters abnormal tracking and debugging during the execution process according to the terminal system type; The process termination module 403 directly sends a process termination signal to the application program when it detects that the executed program is subjected to abnormal tracking and debugging during operation, and reports the tracking and debugging information to the cloud platform.

[0054] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0055] Figure 5 A schematic diagram of the structure of a terminal device or server suitable for implementing an embodiment of the present application is shown.

[0056] like Figure 5 As shown, the terminal device or server includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage part 508 into the random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the terminal device or server are also stored. The CPU 501, ROM 502 and RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0057] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, and the like; an output section 507 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 508 including a hard disk; and a communication section 509 including a network interface card such as a LAN card or a modem. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 510 as needed, so that computer programs read therefrom can be installed into the storage section 508 as needed.

[0058] In particular, according to an embodiment of the present application, the above method flow steps can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present application are executed.

[0059] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0060] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the aforementioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0061] The units or modules involved in the embodiments described in this application may be implemented in software or hardware. The units or modules described may also be provided in a processor. The names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0062] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not be incorporated into the electronic device. The computer-readable storage medium stores one or more programs, which, when used by one or more processors, execute the method described in the present application.

[0063] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of application involved in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the aforementioned application concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions applied for in this application.

Claims

1. A cloud-based collaborative method for preventing an application from being tracked and debugged, characterized in that: include: Obtaining a program header table, merging the quasi-executable program with the program header table to obtain an execution program; Loading and running the execution program, and monitoring in real time whether the execution program suffers from abnormal tracking and debugging during the running process according to the terminal system type; If it is detected that the execution program is subjected to abnormal tracking and debugging during operation, a process termination signal is directly sent to the application program, and the tracking and debugging information is reported to the cloud platform.

2. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The obtaining of the program header table includes: Sending a request to obtain a program header table to the cloud platform; After receiving the program header table request, the cloud platform encrypts the program header table through asymmetric encryption and sends the encrypted program header table to the terminal; The terminal decrypts the encrypted program header table to obtain the program header table.

3. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The quasi-executable program is obtained by merging and compiling the status monitoring program and the application source code.

4. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The real-time monitoring of whether the execution program is subjected to abnormal tracking and debugging during operation according to the terminal system type includes: When the terminal system type is a Linux system, it is determined whether the execution program suffers from abnormal tracking debugging during operation through the ptrace function, the TracerPid field in the process status file, the inotify mechanism, and the SIGTRAP signal.

5. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The real-time monitoring of whether the execution program is subjected to abnormal tracking and debugging during operation according to the terminal system type also includes: When the terminal system type is Android system, determine whether there is a hook tool injection file through mmaps file information; If the hook tool injection file exists, the execution program will be subjected to abnormal tracking debugging during the running process.

6. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The method further comprises: Integrate and analyze the tracking and debugging information reported by different terminals to determine whether there is a risk of coordinated attack; If there is a risk of a coordinated attack, the cloud platform sends a process termination signal to the application program that has the risk of the coordinated attack.

7. The cloud-based collaborative method for preventing applications from being tracked and debugged according to claim 1, characterized in that: The method further comprises: It is queried in the security threat information database whether the abnormal tracking and debugging is in a high-incidence period. If the abnormal tracking and debugging is in a high-incidence period, abnormal tracking and debugging reminder information is sent to the application program of each terminal.

8. A cloud-based collaborative device for preventing an application from being tracked and debugged, characterized in that: include: an acquisition module, configured to acquire a program header table, merge the quasi-executable program with the program header table, and obtain an execution program; A monitoring module, configured to load and run the execution program, and monitor in real time whether the execution program suffers from abnormal tracking and debugging during operation according to the terminal system type; The end process module, when detecting that the execution program is subjected to abnormal tracking and debugging during operation, directly sends an end process signal to the application program and reports the tracking and debugging information to the cloud platform.

9. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images