Installation package detection method, system, device, equipment, medium and product

Abstract

The invention provides an installation package detection method, system, device and equipment, a medium and a product, and relates to the technical field of software security. The method is applied to a detection device in the detection system, the detection system further comprises a terminal device, and the terminal device is provided with an application program based on a to-be-detected installation package. The method comprises the following steps: receiving to-be-verified data sent by terminal equipment; the to-be-verified data is obtained by the terminal equipment based on a file under an installation directory of the application program; the to-be-verified data comprises first to-be-verified sub-data; the first to-be-verified sub-data represents data contained in a specified file in the to-be-detected installation package; the specified file of one installation package comprises an executable file; obtaining pre-recorded reference data; the reference data is data contained in a specified file in an online installation package; and judging whether the reference data is matched with the first to-be-verified sub-data or not to obtain a detection result representing whether the to-be-detected installation package is tampered or not. Whether the installation package is tampered or not can be detected.

Description

Technical Field

[0001] The present invention relates to the field of software security technology, and in particular to an installation package detection method, system, device, equipment, medium and product. Background Art

[0002] The client can run applications (APPs) to provide users with various services. For example, the client plays a video for the user through the application. When the video is played, the client notifies the server to issue points to the user's account.

[0003] However, malicious actors can reverse engineer the application's installation package and modify its functionality to gain illicit benefits. For example, malicious actors can modify the mechanism by which the client notifies the server of points issuance, allowing users to obtain a large number of illicit points.

[0004] It can be seen that how to detect whether the installation package has been tampered with is a problem that needs to be solved urgently. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide an installation package detection method, system, device, equipment, medium, and product to detect whether the installation package has been tampered with. The specific technical solution is as follows:

[0006] In a first aspect, an embodiment of the present invention provides an installation package detection method, which is applied to a detection device in a detection system, wherein the detection system also includes a terminal device, and the terminal device has an application installed based on the installation package to be detected; the method includes:

[0007] Receiving data to be verified sent by the terminal device; wherein the data to be verified is obtained by the terminal device based on files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0008] Obtain pre-recorded reference data; wherein the reference data is data contained in a specified file in an online installation package;

[0009] It is determined whether the reference data matches the first sub-data to be checked, and a detection result indicating whether the installation package to be detected has been tampered with is obtained.

[0010] Optionally, the data to be verified further includes: second sub-data to be verified representing an installation package identifier;

[0011] The obtaining of pre-recorded reference data includes:

[0012] If the second sub-data to be verified exists in the installation package identifier of the pre-recorded online installation package, then the data contained in the specified file in the installation package represented by the second sub-data to be verified is obtained from the data contained in the specified file in the pre-recorded online installation package as reference data; wherein the pre-recorded installation package identifier represents the online installation package.

[0013] Optionally, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm;

[0014] The determining whether the reference data matches the first sub-data to be checked, and obtaining a detection result indicating whether the installation package to be checked has been tampered with, includes:

[0015] Decrypting the first sub-data to be verified based on the first encryption algorithm to obtain decrypted data;

[0016] If the decrypted data is consistent with the reference data, it is determined that the detection result of the installation package to be detected is not tampered with; otherwise, it is determined that the detection result of the installation package to be detected is tampered with.

[0017] Optionally, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package based on a first encryption algorithm and a key to be used; the key to be used is: data at a specified position in an encryption result obtained by encrypting data contained in a specified file in the installation package based on a second encryption algorithm;

[0018] Before decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data, the method further includes:

[0019] Obtain the key to be used;

[0020] The decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data includes:

[0021] The first sub-data to be verified is decrypted based on the first encryption algorithm and the obtained key to be used to obtain decrypted data.

[0022] Optionally, the method further includes:

[0023] If the second sub-data to be verified does not exist in the pre-recorded installation package identifier, it is determined that the detection result of the installation package to be detected is tampered.

[0024] Optionally, the data to be verified is sent by the terminal device when a specified event is detected this time; the data to be verified also includes: an account identifier of an account logged into the terminal device when the specified event is detected this time; the specified event is: an event monitored during the execution of the embedded code in the installation package to be detected;

[0025] The method further comprises:

[0026] After obtaining the detection result of this time, if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the detection result of this time, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; wherein the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past.

[0027] In a second aspect, an embodiment of the present invention provides an installation package detection method, which is applied to a terminal device of a detection system, wherein the detection system further includes a detection device, and the terminal device has an application installed based on the installation package to be detected. The method includes:

[0028] Based on the files in the installation directory of the application, data to be verified is obtained; wherein the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0029] The data to be verified is sent to the detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package.

[0030] Optionally, the data to be verified further includes: second sub-data to be verified representing an installation package identifier;

[0031] The sending the data to be verified to the detection device includes:

[0032] The data to be verified is sent to the detection device, so that after the detection device receives the data to be verified sent by the terminal device, if the second sub-data to be verified exists in the pre-recorded installation package identifier, the data contained in the specified file in the installation package represented by the pre-recorded second sub-data to be verified is obtained as reference data; wherein, the pre-recorded installation package identifier represents an online installation package; determine whether the pre-recorded reference data matches the first sub-data to be verified, and obtain a detection result indicating whether the installation package to be detected has been tampered with; wherein, the reference data is the data contained in the specified file in the installation package.

[0033] Optionally, obtaining the data to be verified based on the files in the installation directory of the application includes:

[0034] Obtain the configuration file and the specified file in the installation directory of the application;

[0035] Encrypting the data contained in the designated file based on a first encryption algorithm to obtain first sub-data to be verified in the data to be verified;

[0036] The data representing the installation package identifier recorded in the configuration file is extracted as the second sub-data to be verified in the data to be verified.

[0037] Optionally, before encrypting the data contained in the designated file based on the first encryption algorithm to obtain the first sub-data to be verified in the data to be verified, the method further includes:

[0038] Encrypting the data contained in the designated file according to a second encryption algorithm to obtain an encryption result;

[0039] Extracting data at a specified position in the encryption result to obtain a key to be used;

[0040] The step of encrypting the data contained in the designated file based on the first encryption algorithm to obtain first sub-data to be verified in the data to be verified includes:

[0041] The data contained in the designated file is encrypted according to the first encryption algorithm and the obtained key to be used, so as to obtain first sub-data to be verified in the data to be verified.

[0042] Optionally, obtaining the data to be verified based on the files in the installation directory of the application includes:

[0043] When a specified event is detected, the current data to be verified is obtained based on the files in the installation directory of the application; wherein the specified event is: an event monitored during the execution of the embedded code in the installation package to be detected.

[0044] Optionally, before obtaining the current data to be verified based on the files in the installation directory of the application when the specified event is detected, the method further includes:

[0045] Obtaining the account identifier of the account that logged into the terminal device when the specified event was detected;

[0046] When a specified event is detected, obtaining the current data to be verified based on the files in the installation directory of the application includes:

[0047] When a specified event is detected, the data to be verified is obtained based on the files in the installation directory of the application and the obtained account identifier;

[0048] The sending the data to be verified to the detection device includes:

[0049] Sending data to be verified to the detection device, so that the detection device, after receiving the data to be verified sent by the terminal device, determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package; after obtaining the current detection result, if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the current detection result, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past;

[0050] The method further includes: if alarm information sent by the detection device is received, displaying the alarm information on a display page of the terminal device.

[0051] In a third aspect, an embodiment of the present invention further provides an installation package detection system, the system comprising a detection device and a terminal device; wherein:

[0052] The detection device is used to perform the installation package detection method of the first aspect above;

[0053] The terminal device is used to execute the installation package detection method of the second aspect above.

[0054] In a fourth aspect, an embodiment of the present invention further provides an installation package detection apparatus, which is applied to a detection device in a detection system, wherein the detection system further includes a terminal device, and the terminal device has an application installed based on the installation package to be detected; the apparatus includes:

[0055] a first receiving module, configured to receive data to be verified sent by the terminal device; wherein the data to be verified is obtained by the terminal device based on files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0056] A first acquisition module is configured to acquire pre-recorded reference data, wherein the reference data is data contained in a specified file in an online installation package;

[0057] The judgment module is used to judge whether the reference data matches the first sub-data to be checked, and obtain a detection result indicating whether the installation package to be detected has been tampered with.

[0058] In a fifth aspect, an embodiment of the present invention further provides an installation package detection device, which is applied to a terminal device of a detection system, wherein the detection system further includes a detection device, and the terminal device has an application installed based on the installation package to be detected, and the device includes:

[0059] a second acquisition module, configured to acquire data to be verified based on files in the installation directory of the application; wherein the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0060] A sending module is used to send the data to be verified to the detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein, the reference data is data contained in a specified file in the installation package.

[0061] An embodiment of the present invention further provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0062] Memory for storing computer programs;

[0063] The processor is configured to implement the above-mentioned installation package detection method when executing the program stored in the memory.

[0064] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned installation package detection method is implemented.

[0065] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the above-mentioned installation package detection method when executed by a processor.

[0066] An embodiment of the present invention provides an installation package detection method, which is applied to a detection device in a detection system. The detection system also includes a terminal device, which has an application installed based on the installation package to be detected. In this scheme, the detection device receives data to be verified sent by the terminal device; the data to be verified is obtained by the terminal device based on files in the application's installation directory; the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the detection device obtains pre-recorded reference data; and determines whether the reference data matches the first sub-data to be verified, thereby obtaining a detection result indicating whether the installation package to be detected has been tampered with.

[0067] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for describing the embodiments or the prior art.

[0069] Figure 1 This is a schematic diagram of the interaction of the detection system provided in an embodiment of the present invention;

[0070] Figure 2 Another interactive schematic diagram of the detection system provided in an embodiment of the present invention;

[0071] Figure 3 A schematic diagram of the principle of a detection system provided in an embodiment of the present invention;

[0072] Figure 4 A schematic diagram of a flow chart of a first installation package detection method provided in an embodiment of the present invention;

[0073] Figure 5 A schematic flow chart of a second installation package detection method provided in an embodiment of the present invention;

[0074] Figure 6 This is a schematic structural diagram of a first installation package detection device provided in an embodiment of the present invention;

[0075] Figure 7 This is a schematic structural diagram of a second installation package detection device provided in an embodiment of the present invention;

[0076] Figure 8 The figure is a schematic structural diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0077] Developers can design user incentive mechanisms within the application's business logic. For example, the business logic could be: When the client application is running, users watch videos on the client application to complete tasks and earn points. When the video is finished playing, the client can notify the server to issue points to the user's account. Points can be redeemed for gifts, vouchers, and other benefits.

[0078] However, after downloading an application's installation package, malicious actors can decompile it and modify the application's functionality to obtain illicit benefits. For example, a malicious actor could identify the data contained in the executable file and obtain legitimate code used to earn points upon completing a video. They could then tamper with the legitimate code to create malicious code that earns points by playing a video for one second. They could then re-edit the executable file with the malicious code and package the altered executable file into an installation package. Users could then download the altered installation package and obtain a large amount of illicit points.

[0079] It can be seen that how to detect whether the installation package has been tampered with is a problem that needs to be solved urgently.

[0080] In order to detect whether an installation package has been tampered with, embodiments of the present invention provide an installation package detection method, system, apparatus, device, medium, and product.

[0081] Among them, an installation package detection method provided by an embodiment of the present invention is applied to a detection device in a detection system, and the detection system includes a terminal device, the terminal device can download the installation package to be detected, and install the application based on the installation package to be detected, and send the data to be verified to the detection device during the operation of the application. The detection device can obtain the data to be verified from the terminal device, and judge whether the installation package to be detected of the terminal device has been tampered with based on the data to be verified. Among them, the detection device can be a server that provides various business services (such as video playback services and commodity purchase services, etc.) to the terminal device at the same time and detects whether the installation package has been tampered with; optionally, the detection device can be a device that specifically detects whether the installation package has been tampered with, and is a different device from the server that provides various business services to the terminal device. For example, the detection device can be a server a that detects whether the installation package has been tampered with, and server a and server b that provides video playback services to the terminal device are different servers.

[0082] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0083] The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

[0084] See also Figure 1 , Figure 1 This is a schematic diagram of the interaction of the detection system provided in an embodiment of the present invention, such as Figure 1 As shown, the detection system includes a terminal device 110 and a detection device 120, and the interaction process between the terminal device 110 and the detection device 120 may include steps S101-S105.

[0085] S101: The terminal device 110 obtains data to be verified based on files in the installation directory of the application.

[0086] The data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file.

[0087] It is understood that the terminal device 110 can download the installation package to be detected from a formal download channel such as an app store or an informal download channel provided by malicious actors, and then install the application based on the installation package to be detected. The files in the application are the files in the installation package to be detected. During the process of installing the application based on the installation package to be detected, the terminal device 110 can copy the files of the installation package to be detected to the application's installation directory. The data in the files of the application are essentially the data in the files of the installation package to be detected on the terminal device 110.

[0088] The data to be verified may include first sub-data to be verified. It should be noted that if the installation package to be tested has not been tampered with, the first sub-data to be verified represents the data contained in the specified file in the installation package to be tested. If the installation package to be tested has been tampered with, the first sub-data to be verified may not represent the data contained in the specified file in the installation package to be tested, and the detection device 120 will subsequently need to test the first sub-data to be verified.

[0089] The terminal device 110 can obtain the data to be verified from the files in the application installation directory. Exemplarily, a specified file is determined in the files in the application installation directory, and the first sub-data to be verified representing the data contained in the specified file in the installation package to be detected is obtained.

[0090] It is understandable that the designated file is a type of file, which may include an executable file. The designated file may be referred to as a target file or a first file.

[0091] When the designated file only contains an executable file, the data contained in the designated file is the data contained in the executable file. Terminal device 110 can run the application by executing the data contained in the executable file. Exemplarily, the executable file can be a classes.dex binary executable file. The executable file is a binary file containing the application code and is used to run the application. The data contained in the executable file is the binary data used to run the application.

[0092] Different applications have different functions, and each installation package has a different executable file. That is, for each online installation package, the file data contained in the designated file containing the executable file is unique. Generally speaking, to modify the functionality of an application, malicious actors will modify the files within the installation package that enable the application to run, essentially tampering with the executable file. In embodiments of the present invention, the file information of the designated file containing the executable file is used as a verification criterion to detect whether the installation package under test has been tampered with.

[0093] It is understandable that the specified file may include other files in addition to the executable file.

[0094] In one implementation, the designated files of an installation package also include resource files.

[0095] It is understood that during the running of an application, the user interface (UI) of the application can be loaded through the data contained in the resource file. Exemplarily, the resource file can be a resources.arsc binary resource file. The resource file is a binary file of user interface resources such as strings, which is used to load the user interface; the data contained in the resource file is the binary data used to load the user interface.

[0096] To adapt the functionality of each application, the resource files of one application are usually different from those of other applications. Malicious actors can modify the file data of resource files to obtain improper benefits. For example, malicious actors can modify the file data in the resource files used to display the user login page, obtain user privacy, and use user privacy to obtain improper benefits. In the embodiment of the present invention, the data contained in the specified file containing the executable file and the resource file is used as the verification standard, which can accurately detect whether the installation package to be tested has been tampered with.

[0097] In another implementation, a specified file of an installation package may include all files in the installation package.

[0098] It is understood that the designated file includes all files in the installation package, and the data contained in all files in the installation package is used as the detection standard. If any file has been tampered with or is missing, the data contained in the designated file of the installation package to be tested will not match the complete and untampered installation package. Embodiments of the present invention can detect whether each file in the installation package has been tampered with, avoid the situation where files are missing in the installation package, detect the integrity of the installation package to be tested, and accurately detect whether the installation package to be tested has been tampered with.

[0099] Optionally, the data to be verified further includes: second sub-data to be verified representing the installation package identifier; the terminal device 110 may obtain the second sub-data to be verified representing the installation package identifier from a configuration file of the application.

[0100] For example, to uniquely distinguish between installed packages that have been released, the installation package identifier may include the version number and channel number of the installation package to be tested, where the channel number indicates the application store from which the installation package to be tested was downloaded. For example, the channel number may represent the Internetworking Operating System (IOS) application store or the Android application store. If there is only one download channel for the installation package and the channel number is the same for each installation package, the installation package identifier may only include the version number of the installation package to be tested. This embodiment of the present invention is merely an example and is not specifically limited to this.

[0101] In one implementation, step S101 includes step S1011.

[0102] S1011: When a specified event is detected, the current data to be verified is obtained based on the files in the installation directory of the application.

[0103] The specified event is an event monitored during the execution of the tracking code in the installation package to be detected.

[0104] It is understandable that the installation package is provided with a buried code, which can monitor specified events. When a specified event is triggered during the operation of the application (i.e., a specified event is detected), the terminal device 110 obtains the data to be verified and then sends the data to be verified to the detection device 120 for installation package detection. Among them, the specified event can be a cold start of the application, a change in the account login status, and / or the completion of the task of the specified service. Exemplarily, the change in the account login status can be a change from a never-logged-in state to a logged-in state, or a change from a logged-in state to a non-logged-in state; the task of completing the specified service can be the completion of video playback, or the completion of a sign-in task, etc.

[0105] In this embodiment of the present invention, terminal device 110 sends the data to be verified to detection device 120 at random times. This allows for the triggering of designated events for installation package detection at various stages of the application's execution, thereby increasing detection frequency and the likelihood of detecting the use of tampered installation packages. Furthermore, the randomized detection timing prevents malicious actors from discovering patterns in the transmission of the data to be verified, thereby enhancing the security of the detection process.

[0106] It should be noted that, generally speaking, if a malicious actor maliciously tampers with the tracking code, the specified event being monitored will be modified, causing the terminal device 110 to not send the data to be verified to the detection device 120 when the specified event is triggered. The detection device 120 is unable to detect the installation package of the terminal device 110 based on the data to be verified. However, the terminal device 110 needs to interact with the server that provides business services to trigger the specified event. The detection device 120 can sense each interaction between the terminal device 110 and the server and determine that the installation package of the terminal device 110 has been tampered with.

[0107] Exemplarily, the detection device 120 can record the interaction between the terminal device 110 and the server. When the terminal device 110 interacts with the server, if the detection device 120 does not receive the data to be verified sent by the terminal device 110, it can be determined that the installation package of the terminal device 110 has been tampered with; if the detection device 120 receives the data to be verified sent by the terminal device 110, the detection device 120 can further determine whether the installation package of the terminal device 110 has been tampered with based on the data to be verified sent by the terminal device 110.

[0108] In an embodiment of the present invention, in the case where the detection device cannot receive the data to be verified sent by the terminal device (for example, the embedded code is modified, resulting in the terminal device not sending the data to be verified to the detection device when triggering the specified event; or the tampered installation package to be detected loses the network address of the detection device, resulting in the detection device not receiving the data to be verified sent by the terminal device), it can be checked based on the interaction between the terminal device and the server providing business services whether the data to be verified sent by the terminal device is received, to ensure that the detection device can perform detection on the installation package to be detected.

[0109] In another implementation, step S101 may include steps S1012 - S1014 .

[0110] S1012: Obtain a configuration file and a specified file in the installation directory of the application.

[0111] It is understood that the files in the application's installation directory are files of the installation package to be detected. After the application is installed, the installation package to be detected may or may not be deleted. The existence of the installation package to be detected is uncertain, but the application's installation directory must exist. In order to ensure that the files in the installation package to be detected can be obtained to detect the installation package to be detected, the terminal device 110 can obtain file information of the configuration file and file information of the specified file in the application's installation directory.

[0112] In one implementation, if the designated file also includes a resource file, the terminal device 110 may also obtain data included in the resource file in the installation directory of the application.

[0113] S1013, encrypting the data contained in the designated file based on the first encryption algorithm to obtain first sub-data to be verified in the data to be verified;

[0114] S1014: Extract the data representing the installation package identifier recorded in the configuration file as the second sub-data to be verified in the data to be verified.

[0115] It is understood that terminal device 110 may encrypt the data contained in the designated file using the first encryption algorithm to obtain the first sub-data to be verified in the data to be verified. The configuration file may record data representing the installation package identifier, and terminal device 110 may extract the data representing the installation package identifier recorded in the data contained in the configuration file as the second sub-data to be verified in the data to be verified.

[0116] For example, the first encryption algorithm may be to encrypt data using a fixed key. The terminal device 110 may encrypt the data contained in the designated file using a preset fixed key.

[0117] It is understandable that the first encryption algorithm may be an algorithm that uses a key to encrypt data contained in a designated file. For example, the first encryption algorithm may be an Advanced Encryption Standard (AES).

[0118] It is understood that the key used by the first encryption algorithm may be a preset key stored in the installation package, which is a fixed key agreed upon between the detection device 120 and a normal application. In this embodiment of the present invention, the terminal device 110 may use the preset key stored in the installation package to encrypt the data contained in the designated file to obtain the first sub-data to be verified. The detection device 120 may then decrypt the encrypted first sub-data to be verified using the preset key and then verify the decrypted result.

[0119] In an embodiment of the present invention, the terminal device can send the ciphertext of the data contained in the specified file to the detection device to prevent the plaintext of the file information from being stolen by malicious actors, thereby reducing the risk of exposing the data contained in the specified file in the online installation package.

[0120] In another implementation, the first encryption algorithm may be to encrypt data using a non-fixed key. The terminal device 110 may first generate a non-fixed key and then use the generated key to encrypt the data contained in the specified file. This implementation will be described in detail in subsequent embodiments.

[0121] In the embodiment of the present invention, the terminal device can obtain the data to be verified from the files in the installation directory of the application. Since the files of the application are the files in the installation package to be detected, the installation package to be detected can be detected.

[0122] It is understandable that steps S1012-S1014 may be the steps executed when a specified event is triggered during the running of the application, or steps S1012-S1014 may be directly executed without paying attention to whether the specified event is triggered.

[0123] In one implementation, the first encryption algorithm may perform encryption using a non-fixed key. Specifically, before step S1013, the terminal device 110 may execute steps A1-A2, and step S1013 includes step S10131.

[0124] A1. Encrypt the data contained in the executable file and the data contained in the resource file according to a second encryption algorithm to obtain an encryption result.

[0125] A2, extract the data at the specified position in the encryption result to obtain the key to be used.

[0126] It is understandable that the terminal device 110 can obtain the hash value of the data contained in the specified file through the second encryption algorithm as the encryption result, and then extract the data at the specified position in the encryption result to obtain the key to be used.

[0127] Exemplarily, the second encryption algorithm can be a Message-Digest Algorithm (MD5). Using the second encryption algorithm to process the data contained in the specified file can generate a 128-bit hash value, which can represent the data contained in the specified file. The data at a specified position in the encryption result is then used as the key to be utilized. Specifically, after generating the hash value using the MD5 algorithm, the data at a specified position in the hash value can be used as the reference ciphertext. The specified position can be the first 8 bits of the hash value.

[0128] In an embodiment of the present invention, the data at a specified position in the encryption result of the data contained in the specified file is used as the key to be used. The transmitted ciphertext is not generated using a fixed key, but is a key to be used generated using a preset rule (a second encryption algorithm), which can avoid the security risks brought about by the leakage of the fixed key.

[0129] It can be understood that if the specified file only contains an executable file, the terminal device 110 can encrypt only the data contained in the executable file according to the second encryption algorithm to obtain the key to be used; if the specified file contains an executable file and a resource file, the terminal device 110 can encrypt the data contained in the executable file and the resource file according to the second encryption algorithm to obtain the key to be used; the specific implementation method is similar to the above embodiment and will not be elaborated here.

[0130] Step S10131: Encrypt the data contained in the designated file according to the first encryption algorithm and the obtained key to be used, and obtain the first sub-data to be verified in the data to be verified.

[0131] It is understandable that, in the process of encrypting the data contained in the designated file, the terminal device 110 may encrypt the data contained in the designated file using the key to be used according to the first encryption algorithm.

[0132] S102 , the terminal device 110 sends the data to be verified to the detection device 120 .

[0133] It is understandable that all steps executed by the terminal device 110 are essentially implemented by running the application program on the terminal device 110. When the terminal device 110 runs the application program, the terminal device 110 can communicate with the detection device 120.

[0134] Terminal device 110 is capable of communicating with detection device 120. For example, the installation package to be detected contains the network address of detection device 120 and the communication protocol of detection device 120. After terminal device 110 installs an application based on the installation package to be detected, while the application is running, terminal device 110 can generate a detection request carrying the data to be verified according to the network address and communication protocol in the installation package to be detected. Detection device 120 can receive the detection request sent by terminal device 110, parse the detection request according to the communication protocol of detection device 120, and obtain the data to be verified.

[0135] It is understandable that, normally, if the application is installed based on an unmodified installation package (the application is collectively referred to as a normal application in this article), then when the application is running, the format of the data to be verified sent by the terminal device 110 to the detection device 120 is the same as the format of the data to be verified parsed by the detection device 120, that is, the normal application and the detection device have pre-agreed on the same format of the data to be verified. Exemplarily, in the detection request sent when a normal application is running, the first sub-data to be verified and the second sub-data to be verified are in their respective fixed positions; the detection device 120 parses the detection request in accordance with the pre-agreed format, and obtains the first sub-data to be verified and the second sub-data to be verified at their respective fixed positions in the detection request.

[0136] S103 , the detection device 120 receives the data to be verified sent by the terminal device 110 .

[0137] It is understood that the detection device 120 can receive the data to be verified sent by the terminal device 110, and the detection device 120 needs to verify the received data to be verified. The detection device 120 can parse the data to be verified according to the format agreed upon by the normal application program to obtain the first sub-data to be verified.

[0138] S104 , the detection device 120 obtains pre-recorded reference data.

[0139] The reference data refers to the data contained in the specified file in the online installation package.

[0140] It can be understood that in one implementation, the pre-recorded reference data can be stored in a file information database (referred to as the file information library), and the detection device 120 can access the file information library to obtain the reference data; in another implementation, the pre-recorded reference data can also be stored locally in the detection device 120, and the detection device 120 can obtain the locally stored reference data.

[0141] The reference data is data contained in a specified file in an online installation package, and is data contained in a specified file in an untampered installation package, and can be used as a standard for detecting the installation package.

[0142] In one implementation, the data to be verified further includes: second sub-data to be verified representing the installation package identifier, and step S104 includes step S1041.

[0143] S1041, if the installation package identifier of the pre-recorded online installation package contains second sub-data to be verified, then obtain the data contained in the specified file in the installation package represented by the second sub-data to be verified from the data contained in the specified file in the pre-recorded online installation package as reference data.

[0144] The pre-recorded installation package identifier indicates the online installation package.

[0145] It is understandable that a normal application and the detection device 120 have pre-agreed on the format of the data to be verified. If the format of the data to be verified has not been tampered with, the detection device 120 can parse the data to be verified in accordance with the agreed format to obtain the second sub-data to be verified. If the installation package identifier storing the installation package to be verified has not been tampered with, the second sub-data to be verified carried in the data to be verified is the installation package identifier of the online installation package. Since the pre-recorded installation package identifier represents an online installation package, if the pre-recorded installation package identifier contains the second sub-data to be verified, it can be considered that the installation package to be detected is an online installation package. The detection device 120 can obtain the data contained in the specified file in the installation package represented by the second sub-data to be verified as reference data for subsequent verification.

[0146] Exemplarily, the packaging device can edit and package the code of the application program, generate an installation package, and then put the generated installation package into various application stores for online release. The packaging device can record the installation package identifier of the online installation package and the file information of the specified file in the file information library to pre-record the installation package identifier and the file information of the specified file. The detection device 120 can check whether there is a second sub-data to be verified in the file information library. If there is a second sub-data to be verified in the file information library, the data contained in the specified file in the installation package represented by the second sub-data to be verified is obtained. Among them, the packaging device can be the same device as the detection device 120, or it can be a different device. In this regard, the embodiment of the present invention is only used as an example for illustration and is not specifically limited.

[0147] Optionally, in one implementation, if the pre-recorded installation package identifier does not contain the second sub-data to be verified, it is determined that the detection result of the installation package to be detected is tampered.

[0148] It is understandable that if the second sub-data to be verified does not exist in the pre-recorded installation package identifier, at least one of the following situations may exist: the format of the data to be verified has been tampered with, resulting in the detection device 120 being unable to obtain the second sub-data to be verified representing the installation package identifier; and the installation package identifier of the installation package to be detected has been tampered with, resulting in the second sub-data to be verified not being in the pre-recorded installation package identifier. When the above situations occur, it can be considered that the information in the installation package to be detected has been tampered with, that is, if the second sub-data to be verified does not exist in the pre-recorded installation package identifier, it can be considered that the installation package to be detected is not a standard installation package released to the application store, and the detection result of the installation package to be detected can be determined to be tampered with. In an embodiment of the present invention, the tampered installation package can be preliminarily screened out by the installation package identifier, reducing the amount of data for subsequent detection and improving detection efficiency.

[0149] S105 , the detection device 120 determines whether the reference data matches the first sub-data to be checked, and obtains a detection result indicating whether the installation package to be detected has been tampered with.

[0150] It is understood that the reference data obtained is standard, untampered data, and the first sub-data to be verified represents data contained in a specified file in the installation package to be tested. Testing device 120 can match the data represented by the first sub-data to be verified with the obtained reference data, that is, match the data of the installation package to be tested with the standard data. If the data of the installation package to be tested matches the standard data, it can be assumed that the installation package to be tested has not been tampered with. If the data of the installation package to be tested does not match the standard data, it can be assumed that the installation package to be tested has been tampered with.

[0151] Determining whether the reference data matches the first sub-data to be verified essentially involves determining whether the parameter data is consistent with the data in the installation package to be tested. Exemplarily, determining whether the reference data matches the first sub-data to be verified can be done by determining whether the reference data is consistent with the first sub-data to be verified, or by determining whether the encryption result of the reference data and the first sub-data to be verified is consistent.

[0152] In one implementation, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm. Step S105 includes steps S1051-S1052.

[0153] S1051: Decrypt the first sub-data to be checked based on a first encryption algorithm to obtain decrypted data.

[0154] It is understandable that the detection device 120 and the normal application have the same first encryption algorithm for data encryption. The detection device 120 can decrypt the first sub-data to be checked according to the pre-agreed first encryption algorithm to obtain decrypted data.

[0155] S1052: If the decrypted data is consistent with the reference data, the detection result of the installation package to be detected is determined to be not tampered with; otherwise, the detection result of the installation package to be detected is determined to be tampered with.

[0156] It is understandable that if the decrypted data is consistent with the reference data, it can be considered that the terminal device 110 uses the pre-agreed first encryption algorithm to encrypt the data contained in the specified file, and the data contained in the specified file is the same as the reference data. At this time, it can be determined that the detection result of the installation package to be detected is not tampered with. If the decrypted data is inconsistent with the reference data, it may be caused by at least one of the following situations: the algorithm used by the terminal device 110 to encrypt the data has been tampered with, the terminal device 110 has not encrypted the data, and the data contained in the specified file in the terminal device 110. The above situations can be uniformly considered that the terminal device 110 has not used the agreed first encryption algorithm to encrypt the data contained in the specified file that has not been tampered with, that is, the installation package to be detected does not comply with the pre-agreed rules, and the installation package to be detected has been tampered with.

[0157] In this embodiment of the present invention, a terminal device can send the encrypted data contained in a designated file to a detection device, preventing the plaintext data contained in the designated file from being stolen by malicious actors, thereby reducing the risk of exposing the data contained in the designated file in an already-released installation package. Furthermore, encryption through a predetermined method can further detect whether the installation package has been tampered with, thereby improving the accuracy of the installation package detection results.

[0158] In one implementation, the first sub-data to be verified represents ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm and a key to be used. The key to be used represents data at a specified location in the encryption result obtained by encrypting data contained in the specified file in the installation package using a second encryption algorithm. Before detection device 120 executes step S1051, step B1 may be executed. Step S1051 may include step S10512.

[0159] B1, obtain the key to be used.

[0160] S10512: Decrypt the first sub-data to be verified based on the first encryption algorithm and the obtained key to be used to obtain decrypted data.

[0161] It is understood that the detection device 120 and the normal application have pre-agreed on a method for obtaining the key to be used by the first encryption algorithm. For example, if the key to be used is a fixed key, the detection device 120 may obtain a pre-recorded key to be used; if the key to be used is not fixed, the detection device 120 may generate the key to be used according to the rules pre-agreed with the normal application. The detection device 120 may then decrypt the first sub-data to be verified using the first encryption algorithm and the obtained key to be used to obtain decrypted data.

[0162] Optionally, in one implementation, the key to be used obtained by the detection device 120 is obtained through the following steps:

[0163] C1, encrypting the reference data based on the second encryption algorithm to obtain an encryption result;

[0164] C2 extracts the data at the specified location in the encryption result to obtain the key to be used.

[0165] It is understandable that the detection device 120 can use the same rules as normal applications to generate the key to be used. The specific implementation method has been described in the above embodiment and will not be repeated here.

[0166] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0167] In another embodiment, the data to be verified also includes the account identifier of the account logged into the terminal device 110, such as Figure 2 As shown, in Figure 1 Based on the interaction between the terminal device 110 and the detection device 120, the steps S201-S203 are also included, and the step S101 includes the step S1016.

[0168] S201 , the terminal device 110 obtains the account identifier of the account that logged into the terminal device 110 when the designated event is detected this time.

[0169] It is understandable that the terminal device 110 can obtain the account identifier of the account logged into the terminal device 110. For example, when an account logs into the terminal device 110 for the first time, the user manually enters the relevant information of the account, such as the account name, and the information entered by the user can be used as the account identifier of the account; in another implementation, the application configuration file also stores the account identifier of the account logged into the terminal device 110, and the terminal device can obtain the account identifier stored in the configuration file.

[0170] The account identifier obtained is the account identifier of the account logged into the terminal device 110 when the specified event was detected. That is, when the terminal device 110 detects the specified event, the execution of the installation package detection method in steps S101-S105 is triggered. The account identifier is obtained during this execution, and the subsequent recording of the detection results obtained is also a process. Historical detection results may also exist in the past before the specified event was detected.

[0171] S1016 , when the terminal device 110 detects a designated event, the terminal device 110 obtains the data to be verified based on the files in the installation directory of the application program and the obtained account identifier.

[0172] It is understandable that the terminal device 110 can obtain the first sub-data to be verified and the second sub-data to be verified based on the files in the installation directory of the application; and then send the obtained first sub-data to be verified, the second sub-data to be verified and the obtained account identifier as the data to be verified to the detection device 120.

[0173] S202. After the detection device 120 obtains the detection result of this time, if there are a specified number of detection results indicating tampering in the historical detection results corresponding to the pre-recorded account identifier and the detection result of this time, an alarm message is sent to the terminal device 110, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier.

[0174] The historical detection result corresponding to the account identifier is obtained by performing installation package detection on data sent by the terminal device when a specified event is detected in the past.

[0175] It is understood that the account identifier of the account logged into the terminal device 110 can be the account name, mobile phone number, or ID number. The terminal device 110 can add the account identifier to the data to be verified when generating the detection request. After obtaining the detection result, the detection device 120 can record the detection result and the account identifier in correspondence to count whether each account uses the tampered installation package.

[0176] It is understood that if a specified number of historical detection results corresponding to a pre-recorded account identifier and the current detection result indicate tampering, that is, if an account has used a tampered installation package a specified number of times, detection device 120 may process the account. The specified number may be at least 1.

[0177] The detection device 120 can send an alert to the terminal device 110 of the account to be processed, prompting the user on the display page of the terminal device 110 that the installation package being used is a tampered installation package, thereby notifying the user of the risk. The detection device 120 can send a deactivation instruction to the server providing the specified service, causing the server to deactivate the specified service for the account represented by the account identifier. For example, the specified service can be point redemption. The detection device 120 can send a deactivation instruction to the server of the point redemption system, and the server can deactivate the point redemption function for the account represented by the account identifier.

[0178] The warning and deactivation processing performed by the detection device 120 can be regarded as penalty measures. The detection device 120 can use both processing methods or one of the two processing methods.

[0179] S203 , if the terminal device 110 receives the alarm information sent by the detection device 120 , the alarm information is displayed on a display page of the terminal device 110 .

[0180] It is understood that if a specified number of historical detection results and current detection results corresponding to the account identifier indicate tampering, detection device 120 may send an alert to terminal device 110. Terminal device 110 may receive the alert sent by detection device 120. After receiving the alert, terminal device 110 may display the alert on a display page of terminal device 110.

[0181] In an embodiment of the present invention, the data to be verified also includes an account identifier. The detection device can collect statistics on the use of tampered installation packages by accounts based on the account identifier, and can prompt the account when it is found that the account uses a tampered installation package.

[0182] In order to better understand the embodiments of the present invention, the following will be described in conjunction with a schematic diagram of the principle of the detection system.

[0183] like Figure 3 As shown, the detection system can be called an installation package integrity detection system. In this system, for the installation package that has been put online, the installation package identifier and the data contained in the specified file in the installation package are recorded in the file information library accordingly. Whenever a new installation package is put online, the installation package identifier of the newly put online installation package and the data contained in the specified file in the installation package can be recorded in the file information library accordingly to implement data maintenance on the file information library. The installation package identifier can be a version number and a channel number, and the file information of the specified file can be called core file information. That is to say, the file information library stores data: version number, channel number and core file information. The detection device can receive the data to be verified sent by the terminal device, that is, receive the delivered installation package information.

[0184] The designated files can be all files in the installation package, including executable files. During the installation package integrity check, when a designated event is triggered while the application is running, the terminal device can retrieve the data to be verified based on the designated files in the application's installation directory. This data is then sent to the testing device. This means the testing device can receive delivery information at different times.

[0185] If the core file information is encrypted by the terminal device using a preset key, the detection device can decrypt the core file information using the preset key. The decrypted result is matched with the file information recorded in the file information library. In other words, the decrypted version number, channel number, and core file information are verified against the data in the file information library.

[0186] The data to be verified also includes the account identifier of the account logged into the terminal device. After obtaining the detection result indicating whether the installation package to be detected has been tampered with, the detection device can record the obtained detection result in correspondence with the login account identifier and process the detection result. If there are a specified number of detection results indicating tampering among the detection results corresponding to the account identifier, a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier. For example, for the account represented by the account identifier, the points obtained are restricted, and the account is blacklisted, etc.

[0187] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is untampered data and can be used as a standard for checking whether the installation package has been tampered with. According to whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0188] Optionally, in one embodiment, as Figure 4 As shown, an embodiment of the present invention further provides an installation package detection method, which is applied to a detection device in a detection system, wherein the detection system also includes a terminal device, and the terminal device has an application installed based on the installation package to be detected. The method includes steps S401-S403.

[0189] S401: Receive data to be verified sent by a terminal device.

[0190] Among them, the data to be verified is obtained by the terminal device based on the files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents the data contained in the specified file in the installation package to be detected; the specified file of an installation package includes an executable file.

[0191] S402: Acquire pre-recorded reference data.

[0192] The reference data refers to the data contained in the specified file in the online installation package.

[0193] S403: Determine whether the reference data matches the first sub-data to be checked, and obtain a detection result indicating whether the installation package to be detected has been tampered with.

[0194] It can be understood that the specific implementation of this embodiment can refer to the embodiment of the above-mentioned detection system, and will not be repeated here.

[0195] Optionally, the data to be verified further includes: second sub-data to be verified representing the installation package identifier;

[0196] Access pre-recorded reference data, including:

[0197] If the installation package identifier of the pre-recorded online installation package contains second sub-data to be verified, then the data contained in the specified file in the installation package represented by the second sub-data to be verified is obtained from the data contained in the specified file in the pre-recorded online installation package as reference data; wherein the pre-recorded installation package identifier represents the online installation package.

[0198] Optionally, the first sub-data to be checked represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm;

[0199] Determining whether the reference data matches the first sub-data to be checked, and obtaining a detection result indicating whether the installation package to be checked has been tampered with, including: decrypting the first sub-data to be checked based on a first encryption algorithm to obtain decrypted data;

[0200] If the decrypted data is consistent with the reference data, the detection result of the installation package to be detected is determined to be not tampered with; otherwise, the detection result of the installation package to be detected is determined to be tampered with.

[0201] Optionally, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package based on the first encryption algorithm and the key to be used; the key to be used is: data at a specified position in an encryption result obtained by encrypting data contained in the specified file in the installation package based on the second encryption algorithm;

[0202] Before decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data, the method further includes:

[0203] Obtain the key to be used;

[0204] Decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data includes:

[0205] The first sub-data to be checked is decrypted based on the first encryption algorithm and the obtained key to be used to obtain decrypted data.

[0206] Optionally, the method further includes:

[0207] If the second sub-data to be verified does not exist in the pre-recorded installation package identifier, it is determined that the detection result of the installation package to be detected is tampered.

[0208] Optionally, the data to be verified is sent by the terminal device when the specified event is detected this time; the data to be verified also includes: the account identifier of the account logged into the terminal device when the specified event is detected this time; the specified event is: the event monitored during the execution of the tracking code in the installation package to be detected;

[0209] The method also includes:

[0210] After obtaining the detection result of this time, if there are a specified number of detection results indicating tampering in the historical detection results corresponding to the pre-recorded account identifier and the detection result of this time, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; wherein the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the history.

[0211] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0212] Optionally, in one embodiment, as Figure 5 As shown, an embodiment of the present invention further provides an installation package detection method, which is applied to a terminal device of a detection system. The detection system also includes a detection device. The terminal device has an application installed based on the installation package to be detected. The method includes steps S501-S502.

[0213] S501, obtaining data to be verified based on the files in the installation directory of the application.

[0214] The data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a designated file in the installation package to be detected; and the designated file of an installation package includes an executable file.

[0215] S502, sending the data to be verified to the detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with.

[0216] The reference data refers to the data contained in the specified file in the installation package.

[0217] It can be understood that the specific implementation of this embodiment can refer to the embodiment of the above-mentioned detection system, and will not be repeated here.

[0218] Optionally, the data to be verified further includes: second sub-data to be verified representing the installation package identifier;

[0219] Send the data to be verified to the testing equipment, including:

[0220] The data to be verified is sent to the detection device, so that after the detection device receives the data to be verified sent by the terminal device, if the second sub-data to be verified exists in the pre-recorded installation package identifier, the data contained in the specified file in the installation package represented by the pre-recorded second sub-data to be verified is obtained as reference data; wherein the pre-recorded installation package identifier represents the online installation package; determine whether the pre-recorded reference data matches the first sub-data to be verified, and obtain a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is the data contained in the specified file in the installation package.

[0221] Optionally, obtain the data to be verified based on the files in the application's installation directory, including:

[0222] Get the configuration file and specified file in the application's installation directory;

[0223] Encrypting the data contained in the specified file based on the first encryption algorithm to obtain first sub-data to be verified in the data to be verified;

[0224] The data representing the installation package identifier recorded in the configuration file is extracted as the second sub-data to be verified in the data to be verified.

[0225] Optionally, before encrypting the data contained in the designated file based on the first encryption algorithm to obtain the first sub-data to be verified in the data to be verified, the method further includes:

[0226] Encrypting the data contained in the specified file according to the second encryption algorithm to obtain an encryption result;

[0227] Extract the data at the specified position in the encryption result to obtain the key to be used;

[0228] Encrypting data contained in a specified file based on a first encryption algorithm to obtain first sub-data to be verified in the data to be verified includes:

[0229] The data contained in the designated file is encrypted according to the first encryption algorithm and the obtained key to be used, so as to obtain first sub-data to be verified in the data to be verified.

[0230] Optionally, obtain the data to be verified based on the files in the application's installation directory, including:

[0231] When a specified event is detected, the current data to be verified is obtained based on the files in the application's installation directory; wherein the specified event is: the event monitored during the execution of the embedded code in the installation package to be detected.

[0232] Optionally, when a specified event is detected, before obtaining the current data to be verified based on the files in the installation directory of the application, the method further includes:

[0233] Get the account ID of the account that logged into the terminal device when the specified event was detected;

[0234] When a specified event is detected, the current data to be verified is obtained based on the files in the application's installation directory, including:

[0235] When a specified event is detected, the data to be verified is obtained based on the files in the application's installation directory and the obtained account identifier;

[0236] Send the data to be verified to the testing equipment, including:

[0237] Sending data to be verified to a detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package; after obtaining the current detection result, if there are a specified number of detection results indicating tampering in the historical detection results corresponding to the pre-recorded account identifier and the current detection result, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past;

[0238] The method also includes: if an alarm message sent by the detection device is received, the alarm message is displayed on a display page of the terminal device.

[0239] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0240] The embodiment of the present invention further provides an installation package detection device, which is applied to a detection device in a detection system, wherein the detection system further includes a terminal device, and the terminal device has an application installed based on the installation package to be detected; Figure 6 As shown, the device includes:

[0241] A first receiving module 610 is configured to receive data to be verified sent by the terminal device; wherein the data to be verified is obtained by the terminal device based on files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0242] A first acquisition module 620 is configured to acquire pre-recorded reference data, wherein the reference data is data contained in a specified file in an online installation package;

[0243] The judgment module 630 is configured to judge whether the reference data matches the first sub-data to be checked, and obtain a detection result indicating whether the installation package to be checked has been tampered with.

[0244] Optionally, the data to be verified further includes: second sub-data to be verified representing an installation package identifier;

[0245] The first acquisition module 620 is specifically used to obtain, from the data contained in the specified file in the pre-recorded online installation package, the data contained in the specified file in the installation package represented by the second sub-data to be verified, as reference data if the second sub-data to be verified exists in the installation package identifier of the pre-recorded online installation package; wherein the pre-recorded installation package identifier represents the online installation package.

[0246] Optionally, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm;

[0247] The judgment module 630 includes:

[0248] a decryption unit, configured to decrypt the first sub-data to be verified based on the first encryption algorithm to obtain decrypted data;

[0249] The determining unit is configured to determine that the detection result of the installation package to be detected is not tampered with if the decrypted data is consistent with the reference data; otherwise, determine that the detection result of the installation package to be detected is tampered with.

[0250] Optionally, the first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package based on a first encryption algorithm and a key to be used; the key to be used is: data at a specified position in an encryption result obtained by encrypting data contained in a specified file in the installation package based on a second encryption algorithm;

[0251] The device further comprises:

[0252] A third acquisition module is used to obtain the key to be used;

[0253] The decryption unit is specifically configured to decrypt the first sub-data to be verified based on the first encryption algorithm and the obtained key to be used to obtain decrypted data.

[0254] Optionally, the device further includes:

[0255] The determining module is configured to determine that the detection result of the installation package to be detected is tampered if the second sub-data to be verified does not exist in the pre-recorded installation package identifier.

[0256] Optionally, the data to be verified is sent by the terminal device when a specified event is detected this time; the data to be verified also includes: an account identifier of an account logged into the terminal device when the specified event is detected this time; the specified event is: an event monitored during the execution of the embedded code in the installation package to be detected;

[0257] The device further comprises:

[0258] A penalty module is used to, after obtaining the current detection result, send an alarm message to the terminal device, and / or send a deactivation instruction to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the current detection result; wherein the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on data sent by the terminal device when a specified event was detected in the past.

[0259] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is untampered data and can be used as a standard for checking whether the installation package has been tampered with. According to whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0260] The embodiment of the present invention further provides an installation package detection device, which is applied to a terminal device of a detection system, wherein the detection system further comprises a detection device, and the terminal device has an application installed based on the installation package to be detected; Figure 7 As shown, the device includes:

[0261] The second acquisition module 710 is configured to acquire data to be verified based on files in the installation directory of the application; wherein the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file;

[0262] The sending module 720 is used to send the data to be verified to the detection device, so that the detection device can determine whether the pre-recorded reference data matches the first sub-data to be verified after receiving the data to be verified sent by the terminal device, and obtain a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is the data contained in the specified file in the installation package.

[0263] Optionally, the data to be verified further includes: second sub-data to be verified representing an installation package identifier;

[0264] The sending module 720 includes:

[0265] A sending unit, used for sending the data to be verified to the detection device, so that after the detection device receives the data to be verified sent by the terminal device, if the second sub-data to be verified exists in the pre-recorded installation package identifier, the detection device obtains the data contained in the specified file in the installation package represented by the pre-recorded second sub-data to be verified as reference data; wherein the pre-recorded installation package identifier represents an online installation package; and determines whether the pre-recorded reference data matches the first sub-data to be verified, to obtain a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is the data contained in the specified file in the installation package.

[0266] Optionally, the second obtaining module 710 includes:

[0267] An acquisition unit, configured to acquire a configuration file and a specified file in the installation directory of the application;

[0268] an encryption unit, configured to encrypt the data contained in the designated file based on a first encryption algorithm to obtain first sub-data to be verified in the data to be verified;

[0269] The extraction unit is configured to extract the data representing the installation package identifier recorded in the configuration file as the second sub-data to be verified in the data to be verified.

[0270] Optionally, the device further includes:

[0271] an encryption module, configured to encrypt the data contained in the designated file according to a second encryption algorithm to obtain an encryption result;

[0272] An extraction module, configured to extract data at a specified position in the encryption result to obtain a key to be used;

[0273] The encryption unit is specifically configured to encrypt the data contained in the designated file according to the first encryption algorithm and the obtained key to be used, to obtain first sub-data to be verified in the data to be verified.

[0274] Optionally, the second acquisition module 710 is specifically used to obtain the current data to be verified based on the files in the installation directory of the application when a specified event is detected; wherein, the specified event is: an event monitored during the execution of the embedded code in the installation package to be detected.

[0275] Optionally, the device further includes:

[0276] A fourth acquisition module is used to obtain the account identifier of the account that logged into the terminal device when the specified event is detected this time;

[0277] The second acquisition module 710 is specifically configured to obtain the data to be verified based on the files in the installation directory of the application and the obtained account identifier when a specified event is detected;

[0278] The sending module 720 is specifically configured to send the data to be verified to the detection device, so that the detection device, after receiving the data to be verified sent by the terminal device, determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package; after obtaining the current detection result, if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the current detection result, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; the historical detection result corresponding to the account identifier is obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past;

[0279] The apparatus further includes: a display module configured to display the alarm information on a display page of the terminal device upon receiving the alarm information sent by the detection device.

[0280] In an embodiment of the present invention, a designated file of an installation package includes an executable file, and the executable file is used to implement the operation of an application. Different applications have different functions, and the executable file of each installation package is different. That is to say, for each online installation package, the designated file containing the executable file in the installation package is unique. Generally speaking, in order to modify the function of an application, a malicious actor will modify the file in the installation package that implements the operation of the application, that is, tamper with the executable file. In an embodiment of the present invention, since the reference data is the data contained in the designated file in the online installation package, and the designated file containing the executable file is unique, the pre-recorded reference data is data that has not been tampered with, and can be used as a standard for checking whether the installation package has been tampered with. By judging whether the reference data matches the first sub-data to be checked, a detection result of whether the installation package to be detected has been tampered with can be obtained to detect whether the installation package has been tampered with.

[0281] The embodiment of the present invention further provides an electronic device, such as Figure 8As shown, it includes a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802, and the memory 803 communicate with each other through the communication bus 804.

[0282] Memory 803, used for storing computer programs;

[0283] The processor 801 is configured to implement the above-mentioned installation package detection method when executing the program stored in the memory 803 .

[0284] The communication bus mentioned in the terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0285] The communication interface is used for communication between the above terminal and other devices.

[0286] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0287] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0288] In another embodiment of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium. When the computer program is executed by a processor, the installation package detection method described in any one of the above embodiments is implemented.

[0289] In another embodiment of the present invention, a computer program product including instructions is provided. When the computer program product is run on a computer, the computer executes the installation package detection method described in any one of the above embodiments.

[0290] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0291] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0292] Each embodiment in this specification is described in a related manner. Similar portions between embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, the method and apparatus embodiments are generally similar to the system embodiments, so their descriptions are relatively simplified. For related portions, reference can be made to the system embodiments.

[0293] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.

Claims

1. A method for detecting an installation package, characterized in that: A detection device used in a detection system, wherein the detection system further includes a terminal device, wherein the terminal device has an application installed based on the installation package to be detected; the method includes: Receiving data to be verified sent by the terminal device; wherein the data to be verified is obtained by the terminal device based on files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file; Obtain pre-recorded reference data; wherein the reference data is data contained in a specified file in an online installation package; It is determined whether the reference data matches the first sub-data to be checked, and a detection result indicating whether the installation package to be detected has been tampered with is obtained.

2. The method according to claim 1, characterized in that The data to be verified further includes: second sub-data to be verified representing the installation package identifier; The obtaining of pre-recorded reference data includes: If the second sub-data to be verified exists in the installation package identifier of the pre-recorded online installation package, then the data contained in the specified file in the installation package represented by the second sub-data to be verified is obtained from the data contained in the specified file in the pre-recorded online installation package as reference data; wherein the pre-recorded installation package identifier represents the online installation package.

3. The method according to claim 1, characterized in that The first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using a first encryption algorithm; The determining whether the reference data matches the first sub-data to be checked, and obtaining a detection result indicating whether the installation package to be checked has been tampered with, includes: Decrypting the first sub-data to be verified based on the first encryption algorithm to obtain decrypted data; If the decrypted data is consistent with the reference data, it is determined that the detection result of the installation package to be detected is not tampered with; otherwise, it is determined that the detection result of the installation package to be detected is tampered with.

4. The method according to claim 3, characterized in that The first sub-data to be verified represents: ciphertext obtained by encrypting data contained in a specified file in the installation package using the first encryption algorithm and the key to be used; the key to be used is: data at a specified position in an encryption result obtained by encrypting data contained in the specified file in the installation package using the second encryption algorithm; Before decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data, the method further includes: Obtain the key to be used; The decrypting the first sub-data to be checked based on the first encryption algorithm to obtain decrypted data includes: The first sub-data to be verified is decrypted based on the first encryption algorithm and the obtained key to be used to obtain decrypted data.

5. The method according to claim 2, characterized in that The method further comprises: If the second sub-data to be verified does not exist in the pre-recorded installation package identifier, it is determined that the detection result of the installation package to be detected is tampered.

6. The method according to claim 1, characterized in that The data to be verified is sent by the terminal device when the specified event is detected this time; The data to be verified also includes: the account identifier of the account logged into the terminal device when the specified event is detected this time; the specified event is: the event monitored during the execution of the embedded code in the installation package to be detected; The method further comprises: After obtaining the detection result of this time, if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the detection result of this time, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; wherein the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past.

7. A method for detecting an installation package, characterized in that: A terminal device applied to a detection system, the detection system further comprising a detection device, the terminal device having an application installed based on an installation package to be detected, the method comprising: Based on the files in the installation directory of the application, data to be verified is obtained; wherein the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file; The data to be verified is sent to the detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package.

8. The method according to claim 7, characterized in that The data to be verified further includes: second sub-data to be verified representing the installation package identifier; The sending the data to be verified to the detection device includes: The data to be verified is sent to the detection device, so that after the detection device receives the data to be verified sent by the terminal device, if the second sub-data to be verified exists in the pre-recorded installation package identifier, the data contained in the specified file in the installation package represented by the pre-recorded second sub-data to be verified is obtained as reference data; wherein, the pre-recorded installation package identifier represents an online installation package; determine whether the pre-recorded reference data matches the first sub-data to be verified, and obtain a detection result indicating whether the installation package to be detected has been tampered with; wherein, the reference data is the data contained in the specified file in the installation package.

9. The method according to claim 7, characterized in that The step of obtaining the data to be verified based on the files in the installation directory of the application comprises: Obtain the configuration file and the specified file in the installation directory of the application; Encrypting the data contained in the designated file based on a first encryption algorithm to obtain first sub-data to be verified in the data to be verified; The data representing the installation package identifier recorded in the configuration file is extracted as the second sub-data to be verified in the data to be verified.

10. The method according to claim 9, characterized in that Before encrypting the data contained in the designated file based on the first encryption algorithm to obtain the first sub-data to be verified in the data to be verified, the method further includes: Encrypting the data contained in the designated file according to a second encryption algorithm to obtain an encryption result; Extracting data at a specified position in the encryption result to obtain a key to be used; The step of encrypting the data contained in the designated file based on the first encryption algorithm to obtain first sub-data to be verified in the data to be verified includes: The data contained in the designated file is encrypted according to the first encryption algorithm and the obtained key to be used, so as to obtain first sub-data to be verified in the data to be verified.

11. The method according to claim 7, characterized in that The step of obtaining the data to be verified based on the files in the installation directory of the application comprises: When a specified event is detected, the current data to be verified is obtained based on the files in the installation directory of the application; wherein the specified event is: an event monitored during the execution of the embedded code in the installation package to be detected.

12. The method according to claim 11, characterized in that Before acquiring the current data to be verified based on the files in the installation directory of the application when the specified event is detected, the method further includes: Obtaining the account identifier of the account that logged into the terminal device when the specified event was detected; When a specified event is detected, obtaining the current data to be verified based on the files in the installation directory of the application includes: When a specified event is detected, the data to be verified is obtained based on the files in the installation directory of the application and the obtained account identifier; The sending the data to be verified to the detection device includes: Sending data to be verified to the detection device, so that the detection device, after receiving the data to be verified sent by the terminal device, determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein the reference data is data contained in a specified file in the installation package; after obtaining the current detection result, if there are a specified number of detection results indicating tampering in the pre-recorded historical detection results corresponding to the account identifier and the current detection result, an alarm message is sent to the terminal device, and / or a deactivation instruction is sent to the server providing the specified service, so that the server deactivates the specified service for the account represented by the account identifier; the historical detection result corresponding to the account identifier is: obtained by performing installation package detection on the data sent by the terminal device when a specified event was detected in the past; The method further includes: if alarm information sent by the detection device is received, displaying the alarm information on a display page of the terminal device.

13. An installation package detection system, characterized in that: The system includes a detection device and a terminal device; wherein: The detection device is used to perform the method according to any one of claims 1 to 6 above; The terminal device is used to execute the method described in any one of claims 7 to 12.

14. An installation package detection device, characterized in that: A detection device used in a detection system, wherein the detection system further includes a terminal device, wherein the terminal device has an application installed based on an installation package to be detected; the device includes: a first receiving module, configured to receive data to be verified sent by the terminal device; wherein the data to be verified is obtained by the terminal device based on files in the installation directory of the application, and the data to be verified includes: first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file; A first acquisition module is configured to acquire pre-recorded reference data, wherein the reference data is data contained in a specified file in an online installation package; The judgment module is used to judge whether the reference data matches the first sub-data to be checked, and obtain a detection result indicating whether the installation package to be detected has been tampered with.

15. An installation package detection device, characterized in that: A terminal device applied to a detection system, wherein the detection system further includes a detection device, wherein the terminal device has an application installed based on an installation package to be detected, and the apparatus includes: a second acquisition module, configured to acquire data to be verified based on files in the installation directory of the application; wherein the data to be verified includes first sub-data to be verified; the first sub-data to be verified represents data contained in a specified file in the installation package to be detected; the specified file of an installation package includes an executable file; A sending module is used to send the data to be verified to the detection device, so that after receiving the data to be verified sent by the terminal device, the detection device determines whether the pre-recorded reference data matches the first sub-data to be verified, and obtains a detection result indicating whether the installation package to be detected has been tampered with; wherein, the reference data is data contained in a specified file in the installation package.

16. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method according to any one of claims 1 to 12 when executing a program stored in a memory.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

18. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 12 when executed by a processor.

Images