Mobile device application permission intelligent dynamic management method and system

Abstract

The invention relates to the technical field of mobile terminal application permission management, and particularly discloses an intelligent dynamic management method and system for application permission of mobile equipment. The method comprises the steps of collecting application operation behavior data in real time; constructing a permission dependency graph, and endowing a weight coefficient to the path; when the permission change request is responded, analyzing direct and indirect dependence paths of the target permission in the atlas; calculating the outage probability of permission change according to the path weight; and when the outage probability exceeds a threshold value, dynamically generating an alternative data flow path containing a transfer interface and an authority agent node, and maintaining the continuity of the service data flow. The corresponding system comprises a data acquisition module, a map construction module, a path analysis module, a probability calculation module, a path generation module and an execution module. According to the method, the problem of systematic service interruption caused by lack of static rules and dependency relationships in the prior art is solved by quantifying the authority change risk, identifying the implicit data association relationship and dynamically generating the localized substitution data flow path, and intelligent authority management of resource optimization is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of mobile terminal application permission management, and specifically to a method and system for intelligently and dynamically managing application permissions on mobile devices. By constructing an application permission dependency graph, predicting permission change risks and generating alternative data flow paths, the risk of systemic service interruption during dynamic permission adjustment is minimized. Background Art

[0002] As the functions of mobile device applications become increasingly complex and the dependencies between applications become closer, traditional permission management methods often lead to abnormal application functions or system service interruptions after permission changes.

[0003] Existing mobile device app permission management primarily relies on simple, rule-based controls, focusing only on the direct relationship between apps and permissions while ignoring the implicit dependencies between apps. When a permission for an app changes, the system is unable to fully assess the impact of the change on other apps that rely on that permission, leading to a chain reaction of systemic service interruptions.

[0004] Furthermore, existing technologies often employ an "all-or-nothing" approach to permission management, lacking a quantitative assessment of the disruption risks associated with permission changes and unable to predict the scope and severity of impacts before a permission change occurs. Furthermore, mobile device application usage patterns and dependencies change over time, and existing permission management methods are often based on static rules, unable to dynamically adjust permission policies based on real-time behavior.

[0005] Taking the Android system as an example, its permission management primarily relies on PermissionManagerService and AppOpsService. These services record application permission status and operation history, but lack the ability to analyze permission dependencies and a dynamic path adjustment mechanism. When a user revokes an application's permissions, the system simply blocks the application from accessing related resources without considering the impact of the permission change on other applications. There is also no mechanism to maintain business continuity after the permission change.

[0006] Therefore, a method and system for intelligent dynamic management of application permissions of mobile devices are proposed to address the current deficiencies. Summary of the Invention

[0007] The purpose of the present invention is to solve the problem of systematic service interruption caused by dynamic adjustment of permissions in existing mobile device application permission management methods, and to provide a method and system that can intelligently and dynamically manage application permissions. By constructing an application permission dependency graph, it predicts the risk of permission changes and generates alternative data flow paths to ensure the continuity of application business data flow.

[0008] The technical problem to be solved by the present invention is to overcome the defects of the above-mentioned technologies and provide a method and system for intelligent dynamic management of application permissions of mobile devices.

[0009] To solve the above technical problems, the present invention provides a method for intelligent dynamic management of application permissions of mobile devices, comprising the following steps:

[0010] S1. Real-time collection of operational behavior data of applications on mobile devices, including the frequency of application interface calls, call sequence, resource access path, and data flow direction;

[0011] S2. Constructing a permission dependency graph based on the operation behavior data, wherein the permission dependency graph includes application nodes, interface nodes, resource nodes, and data flow relationships between the nodes;

[0012] S3. When an application permission change request is detected, analyzing the direct dependency path and the indirect dependency path related to the target permission in the permission dependency graph;

[0013] S4. Calculate, based on the weight coefficients of the direct dependency path and the indirect dependency path, the probability of interruption of the path due to the permission change;

[0014] S5. When the interruption probability exceeds a preset threshold, dynamically generate an alternative data flow path, wherein the alternative data flow path includes a transit interface and an authority proxy node;

[0015] S6. Maintain the continuity of application business data flow through the alternative data flow path to avoid systemic service interruption caused by permission change.

[0016] As an improvement, the method for collecting operation behavior data in real time in step S1 includes:

[0017] S1.1. Intercepting the application's interface call request through the system layer of the mobile device;

[0018] S1.2. Record the source application, calling interface, accessed resource, and call sequence of the interface call request;

[0019] S1.3. Structurally process the recorded operation behavior data and store them in a local database of the mobile device.

[0020] As an improvement, the method for constructing the permission dependency graph in step S2 is:

[0021] S2.1. Standardize the operational behavior data and extract interaction features between applications, interfaces, and resources;

[0022] S2.2. Constructing a topological structure of the permission dependency graph using the interaction features, wherein the topological structure includes explicit call relationships and implicit data association relationships;

[0023] S2.3. Assign a weight coefficient to each path in the permission dependency graph, where the weight coefficient is calculated based on the historical usage frequency and real-time activity of the operation behavior data.

[0024] As an improvement, the calculation formula of the weight coefficient is:

[0025] W=α·f his +β·f real

[0026] Where W is the weight coefficient; f his is the historical usage frequency; f real is the real-time activity; α and β are preset weight parameters, and satisfy α+β=1, where α≥0.6.

[0027] As an improvement, the method for analyzing the permission dependency graph in step S3 includes:

[0028] S3.1. Identify direct call relationships related to the target permission in the permission dependency graph;

[0029] S3.2. Identify an indirect dependency path related to the target permission in the permission dependency graph through the implicit data association relationship;

[0030] S3.3. Generate the weight coefficients for the direct dependency path and the indirect dependency path.

[0031] As an improvement, the calculation formula for the interruption probability in step S4 is:

[0032] P int =∑(w i ·p i )

[0033] Among them, P int represents the interruption probability, w i represents the weight coefficient of path i, p i Indicates the probability that path i will be interrupted due to permission change.

[0034] As an improvement, the method for dynamically generating an alternative data flow path in step S5 includes:

[0035] S5.1. Identify alternative data flow paths in the permission dependency graph based on the topology of the direct dependency paths and the indirect dependency paths;

[0036] S5.2. Calculate a priority score for the alternative data flow path, the priority score being based on an interruption probability, resource consumption, and response time of the alternative data flow path;

[0037] S5.3. Select the path with the highest priority score as the alternative data flow path.

[0038] As an improvement, the calculation formula of the priority score is:

[0039] S p =γ·(1-P int )+δ·(1-e con )+η·(1-t res )

[0040] Among them, S p represents the priority score, P int represents the interruption probability of the alternative data flow path, e con represents the resource consumption rate of the alternative data flow path, t res represents the response time of the alternative data flow path, and γ, δ, and η are preset weight parameters.

[0041] As an improvement, the method for maintaining the consistency of the application service data flow in step S6 includes:

[0042] S6.1. Insert a permission proxy node into the alternative data flow path, where the permission proxy node is responsible for verifying the permission status of the application.

[0043] S6.2. Dynamically monitor the alternative data flow path through the authority proxy node. When an abnormality is detected in the alternative data flow path, recalculate the priority score and select a new alternative data flow path.

[0044] The present invention also provides a system based on the method for intelligent dynamic management of mobile device application permissions, comprising:

[0045] A data collection module, configured to collect operation behavior data of applications on the mobile device in real time;

[0046] A graph construction module, configured to construct the permission dependency graph based on the operation behavior data;

[0047] A path analysis module, configured to analyze direct dependency paths and indirect dependency paths related to the target permission in the permission dependency graph;

[0048] A probability calculation module, configured to calculate a probability of interruption of the path caused by the permission change;

[0049] a path generation module, configured to dynamically generate the alternative data flow path when the interruption probability exceeds a preset threshold;

[0050] A path execution module is used to maintain the continuity of the application business data flow through the alternative data flow path.

[0051] The advantages of the present invention compared with the prior art are:

[0052] 1. Solve the problem of systemic service interruption: By building a permission dependency graph that includes explicit call relationships and implicit data association relationships, the impact scope of permission changes can be fully identified to avoid chain reaction service interruptions caused by permission changes.

[0053] 2. Dynamically adjust paths: When permission changes may cause service interruption, the system can dynamically generate alternative data flow paths to maintain the continuity of application business data flow and ensure that the user service experience is not affected.

[0054] 3. Intelligent risk prediction: Through the weight coefficient mechanism and interruption probability calculation, the risk of permission change is quantified to achieve intelligent risk prediction and path selection.

[0055] 4. Localized processing: All data collection, graph construction, and path analysis are completed locally on the mobile device, without relying on server-side computing, reducing system latency and privacy risks.

[0056] 5. Resource optimization: The multi-objective priority scoring model comprehensively considers the interruption probability, resource consumption and response time, selects the optimal alternative data flow path, and improves system resource utilization.

[0057] 6. Adapt to dynamic scenarios: The system can dynamically adjust permission policies and path selection based on real-time behavior to adapt to changes in mobile device application usage patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a system architecture diagram of a method and system for intelligent dynamic management of application permissions of mobile devices according to the present invention.

[0059] Figure 2 This is an example diagram of a permission dependency graph of a method and system for intelligent dynamic management of application permissions on mobile devices according to the present invention.

[0060] Figure 3 This is a weight calculation flow chart of a method and system for intelligent dynamic management of application permissions of mobile devices of the present invention.

[0061] Figure 4 The present invention discloses a method and system for intelligent dynamic management of mobile device application permissions and a dynamic path generation flow chart. DETAILED DESCRIPTION

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the invention more clear, the technical solutions in the embodiments of the invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the invention. Obviously, the described embodiments are only part of the embodiments of the invention, not all of the embodiments. Generally, the components of the embodiments of the invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0063] In the description of the embodiments of the invention, it should be noted that if the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," "outer," etc. appear, the orientations or positional relationships indicated are based on the orientations or positional relationships shown in the accompanying drawings, or are the orientations or positional relationships in which the inventive product is typically placed when in use. These terms are intended solely to facilitate the description of the invention and simplify the description, and do not indicate or imply that the device or component referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," "third," etc. are used solely to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0064] Furthermore, the use of terms such as "horizontal," "vertical," and "overhanging" does not necessarily imply that the component must be absolutely horizontal or overhanging, but rather that it can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal than "vertical," not that the structure must be completely horizontal, but rather that it can be slightly tilted.

[0065] In the description of the embodiments of the invention, "a plurality" means at least two.

[0066] In the description of the embodiments of the invention, it should also be noted that, unless otherwise expressly specified or limited, the terms "disposed," "installed," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to internal connections between two components. Those skilled in the art will understand the specific meanings of the above terms in the invention based on specific circumstances.

[0067] Example 1:

[0068] As shown in the accompanying drawings, a method for intelligent dynamic management of application permissions of a mobile device includes the following steps:

[0069] S1. Real-time collection of operational behavior data of applications on mobile devices, including the frequency of application interface calls, call sequence, resource access path, and data flow direction;

[0070] Specifically, the method for collecting operation behavior data in real time includes:

[0071] S1.1. Intercepting the application's interface call request through the system layer of the mobile device;

[0072] S1.2. Record the source application, calling interface, accessed resource, and call sequence of the interface call request;

[0073] S1.3. Structurally process the recorded operation behavior data and store them in a local database of the mobile device.

[0074] In the Android system, applications access resources and functions by calling system APIs. To capture these calls, the LSPosed framework is used to implement system-level API interception. The specific implementation steps are as follows:

[0075] API interception point selection: Select key system APIs as interception points. These APIs are the main entry points for applications to access system resources. For example, camera permission-related APIs include CameraManager.openCamera() and CameraDevice.open(), and storage permission-related APIs include Context.getFilesDir() and Context external storage access.

[0076] API interception implementation: Use LSPosed's findAndHookMethod function to intercept API calls and record the caller application, target interface, and timestamp;

[0077] Data structuring: Convert the collected raw data into a structured format, including the following fields:

[0078] Call application ID (package_name);

[0079] Called interface / permission (permission_name);

[0080] The resource path to be accessed (resource_path);

[0081] Call timestamp(timestamp);

[0082] Call result (authorization / rejection, result);

[0083] Local storage: Stores processed data in a local SQLite database on the mobile device to prevent private data from being uploaded to the server.

[0084] By collecting application operation behaviors in real time, we provide basic data for the subsequent construction of permission dependency graphs. All data is stored locally, meeting privacy protection requirements.

[0085] S2. Constructing a permission dependency graph based on the operation behavior data, wherein the permission dependency graph includes application nodes, interface nodes, resource nodes, and data flow relationships between the nodes;

[0086] Specifically, the method for constructing the permission dependency graph is as follows:

[0087] S2.1. Standardize the operational behavior data and extract interaction features between applications, interfaces, and resources;

[0088] S2.2. Constructing a topological structure of the permission dependency graph using the interaction features, wherein the topological structure includes explicit call relationships and implicit data association relationships;

[0089] S2.2.1. Extraction rules for implicit data association relationships:

[0090] By analyzing the read and write behavior of resource access paths, implicit associations between applications can be identified. The specific rules are as follows:

[0091] If two applications perform read and write operations on the same path within 5 minutes, an implicit association edge is established;

[0092] The deeper the shared path level, the weight coefficient decays by 0.1 / level;

[0093] If the shared path involves sensitive data (such as / data / shared / contacts / ), the weight coefficient is increased by 0.15.

[0094] S2.2.2 Modeling of implicit association relationships:

[0095] Implicit association edges connect application nodes with resource nodes as intermediaries and dynamically adjust weight coefficients.

[0096] S2.3. Assign a weight coefficient to each path in the permission dependency graph, where the weight coefficient is calculated based on the historical usage frequency and real-time activity of the operation behavior data.

[0097] Furthermore, the calculation formula of the weight coefficient is:

[0098] W=α·f his +β·f real

[0099] Where W is the weight coefficient; f his is the historical usage frequency; f realis the real-time activity; α and β are preset weight parameters, and satisfy α+β=1, where α≥0.6.

[0100] In this calculation formula, the principles for selecting the values ​​of α and β are:

[0101] Importance of historical usage frequency: The historical usage frequency of an application or interface reflects a long-term stable behavior pattern, has a greater impact on the path weight, and is given a high weight.

[0102] Dynamic adjustment of real-time activity: Real-time activity reflects the changing trend of current user behavior and needs to be dynamically adjusted to adapt to short-term needs.

[0103] In specific implementation, a permission dependency graph containing explicit call relationships and implicit data association relationships is constructed based on the collected operation behavior data:

[0104] Explicit call relationship extraction: Extract the direct call relationship between applications and interfaces / permissions from the permission_actions table. For example, if application A calls the camera interface and application B calls the storage permission, these direct relationships form edges in the graph.

[0105] Implicit data association analysis: By analyzing the resource access paths in the file_access_actions table, we can identify implicit data associations between applications. For example, if application A reads a file stored in the / data / shared / wx_files / path, and application B writes to the same file, there is an implicit data association between the two.

[0106] Graph topology construction: Use adjacency lists to represent graphs, including the following node types:

[0107] Application node: represents an application on a mobile device. The node ID is the application package name (e.g., com.tencent.mm represents WeChat).

[0108] Interface / Permission node: represents the permissions provided by the system, such as CAMERA and WRITE_EXTERNAL_STORAGE.

[0109] Resource node: represents the resource path accessed by the application, such as / data / shared / images / ;

[0110] Edge types include:

[0111] Explicit call edge: From an application node to an interface / permission node, it indicates that the application directly calls the permission.

[0112] Implicit association edges: from application nodes to resource nodes to other application nodes, indicating that an application indirectly depends on the permissions of other applications through shared resources.

[0113] Weight coefficient calculation: Calculate the weight coefficient W for each path based on the historical usage frequency f his and real-time activity f real :

[0114] Among them, α = 0.7, β = 0.3 (α ≥ 0.6), ensuring that the weight coefficient reflects historical usage habits more and takes current activity into account.

[0115] Historical usage frequency: calculates the ratio of the number of times the path was called to the total number of calls in the past 24 hours;

[0116] Real-time activity: uses an exponential decay model to calculate the activity of the path being called in the past 5 minutes;

[0117] Graph update mechanism: Update the graph regularly (e.g., every hour), adjust the weights of nodes and edges based on new operational behavior data, and ensure that the graph reflects the latest application behavior patterns.

[0118] By constructing a complete permission dependency graph containing explicit calls and implicit associations, a topological structure foundation is provided for subsequent interruption probability prediction and path generation. The adjacency list storage method exhibits good storage efficiency and query performance on mobile devices.

[0119] S3. When an application permission change request is detected, analyzing the direct dependency path and the indirect dependency path related to the target permission in the permission dependency graph;

[0120] Specifically, the methods for analyzing the permission dependency graph include:

[0121] S3.1. Identify direct call relationships related to the target permission in the permission dependency graph;

[0122] S3.2. Identify an indirect dependency path related to the target permission in the permission dependency graph through the implicit data association relationship;

[0123] S3.3. Generate the weight coefficients for the direct dependency path and the indirect dependency path.

[0124] S4. Calculate, based on the weight coefficients of the direct dependency path and the indirect dependency path, the probability of interruption of the path due to the permission change;

[0125] Weight coefficient w i Dynamic adjustment:

[0126] Weight coefficient w i It is not only calculated based on historical usage frequency and real-time activity, but also needs to be dynamically adjusted based on the specific type of permission change (such as direct dependency permissions or indirect dependency permissions).

[0127] Direct dependency permissions: If the path involves directly calling the target permission (such as application A directly calling the storage permission), the weight coefficient w i The historical usage frequency weight α increases (e.g., α = 0.8), reflecting the direct impact of the permission change on the path.

[0128] Indirect dependency permissions: If the path depends on the target permission through implicit association (for example, application A indirectly depends on storage permissions through file sharing), the weight coefficient w i The real-time activity weight β increases (e.g., β = 0.7), reflecting the dynamic impact of permission changes on indirect paths.

[0129] Dynamic adjustment mechanism: When a permission change is detected, the system recalculates α and β according to the permission change type (direct / indirect) and updates the weight coefficient w i , thereby more accurately reflecting the impact of permission changes on paths.

[0130] Specifically, the calculation formula for the interruption probability is:

[0131] P int =∑(w i ·p i )

[0132] Among them, P int represents the interruption probability, w i represents the weight coefficient of path i, p i Indicates the probability that path i will be interrupted due to permission change.

[0133] Interruption probability p i The assignment rules are:

[0134] Interruption probability p i The value of needs to be refined according to the permission change type and path dependency level:

[0135] Directly dependent path: If the permission change directly affects the path (such as the target permission is revoked), then p i =1.

[0136] Indirect dependency path: If the permission change affects the path through implicit association (such as the target permission is revoked, resulting in the shared resource being unavailable), then p i Dynamically assign values ​​based on the path's dependency hierarchy:

[0137] First-level indirect dependency (e.g., through an intermediate resource node) i =0.7;

[0138] Secondary indirect dependency (e.g. through two intermediate resource nodes): p i =0.4.

[0139] Dynamic adjustment: If the permission change involves highly sensitive permissions (such as camera, location), then p i An additional 0.1 is added to reflect the potential risk of highly sensitive permission changes.

[0140] In specific implementation, the interruption probability that may be caused by permission changes is predicted based on the permission dependency graph.

[0141] When an application permission change request is detected (for example, the user revokes storage permissions for an application), the following steps are performed:

[0142] Target permission identification: Determine the permissions that the user is requesting to change (such as READ_EXTERNAL_STORAGE).

[0143] Dependency path analysis: In the permission dependency graph, identify all direct and indirect dependency paths related to the permission:

[0144] Direct dependency path: The path where the application directly calls the permission. For example:

[0145] WeChat to READ_EXTERNAL_STORAGE (weight 0.8);

[0146] File Manager to READ_EXTERNAL_STORAGE (weight 0.7);

[0147] Indirect dependency path: The path where the application indirectly depends on the permission through other interfaces or resources. For example:

[0148] Health App to / data / shared / health_data / (weight 0.6) to Shared File Manager to READ_EXTERNAL_STORAGE (weight 0.5);

[0149] Interruption probability assignment: Assign an interruption probability p to each path i :

[0150] Direct dependency path: p i =1 (direct impact of authority change);

[0151] Indirect dependency path: p i =0.5 (assuming that the indirect dependency path has a 50% probability of being affected);

[0152] Calculation of interruption probability: Based on the path weight coefficient w i and the interruption probability p i , calculate the total interruption probability.

[0153] Specific calculation example:

[0154] Assume that the permission change affects the following paths:

[0155] Path 1: WeChat to READ_EXTERNAL_STORAGE (weight 0.8, interruption probability 1), i.e. contribution 0.8×1=0.8;

[0156] Path 2: Health App to shared files to file manager (weight 0.6, interruption probability 0.5), i.e. contribution 0.6 × 0.5 = 0.3;

[0157] Path 3: social media app to camera to network storage (weight 0.7, interruption probability 0.8), i.e. contribution 0.7 × 0.8 = 0.56;

[0158] The total outage probability is:

[0159] P int =0.8+0.3+0.56=1.66

[0160] Threshold judgment: If P int If the value exceeds a preset threshold (such as 0.8), the alternative data flow path generation process is triggered.

[0161] S5. When the interruption probability exceeds a preset threshold, dynamically generate an alternative data flow path, wherein the alternative data flow path includes a transit interface and an authority proxy node;

[0162] Specifically, the method for dynamically generating an alternative data flow path includes:

[0163] S5.1. Identify alternative data flow paths in the permission dependency graph based on the topology of the direct dependency paths and the indirect dependency paths;

[0164] S5.2. Calculate a priority score for the alternative data flow path, the priority score being based on an interruption probability, resource consumption, and response time of the alternative data flow path;

[0165] S5.3. Select the path with the highest priority score as the alternative data flow path.

[0166] Furthermore, the calculation formula of the priority score is:

[0167] S p =γ·(1-P int )+δ·(1-e con )+η·(1-t res )

[0168] Among them, S p represents the priority score, P int represents the interruption probability of the alternative data flow path, e conrepresents the resource consumption rate of the alternative data flow path, t res represents the response time of the alternative data flow path, and γ, δ, and η are preset weight parameters.

[0169] In addition, in the priority scoring formula, the values ​​of γ (interruption probability weight), δ (resource consumption weight), and η (response time weight) in the priority scoring formula are based on the following logic:

[0170] Priority of interruption probability: Interruption probability directly affects the continuity of system services and is therefore given the highest weight.

[0171] Suboptimal weighting of resource consumption: Resource consumption (such as CPU and memory) affects device performance, but the probability of interruption needs to be balanced.

[0172] Secondary weighting of response time: Response time affects user experience but has a lower priority than outage probability and resource consumption.

[0173] In specific implementation, alternative data flow paths are dynamically generated based on the permission dependency graph.

[0174] When the outage probability exceeds the threshold, the following steps are performed:

[0175] Identify alternative data flow paths: In the permission dependency graph, find alternative data flow paths that avoid the target permission. For example, if application A needs to access a file through storage permission, and this permission is revoked, the following alternative data flow paths can be found:

[0176] Path 1: Apply A to the cloud storage interface to the file (avoiding local storage permissions);

[0177] Path 2: Application A to network cache to application B to file (accessed through application B's permissions);

[0178] Priority score calculation: Calculate the priority score S for each alternative data flow path p , based on outage probability, resource consumption, and response time:

[0179] S p =γ·(1-P int )+δ·(1-e con )+η·(1-t res )

[0180] Among them, γ = 0.6, δ = 0.3, η = 0.1, representing the weights of interruption probability, resource consumption and response time.

[0181] Parameter acquisition method:

[0182] Interruption probability P int: Obtained through the above interruption probability calculation model.

[0183] Resource consumption rate e con : Obtain the CPU, memory, and network bandwidth required for path execution through the system monitoring API and calculate the relative consumption rate.

[0184] Response time t res : Measure the time from request to completion by simulating path execution.

[0185] Specific calculation example:

[0186] For path 1 (cloud storage interface):

[0187] Interruption probability P int =0.3;

[0188] Resource consumption rate e con =0.7 (higher due to network transmission);

[0189] Response time t res =0.8 (medium, delay of about 300ms);

[0190] Priority Rating:

[0191] S p =0.6×(1-0.3)+0.3×(1-0.7)+0.1×(1-0.8)=0.42+0.09+0.02=0.53

[0192] For path 2 (network cache):

[0193] Interruption probability P int =0.1;

[0194] Resource consumption rate e con =0.5 (medium, cache management required);

[0195] Response time t res =0.9 (longer, about 500ms delay);

[0196] Priority Rating:

[0197] S p =0.6×(1-0.1)+0.3×(1-0.5)+0.1×(1-0.9)=0.54+0.15+0.01=0.70

[0198] Path search algorithm: Use the improved A* algorithm to search for the optimal alternative data flow path:

[0199] Path selection: The path with the highest s_p is selected as the alternative data flow path. In the above example, path 2 has a higher score and is therefore selected as the alternative data flow path.

[0200] Path Verification: Verify that the selected alternative data flow path meets all necessary permission conditions to ensure that the path is feasible.

[0201] S6. Maintain the continuity of application business data flow through the alternative data flow path to avoid systemic service interruption caused by permission change.

[0202] Specifically, methods for maintaining the consistency of application business data flow include:

[0203] S6.1. Insert a permission proxy node into the alternative data flow path, where the permission proxy node is responsible for verifying the permission status of the application.

[0204] In this embodiment, the specific implementation of the authority proxy node is:

[0205] System layer injection: rewrite the Binder.transact() method based on the Xposed framework and insert proxy logic before the interface call (see Figure 1 Module 5.2);

[0206] Permission verification: The proxy node calls PackageManager.getPackageInfo(packageName,PackageManager.GET_PERMISSIONS) to obtain the real-time permission status;

[0207] Dynamic request: If the permission is not granted, trigger the system native permission pop-up window through transparent Activity (compatible with Android 6.0+);

[0208] Monitoring mechanism: The agent node has a built-in monitoring thread that collects path execution latency (the difference between SystemClock.elapsedRealtime()) and CPU usage (parsed through / proc / stat) every 200ms.

[0209] S6.2. Dynamically monitor the alternative data flow path through the authority proxy node. When the system detects that the alternative data flow path is abnormal, recalculate the priority score and select a new alternative data flow path.

[0210] During specific implementation, the continuity of application business data flow is maintained through alternative data flow paths and dynamic monitoring is performed.

[0211] Proxy node insertion: inserting a permission proxy node into the alternative data flow path to verify the permission status of the application;

[0212] Path execution: Execute application requests through alternative data flow paths to ensure the continuity of business data flow. For example, when WeChat storage permissions are revoked, the system redirects file access requests to the cloud storage interface through a proxy node.

[0213] Dynamic monitoring: The authority proxy node continuously monitors the operating status of the alternative data flow path;

[0214] Record the path execution success rate (such as the number of successful executions in the past 5 minutes);

[0215] Monitor resource consumption (such as CPU usage and memory usage);

[0216] Monitor response time (time from request to completion);

[0217] Specifically, the implementation of dynamic monitoring:

[0218] The proxy node registers a BroadcastReceiver to listen for permission change events (such as ACTION_PACKAGE_CHANGED).

[0219] Periodically poll the permission status (for example, call PackageManager.getApplicationInfo() every 5 minutes).

[0220] When a permission anomaly is detected (e.g., permission is revoked), the priority score of the alternative data flow path is recalculated and the path is switched.

[0221] Exception handling: When an abnormality is detected in the alternative data flow path (such as the success rate is lower than the threshold or the response time is too long), the priority score is recalculated and a new alternative data flow path is selected.

[0222] The present invention also provides a system based on the method for intelligent dynamic management of mobile device application permissions, comprising:

[0223] A data collection module, configured to collect operation behavior data of applications on the mobile device in real time;

[0224] Specifically, the system-level API technology is used to collect application operation behavior data in real time, including interface call frequency, timing, resource access path, etc. The module uses a lightweight design to ensure efficient operation on resource-constrained mobile devices.

[0225] A graph construction module, configured to construct the permission dependency graph based on the operation behavior data;

[0226] Specifically, based on the collected data, a permission dependency graph is constructed, including explicit call relationships and implicit data association relationships, and a weight coefficient is calculated for each path. This module uses an adjacency list data structure to store the graph, reducing memory usage.

[0227] A path analysis module, configured to analyze direct dependency paths and indirect dependency paths related to the target permission in the permission dependency graph;

[0228] A probability calculation module, configured to calculate a probability of interruption of the path caused by the permission change;

[0229] Specifically, the interruption probability of permission changes on dependent paths is calculated based on the weight coefficient and the interruption probability. This module implements fast interruption probability calculation to ensure real-time response when permission changes occur.

[0230] a path generation module, configured to dynamically generate the alternative data flow path when the interruption probability exceeds a preset threshold;

[0231] Specifically, when the interruption probability exceeds a threshold, alternative data flow paths are dynamically generated, and the optimal path is selected using a multi-objective scoring model. This module implements an efficient path search algorithm that can complete path generation in an extremely short time.

[0232] A path execution module is used to maintain the continuity of the application business data flow through the alternative data flow path.

[0233] Specifically, it executes application requests by replacing data flow paths and inserting permission proxy nodes for dynamic monitoring to ensure path validity. This module enables seamless path switching, making path changes almost imperceptible to users.

[0234] Example 2:

[0235] This embodiment describes a specific application case of the present invention in a social media app.

[0236] Scenario description:

[0237] The user revoked the "storage" permission (WRITE_EXTERNAL_STORAGE) of the social media app, but the app needs to store pictures and videos uploaded by the user.

[0238] Data collection: The system recorded that the app called storage permissions 0.15 times in the past 24 hours and 0.2 times in the last 5 minutes.

[0239] Graph construction: The permission dependency graph shows that the app directly accesses local storage through storage permissions (weight 0.8), and indirectly affects the backup function of the file manager through storage permissions (weight 0.2).

[0240] Interruption probability prediction: The interruption probability of the direct dependent path is 1, the interruption probability of the indirect dependent path is 0.5, and the total interruption probability P int =0.8×1+0.2×0.5=0.9>0.8 (threshold), triggering the generation of an alternative data flow path.

[0241] Alternative data flow path generation: The system searches for two alternative data flow paths:

[0242] Path 1: Uploading images and videos through the cloud storage interface (interruption probability 0.3, resource consumption 0.7, response time 0.8);

[0243] Path 2: Use the application's built-in cache to store data first, and then periodically synchronize it to cloud storage (interruption probability 0.1, resource consumption 0.5, response time 0.9);

[0244] Calculate the priority score:

[0245] Path 1: S p =0.6×(1-0.3)+0.3×(1-0.7)+0.1×(1-0.8)=0.42+0.09+0.02=0.53

[0246] Path 2: S p =0.6×(1-0.1)+0.3×(1-0.5)+0.1×(1-0.9)=0.54+0.15+0.01=0.70

[0247] The system selects path 2 as the alternative data flow path.

[0248] Path execution: The system executes path 2 through the permission proxy node. The pictures and videos uploaded by the user are first stored in the application cache and then uploaded to the cloud storage through a scheduled task to ensure functional continuity.

[0249] Dynamic monitoring: The authority proxy node continuously monitors the execution of path 2. If it finds insufficient cache space or unstable network connection, it will recalculate the priority score and select a new alternative data flow path (such as path 1).

[0250] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A method for intelligent dynamic management of application permissions of mobile devices, characterized in that: The following steps are involved: S1. Real-time collection of operational behavior data of applications on mobile devices, including the frequency of application interface calls, call sequence, resource access path, and data flow direction; S2. Constructing a permission dependency graph based on the operation behavior data, wherein the permission dependency graph includes application nodes, interface nodes, resource nodes, and data flow relationships between the nodes; S3. When an application permission change request is detected, analyzing the direct dependency path and the indirect dependency path related to the target permission in the permission dependency graph; S4. Calculate, based on the weight coefficients of the direct dependency path and the indirect dependency path, the probability of interruption of the path due to the permission change; S5. When the interruption probability exceeds a preset threshold, dynamically generate an alternative data flow path, wherein the alternative data flow path includes a transit interface and an authority proxy node; S6. Maintain the continuity of application business data flow through the alternative data flow path to avoid systemic service interruption caused by permission change.

2. The method for intelligent dynamic management of application permissions of a mobile device according to claim 1, characterized in that: The method for collecting operation behavior data in real time in step S1 includes: S1.

1. Intercepting the application's interface call request through the system layer of the mobile device; S1.

2. Record the source application, calling interface, accessed resource, and call sequence of the interface call request; S1.

3. Structurally process the recorded operation behavior data and store them in a local database of the mobile device.

3. The method for intelligent dynamic management of application permissions of a mobile device according to claim 1, characterized in that: The method for constructing the permission dependency graph in step S2 is: S2.

1. Standardize the operational behavior data and extract interaction features between applications, interfaces, and resources; S2.

2. Constructing a topological structure of the permission dependency graph using the interaction features, wherein the topological structure includes explicit call relationships and implicit data association relationships; S2.

3. Assign a weight coefficient to each path in the permission dependency graph, where the weight coefficient is calculated based on the historical usage frequency and real-time activity of the operation behavior data.

4. The method for intelligent dynamic management of application permissions of a mobile device according to claim 3, characterized in that: The calculation formula of the weight coefficient is: W=α·f his +β·f real Where W is the weight coefficient; f his is the historical usage frequency; f real is the real-time activity; α and β are preset weight parameters, and satisfy α+β=1, where α≥0.

6.

5. The method for intelligent dynamic management of application permissions of a mobile device according to claim 3, characterized in that: The method for analyzing the permission dependency graph in step S3 includes: S3.

1. Identify direct call relationships related to the target permission in the permission dependency graph; S3.

2. Identify an indirect dependency path related to the target permission in the permission dependency graph through the implicit data association relationship; S3.

3. Generate the weight coefficients for the direct dependency path and the indirect dependency path.

6. The method for intelligent dynamic management of application permissions of a mobile device according to claim 1, characterized in that: The calculation formula for the interruption probability in step S4 is: P int =∑(w i ·p i ) Among them, P int represents the interruption probability, w i represents the weight coefficient of path i, p i Indicates the probability that path i will be interrupted due to permission change.

7. The method for intelligent dynamic management of application permissions of a mobile device according to claim 1, characterized in that: The method for dynamically generating an alternative data flow path in step S5 includes: S5.

1. Identify alternative data flow paths in the permission dependency graph based on the topology of the direct dependency paths and the indirect dependency paths; S5.

2. Calculate a priority score for the alternative data flow path, the priority score being based on an interruption probability, resource consumption, and response time of the alternative data flow path; S5.

3. Select the path with the highest priority score as the alternative data flow path.

8. The method for intelligent dynamic management of application permissions of a mobile device according to claim 7, characterized in that: The calculation formula for the priority score is: S p =γ·(1-P int )+δ·(1-e con )+η·(1-t res ) Among them, S p represents the priority score, P int represents the interruption probability of the alternative data flow path, e con represents the resource consumption rate of the alternative data flow path, t res represents the response time of the alternative data flow path, and γ, δ, and η are preset weight parameters.

9. The method for intelligent dynamic management of application permissions of a mobile device according to claim 7, characterized in that: The method for maintaining the consistency of application service data flow in step S6 includes: S6.

1. Insert a permission proxy node into the alternative data flow path, where the permission proxy node is responsible for verifying the permission status of the application. S6.

2. Dynamically monitor the alternative data flow path through the authority proxy node. When an abnormality is detected in the alternative data flow path, recalculate the priority score and select a new alternative data flow path.

10. An intelligent dynamic management system for mobile device application permissions used in the method according to any one of claims 1 to 9, characterized in that: include: A data collection module, configured to collect operation behavior data of applications on the mobile device in real time; A graph construction module, configured to construct the permission dependency graph based on the operation behavior data; A path analysis module, configured to analyze direct dependency paths and indirect dependency paths related to the target permission in the permission dependency graph; A probability calculation module, configured to calculate a probability of interruption of the path caused by the permission change; a path generation module, configured to dynamically generate the alternative data flow path when the interruption probability exceeds a preset threshold; A path execution module is used to maintain the continuity of the application business data flow through the alternative data flow path.

Images