Method and device for acquiring behavior track of non-system user account and electronic equipment

Abstract

The invention provides a behavior track acquisition method and device of a non-system user account and electronic equipment, and relates to the technical field of mobile communication, in particular to the technical field of mobile security risk control. According to the specific implementation scheme, behavior traceability is carried out on a non-system user space in target equipment, and traceability information of the non-system user space is obtained; obtaining a process list of the target equipment; and associating the traceability information with processes in the process list, and determining a behavior track of a non-system user account associated with the non-system user space.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of mobile communication, in particular to the technical field of mobile security risk control, and more particularly to a behavior track acquisition method and device for non-system user accounts and an electronic device. BACKGROUND

[0002] With the virtualization of mobile devices, the growth of multi-user support and the demand for split personality, more and more users simulate a "pseudo-user environment" through third-party applications to realize data isolation, application dual opening and other behaviors. Such pseudo-users constitute a kind of "non-system user", that is, they are not registered in the system native user management system, but logically have independent running space and data domain similar to system users. However, traditional multi-user detection is difficult to perceive the activities of such non-system users, which brings a blind area to terminal security monitoring. SUMMARY

[0003] The present disclosure provides a behavior track acquisition method and device for non-system user accounts and an electronic device.

[0004] According to an aspect of the present disclosure, a behavior track acquisition method for non-system user accounts is provided, comprising: performing behavior tracing on a non-system user space in a target device to obtain tracing information of the non-system user space; obtaining a process list of the target device; and associating the tracing information and a process in the process list to determine a behavior track of a non-system user account associated with the non-system user space.

[0005] According to another aspect of the present disclosure, a behavior track acquisition device for non-system user accounts is provided, comprising: a tracing module configured to perform behavior tracing on a non-system user space in a target device to obtain tracing information of the non-system user space; an obtaining module configured to obtain a process list of the target device; and a determining module configured to associate the tracing information and a process in the process list to determine a behavior track of a non-system user account associated with the non-system user space.

[0006] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the behavior track acquisition method for non-system user accounts according to the above-mentioned aspect of the embodiment.

[0007] According to another aspect of the present disclosure, a non-transitory computer readable storage medium storing computer instructions is provided, and the computer instructions are stored on the computer readable storage medium, and are used to make the computer execute the behavior track acquisition method of the non-system user account according to the embodiment of the above aspect.

[0008] According to another aspect of the present disclosure, a computer program product is provided, and the computer program product comprises computer instructions, and the computer instructions are executed by a processor to implement the behavior track acquisition method of the non-system user account according to the embodiment of the above aspect.

[0009] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present disclosure, nor to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings are used to better understand the present scheme, and do not constitute a limitation on the present disclosure. Among them:

[0011] Figure 1 A flowchart of a behavior track acquisition method of a non-system user account according to an embodiment of the present disclosure is provided;

[0012] Figure 2 A flowchart of another behavior track acquisition method of a non-system user account according to an embodiment of the present disclosure is provided;

[0013] Figure 3 A flowchart of another behavior track acquisition method of a non-system user account according to an embodiment of the present disclosure is provided;

[0014] Figure 4 A structural diagram of a behavior track acquisition device of a non-system user account according to an embodiment of the present disclosure is provided;

[0015] Figure 5 A block diagram of an electronic device for implementing the behavior track acquisition method of a non-system user account according to an embodiment of the present disclosure is provided. DETAILED DESCRIPTION

[0016] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to help understanding, and should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Also, in order to be clear and concise, the description below omits the description of well-known functions and structures.

[0017] It should be noted that the acquisition, storage, use, processing, etc. of data in the technical solutions of the present disclosure comply with relevant laws and regulations.

[0018] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.), and signals involved in the present disclosure are all authorized by the user or sufficiently authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant laws, regulations, and standards.

[0019] The behavior track acquisition method, device, electronic equipment, and storage medium of a non-system user account of an embodiment of the present disclosure are described below with reference to the accompanying drawings.

[0020] Mobile security risk control technology refers to identifying, evaluating, and preventing security threats in mobile communication through technical means to protect user data, devices, and networks, and the core goal is to prevent information leakage, attacks, and system intrusion.

[0021] A non-system user account refers to using the Root permission of an operating system to add a user account through a command, thereby running an application and storing data under the account to evade the security monitoring of a main user.

[0022] A clone application is a function that allows a user to create and run multiple independent instances of the same application on the same device. For example, multiple accounts of the same application can be logged in on a smart terminal device at the same time, and the data and operations of each account do not interfere with each other.

[0023] Figure 1 A flowchart of a behavior track acquisition method of a non-system user account provided by an embodiment of the present disclosure is shown.

[0024] As shown in Figure 1 The behavior track acquisition method of a non-system user account can include:

[0025] S101, tracing the behavior of a non-system user space in a target device to obtain tracing information of the non-system user space.

[0026] It should be noted that the execution subject of the behavior track acquisition method of a non-system user account in the present embodiment can be a hardware device with data processing capability and / or the necessary software required to drive the hardware device to work. Alternatively, the execution subject can include a server, a user terminal, and other smart devices. Alternatively, the user terminal includes but is not limited to a mobile phone, a computer, a smart voice interaction device, etc. Alternatively, the server includes but is not limited to a network server, an application server, and can also be a server of a distributed system, or a server combined with a blockchain, etc. The present embodiment is not limited in this regard.

[0027] It is understood that non-system user space can be an independent runtime environment generated through virtualization or cloning technology, used to isolate the data and operations of the main application from those of the cloned application. The traceability information of non-system user space can record the process, source, and transformation of data or operations from their generation to their current state. This traceability information can be used to determine the behavioral trajectory of non-system user accounts.

[0028] In some embodiments, before tracing the behavior of the non-system user space in the target device, it can be determined whether the non-system user space exists in the target device. If so, the behavior of the non-system user space can be traced.

[0029] For example, the presence of non-system user space on the target device can be determined based on whether there are cloned applications among the applications installed on the target device, whether there are suspicious user accounts among the user accounts on the target device, and whether there are suspicious processes in the process list of the target device. Alternatively, if there are cloned applications on the target device, the target device has a suspicious user account, and the target device has a suspicious process, the presence of non-system user space on the target device can be determined.

[0030] In some embodiments, the behavior of the non-system user space can be traced based on the system files and system logs of the target device to obtain the abnormal directory structure corresponding to the non-system user space and the event information of the non-system user space from the system files and system logs, thereby determining the tracing information of the non-system user space.

[0031] For example, the name of the clone application can be determined from the abnormal directory structure as traceability information. The timestamp and content of key events such as the launch of the clone application and the clone application network access can be determined from the event information as traceability information.

[0032] It's understandable that when operations are performed in non-system user space, the system log will record corresponding events and event information. Therefore, the event information for non-system user space can be obtained from the system log. Because data stored in non-system user space has different data paths, the path of the system file can be traced to obtain the abnormal directory structure from the system file. For example, the abnormal directory structure can be determined based on the directory naming structure of the system file.

[0033] S102: Obtain a process list of the target device.

[0034] In some embodiments, the process information of the target device may be accessed based on the access instruction, thereby obtaining a process list from the process information.

[0035] In some embodiments, information related to the process may also be obtained based on a virtual file system of the target device, thereby obtaining a process list.

[0036] S103, the trace information and the processes in the process list are associated to determine the behavior track of the non-system user account associated with the non-system user space.

[0037] In some embodiments, the user account of the virtual application corresponding to the non-system user space can be the non-system user account associated with the non-system user space.

[0038] In some embodiments, the behavior data of the non-system user account in the non-system user space can be determined by determining the process corresponding to the virtual application from the process list and associating the trace information and the process corresponding to the virtual application. The behavior data includes behavior events and corresponding time stamps.

[0039] It can be understood that when the non-system user account operates in the non-system user space, the non-system user account can switch to the main user space of the target device and operate in the main user space. That is, the behavior data of the non-system user account in the main user space also needs to be obtained, and the behavior track of the non-system user account is determined by combining the behavior data of the non-system user account in the non-system user space and the behavior data of the non-system user account in the main user space.

[0040] It can be understood that the non-system user space can be the environment in which the virtual application runs, and the main user space can be the original environment in which the main application runs. For example, application A is a virtual application of application B, and the environment in which application A runs is the non-system user space, and the running environment of application B is the main user space.

[0041] In some embodiments, the process corresponding to the main application can be determined from the process list, and the trace information and the process corresponding to the main application are associated to determine the behavior data of the non-system user account in the main user space.

[0042] In some embodiments, the behavior events can be trajectory restored according to the time stamps corresponding to the behavior events in the behavior data of the non-system user account in the non-system user space to obtain a first behavior track, and the behavior events can be trajectory restored according to the time stamps corresponding to the behavior events in the behavior data of the non-system user account in the main user space to obtain a second behavior track. Further, the first behavior track and the second behavior track can be combined in time sequence to obtain the behavior track of the non-system user account associated with the non-system user space.

[0043] For example, continuing with the above example, the non-system user account 1 starts application A at timestamp 1, operates application A at timestamp 2, and switches to application B at timestamp 3 to operate, including the first behavior track of the non-system user space: operating application A at timestamp 2, and the second behavior track of the main user space: starting application A at timestamp 1, and switching to application B at timestamp 3. By combining the first behavior track and the second behavior track in chronological order, the behavior track of the non-system user account 1 can be obtained.

[0044] It should be noted that the method of the embodiments of the present disclosure can be used to identify abnormal terminal devices. By tracing the behavior of the non-system user space of the target device, and determining the behavior track of the non-system user account according to the trace information and the process, when the target device has the behavior track of the non-system user account, the target device is determined to be an abnormal terminal device.

[0045] According to the behavior track acquisition method of the non-system user account provided by the embodiments of the present disclosure, the behavior of the non-system user space in the target device is traced to obtain corresponding trace information, and a process list of the target device is obtained, so as to associate the trace information and the processes in the process list to obtain the behavior track of the non-system user account associated with the non-system user space. Therefore, the present scheme can accurately identify the behavior track of the non-system user account, fill the blind area of the device security monitoring, and effectively improve the security of the device running environment. By tracing the non-system user space, the running environment of the device can be comprehensively detected, thereby helping to identify the risk space in the device.

[0046] Figure 2 A flowchart of a behavior track acquisition method of a non-system user account provided by the embodiments of the present disclosure.

[0047] As Figure 2 shown, the behavior track acquisition method of the non-system user account can include:

[0048] S201, obtaining multi-dimensional information of a target device, the multi-dimensional information at least including first feature information of applications installed in the target device, a user account set, and a process list.

[0049] In some embodiments, before tracing the behavior of the non-system user space in the target device, it can be judged whether the non-system user space exists in the target device. If it exists, the behavior of the non-system user space can be traced.

[0050] In some embodiments, the first feature information of the installed application on the target device, the user account set of the target device, and the process list of the target device can be acquired as the multi-dimension information of the target device, and it is determined whether the non-system user space exists in the target device according to the multi-dimension information.

[0051] In some embodiments, the first feature information includes but is not limited to the application package name, signature feature, behavior feature, and the like of the installed application. Optionally, the application list of the installed application is acquired, and the first feature information of the application in the application list is acquired based on the Android Debug Bridge (ADB) command.

[0052] Optionally, the user account set is acquired through a user information acquisition command, and the process list is acquired through a process list access instruction.

[0053] S202, determining the non-system user space in the target device according to the multi-dimension information.

[0054] In some embodiments, when each dimension information in the multi-dimension information satisfies the respective condition, it is determined that the non-system user space exists in the target device, thereby improving the accuracy of the non-system user space detection, and being able to cope with various running environments, and improving the applicability of the non-system user space detection.

[0055] Optionally, it is determined whether the target device exists the clone application according to the first feature information, whether the user account set exists the suspicious user account, and whether the process list exists the suspicious process, so that the target device exists the clone application, the user account set exists the suspicious user account, and the process list exists the suspicious process are taken as the respective condition of each dimension information in the multi-dimension information.

[0056] That is, in response to the first feature information indicating that the target device exists the clone application, and the user account set exists the suspicious user account, and the process list exists the suspicious process, it is determined that the target device exists the non-system user space.

[0057] Further, the non-system user space can be determined. Optionally, the clone application in the target device can be determined according to the suspicious process and the suspicious user account. The first application corresponding to the suspicious process and the second application corresponding to the suspicious user account are determined, and the same application in the first application and the second application is determined as the clone application, so that the clone space corresponding to the clone application can be determined, and the non-system user space is determined according to the clone space. Optionally, the clone space can be taken as the non-system user space.

[0058] For example, if there is one cloned application A on the target device, the cloned space A corresponding to the cloned application A can be used as the non-system user space. For another example, if there are cloned application A, cloned application B and cloned application C on the target device, the cloned space A corresponding to the cloned application A, the cloned space B corresponding to the cloned application B and the cloned space C corresponding to the cloned application C can be determined, and the cloned space A, the cloned space B and the cloned space C can be combined to obtain the non-system user space.

[0059] In some embodiments, the first feature information can be matched with a pre-established feature library, so as to determine whether the target device has the cloned application according to the matching result. The second feature information of the cloned application is included in the feature library.

[0060] Optionally, the first feature information is matched with the pre-established feature library, if the first feature information and the second feature information are matched successfully, it can be determined that the feature library includes the first feature information as the matching result; if the first feature information and the second feature information are not matched successfully, it can be determined that the feature library does not include the first feature information as the matching result. Optionally, in response to the feature library including the first feature information, it is determined that the target device has the cloned application.

[0061] In the embodiments of the present disclosure, the first feature information is matched with the pre-established feature library, and whether the target device has the cloned application can be directly determined according to the matching result, so as to improve the identification efficiency.

[0062] In some embodiments, the suspicious user account can be identified from the user account set based on the type of the user account and the application information associated with the user account. Optionally, the type identifier of the user account in the user account set can be obtained from the configuration information of the user account, and the application information associated with the user account can be obtained. Optionally, the number of applications associated with the user account and the use record of the applications can be used as the application information associated with the user account.

[0063] Further, the suspicious user account can be identified from the user account set according to the type identifier and the associated application information. Optionally, the types of the non-suspicious user accounts include but are not limited to: work configuration user, main user, visitor user, and system user carried by the operating system itself. By taking the type identifier of the non-suspicious user account as a reference identifier, and comparing the type identifier with the reference identifier for consistency, if they are inconsistent, the user account corresponding to the type identifier can be determined as the suspicious user account.

[0064] Optionally, a threshold of the number of applications can also be set, if the application information indicates that the number of applications is greater than the threshold, the user account associated with the application information can be determined as the suspicious user account.

[0065] In the embodiment of the present disclosure, by identifying suspicious user accounts, data support can be provided for determining non-system user space, thereby effectively detecting potential risks in the system.

[0066] In some embodiments, suspicious processes are identified from a process list by determining identification information of the process and based on the identification information. Optionally, at least one of the process name, the user account associated with the process, and the application identifier associated with the process in the process list can be determined as the process identification information. Furthermore, a set condition corresponding to the identification information is determined, and in response to the process identification information satisfying the corresponding set condition, the process is determined to be a suspicious process.

[0067] For example, the identification information of process A is the process name of the process. If the process name meets the corresponding set conditions, process A can be determined to be a suspicious process.

[0068] It is understandable that if the process name of a suspicious process contains keywords of a clone application, the keywords can be extracted from the process name, and in response to the presence of keywords of the clone application in the keywords, the process is determined to be a suspicious process.

[0069] It is understood that if a user account is associated with multiple independent processes, the process associated with the user account can be determined to be a suspicious process. In other words, by obtaining the processes associated with the user account and responding that the processes associated with the user account are independent of each other, the process associated with the user account can be determined to be a suspicious process.

[0070] It is understandable that if the process name corresponds to application A, and application A is not installed on the target device, the process can be determined to be a suspicious process. In other words, in response to the application identifier associated with the process being an application not installed on the target device, the process is determined to be a suspicious process.

[0071] In the embodiment of the present disclosure, by identifying suspicious processes in the process list and combining suspicious processes, suspicious user accounts and clone applications to identify non-system user spaces in the target device, multi-dimensional information fusion can be achieved, thereby improving the accuracy of identification.

[0072] S203: Tracing the behavior of the non-system user space in the target device to obtain tracing information of the non-system user space.

[0073] S204: Obtain a process list of the target device.

[0074] S205 , correlating the tracing information with the processes in the process list to determine the behavior trajectory of the non-system user account associated with the non-system user space.

[0075] The relevant contents of steps S203-S205 can be found in the above embodiment and will not be repeated here.

[0076] The method for obtaining a behavior track of a non-system user account provided by the embodiments of the present disclosure can improve the accuracy of non-system user space detection and identification by obtaining multi-dimensional information of a target device and determining a non-system user space in the target device based on the multi-dimensional information before performing behavior tracing on the non-system user space. The method can cope with various running environments and improve the applicability of detecting non-system user spaces. By determining the non-system user space of the target device, comprehensive security monitoring of the target device can be achieved.

[0077] Figure 3 A flowchart of a method for obtaining a behavior track of a non-system user account is provided for the embodiments of the present disclosure.

[0078] As shown in Figure 3 , the method for obtaining a behavior track of a non-system user account can include:

[0079] S301, performing behavior tracing on a non-system user space in a target device to obtain tracing information of the non-system user space.

[0080] In some embodiments, the behavior tracing on the non-system user space in the target device can be performed according to system files and system logs of the target device, so that the tracing can be more comprehensive and in-depth, and the accuracy of the tracing information can be enhanced.

[0081] In some embodiments, the system files and system logs can be obtained based on a command line tool, and a split application carried by the non-system user space can be determined from an activity manager of the system logs. It can be understood that the activity manager can record log entries of the start of the split application to determine the split application carried by the non-system user space.

[0082] Further, the key events and corresponding event information related to the split application can be extracted from the system logs according to the split application. Alternatively, the key events and corresponding event information can be extracted from the system logs according to the identifier of the split application. The key events and corresponding event information can also be extracted from the system logs based on the process name associated with the split application. The key events can be events such as starting the split application and the split application accessing the network, and the corresponding event information can be the time and content of the key events.

[0083] It can be understood that the directory structure in which the non-system user space stores data is different from that of the main user space, so the directory structure in which the main user space stores data can be taken as a reference directory structure, and the directory structure different from the reference directory structure can be extracted from the system files as an abnormal directory structure of the non-system user space. Alternatively, the system files can be subjected to path recognition to identify the abnormal directory structure from the system files.

[0084] Further, the trace information of the non-system user space can be obtained according to the key events and corresponding event information, and the abnormal directory structure. For example, the name of the clone application can be determined from the abnormal directory structure as the trace information. The time stamp and content of the key events such as starting the clone application and network access of the clone application can be determined from the event information as the trace information.

[0085] In some embodiments, in order to improve the comprehensiveness of the trace information, the trace information can also be updated to further improve the accuracy of the behavior track determination according to the trace information. According to the external storage medium of the target device, such as a universal serial bus (USB) drive, a secure digital memory card (SD), an external hard disk, and the target configuration file of the target device, such as a user configuration file and an application configuration file, the record information related to the non-system user space can be obtained, and then the trace information of the non-system user space can be updated according to the record information.

[0086] That is, by determining the external storage area and the target configuration file of the target device, and extracting the record information of the non-system user space from at least one of the external storage area and the target configuration file.

[0087] S302, obtaining a process list of the target device.

[0088] The related content of step S302 can be referred to the above-mentioned embodiments, which will not be repeated here.

[0089] S303, identifying each process in the process list to distinguish the suspicious first process and the safe second process.

[0090] In some embodiments, the user account to which each process in the process list belongs can be identified to determine the user account to which each process belongs, so that the suspicious first process and the safe second process can be distinguished from the process list according to the user account to which the process belongs.

[0091] In some embodiments, one or more processes associated with the same user account can be determined according to the user account to which the process belongs, to distinguish the suspicious first process and the safe second process. If one process is associated with the same user account, the process can be determined as the safe second process. If multiple processes are associated with the same user account, it can be further determined whether the processes are independent. In response to the processes being independent of each other, the processes can be determined as the suspicious first process, otherwise as the safe second process.

[0092] In some embodiments, the process name of each process in the process list can also be identified to distinguish the suspicious first process from the safe second process according to the process name. Optionally, if the process name includes the keyword corresponding to the clone application, the process can be determined as the suspicious first process, otherwise as the safe second process.

[0093] In S304, the running information of the process is obtained, wherein the running information includes the user account to which the process belongs and the command parameter when the process is started.

[0094] In some embodiments, the user account to which the process belongs can be obtained from the virtual file storing the process state information, and the command parameter when the process is started can be obtained from the virtual file storing the process command parameter, and the user account to which the process belongs and the command parameter when the process is started are taken as the running information.

[0095] In S305, the tracing information and the running information of the process are associated to determine the behavior track of the non-system user account.

[0096] In some embodiments, the first process runs in the non-system user space, and the second process runs in the main user space. By associating the tracing information and the running information of the first process and the running information of the second process, the behavior track of the non-system user account can be fully restored, and the comprehensiveness and accuracy of the behavior track are improved.

[0097] Optionally, the tracing information and the running information can be associated according to the time stamp contained in the tracing information to obtain the behavior event and the corresponding time stamp as the behavior data. That is, the first behavior data of the non-system user space can be obtained according to the tracing information and the running information of the first process, and the second behavior data of the main user space can be obtained according to the tracing information and the running information of the second process.

[0098] Further, the first behavior data and the second behavior data are compared and associated on the time axis according to the first time stamp in the first behavior data and the second time stamp in the second behavior data to obtain the behavior track of the non-system user account.

[0099] Optionally, the behavior events corresponding to the first time stamp and the second time stamp respectively can be sorted according to the time axis to obtain the behavior track of the non-system user account. For example, the non-system user account 1 starts the application A (clone application) at time stamp 1, operates the application A at time stamp 2, and switches to the application B for operation at time stamp 3. The first behavior data is: operating the application A at time stamp 2, and the second behavior data is: starting the application A at time stamp 1 and switching to the application B at time stamp 3. Therefore, the first behavior data and the second behavior data can be associated according to the time axis to obtain the behavior track of the non-system user account 1.

[0100] In some embodiments, after determining the behavior track of the non-system user account associated with the non-system user space, the non-system user account can be controlled based on the behavior track to ensure the security of the target device.

[0101] In some embodiments, the risk type of the non-system user account can be identified according to the behavior track, and the risk control strategy corresponding to the non-system user account can be determined according to the risk type, so as to execute the risk control strategy on the non-system user account and achieve the risk control of the non-system user account.

[0102] Optionally, a corresponding relationship between the risk type and the risk control strategy can be established in advance, and after the risk type of the non-system user account is determined, the risk control strategy corresponding to the non-system user account can be determined by querying the corresponding relationship.

[0103] In some embodiments, the risk level of the non-system user account can be determined as the risk type according to the number of events related to the clone application in the behavior track. Optionally, an event number range can be set for each risk level, and the target event number range to which the number of events related to the clone application in the behavior track belongs can be determined, so that the target risk level of the non-system user account can be determined as the risk type.

[0104] In some embodiments, after determining the behavior track of the non-system user account associated with the non-system user space, the risk report information of the non-system user account can be generated, so that the behavior track of the non-system user account can be intuitively displayed.

[0105] In some embodiments, the behavior summary information of the non-system user account can be generated according to the behavior track associated with the non-system user account, and the risk report information of the non-system user account can be generated according to the application and data associated with the non-system user account and the behavior summary information by determining the application and data associated with the non-system user account.

[0106] Optionally, a report template can be set, and the application and data and the behavior summary information can be added to the report template to obtain the risk report information of the non-system user account. For example, the generated risk report information is: "The device has a non-system user space, which contains 5 clone applications (list is xxxx), and the clone application contains the blacklisted application A of the company, and the user has performed Y operation on the application A in the non-system user space at a certain time period".

[0107] According to the behavior track acquisition method of the non-system user account provided by the embodiment of the present disclosure, the suspicious first process and the safe second process in the process list are identified, the trace information is associated with the running information of the first process and the second process, and the behavior track of the non-system user account is obtained. The behavior data of the non-system user space can be compared and associated with the behavior data of the main user space, and the completeness and accuracy of the behavior track are increased.

[0108] Corresponding to the behavior track acquisition method of the non-system user account provided by the above several embodiments, an embodiment of the present disclosure further provides a behavior track acquisition device of a non-system user account. Since the behavior track acquisition device of the non-system user account provided by the embodiment of the present disclosure corresponds to the behavior track acquisition method of the non-system user account provided by the above several embodiments, the implementation manners of the behavior track acquisition method of the non-system user account are also applicable to the behavior track acquisition device of the non-system user account provided by the embodiment of the present disclosure, which will not be described in detail in the following embodiments.

[0109] Figure 4 A structural schematic diagram of a behavior track acquisition device of a non-system user account provided by the embodiment of the present disclosure.

[0110] As shown in Figure 4 The behavior track acquisition device 400 of the non-system user account of the embodiment of the present disclosure includes a trace module 401, an acquisition module 402, and a determination module 403.

[0111] The trace module 401 is configured to perform behavior tracing on the non-system user space in the target device to obtain trace information of the non-system user space.

[0112] The acquisition module 402 is configured to acquire a process list of the target device.

[0113] The determination module 403 is configured to associate the trace information with the processes in the process list, and determine the behavior track of the non-system user account associated with the non-system user space.

[0114] In an embodiment of the present disclosure, the trace module 401 is further configured to acquire multi-dimensional information of the target device, the multi-dimensional information at least including first feature information of an installed application of the target device, a user account set, and a process list; and determine the non-system user space in the target device according to the multi-dimensional information.

[0115] In an embodiment of the disclosure, the tracing module 401 is further configured to: in response to the first feature information indicating that the target device has a clone application, and the user account set having a suspicious user account, and the process list having a suspicious process, determine that the target device has a non-system user space; determine the clone application in the target device according to the suspicious process and the suspicious user account; determine a clone space corresponding to the clone application, and determine the non-system user space according to the clone space.

[0116] In an embodiment of the disclosure, the tracing module 401 is further configured to: perform feature matching on the first feature information and a pre-constructed feature library, wherein the feature library includes second feature information of a clone application; and in response to the feature library including the first feature information, determine that the target device has a clone application.

[0117] In an embodiment of the disclosure, the tracing module 401 is further configured to: obtain a type identifier of a user account in the user account set; obtain application information associated with the user account; and identify a suspicious user account from the user account set according to the type identifier and the associated application information.

[0118] In an embodiment of the disclosure, the tracing module 401 is further configured to: determine at least one of a process name of a process in the process list, a user account associated with the process, and an application identifier associated with the process as identification information of the process; and in response to the identification information of the process satisfying a corresponding set condition, determine that the process is a suspicious process.

[0119] In an embodiment of the disclosure, the tracing module 401 is further configured to: extract a keyword from the process name, and in response to the keyword including a keyword of a clone application, determine that the process is a suspicious process; or obtain processes associated with the user account, and in response to the processes associated with the user account being independent of each other, determine that the processes associated with the user account are suspicious processes; or in response to the application identifier associated with the process being an application not installed on the target device, determine that the process is a suspicious process.

[0120] In an embodiment of the disclosure, the tracing module 401 is further configured to: obtain system files and system logs; determine a clone application carried by the non-system user space; extract, from the system logs, a key event related to the clone application and corresponding event information according to the clone application; perform path identification on the system files to identify an abnormal directory structure from the system files; and obtain tracing information of the non-system user space according to the key event, the corresponding event information, and the abnormal directory structure.

[0121] In an embodiment of the present disclosure, the tracing module 401 is further configured to determine an external storage area and a target configuration file of the target device, extract record information of the non-system user space from at least one of the external storage area and the target configuration file, and update the tracing information of the non-system user space according to the record information.

[0122] In an embodiment of the present disclosure, the determining module 403 is further configured to identify each process in the process list to distinguish a suspicious first process from a safe second process, obtain running information of the process, where the running information includes a user account to which the process belongs and a command parameter when the process is started, and associate the tracing information with the running information of the process to determine a behavior track of the non-system user account.

[0123] In an embodiment of the present disclosure, the determining module 403 is further configured to obtain first behavior data of the non-system user space according to the tracing information and the running information of the first process, obtain second behavior data of the main user space according to the tracing information and the running information of the second process, and compare and associate the first behavior data and the second behavior data on a time axis to obtain the behavior track of the non-system user account.

[0124] In an embodiment of the present disclosure, the determining module 403 is further configured to identify a risk type of the non-system user account according to the behavior track, determine a risk control strategy corresponding to the non-system user account according to the risk type, and execute the risk control strategy on the non-system user account.

[0125] In an embodiment of the present disclosure, the determining module 403 is further configured to generate behavior summary information of the non-system user account according to the behavior track associated with the non-system user account, and generate risk report information of the non-system user account according to the application and data associated with the non-system user account and the behavior summary information.

[0126] The behavior track acquisition apparatus of the non-system user account provided in the embodiments of the present disclosure can obtain corresponding tracing information by performing behavior tracing on the non-system user space in the target device, and obtain a process list of the target device, so as to associate the tracing information with the processes in the process list to obtain a behavior track of a non-system user account associated with the non-system user space. Thus, the present solution can accurately identify the behavior track of the non-system user account, fill in the blind spot of the device security monitoring, and effectively improve the security of the device running environment. By performing tracing on the non-system user space, the running environment of the device can be comprehensively detected, thereby helping to identify the risk space in the device.

[0127] In the technical solution of the present disclosure, the acquisition, storage and application of the user account personal information comply with relevant laws and regulations and do not violate public order and good customs.

[0128] According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0129] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0130] As shown in Figure 5 The device 500 includes a computing unit 501 that can perform various appropriate actions and processes according to computer programs / instructions stored in a read-only memory (ROM) 502 or loaded into a random access memory (RAM) 503 from a storage unit 506. Various programs and data required for the operation of the device 500 can also be stored in the RAM 503. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0131] Various components in the device 500 are connected to the I / O interface 505, including: an input unit 506 such as a keyboard, a mouse, etc.; an output unit 507 such as various types of displays, speakers, etc.; a storage unit 508 such as a magnetic disk, an optical disk, etc.; and a communication unit 509 such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0132] The computing unit 501 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs various methods and processes described above, such as the behavior trajectory acquisition method for non-system user accounts. For example, in some embodiments, the behavior trajectory acquisition method for non-system user accounts can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 506. In some embodiments, part or all of the computer program / instructions can be loaded and / or installed onto the device 500 via the ROM 502 and / or the communication unit 509. When the computer program / instructions are loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the behavior trajectory acquisition method for non-system user accounts described above can be performed. Alternatively, in other embodiments, the computing unit 501 can be configured to perform the behavior trajectory acquisition method for non-system user accounts by any other suitable means, such as by means of firmware.

[0133] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0134] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / acts specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0135] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include a linearly-programmed electrical connection, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0136] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0137] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0138] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0139] It should be understood that the various forms of flow shown above can be re-ordered, added to, or have steps deleted, using the steps disclosed in the present disclosure. For example, the steps disclosed in the present disclosure can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure are achieved, and the present disclosure is not limited herein.

[0140] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for obtaining the behavior trajectory of a non-system user account, wherein: The method comprises: Tracing the behavior of the non-system user space in the target device to obtain tracing information of the non-system user space; Obtain a process list of the target device; The tracing information is associated with the processes in the process list to determine a behavior track of the non-system user account associated with the non-system user space.

2. The method according to claim 1, wherein Before tracing the behavior of the non-system user space in the target device and obtaining the tracing information of the non-system user space, the method further includes: Acquire multi-dimensional information of the target device, the multi-dimensional information including at least first feature information of applications installed on the target device, a user account set, and a process list; The non-system user space in the target device is determined according to the multi-dimensional information.

3. The method according to claim 2, wherein: The determining, based on the multi-dimensional information, the non-system user space in the target device includes: In response to the first characteristic information indicating that a clone application exists on the target device, a suspicious user account exists in the user account set, and a suspicious process exists in the process list, determining that the non-system user space exists on the target device; Determining a clone application in the target device based on the suspicious process and the suspicious user account; Determine the clone space corresponding to the clone application, and determine the non-system user space based on the clone space.

4. The method according to claim 3, wherein: The method further comprises: Performing feature matching on the first feature information with a pre-built feature library, wherein the feature library includes the second feature information of the clone application; In response to the feature library including the first feature information, it is determined that a clone application exists on the target device.

5. The method according to claim 3, wherein The method further comprises: Obtaining a type identifier of a user account in the user account set; Obtain application information associated with the user account; The suspicious user account is identified from the set of user accounts according to the type identifier and the associated application information.

6. The method according to claim 3, wherein: The method further comprises: Determine at least one of a process name of a process in the process list, a user account associated with the process, and an application identifier associated with the process as identification information of the process; In response to the identification information of the process satisfying a corresponding set condition, the process is determined to be the suspicious process.

7. The method according to claim 6, wherein: The method further comprises: Extracting keywords from the process name, and determining that the process is the suspicious process in response to the presence of keywords of the clone application in the keywords; or Obtaining the processes associated with the user account, and in response to the processes associated with the user account being independent of each other, determining that the process associated with the user account is the suspicious process; or In response to the application associated with the process being identified as an application not installed on the target device, the process is determined to be the suspicious process.

8. The method according to any one of claims 1 to 7, wherein The tracing of the behavior of the non-system user space in the target device to obtain the tracing information of the non-system user space includes: Obtain system files and system logs; Determining a clone application carried by the non-system user space; Extracting, from the system log, key events and corresponding event information related to the clone application according to the clone application; Performing path identification on the system files, and identifying abnormal directory structures from the system files; According to the key event and the corresponding event information, as well as the abnormal directory structure, the tracing information of the non-system user space is obtained.

9. The method according to claim 8, wherein The method further comprises: Determining an external storage area and a target configuration file of the target device; extracting the record information of the non-system user space from at least one of the external storage area and the target configuration file; According to the record information, the traceability information of the non-system user space is updated.

10. The method according to any one of claims 1 to 7, wherein The correlating the tracing information with the processes in the process list to determine the behavior trajectory of the non-system user account associated with the non-system user space includes: Identifying each process in the process list to distinguish a suspicious first process from a safe second process; Obtaining running information of the process, wherein the running information includes the user account to which the process belongs and command parameters when the process is started; The tracing information is associated with the running information of the process to determine the behavior track of the non-system user account.

11. The method according to claim 10, wherein: The correlating the tracing information with the running information of the process to determine the behavior track of the non-system user account includes: Acquire first behavior data of the non-system user space according to the tracing information and the running information of the first process; Acquire second behavior data of the main user space according to the tracing information and the running information of the second process; The first behavior data and the second behavior data are compared and associated on a time axis to obtain a behavior track of the non-system user account.

12. The method according to any one of claims 1 to 8, wherein After determining the behavior track of the non-system user account associated with the non-system user space, the method further includes: Identifying the risk type of the non-system user account based on the behavior trajectory; Determining a risk control strategy corresponding to the non-system user account according to the risk type; The risk control policy is executed on the non-system user account.

13. The method according to claim 12, wherein: After determining the behavior track of the non-system user account associated with the non-system user space, the method further includes: generating behavior summary information of the non-system user account according to the behavior track associated with the non-system user account; Generate risk report information for the non-system user account based on the applications and data associated with the non-system user account and the behavior summary information.

14. A device for obtaining the behavior trajectory of a non-system user account, wherein: The device comprises: A tracing module is used to trace the behavior of the non-system user space in the target device and obtain the tracing information of the non-system user space; An acquisition module, configured to acquire a process list of the target device; A determination module is used to associate the tracing information with the processes in the process list to determine the behavior trajectory of the non-system user account associated with the non-system user space.

15. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 13.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-13.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 13 is implemented.

Images