APP security compliance detection method, system and device, medium and server

Abstract

The invention belongs to the technical field of information security, and provides an APP security compliance detection method, system and device, a medium and a server, and the method comprises the steps: configuring a security detection SDK for an APP, adjusting the increase, decrease, sequence, depth and range of detection items in the SDK based on a detection strategy, and carrying out the monitoring through a corresponding monitoring strategy according to the resource performance environment of the current device. And establishing an abnormal behavior model by using big data analysis and machine learning technologies, and detecting and analyzing application operation data in real time. According to the method, the security detection capability in an SDK form is provided, the operation of directly going deep into a kernel layer is avoided, the technical threshold and the stability risk of APP integration are reduced, and through flexible combination of synchronous detection and asynchronous detection and coverage of full-life-cycle detection, timely response of key security events is ensured, and the security risk of APP integration is reduced. And the main thread resource is prevented from being occupied for a long time, and the safety and the fluency when the user uses the APP are ensured.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to an APP security compliance detection method, system, device, medium and server. BACKGROUND

[0002] In the current digital era, network security and system security are increasingly important, and are related to the core interests and smooth operation of enterprises. Security probes emerge as the times require in this field, and are committed to enhancing the security monitoring, protection and emergency response capabilities of systems, detecting and identifying various security threats in networks and systems, such as malicious software intrusion, illegal access, data leakage risk, etc., and protecting the security of key information and assets of enterprises.

[0003] At present, the security probe business in the industry is still in the blue ocean stage, and there are few formed products. The APP security compliance is mainly protected by various separated security strategies, and the main defects are as follows: 1. Most of them are implemented in the kernel layer, and it is difficult to integrate APP, and the integration stability needs to be examined; 2. The life cycle of the strategy protection is fixed, and a large amount of system resources may be consumed; 3. The market mainly monitors the "heavy" security compliance problems, and does not cover the "light" security problems that affect the customer transaction experience. SUMMARY

[0004] The purpose of the application is to overcome the existing defects, and provide an APP security compliance detection method, system, device, medium and server.

[0005] In order to solve the above technical problems, the application provides the following technical scheme: The first purpose of the application is to provide an APP security compliance detection method, comprising: Configuring a security detection SDK to the APP, the SDK encapsulating security detection logic; Building an elastic security detection chain: based on the detection strategy configured locally or issued online, adjusting the increase, decrease, order, depth and range of the detection items in the SDK, the detection items including synchronous detection, asynchronous detection and full life cycle detection, the synchronous detection being used for performing security detection in the main thread, the asynchronous detection being used for performing security detection in the sub-thread, and the full life cycle detection being used for detecting security risk events in the process of the full life cycle of the APP according to the demand for allocating resources to adapt to different devices; Multi-life cycle switching detection: according to the resource performance environment of the current device, using the corresponding monitoring strategy for monitoring, the monitoring strategy including a full life cycle monitoring strategy, an intermittent cycle monitoring strategy, a one-time monitoring strategy or a closed monitoring; Abnormal online analysis: based on synchronous detection, asynchronous detection and full life cycle detection, security detection data is obtained, big data analysis and machine learning technology are used to establish an abnormal behavior model, application running data is detected and analyzed in real time, and repair feedback is generated.

[0006] Further, the synchronous detection includes HTTP proxy detection, VPN detection, ROOT detection, emulator detection, debugger detection, record permission detection, man-in-the-middle attack detection and light problem detection; The asynchronous detection detects DNS hijacking, and after identifying the DNS hijacking scene, the hijacked URL-IP is encrypted and reported; The full life cycle detection includes application crash detection and application card detection.

[0007] Further, the specific steps of the multi-life cycle switching detection include: Read the device parameters, evaluate the resource performance environment of the current device according to the device parameters, and the resource performance environment includes high resource performance environment, medium resource performance environment, low resource performance environment and extremely poor resource performance environment; If the device is in a high resource performance environment, use the full life cycle monitoring strategy for monitoring; If the device is in a medium resource performance environment, use the intermittent cycle monitoring strategy for monitoring; If the device is in a low resource performance environment, use the one-time monitoring strategy for monitoring; If the device is in an extremely poor resource performance environment, turn off the monitoring.

[0008] Further, the device parameters include CPU usage, memory occupation, storage space, network stability and battery capacity.

[0009] Further, the specific steps of the abnormal online analysis include: Data collection and preprocessing: use the client to collect the fault information of the device, extract the time characteristics, environment characteristics and user behavior characteristics in the fault information; Model design and training: according to the abnormal detection target and data characteristics, select the model type, design the model architecture, use the training set to train the model, adjust the hyperparameters to optimize the model performance, use the validation set and test set to evaluate the model, and ensure the accuracy and generalization ability of the model on unknown data; Abnormal detection and positioning: use the trained model for real-time monitoring and report data for analysis.

[0010] Another object of the application is to provide an APP security compliance detection system, comprising: The SDK integration module is configured with a security detection SDK, and the SDK encapsulates security detection logic; An elastic security detection chain construction module is configured to adjust the increase, decrease, sequence, depth and range of detection items in the SDK according to a local configuration or a detection strategy issued online, the detection items including a synchronous detection unit, an asynchronous detection unit and a full life cycle detection unit, the synchronous detection unit being configured to perform security detection in a main thread, the asynchronous detection unit being configured to perform security detection in a sub-thread, and the full life cycle detection unit being configured to allocate resources as needed to adapt to different devices and detect security risk events in the full life cycle of the APP. A multi-life cycle switching detection module is configured to monitor according to a corresponding monitoring strategy based on the resource performance environment of the current device, the monitoring strategy including a full life cycle monitoring strategy, an intermittent cycle monitoring strategy, a one-time monitoring strategy or a closed monitoring.

[0011] An abnormal online analysis module is configured to establish an abnormal behavior model by using big data analysis and machine learning technology based on security detection data obtained by the synchronous detection, the asynchronous detection and the full life cycle detection, to perform real-time detection and analysis on application running data, and to generate repair feedback.

[0012] Further, the synchronous detection unit includes an HTTP proxy detection subunit, a VPN detection subunit, a ROOT detection subunit, an emulator detection subunit, a debugger detection subunit, a record permission detection subunit, a man-in-the-middle attack detection subunit and a light problem detection subunit. The asynchronous detection unit includes a DNS hijacking detection subunit and a result reporting subunit. The full life cycle detection unit includes an application crash detection subunit and an application lag detection subunit.

[0013] Another object of the present application is to provide an electronic device comprising a processor and a memory storing a computer program, wherein the processor implements the APP security compliance detection method provided in the first object of the present application when executing the computer program.

[0014] Another object of the present application is to provide a computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the APP security compliance detection method provided in the first object of the present application.

[0015] Another object of the present application is to provide a server comprising at least one processor and a memory in communication connection with the processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to cause the at least one processor to execute the APP security compliance detection method provided in the first object of the present application.

[0016] Compared with the prior art, the application has the beneficial effects as follows: The application provides a security detection capability in the form of SDK, avoids direct deep kernel layer operation, and reduces the technical threshold and stability risk of APP integration.

[0017] The application combines synchronous detection and asynchronous detection, ensures timely response of key security events (synchronous detection), and avoids long-term occupation of main thread resources (asynchronous detection).

[0018] The application combines synchronous detection and asynchronous detection, and covers the whole life cycle detection, ensures timely response of key security events, and reduces the influence on user experience.

[0019] The application has the beneficial effects as follows: 1. Development integration and cost optimization: The SDK integration mode enables developers to easily add security functions to APPs without studying underlying technologies, reduces the development threshold and cost, avoids complex kernel operations, reduces unstable factors in integration, facilitates later upgrade and compatibility, and reduces maintenance cost.

[0020] 2. Performance resource and experience improvement: Synchronous detection quickly responds to security events to ensure APP security, asynchronous detection runs in a sub-thread to improve response speed and smoothness, and whole life cycle detection allocates resources as needed to adapt to different devices, reduce interference of security problems, and improve user satisfaction.

[0021] 3. Security guarantee and market development: The application comprehensively detects various levels of security problems, effectively prevents data leakage and malicious attacks, and protects the information security of APPs and users; helps APPs to meet security standards, reduces legal risks, improves security and user experience, and enhances market competitiveness.

[0022] In summary, the application effectively solves multiple technical problems in the current mobile application security field through its comprehensive security detection capability, and provides strong security guarantee for developers. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of the application, and are incorporated in and constitute a part of the specification, illustrate embodiments of the application, and are used to explain the present application, but are not used to limit the present application. In the drawings: Figure 1 is a flowchart of the APP security compliance detection method provided by the embodiment of the application; Figure 2 is a switching flowchart of the multi-life cycle detection provided by the embodiment of the application; Figure 3 is an architecture diagram of the elastic security detection chain provided by the embodiment of the application; Figure 4 is a structure principle diagram of the APP security compliance detection system provided by the embodiment of the application. DETAILED DESCRIPTION

[0024] The preferred embodiments of the application are described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to explain and illustrate the application, and are not used to limit the application.

[0025] Embodiment 1: As shown in Figure 1 , it is one embodiment of the APP security compliance detection method provided by the application, comprising the following steps: S1: configuring a security detection SDK to the APP, the SDK encapsulating security detection logic; S2: building an elastic security detection chain: based on the detection strategy configured locally or issued online, adjusting the increase, order, depth and range of the detection items in the SDK, the detection items including synchronous detection, asynchronous detection and full life cycle detection, the synchronous detection being used for performing security detection in the main thread, the asynchronous detection being used for performing security detection in the sub-thread, and the full life cycle detection being used for assigning resources as needed to adapt to different devices and detecting security risk events in the full life cycle of the APP; S3: multi-life cycle switching detection: according to the resource performance environment of the current device, using the corresponding monitoring strategy for monitoring, the monitoring strategy including full life cycle monitoring strategy, intermittent cycle monitoring strategy, one-time monitoring strategy or closing monitoring; S4: abnormal online analysis: based on the security detection data obtained by the synchronous detection, asynchronous detection and full life cycle detection, using big data analysis and machine learning technology to establish an abnormal behavior model, detecting and analyzing the application running data in real time, and generating repair feedback.

[0026] The application avoids direct deep kernel layer operation by providing a security detection capability in the form of SDK, reduces the technical threshold and stability risk of APP integration. The SDK encapsulates complex security detection logic, and the developer only needs to integrate it simply to use, without the need to deeply understand the underlying technical details. Through the flexible combination of synchronous detection and asynchronous detection, both the timely response of key security events (synchronous detection) and the avoidance of long-term occupation of main thread resources (asynchronous detection) are ensured. Asynchronous detection is executed in a sub-thread, reducing the impact on the APP main thread and improving user experience. At the same time, lightweight security issues that affect user transaction experience are specially designed to ensure the security and smoothness of users when using the APP.

[0027] As preferred, the synchronous detection in the embodiment of the application includes HTTP proxy detection, VPN detection, ROOT detection, emulator detection, debugger detection, record permission detection, man-in-the-middle attack detection and light problem detection; the asynchronous detection detects DNS hijacking, and after identifying the DNS hijacking scene, the hijacked URL-IP is encrypted and reported; the full life cycle detection includes application crash detection and application jitter detection.

[0028] Specifically, the detection capability of the application includes three types: synchronous detection, asynchronous detection and full life cycle detection. The synchronous detection and asynchronous detection are executed immediately when the strategy chain detection is started, the difference being that the synchronous detection is performed in the main thread, the asynchronous detection is processed in a single sub-thread, and the full life cycle detection is detected in the full life cycle of the APP, and is reported at any time.

[0029] 1. Synchronous detection technology is an important part of mobile application security, aiming to protect user data security and application integrity. The following is a detailed explanation of these detection technologies: (1) HTTP proxy detection Purpose: Identify whether the user device connects to the Internet through an HTTP proxy. HTTP proxy may allow data to be intercepted or tampered with by an intermediate person during transmission, increasing the risk of data leakage.

[0030] Implementation: The SDK checks network connection information such as IP address, port number, etc. to determine whether there is an HTTP proxy. Once proxy information is identified, the SDK will report it immediately.

[0031] (2) VPN detection Purpose: Identify whether the user device connects to the Internet through a VPN (Virtual Private Network). VPN may bypass regional restrictions, but may also be used for illegal access or data theft.

[0032] Implementation: The SDK determines whether there is a VPN connection by checking network configuration, DNS resolution results, and other information. Once VPN information is identified, the SDK immediately reports it.

[0033] (3) ROOT detection Purpose: Determine whether the device has been rooted. Rooted devices have higher permissions and may be used by malicious applications to steal, tamper with, or hijack user data.

[0034] Implementation: The SDK determines whether the device is rooted by checking system files, permission status, and other information. Once a rooted state is identified, the SDK triggers a risk event report.

[0035] (4) Emulator detection Purpose: Identify whether the user's device is an emulator. User behavior in an emulator environment may be completely controlled by the emulator holder and does not belong to the normal user usage environment.

[0036] Implementation: The SDK determines whether it is an emulator by checking device hardware information, system fingerprints, and other information. Once an emulator environment is identified, the SDK triggers a risk event report.

[0037] (5) Debugger detection Purpose: Determine whether the application is being debugged. Debugging mode may expose the internal logic and sensitive information of the application, which can be exploited by malicious users for attacks.

[0038] Implementation: The SDK determines whether the application is being debugged by checking system processes, debugging flags, and other information. Once a debugging state is identified, the SDK triggers a risk event report.

[0039] (6) Record permission detection Purpose: Help the host APP update the "Privacy Policy" in a timely manner to avoid compliance risks. By checking the APP's permission registration list, determine whether there are new sensitive permissions registered by third-party SDKs.

[0040] Implementation: The SDK compares the recorded permissions configured by the host APP with the actual registered permission list to discover potential permission abuse issues. Once an anomaly is found, the SDK triggers a risk event report.

[0041] (7) Man-in-the-middle attack detection Purpose: Based on HTTP detection, combined with the judgment of WiFi connection state, more accurately identify the man-in-the-middle attack scenario. Man-in-the-middle attacks may intercept, tamper with, or steal user data.

[0042] Implementation: The SDK determines whether there is a man-in-the-middle attack by checking network connection information, certificate status, etc. Once the attack scenario is identified, the SDK will immediately report it.

[0043] (8) "Light" problem detection Purpose: Around the user experience of financial services, it points out how various settings and problems affect customers' daily use Implementation: Monitor the status of the customer's device and provide prompts.

[0044] 2. In asynchronous detection, detection of DNS hijacking is crucial. DNS hijacking is a network attack method in which attackers tamper with DNS records to redirect users to malicious phishing websites, thereby stealing users' passwords, personal privacy information, and other sensitive content. To deal with this threat, the SDK will encrypt and report the hijacked URL-IP after identifying the DNS hijacking scenario, so that timely measures can be taken to protect user safety.

[0045] DNS hijacking detection: Purpose: To discover and report DNS hijacking events in a timely manner, prevent users from being redirected to malicious websites, and protect users' passwords, personal privacy information, and other sensitive content from being stolen.

[0046] Implementation: SDK integrates detection module: The SDK integrates a DNS hijacking detection module that can monitor the DNS query and response process and analyze changes in DNS records. Once a DNS hijacking event is detected, the SDK will encrypt the hijacked URL-IP to ensure data security during transmission, and then report it to the server. Combined with various detection methods (such as passive monitoring, active detection, command line tools, etc.) and contextual information (such as user behavior, network environment, etc.), comprehensive judgment is made to improve the accuracy and reliability of detection.

[0047] 3. Full life cycle detection: Full life cycle detection is the ability to detect security risks during the entire life cycle of an APP. Currently, this plugin supports application crash detection.

[0048] (1) Application crash detection: Purpose: Application crash detection aims to discover and report APP crash events in a timely manner, so that developers can quickly locate problems, fix vulnerabilities, and restore normal business operation to improve user experience. Through full life cycle application crash detection, the stability and reliability of the APP in different stages and scenarios can be ensured.

[0049] Implementation: The SDK integrates crash log capture function, which can automatically capture crash logs when the APP crashes, including crash time, crash reason, stack information and other key information. The crash log capture function needs to ensure that it can execute normally when the APP crashes, and will not interfere with the normal operation of other systems. The captured crash logs need to be encrypted to ensure the security of the data during transmission. The encrypted crash logs are reported to the server or cloud platform designated by the developer, so that the developer can analyze and process them later. Developers can analyze the reported crash logs in real time through the server or cloud platform to quickly locate the problem. According to the analysis results, developers can develop appropriate repair solutions and release updates in a timely manner to restore the normal operation of the APP. At the same time, developers can also continuously improve and optimize the APP according to the statistical information of the crash logs to improve user experience and stability.

[0050] (2) Application card detection: Purpose: Application card detection aims to timely discover and report APP card events so that developers can quickly locate problems, fix vulnerabilities, and restore normal business operation to improve user experience. Through full-life-cycle application crash detection, the stability and reliability of the APP in different stages and different scenarios can be ensured.

[0051] The elastic security detection chain in the embodiment of the application supports local preset policy chain and server-side issued policy chain. The policy chain can increase or decrease detection items and adjust the order according to different business needs and compliance requirements, such as not configuring weak security detection items if the APP only needs to meet the security conditions of compliance agencies, that is, only detecting serious security problems. The policy can configure life cycle detection conditions, such as "man-in-the-middle attack detection" which can be used for detection only at startup or full life cycle detection according to the alert strength of the APP to hijacking attacks.

[0052] As preferred, the specific steps of the multi-life-cycle switching detection in the embodiment of the application include: reading device parameters, evaluating the resource performance environment of the current device according to the device parameters, the resource performance environment including high resource performance environment, medium resource performance environment, low resource performance environment and extremely poor resource performance environment; if the device is in a high resource performance environment, use a full life cycle monitoring strategy for monitoring; if the device is in a medium resource performance environment, use an intermittent cycle monitoring strategy for monitoring; if the device is in a low resource performance environment, use a one-time monitoring strategy for monitoring; if the device is in an extremely poor resource performance environment, turn off the monitoring.

[0053] Specifically, as Figure 2As shown, the flow of multi-life cycle detection starts from the "start monitoring" node, followed by the step of "read device parameters". After completing parameter reading, the system enters the "evaluate the current device resource performance environment" link to assess the performance state of the device currently in.

[0054] The performance environment of mobile phone resources is divided into three levels: high resource performance environment, medium resource performance environment, and low resource performance environment.

[0055] High resource performance environment: when CPU usage is low, memory usage is moderate, storage space is sufficient, network connection is stable, and battery power is high, it can be determined that the mobile phone is in a high resource performance environment. At this time, the performance of the mobile phone is in a relatively optimal state, and it can smoothly run large applications and multi-task processing.

[0056] Medium resource performance environment: if CPU usage is moderate, memory usage is high, storage space is relatively tight, network connection is general, and battery power is moderate, it can be determined that the mobile phone is in a medium resource performance environment. At this time, the performance of the mobile phone is relatively general, and it may not be able to run large applications smoothly, but basic functions can still be guaranteed.

[0057] Low resource performance environment: when CPU usage is too high, memory usage is close to saturation, storage space is insufficient, network connection is unstable, and battery power is low, it can be determined that the mobile phone is in a low resource performance environment. At this time, the performance of the mobile phone is greatly affected, and may appear to be lagging, slow or even no response.

[0058] In the process of determining the current resource performance state, we also need to consider some special environmental states, such as the extremely poor resource performance environment. This environment is usually characterized by serious over-standard of mobile phone parameters, such as CPU usage reaching the peak, memory almost full, storage space severely insufficient, network connection extremely poor, and battery power extremely low. At this time, the mobile phone may not be able to function normally and needs to be optimized or maintained immediately.

[0059] The results of the evaluation will determine the next processing path: If the device is in "high resource performance environment", use "full life cycle monitoring strategy" for monitoring.

[0060] If the device is in "medium resource performance environment", use "intermittent cycle monitoring strategy" for monitoring.

[0061] If the device is in "low resource performance environment", use "one-time monitoring strategy" for monitoring.

[0062] If the device is in "extremely poor resource performance environment", turn off the monitoring.

[0063] According to the selected monitoring strategy, the monitoring is implemented. After the monitoring is completed, the process returns to the "start monitoring" node, and prepares for the next round of device monitoring.

[0064] This process ensures that the device can adopt appropriate monitoring strategies in different performance environments, avoiding continuous monitoring in poor resource conditions to save resources and improve monitoring efficiency.

[0065] As a preferred, the specific steps of the abnormal online analysis in the embodiment of the application include: Data collection and preprocessing: Use the client to collect the fault information of the device, such as network environment, problem stack, abnormal website, etc., and extract time features, environment features and user behavior features from the fault information; Model design and training: According to the abnormal detection target and data characteristics, select the model type, such as statistical-based model, machine learning-based model or deep learning-based model, and design the model architecture, such as support vector machine (SVM), random forest, long short-term memory network (LSTM) or autoencoder.

[0066] Train the model using the training set, adjust the hyperparameters to optimize the model performance, evaluate the model using the validation set and test set, and ensure the accuracy and generalization ability of the model on unknown data; It should be noted that the validation set and the test set are divided from the entire data set, and in the data preprocessing stage, the entire data set is usually divided into a training set, a validation set and a test set, such as a division ratio of 70% (training set), 15% (validation set) and 15% (test set).

[0067] Abnormal detection and positioning: Use the trained model for real-time monitoring and report data for analysis.

[0068] The embodiment of the application is based on the security detection data reported by synchronous detection, asynchronous detection and full life cycle detection, uses big data analysis, machine learning and other technologies to detect and analyze application running data in real time, establishes an abnormal behavior model, accurately locates problems, and quickly feeds back to the development for corresponding repair online work. This part uses an agent platform to realize, and the main implementation process is to fill the historical data and collected data into the knowledge base, and the agent performs learning, training and other operations, and then provides abnormal judgment ability to the outside through the interface.

[0069] For example, Figure 3The diagram illustrates the operational architecture of the elastic security detection chain. First, the security detection chain management module at the server level configures the security detection chain's parameters and persists these parameters. Then, the communication subsystem transmits these parameters to the application. The application's security detection chain module persists the received configuration parameters and flexibly adjusts the detection items based on the phone's resource performance environment. Finally, corresponding synchronous detection, anomaly detection, and full lifecycle detection are performed according to the determined detection chain.

[0070] The APP feeds back the security detection data collected by synchronous detection, anomaly detection and full life cycle detection to the server layer through the communication subsystem. The problem analysis module in the server layer uses methods such as large model to perform online problem analysis on the security detection data, detects the fault information of the device in the security detection data, and uses the problem dashboard to intuitively display the fault information.

[0071] Example 2: like Figure 4 As shown in the figure, this embodiment of the invention provides an APP security compliance detection system, including: The SDK integration module is used to configure the security detection SDK for the APP. This SDK encapsulates the security detection logic. The elastic security detection chain construction module is used to adjust the addition, deletion, order, depth, and scope of detection items in the SDK according to local configuration or offline detection strategies. The detection items include synchronous detection units, asynchronous detection units, and full lifecycle detection units. The synchronous detection units are used to perform security detection on the main thread, the asynchronous detection units are used to perform security detection on the child thread, and the full lifecycle detection units are used to allocate resources as needed to adapt to different devices and detect security risk events throughout the entire lifecycle of the APP. The multi-lifecycle switching detection module is used to monitor the current resource performance environment of the device using corresponding monitoring strategies. The monitoring strategies include full lifecycle monitoring strategy, intermittent periodic monitoring strategy, one-time monitoring strategy, or monitoring shutdown strategy.

[0072] The online anomaly analysis module is used to build anomaly behavior models based on security detection data obtained from synchronous detection, asynchronous detection, and full lifecycle detection, and to perform real-time detection and analysis of application operation data, and generate remediation feedback.

[0073] As preferred, the synchronous detection unit in the embodiment of the application comprises an HTTP proxy detection subunit, a VPN detection subunit, a ROOT detection subunit, an emulator detection subunit, a debugger detection subunit, a record permission detection subunit, a man-in-the-middle attack detection subunit and a light problem detection subunit; the asynchronous detection unit comprises a DNS hijacking detection subunit and a result reporting subunit; and the full life cycle detection unit comprises an application crash detection subunit and an application lag detection subunit.

[0074] The SDK integration module in the embodiment of the application enables developers to easily add security functions to APPs without studying underlying technologies, reduces development threshold and cost, avoids complex kernel operations, reduces unstable factors in integration, facilitates later upgrade compatibility and reduces maintenance cost. The elastic security detection chain construction module constructs a detection chain that can flexibly adjust detection links, order, depth and range, adapts to different scenarios, threat types and user needs. The online security detection chain is supported, and the security detection scenario, type and the like are dynamically adjusted. The multi-life cycle switching detection module comprehensively uses the synchronous detection unit (real-time detection and response for key security events), the asynchronous detection unit (detection in a sub-thread to avoid occupation of main thread resources) and the full life cycle detection unit (covering all stages from application development to maintenance), to provide all-round security protection for the application. The abnormal online analysis module uses big data analysis, machine learning and other technologies to detect and analyze application running data in real time, establishes an abnormal behavior model and accurately locates problems.

[0075] Embodiment 3 The embodiment of the application provides an electronic device, including a processor and a memory storing a computer program, and the processor implements the APP security compliance detection method provided in the embodiment 1 of the application when executing the computer program.

[0076] Embodiment 4 The embodiment of the application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the APP security compliance detection method provided in the embodiment 1 of the application.

[0077] Embodiment 5 The embodiment of the application provides a server, including at least one processor and a memory in communication connection with the processor, the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to enable the at least one processor to execute the APP security compliance detection method provided in the embodiment 1 of the application.

[0078] It should be understood that, although the steps in the flowcharts of the embodiments of the present application are shown in a certain order according to the arrows, the steps are not necessarily executed in the order of the arrows. Unless otherwise specified in the present application, the execution of the steps is not strictly limited in order, and the steps can be executed in other orders. Moreover, at least some of the steps in the embodiments can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of the sub-steps or stages is not necessarily sequential, but can be alternated or interlaced with at least part of other steps or sub-steps or stages of other steps.

[0079] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments of the methods. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0080] Finally, it should be noted that: the above only describes the preferred embodiments of the present application, and is not used to limit the present application, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An APP security compliance detection method, characterized in that, The method comprises: configuring a security detection SDK for the APP, the SDK encapsulating security detection logic; building a flexible security detection chain: based on a locally configured or online issued detection strategy, adjusting the increase, order, depth and range of detection items in the SDK, the detection items including synchronous detection, asynchronous detection and full life cycle detection, the synchronous detection being used for performing security detection in a main thread, the asynchronous detection being used for performing security detection in a sub-thread, and the full life cycle detection being used for assigning resources as needed to adapt to different devices and detecting security risk events in the full life cycle of the APP; multi-life cycle switching detection: based on the resource performance environment of the current device, using a corresponding monitoring strategy for monitoring, the monitoring strategy including a full life cycle monitoring strategy, an intermittent cycle monitoring strategy, a one-time monitoring strategy or a closed monitoring; abnormal online analysis: based on security detection data obtained through synchronous detection, asynchronous detection and full life cycle detection, using big data analysis and machine learning technology to establish an abnormal behavior model, performing real-time detection and analysis on application running data, and generating a repair feedback.

2. The APP security compliance detection method of claim 1, wherein, The synchronous detection includes HTTP proxy detection, VPN detection, ROOT detection, emulator detection, debugger detection, record permission detection, man-in-the-middle attack detection and light problem detection; The asynchronous detection is used for detecting DNS hijacking, and after a DNS hijacking scenario is identified, a hijacked URL-IP is encrypted and reported; The full life cycle detection includes application crash detection and application jitter detection.

3. The APP security compliance detection method of claim 1, wherein, The specific steps of the multi-life cycle switching detection include: reading device parameters, evaluating the resource performance environment of the current device according to the device parameters, the resource performance environment including high resource performance environment, medium resource performance environment, low resource performance environment and extremely poor resource performance environment; if the device is in a high resource performance environment, using a full life cycle monitoring strategy for monitoring; if the device is in a medium resource performance environment, using an intermittent cycle monitoring strategy for monitoring; if the device is in a low resource performance environment, using a one-time monitoring strategy for monitoring; if the device is in an extremely poor resource performance environment, closing the monitoring.

4. The APP security compliance detection method of claim 3, wherein, The device parameters include CPU usage, memory occupation, storage space, network stability and battery capacity.

5. The APP security compliance detection method of claim 1, wherein, The specific steps of the abnormal online analysis include: data collection and preprocessing: collecting fault information of the device using the client, and extracting time features, environment features and user behavior features from the fault information; model design and training: selecting a model type, designing a model architecture, training the model using a training set, adjusting hyperparameters to optimize the performance of the model, evaluating the model using a validation set and a test set, and ensuring the accuracy and generalization ability of the model on unknown data; abnormal detection and positioning: using the trained model for real-time monitoring and reporting data for analysis.

6. An APP security compliance detection system characterized in that, The system comprises: an SDK integration module configured to configure a security detection SDK for the APP, the SDK encapsulating security detection logic; An elastic security detection chain construction module is configured to adjust the increase, decrease, sequence, depth and range of detection items in the SDK according to a local configuration or an online issued detection strategy, the detection items including a synchronous detection unit, an asynchronous detection unit and a full life cycle detection unit, the synchronous detection unit being configured to perform security detection in a main thread, the asynchronous detection unit being configured to perform security detection in a sub-thread, and the full life cycle detection unit being configured to allocate resources as needed to adapt to different devices and detect security risk events in the full life cycle of the APP; A multi-life cycle switching detection module is configured to monitor according to a corresponding monitoring strategy based on the resource performance environment of the current device, the monitoring strategy including a full life cycle monitoring strategy, an intermittent cycle monitoring strategy, a one-time monitoring strategy or a closed monitoring; An abnormal online analysis module is configured to establish an abnormal behavior model by using big data analysis and machine learning technology based on security detection data obtained by synchronous detection, asynchronous detection and full life cycle detection, to perform real-time detection and analysis on application running data, and to generate repair feedback.

7. The APP security compliance detection system of claim 6, wherein, The synchronous detection unit includes an HTTP proxy detection subunit, a VPN detection subunit, a ROOT detection subunit, an emulator detection subunit, a debugger detection subunit, a record permission detection subunit, a man-in-the-middle attack detection subunit and a light problem detection subunit; The asynchronous detection unit includes a DNS hijacking detection subunit and a result reporting subunit; The full life cycle detection unit includes an application crash detection subunit and an application lag detection subunit.

8. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that, The processor executes the computer program to implement the APP security compliance detection method of any one of claims 1 to 5.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the APP security compliance detection method of any one of claims 1 to 5.

10. A server, characterized by: The computer program is executed by the processor to implement the APP security compliance detection method of any one of claims 1 to 5. The computer program is executed by the processor to implement the APP security compliance detection method of any one of claims 1 to 5.

Images