Application risk prompting method and device and computer readable storage medium

Abstract

The embodiment of the invention provides an application risk prompting method and device and a computer readable storage medium, and relates to the technical field of terminals. According to the method, the page feature of the first page which is displayed by the current application and comprises the sensitive component is obtained, the risk condition of the first page is detected according to the page feature of the first page, and the risk prompt used for prompting that the application is the abnormal application is output under the condition that the page feature of the first page represents that the first page has the risk. Therefore, when the user inputs the sensitive information through the sensitive component, the risk prompt can be directly carried out on the abnormal application, the leakage probability of the sensitive information of the user is reduced, and the safety of the user information is guaranteed.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to an application risk warning method, device and computer-readable storage medium. Background Technology

[0002] With the development of terminal application technology, the types of applications on terminals are also increasing, covering all aspects of daily life. Examples include mobile payment, social networking, and work. These scenarios often involve operations related to user privacy and financial security. For instance, in mobile payment applications, users enter their account and password through the payment application running on their terminal. Entering account and password is an operation that involves user privacy and financial security.

[0003] Since most interface elements used in highly sensitive scenarios are not significantly different, malicious applications and plugins may imitate these interface elements. For example, they might imitate the payment pop-up of a payment application, causing users to enter their account information and password in the fake pop-up, resulting in the leakage of users' privacy information and affecting their financial security. Summary of the Invention

[0004] Based on the above research, this application provides an application risk warning method, device, and computer-readable storage medium, which can prevent information leakage from users in scenarios with security risks and ensure the security of user information.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] In a first aspect, an application risk warning method is provided. The method includes: displaying a first page of the application, the first page including sensitive components, the sensitive components being components on the first page used for users to input sensitive information; and outputting a risk warning when the page features of the first page indicate that the first page has risks, the risk warning being used to indicate that the application is an abnormal application, the page features including one or more of the following: page text information of the first page, page component tree, page image, page jump relationship of the first page, and application name of the application.

[0007] The solution provided in the second aspect above obtains the page features of the first page displayed by the current application, including sensitive components. Based on these features, it detects the risk level of the first page. If the page features indicate that the first page poses a risk, it outputs a risk warning indicating that the application is abnormal. In this way, risk warnings can be directly issued to abnormal applications when the user inputs sensitive information through sensitive components, reducing the probability of leakage of sensitive user information and ensuring the security of user information.

[0008] For example, risk warnings can be displayed as pop-up windows.

[0009] For example, sensitive information may include user account, password, iris, fingerprint, facial image, etc.

[0010] For example, a sensitive component could be a visual component on the first page.

[0011] As one possible implementation, if the page features of the first page indicate that the first page poses a risk, the method further includes: displaying a first component and a second component on the first page; receiving user input on the first component and exiting the application; or, receiving user input on the second component, stopping the output of the application's risk warning, and continuing to run the application. Thus, by displaying components that control the application, abnormal applications can be intercepted directly during the user's input of sensitive information, reducing the probability of sensitive information leakage and improving the security of sensitive information.

[0012] As one possible implementation, the method further includes: obtaining risk information for the first page based on the matching results between the page features of the first page and the features of the sample page; the risk information is used to determine whether the first page poses a risk. Thus, by using the features of the sample page as a comparison basis to perform anomaly identification on the first page, including sensitive components, the risk of the page can be accurately identified.

[0013] For example, the page features of the first page indicate that there is a risk on the first page, that is, the risk information on the first page meets the preset conditions.

[0014] For example, sample page features may include sensitive word features, component features, image features, jump relationship features, application whitelist, and tag features. Sensitive word features, component features, image features, and jump relationship features are features collected from normal application pages.

[0015] For example, the terminal can detect whether the first page meets the risk conditions based on the matching results between the page features of the first page and the features of the sample page. If the risk conditions are met, the terminal can obtain risk information indicating a higher degree of risk. If the risk conditions are not met, the terminal can obtain risk information indicating a lower degree of risk. The risk conditions include one or more of the following: the application corresponding to the first page is an untrusted application, the first page contains sensitive information, or the first page exhibits an anomaly.

[0016] As one possible implementation, risk information for the first page is obtained based on the matching results between the page features of the first page and the features of the sample page. This includes: determining the degree of anomalousness of the first page in risk items based on the matching results; and obtaining risk information for the first page based on the degree of anomalousness of the first page in risk items. The risk items include one or more of the following: application credibility, page sensitivity, and page anomaly. Thus, by using the features of the sample page as a comparison basis to detect the degree of anomalousness of the first page in risk items, and by identifying anomalies in the first page, including sensitive components, based on the degree of anomalousness of the first page in risk items, the risk of the page can be accurately identified.

[0017] As one possible implementation, the degree of anomalousness of the first page in risk items is obtained based on the matching results of the page features of the first page and the features of the sample page. This includes: obtaining the degree of anomalousness of the first page in application trustworthiness based on the matching results of the application name and the application whitelist and tag features in the features of the sample page; and / or, obtaining the degree of anomalousness of the first page in page sensitivity based on the matching results of the page text information of the first page and the sensitive word features in the features of the sample page, and the matching results of the page image of the first page and the image features in the features of the sample page; and / or, obtaining the degree of anomalousness of the first page in page anomaly based on the matching results of the page component tree of the first page and the component tree features in the features of the sample page, and the matching results of the page jump relationship of the first page and the jump relationship features in the features of the sample page. Thus, by collecting page features from normal application pages to construct sample page features, and using these sample page features as a comparison basis, the degree of anomalousness of the first page in risk items is detected. Based on the degree of anomalousness of the first page in risk items, anomaly identification can be performed on the first page, including sensitive components, thereby accurately identifying the risk of the page.

[0018] For example, after obtaining the degree of abnormality of the first page for each risk item, the terminal can calculate the abnormality index value of the first page for each risk item, and obtain the risk information of the first page based on the abnormality index value of the first page for each risk item.

[0019] For example, the terminal can multiply the abnormality levels of each risk item on the first page and determine the multiplied value as the abnormality indicator value. If the abnormality indicator value exceeds a set abnormality threshold, a risk warning will be output.

[0020] As one possible implementation, the method further includes: receiving updated features sent by a server, the updated features including one or more of the following: sensitive word features, image features, component tree features, jump relationship features, and application whitelist; and updating the sample page features according to the updated features. Thus, by updating the sample page features, the accuracy of anomaly detection can be improved, and the security of user sensitive information can be enhanced.

[0021] As one possible implementation, the method further includes: assigning a first label to the application based on user actions on the first component, the first label being used to characterize the application as untrustworthy; and updating sample page features based on the first label. Thus, by labeling the application through user actions on the component and updating the sample page features based on the label, the efficiency and accuracy of subsequent anomaly identification can be improved.

[0022] As one possible implementation, the method further includes: the second component comprising a first trusted component and a second trusted component; the method further includes: assigning a second mark to the application based on the user's operation on the first trusted component, the second mark being used to characterize the application's trustworthiness; updating sample page features based on the second mark; or, not marking the application based on the user's operation on the second trusted component. Thus, by displaying components, users can easily operate the application through these components, improving the convenience of user operation, while also reducing the probability of sensitive information leakage and improving the security of sensitive information. Furthermore, the user's operation on the components, marking the application, and updating the sample page features based on the mark can improve the efficiency and accuracy of subsequent anomaly identification.

[0023] Secondly, an application risk warning device is provided, including a display module and an interception module; the display module is used to display the first page of the application, the first page includes sensitive components, the sensitive components being components on the first page used for users to input sensitive information; the interception module is used to output a risk warning when the page features of the first page indicate that the first page has risks, the risk warning is used to indicate that the application is an abnormal application, and the page features include one or more of the following: page text information of the first page, page component tree, page image, page jump relationship of the first page, and application name of the application.

[0024] For example, the page anomaly identification module further includes a page feature acquisition module, which is used to acquire the page features of the first page.

[0025] As one possible implementation, if the page features of the first page indicate that the first page has a risk, the interception module is also used to: display the first component and the second component on the first page; receive the user's operation on the first component and exit the application; or, receive the user's operation on the second component, stop outputting the application's risk warning, and continue running the application.

[0026] As one possible implementation, the application risk warning device further includes a page anomaly identification module, which is used to: obtain risk information of the first page based on the matching result of the page features of the first page and the features of the sample page; the risk information is used to determine whether there is a risk on the first page.

[0027] As one possible implementation, the page anomaly identification module is specifically used to: obtain the degree of anomaly of the first page in the risk item based on the matching result of the page features of the first page and the features of the sample page; and obtain the risk information of the first page based on the degree of anomaly of the first page in the risk item; wherein, the risk item includes one or more of the following: application credibility, page sensitivity, and page anomaly.

[0028] As one possible implementation, the page anomaly identification module is specifically used to: determine the degree of anomaly in the application credibility of the first page based on the matching results of the application name and the application whitelist and tag features in the sample page features; and / or, determine the degree of anomaly in page sensitivity based on the matching results of the page text information of the first page and the sensitive word features in the sample page features, and the matching results of the page image of the first page and the image features in the sample page features; and / or, determine the degree of anomaly in the page anomaly based on the matching results of the page component tree of the first page and the component tree features in the sample page features, and the matching results of the page jump relationship of the first page and the jump relationship features in the sample page features.

[0029] As one possible implementation, the page anomaly identification module is also used to: receive updated features sent by the server, the updated features including one or more of the following: sensitive word features, image features, component tree features, jump relationship features, application whitelist; and update the sample page features according to the updated features.

[0030] As one possible implementation, the page anomaly identification module is also used to: mark the application with a first tag based on the user's operation on the first component, the first tag being used to characterize the application as untrustworthy; and update the sample page features based on the first tag.

[0031] In one possible implementation, the second component includes a first trust component and a second trust component; the page anomaly identification module is further configured to: mark the application with a second mark based on the user's operation on the first trust component, the second mark being used to characterize the application as trustworthy; update the sample page features based on the second mark; or, not mark the application based on the user's operation on the second trust component.

[0032] The beneficial effects of the solution provided in the second aspect described above can be found in the description of any embodiment in the first aspect, and will not be repeated here. The controller has the function of implementing the behavior in the method examples of any embodiment in the first aspect described above. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0033] Thirdly, a server is provided, which is used to: obtain first sample page features, the first sample page features including one or more of the following: sensitive word features of normal application pages, image features of normal application pages, component tree features of normal application pages, jump relationship features of normal application pages, and application whitelist; and send the first sample page features to a terminal, so that the terminal can perform risk identification on the first page of the displayed application, the first page including sensitive components.

[0034] For example, the server includes a feature server and an application server.

[0035] Fourthly, an apparatus is provided, comprising: a memory and a processor; the memory and the processor being coupled, the processor being configured to execute a computer program stored in the memory, such that the apparatus performs a method as described in any of the possible embodiments of the first aspect.

[0036] Fifthly, an application risk warning system is provided, including a terminal and a server; wherein the server is used to obtain first sample page features, the first sample page features including one or more of the following: sensitive word features of normal application pages, image features of normal application pages, component tree features of normal application pages, jump relationship features of normal application pages, and application whitelist, and the server sends the first sample page features to the terminal.

[0037] The terminal is used to collect features of the second sample page, which include marker features.

[0038] The terminal is used to identify risks in the first page of the displayed application based on the characteristics of the first sample page and the characteristics of the second sample page. The first page includes sensitive components, which are components on the first page used for users to input sensitive information. When the page characteristics of the first page indicate that the first page has risks, a risk warning is output. The risk warning is used to indicate that the application is an abnormal application. The page characteristics of the first page include one or more of the following: page text information of the first page, page component tree, page image, page jump relationship of the first page, and application name.

[0039] For example, the server includes a feature server and an application server.

[0040] In a sixth aspect, a computer-readable storage medium is provided, comprising a computer program or instructions that, when executed on a computer, cause the computer to perform a method as described in any of the possible implementations of the first aspect.

[0041] In a seventh aspect, a computer program product is provided, comprising: a computer program or instructions that, when executed on a computer, cause the computer to perform a method as described in any of the possible implementations of the first aspect. Attached Figure Description

[0042] Figure 1 A schematic diagram of an interface element in a highly sensitive scenario provided in an embodiment of this application;

[0043] Figure 2 A schematic diagram illustrating the principle of malicious applications using counterfeit interface elements to obtain sensitive information;

[0044] Figure 3 This is a schematic diagram of the system to which the application risk warning method provided in the embodiments of this application applies;

[0045] Figure 4 A schematic diagram of the structure of a terminal provided in an embodiment of this application;

[0046] Figure 5 A software structure block diagram of the terminal provided in the embodiments of this application;

[0047] Figure 6 This is a schematic diagram of the functional modules of the application anomaly identification service provided in the embodiments of this application;

[0048] Figure 7 A flowchart illustrating the application risk warning method provided in this application embodiment;

[0049] Figure 8 A schematic diagram of the user interface of the terminal provided in the embodiments of this application;

[0050] Figure 9 A schematic diagram illustrating the terminal receiving user operations and loading / displaying a page, as provided in an embodiment of this application;

[0051] Figure 10 One of the page illustrations of the first page provided in the embodiments of this application;

[0052] Figure 11 A schematic diagram illustrating the principle of a page event listening module for listening to and detecting pages, as provided in an embodiment of this application.

[0053] Figure 12 A schematic diagram illustrating the principle of constructing sample page features as provided in this application embodiment;

[0054] Figure 13 A schematic diagram illustrating the principle of page anomaly identification provided in this application embodiment;

[0055] Figure 14 A second schematic diagram of the first page provided for embodiments of this application;

[0056] Figure 15 A flowchart illustrating the application tagging process provided in this application embodiment;

[0057] Figure 16 A schematic diagram illustrating a scenario for updating sample page features as provided in an embodiment of this application;

[0058] Figure 17 This is a schematic diagram of the application risk warning device provided in the embodiments of this application. Detailed Implementation

[0059] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0060] The terms "comprising" and "having," and any variations thereof, used in the description of the embodiments of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0061] Hereinafter, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature.

[0062] In this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0063] In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone.

[0064] As described in the background section, since most interface elements used in highly sensitive scenarios are not significantly different, malicious applications or plugins may engage in imitation of interface elements in such cases.

[0065] For example, such as Figure 1 As shown in (a), in some account login scenarios, there is no significant difference between the terminal's system input pop-up 1A and the third-party application's input pop-up 1B. For example, as... Figure 1 As shown in (b), in some payment scenarios, there is no significant difference between the payment pop-up window 2A of various payment applications and the payment pop-up window 2B of the terminal. In this case, some malicious applications or malicious plugins may engage in behaviors such as imitating system input pop-ups or payment pop-ups.

[0066] like Figure 2 As shown, when malicious applications or plugins impersonate interface elements, users may enter sensitive information (such as usernames and passwords) into the impersonated interface elements. The malicious applications or plugins can then obtain the sensitive information entered by the user from the impersonated interface elements, access the user's account, and thus cause the leakage of the user's sensitive information or affect the user's property security.

[0067] Currently, to intercept malicious applications and improve user security when using applications, conventional technical solutions involve auditing the security of applications when they are released on app stores. Alternatively, when an application accesses a personal account, in addition to authentication via the user's account and password, it also needs to authenticate via a trusted device or trusted mobile phone number. Only when both authentications are successful can the application access the personal account.

[0068] While reviewing the security of an application during its listing process can be done, it is impossible to prevent applications from imitating UI elements through hot updates or dynamic loading.

[0069] Adding verification when applications access personal accounts cannot completely prevent the leakage of user information (such as account and password leaks), and certain risks still exist. For example, malicious applications can still obtain a user's account and password when the user authenticates, and then log in to other application accounts based on the obtained account and password, thereby causing privacy leaks or financial losses.

[0070] Based on the above research, this application provides an application risk warning method. By acquiring the page features of a first page currently displayed by the application, including sensitive components, and obtaining risk information for the first page based on these features, a risk warning for the application is output when the risk information on the first page meets preset conditions. In this way, risk warnings for abnormal applications can be directly provided during the stage when the user inputs sensitive information through sensitive components, reducing the probability of leakage of user sensitive information and ensuring the security of user information.

[0071] Furthermore, in the embodiments of this application, risk warnings for abnormal applications are directly provided during the stage of user input of sensitive information, which can ensure information security without requiring users to participate in multiple verifications after sensitive information is leaked.

[0072] The application risk warning method provided in this application can be applied to scenarios where users need to input sensitive information in an application. For example, the application risk warning method provided in this application can be applied to scenarios where users enter payment passwords through payment applications. As another example, the application risk warning method provided in this application can also be applied to scenarios where users enter their account and password when logging into social applications. As yet another example, the application risk warning method provided in this application can also be applied to scenarios where users decrypt encrypted files in an application and enter decryption passwords. Furthermore, the application risk warning method provided in this application can also be applied to scenarios where users' fingerprints, iris scans, or facial images are collected when logging into an application.

[0073] It is understood that the above is merely an illustrative example of the application scenarios of the provided application risk warning method in the embodiments of this application, and is not intended as a specific limitation.

[0074] To facilitate understanding, the system architecture to which the application risk warning method provided in this application embodiment applies will be described below. Please refer to [the relevant documentation / reference]. Figure 3 , Figure 3 This is a schematic diagram of the system to which the application risk warning method provided in the embodiments of this application applies. For example... Figure 3 As shown, the system may include at least terminal 100.

[0075] As an example, the terminal 100 in this application embodiment can be a mobile phone, tablet computer, personal computer (PC), computer with wireless transceiver function, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal in industrial control, wireless terminal in self-driving, wireless terminal in remote medical care, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, vehicle terminal, RSU with terminal function, etc. The terminal 100 in this application can also be an on-board module, on-board component, on-board chip, or on-board unit built into a vehicle as one or more components or units. This application embodiment does not limit the specific type of terminal 100.

[0076] In this embodiment, at least one application is installed on the terminal 100. The terminal 100 can run the installed application to provide corresponding application services. The application installed on the terminal 100 can be a system application or a third-party application. System applications refer to those installed on the terminal 100 before it leaves the factory, during the installation of the operating system, such as calendar, weather, and call applications. Third-party applications can be applications downloaded and installed by the user through an application store, such as... wait.

[0077] In some examples, in order for the application to better provide the corresponding services, Figure 3 The system shown may also include an application server 200, which refers to a server used to manage and run applications. The application server 200 can receive requests from applications on terminal 100, perform corresponding processing according to the requests, and return the processing results to terminal 100. Terminal 100 can display the corresponding processing results on the application, thereby better realizing the application's business logic and enabling the application on terminal 100 to better provide the corresponding services.

[0078] In order to intercept malicious applications and improve user security when using applications, in this embodiment of the application, the terminal 100 stores sample page features of each application. The terminal 100 can identify risks in applications during runtime based on the sample page features, thereby intercepting applications that exhibit abnormalities.

[0079] Among them, the sample page features are used to characterize the page features of normal application pages, that is, the page features of risk-free application pages.

[0080] As an example, sample page features, or a portion thereof, can be transmitted from application server 200 to terminal 100. Application server 200 can send page features of the applications it manages to the terminal. After receiving the page features sent by application server 200, terminal 100 stores the page features sent by application server 200 as sample page features.

[0081] Considering that application servers may differ for different applications, in order to reduce the processing load on the terminal and improve terminal security, in some examples, Figure 3 The system shown may further include a feature server 300. The feature server 300 can establish communication connections with each terminal 100 and the application server 200 via a network, thereby enabling information exchange between the feature server 300 and each terminal 100, and between the feature server 300 and the application server 200. This network can be a cellular mobile network (such as a 4th generation (4G) network, a 5th generation (5G) network, etc.) or a wireless local area network (WLAN) (such as a wireless fidelity (Wi-Fi) network). This embodiment does not limit the network type; it can be set according to actual needs.

[0082] As an example, the feature server 300 in this application embodiment can be a cloud server or a physical server. This application embodiment does not limit the specific type of the feature server 300.

[0083] In this embodiment, the feature server 300 can receive page features sent by the application server 200 and send the page features sent by the application server 200 to the terminal 100. Exemplarily, the feature server 300 can provide an application programming interface (API) to the application server 200 through a software development kit (SDK). The application server 200 can call the API to transmit the application's page features to the SDK, and the SDK will then send the page features sent by the application server 200 to the feature server 300. After receiving the page features, the feature server 300 can preprocess the page features and then send the preprocessed page features to the terminal 100. Preprocessing includes, but is not limited to, data cleaning, data transformation, feature selection, and anomaly handling.

[0084] After receiving page features, terminal 100 can store them as sample page features. Thus, when an application runs on terminal 100, terminal 100 can identify risks in the application based on the stored sample page features, thereby intercepting any abnormal applications.

[0085] In some examples, terminal 100 can also collect page features of an application without any abnormalities while the application is running, and construct sample page features based on the collected page features.

[0086] To better illustrate the process by which terminal 100 identifies application risks, the structure of terminal 100 will be described below. Please refer to [link / reference]. Figure 4 , Figure 4 This is a schematic diagram of a terminal 100 provided in an embodiment of this application. Figure 4 As shown, the terminal 100 includes a processor 110, a memory 120, an antenna 1, an antenna 2, a mobile communication module 130, a wireless communication module 140, a sensor module 150, a display screen 160, etc.

[0087] Processor 110 may include one or more processing units, such as a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). These different processing units may be independent devices or integrated into one or more processors.

[0088] The controller can serve as the nerve center and command center of the terminal. Based on the instruction opcode and timing signals, the controller generates operation control signals to control the fetching and execution of instructions.

[0089] The processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. This memory can store instructions or data that the processor 110 has just used or that are used repeatedly. If the processor 110 needs to use the instruction or data again, it can directly retrieve it from the memory, avoiding repeated access and reducing the waiting time of the processor 110.

[0090] The terminal's wireless communication function can be implemented through antenna 1, antenna 2, mobile communication module 130, wireless communication module 140, modem processor, and baseband processor.

[0091] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in the terminal can be used to cover one or more communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0092] The mobile communication module 130 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G in terminals. The mobile communication module 130 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc.

[0093] The mobile communication module 130 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 130 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 130 can be housed in the processor 110. In some embodiments, at least some functional modules of the mobile communication module 130 and at least some modules of the processor 110 can be housed in the same device.

[0094] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs a sound signal through an audio module or displays an image or video on a display screen. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 110 and may be housed in the same device as the mobile communication module 130 or other functional modules.

[0095] The wireless communication module 140 can provide solutions for wireless communication applications on terminals, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 140 can be one or more devices integrating at least one communication processing module. The wireless communication module 140 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signals, and sends the processed signal to processor 110. The wireless communication module 140 can also receive signals to be transmitted from processor 110, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0096] In some embodiments, antenna 1 of the terminal is coupled to mobile communication module 130, and antenna 2 is coupled to wireless communication module 140, enabling the terminal 100 to communicate with networks and other devices, such as the feature server 200, via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), the BeiDou Navigation Satellite System (BDS), the Quasi-Zenith Satellite System (QZSS), and / or satellite-based augmentation systems (SBAS).

[0097] The memory 120 can be used to store computer executable program code, which includes instructions. The memory 120 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area may store data created during terminal use (such as audio data, phonebook, etc.). Furthermore, the memory 120 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the terminal 100 by running instructions stored in the memory 120 and / or instructions stored in memory disposed within the processor.

[0098] For example, the application risk warning method provided in this application embodiment can be pre-loaded into the memory of terminal 100 in the form of a program product. The processor of terminal 100 can execute the instructions in the memory to implement the steps of the application risk warning method provided in this application embodiment.

[0099] In this embodiment, the sensor module 150 includes a touch sensor.

[0100] A touch sensor, also known as a "touch panel," can be located on the display screen 160. The touch sensor and the display screen 160 together form a touchscreen, also called a "touch display." The touch sensor detects touch operations applied to or near it. The touch sensor can then transmit the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 160. In some embodiments, the touch sensor may also be located on the surface of the terminal 100, in a different position than the display screen 160.

[0101] In this embodiment, the display screen 160 can also be used to display application pages of various applications on the terminal 100. An application page refers to the interface used in an application to display the application's content, functions, and receive user input. An application page can include various components, such as button components, text box components, and icon components. These components can be combined and laid out using programming languages ​​and design tools to form an interactive interface. In some examples, these components can also be displayed as interface elements on the application page to facilitate user interaction. For example, a button component can be displayed as a button element on the application page. Alternatively, button components, text box components, and icon components can be combined and displayed as pop-up elements on the application page.

[0102] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the terminal 100. In other embodiments of this application, the terminal 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0103] In this embodiment, the software system of terminal 100 can adopt a layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture. This embodiment uses a layered architecture. Taking the system as an example, the software structure of terminal 100 is illustrated.

[0104] Figure 5 This is a software structure block diagram of the terminal 100 provided in the embodiments of this application.

[0105] Layered architecture divides software into several layers, each with a clear role and function. Layers communicate with each other through software interfaces. In some examples, [the following is implied:] ... The system consists of, from top to bottom, the application layer, the application framework layer, the system service layer, and the kernel layer.

[0106] The application layer can include a range of applications, such as the system applications and third-party applications described above.

[0107] The application framework layer provides multi-language user program frameworks and Ability frameworks (such as Java / C / C++) and various software and hardware services with external multi-language framework APIs for applications in the application layer.

[0108] For example, the application framework layer can provide window modules for applications within the application layer. These window modules can be used to manage lifecycle events of application windows, such as creation, destruction, display, and hiding, and can also handle window-related input events.

[0109] For example, the application framework layer can also provide a multimodal input module for applications within the application layer. This multimodal input module can manage input events from different input devices and distribute these events to the application, enabling the application to respond to input events from various devices. Input events from different input devices include, but are not limited to, touch input events from a touchscreen, input events from a keyboard, voice input events from a microphone, input events from a stylus, and so on.

[0110] In this embodiment of the application, for each application, after the application is run on the terminal, the window module can register a listener with the multi-modal input module based on all windows of the application in order to capture input events in each window.

[0111] In this embodiment, the application framework layer may further include an application anomaly identification service, which is used to identify abnormal applications.

[0112] For example, such as Figure 6 As shown, the application anomaly detection service may include a page event listening module, a page feature collection module, a page anomaly detection module, and an interception module.

[0113] The page event listening module is used to listen for user input events on the application page and application page load events. User input events refer to the input events made by the user through an input device on the application page after the terminal displays the application page. Page load events refer to the events that load and display the application page during the terminal's application operation.

[0114] The page feature acquisition module is used to acquire features of the application pages displayed on the terminal to obtain page features.

[0115] The page anomaly detection module is used to identify whether there are anomalies in the application page based on page characteristics.

[0116] The interception module can be used to intercept applications when there are abnormalities on the application page.

[0117] For example, for each application, after the application is run on the terminal, the page event listening module performs module initialization. It can register listeners with the window module to listen for the application's page load event, and register listeners with the multi-modal input module to listen for user input events on the application page.

[0118] After registering a listener with the window module, if the window module creates one or more windows of the application and loads a page in the window, the listener will be triggered, and the page event listener module can listen for the application's page load event.

[0119] Accordingly, after registering a listener with the multi-modal input module, if the user inputs on the application page, the multi-modal input module will dispatch the user input event and trigger the listener, so that the page event listening module can listen to the user's input event on the application page.

[0120] After the page event listening module detects user input events and / or page load events on the application page, it will trigger the page feature acquisition module to collect page features.

[0121] The page feature acquisition module can acquire features of the application page refreshed by the page load event and / or the application page refreshed by the user input event to obtain page features.

[0122] The application page refreshed by a page load event refers to the latest application page displayed by the application after the page is loaded. The application page refreshed by a user input event refers to the latest application page displayed by the application after responding to user input.

[0123] After obtaining the page features, the page features can be input into the page anomaly detection module for anomaly detection.

[0124] The page anomaly detection module can include an anomaly detection model and an anomaly detection module. The anomaly detection model can detect anomalies based on page features, and the anomaly detection module can obtain risk information about the application page based on the detection results of the anomaly detection model.

[0125] In this embodiment, the anomaly detection model may include sample page features, and the anomaly detection model performs anomaly detection based on the sample page features.

[0126] The interception module can block the current application when the risk information on the application page meets preset conditions, thereby reducing the probability of leakage of user sensitive information and ensuring the security of user information.

[0127] In this embodiment of the application, the system service layer provides services to the application through the application framework. The system service layer includes a set of basic system capability subsystems, a set of basic software service subsystems, a set of enhanced software service subsystems, a set of hardware service subsystems, etc.

[0128] In this embodiment, the kernel layer provides basic system functions, such as process management, memory management, and network protocol stack. The kernel layer also includes various drivers, such as display drivers, camera drivers, audio drivers, and sensor drivers.

[0129] It should be noted that, Figure 5 Only in a layered architecture The software architecture of the terminal 100 provided in this application embodiment is described using a system as an example. This application embodiment does not limit the specific architecture of the terminal 100 software system; for details regarding other software systems with different architectures, please refer to conventional techniques. For example, the software system may also include, but is not limited to, [other types of systems]. Operating systems, etc., are not specifically limited.

[0130] For ease of understanding, the following will be based on Figures 3 to 6 Using the architecture shown as an example, and in conjunction with the accompanying drawings, the application risk warning method provided in this application embodiment will be specifically described. Please refer to the attached drawings. Figure 7 , Figure 7 This is one of the flowcharts illustrating the application risk warning method provided in the embodiments of this application. Figure 7 The application risk warning method shown can be applied to Figure 3 , Figure 4 and Figure 5 The terminal shown is made by Figure 3 , Figure 4 and Figure 5 The terminal shown is executed. Figure 7 As shown, the application risk warning method provided in this application embodiment includes S401 to S404.

[0131] S401, the terminal runs the application and displays the application's first page.

[0132] The terminal includes multiple applications, and the application running on the terminal can be any one of these applications.

[0133] For example, the terminal can receive user input on the application icon within the terminal interface to run the application. For instance... Figure 8 As shown, the example uses a mobile phone as the terminal. During operation, the terminal provides a user interface 10, which can include icons for various applications, such as clock, camera, email, gallery, memo, file manager, music, calculator, smart living, settings, weather, and wallet. When the user needs to use the wallet, they can interact with the wallet icon 10a in the user interface 10 (e.g., click, swipe, etc.). The terminal can respond to the user's interaction with the wallet icon 10a and run the wallet.

[0134] For example, the terminal can also receive voice commands from the user to run applications. For instance, when a user needs to use a wallet, they can input a voice command such as "open wallet" into the terminal. After receiving the user's voice command, the terminal responds to the user's voice command and runs the wallet.

[0135] It is understood that the above are merely illustrative examples of terminal application operation in this application and are not intended to limit the scope of the application. Other methods may exist in some examples, and the specific implementation can be tailored to actual needs.

[0136] After the application is running, the terminal can display the application page of the running application to the user.

[0137] As an example, while an application is running, the terminal can display the application page according to the application's page loading instructions.

[0138] For example, when an application is running on a terminal, if the application's business logic requires loading an application page, the application can send a page loading command to the terminal's window module, and the terminal's window module can load and display the application page according to the application's page loading command.

[0139] by Figure 5 Using the architecture shown as an example, this explains how the terminal displays application pages based on application page loading instructions. For instance, if the application's business logic requires loading an application page during runtime, the application can send a page loading instruction to the window module. The window module creates a window based on the page loading instruction, loads the application's content into the created window, performs page rendering, and then displays the rendered application page on the terminal's screen.

[0140] As another example, while the terminal is running an application, it can receive page loading operations from the user and display the application page.

[0141] For example, after the terminal loads and displays the application page, the displayed application page may also include components for refreshing the page, that is, components for loading new pages. Users can perform page loading operations through these components, and the terminal responds to the user's operations on these components by loading and displaying new application pages.

[0142] For example, such as Figure 9 As shown, during the process of running an application, the terminal can first display the application page 20. The application page 20 includes the page content 20a displayed on the application page, a sharing component 20b for sharing the page content, and a download component 20c for downloading the page content.

[0143] When a user needs to share the page content 20a displayed on the application page, the user can interact with the sharing component 20b (such as clicking, swiping, etc.). The terminal receives the user's interaction with the sharing component 20b on the application page 20, responds to the user's interaction, loads and displays the application page 21 of the application, which is the sharing page.

[0144] Understandably, the sharing component 20b used to share page content is the same component in application page 20 used to refresh the page. The user's operation on the sharing component 20b is the user's page loading operation.

[0145] by Figure 5 Using the illustrated architecture as an example, we will explain how the terminal receives a user's page loading operation and displays the application page. For instance, after a user performs a page loading operation on an application page via a touchscreen, keyboard, or other input device, this page loading operation is first captured by the hardware and transmitted to the kernel layer. The kernel layer processes this page loading operation into a related input event, which is then passed to the multi-modal input module. The multi-modal input module distributes this input event to the window containing the corresponding application (the application currently running on the terminal). The application window responds to the input event and loads and displays the application page corresponding to the page loading operation.

[0146] The process by which the application responds to the input event and loads and displays the application page corresponding to the page operation can be referred to as the process by which the terminal displays the application page according to the application's page loading instruction, which will not be elaborated here.

[0147] In this embodiment of the application, during the process of loading and displaying the application page, the terminal can also perform page content recognition on the loaded and displayed application page to detect whether the application page to be loaded and displayed includes sensitive components.

[0148] Sensitive components can be those used for users to input sensitive information, such as input-type components. Input-type components are those that allow users to input information into the application, such as text input components (TextInput) and components for inputting biometric features. In some examples, a text input component might be a text box input component. Components for inputting biometric features might be those for inputting fingerprints, iris scans, facial images, etc.

[0149] Sensitive information includes, but is not limited to, user account passwords, user-set payment passwords, decryption passwords, user iris images, fingerprints, facial images, and other information.

[0150] In some examples, a sensitive component can be a visual component on the application page, that is, a component that is displayed on the application page and can be viewed and interacted with by the user.

[0151] Please refer to the following: Figure 10 , Figure 10 This is a schematic diagram of the first page provided for an embodiment of this application. For example... Figure 10 As shown, Figure 10 The first page 30 includes a password input box 30a and an account input box 30b, which are TextInput components on the first page. Therefore, the password input box 30a and the account input box 30b can be sensitive components on the first page.

[0152] by Figure 5 and Figure 6 The architecture shown is used as an example for illustration; please refer to the relevant documentation. Figure 11 , Figure 11 This is a schematic diagram illustrating the principle of a page event listening module for listening to and detecting pages, as provided in an embodiment of this application.

[0153] like Figure 11 As shown, after the application runs on the terminal, the page event listening module initializes itself. It can register listeners with the window module and with the listening management service in the multi-modal input module. The window module can also register listeners with the listening management service.

[0154] When the page event listening module detects that the window module creates a window to load the page according to the page loading instruction, or when the multi-modal input module distributes input events, the page event listening module performs content recognition on the application page to be loaded and displayed, and detects whether the application page to be loaded and displayed contains sensitive components.

[0155] In this embodiment, when it is detected that the application page to be loaded and displayed includes sensitive components, the application page to be loaded and displayed can be determined to be the first page. That is, in this embodiment, the first page refers to the application page that includes sensitive components.

[0156] S402, the terminal performs feature collection on the first page to obtain the page features of the first page.

[0157] Specifically, after detecting that the application page to be loaded and displayed contains sensitive components, the terminal can obtain the page characteristics of the application page containing the sensitive components, that is, obtain the page characteristics of the first page.

[0158] In this application example, the page features of the first page may include one or more of the following: page text information, page component tree, page images, page navigation relationships, and the application name of the application corresponding to the first page. Thus, by collecting multi-dimensional page features, the accuracy of subsequent page anomaly identification can be improved.

[0159] Here, "page text information" refers to the text content extracted from the first page. For example, the terminal can extract the text content of the first page to obtain the page text information of the first page.

[0160] The page component tree can be the component tree of the first page. For example, the terminal performs component tree collection on the first page to obtain the page component tree of the first page. The collected page component tree of the first page can include the visual components on the first page.

[0161] A page image refers to the image information of the first page. For example, the terminal can take a screenshot of the first page to obtain a page image of the first page.

[0162] Page navigation information can be the routing information for the first page, i.e., the routing information from the previous application page to the first page. This can include the package name of the application to which the previous page belongs, the package name of the application to which the first page belongs, information about the window displaying the first page, and navigation information within the application. Specifically, the information about the window displaying the first page refers to whether the first page is displayed in an independent window. The navigation information within the application refers to whether the navigation from the previous application page to the first page occurs within the same application.

[0163] The application name corresponding to the first page refers to the application name of the application displaying the first page. For example, the terminal can obtain the page navigation relationship and the application name of the corresponding application when loading and displaying the first page.

[0164] In some examples, the page features of the first page may also include user tagging information. This user tagging information includes a user's tagging of whether the application corresponding to the first page is trustworthy. For example, the terminal stores user tagging information for different applications. For each application, the user's tagging information may include the application name and the user's tagging of whether the application is trustworthy.

[0165] For example, when the terminal loads and displays the first page, it can obtain the user tagging information of the application corresponding to the first page from the stored tagging information of different applications based on the application name of the application corresponding to the first page. The user tagging information of the application corresponding to the first page may include one of the following: the application corresponding to the first page is tagged as trusted, the application corresponding to the first page is tagged as untrusted, or the application corresponding to the first page is not tagged.

[0166] by Figure 6 Taking the architecture shown as an example, when the page event listening module detects that the application page to be loaded and displayed contains sensitive components, that is, after the page event listening module detects that the terminal needs to load and display the first page, it can trigger the page feature acquisition module to collect the features of the first page and obtain the page features of the first page.

[0167] S403, the terminal obtains the risk information of the first page based on the page characteristics of the first page.

[0168] In this embodiment of the application, the risk information on the first page can characterize the degree of risk of the first page, and based on the risk information, it can be determined whether there is a risk on the first page.

[0169] Because the first page contains sensitive components, if a user inputs sensitive information through these components, it could lead to the leakage of that information, especially if the first page itself is compromised. Therefore, after obtaining the page characteristics of the first page, the terminal can detect whether the first page poses a risk based on these characteristics.

[0170] For example, the terminal includes an anomaly detection model. After obtaining the page features of the first page, the terminal can detect whether there is any risk on the first page through the anomaly detection model.

[0171] As an example, the anomaly detection model can be trained using supervised or unsupervised methods with an artificial intelligence algorithm. This algorithm can be, but is not limited to, random forests, neural networks, decision trees, etc. After obtaining the page features of the first page, the terminal can input these features into the anomaly detection model. The model then performs risk detection on the first page to obtain its risk information.

[0172] To improve processing efficiency and reduce terminal power consumption, in this embodiment of the application, the anomaly identification model may include sample page features. The terminal can match the page features of the first page with the sample page features, and obtain the risk information of the first page based on the matching result of the page features of the first page and the sample page features.

[0173] In this embodiment of the application, the features of the sample page may include sensitive word features, component features, image features, and jump relationship features.

[0174] The sample page features can be obtained by the server from the page features of a normal application page and sent to the terminal. A normal application page refers to a risk-free application page. For example, an application server can collect features from application pages during normal operation and send the collected page features (such as sensitive word features, component features, image features, and navigation relationship features) to the terminal. Alternatively, the application server can collect features from application pages during normal operation and send the collected page features (such as sensitive word features, component features, image features, and navigation relationship features) to a feature server, which then sends them to the terminal.

[0175] In order to ensure the security of user information in sensitive scenarios, in this embodiment of the application, the above-mentioned sample page features can also be constructed by collecting the page features of the application page of the application in sensitive scenarios (such as payment scenarios, account login scenarios, etc.) for applications that input sensitive information, when the application is running normally, that is, when it is running without risk.

[0176] like Figure 12 As shown, for example, the sensitive word features in the sample page features can be obtained by recording sensitive words in the normal application pages displayed by the application during normal operation. That is, the sensitive word features include one or more sensitive words. Here, sensitive words can refer to key text information involving the input of sensitive information. For example, in a payment scenario, a sensitive word could be the payment password. As another example, in an account login scenario, sensitive words could be the account name, login password, etc.

[0177] The component features in the sample page features can be obtained by collecting the component tree of the normal application page displayed by the application when it is running normally. That is, the component features can include the component tree of one or more normal application pages.

[0178] Image features in the sample page features can be obtained by taking screenshots of normal application pages displayed by the application while it is running normally. That is, image features include page images of one or more normal application pages.

[0179] The navigation relationship feature in the sample page features can be obtained by collecting the page navigation relationships of the normal application pages displayed by the application under normal operation. That is, the navigation relationship feature includes the page navigation relationships of one or more normal application pages. The page navigation relationship can include the package name of the application to which the navigation page belongs (i.e., the package name of the application to which the previous page belongs and the package name of the application to which the current page belongs when navigating from the previous page to the current page), information about the window displaying the current page, and navigation information within the application.

[0180] To improve the efficiency of anomaly detection, please continue to combine... Figure 12 In this embodiment, the sample page features may further include an application whitelist. The application whitelist can be obtained by recording the application names of trusted applications in various scenarios (including sensitive scenarios), meaning it may include the application names of one or more trusted applications. By constructing a whitelist of applications, applications in the whitelist can be considered to have lower risk during anomaly detection and assigned a lower anomaly coefficient (as described in the anomaly level below). Alternatively, in some examples, anomaly detection may be skipped for applications in the whitelist.

[0181] In this embodiment of the application, the application whitelist in the sample page features can be sent to the terminal by a server. For example, the application whitelist can be sent to the terminal by a feature server. The feature server can record the names of applications pre-marked as trusted applications, construct a whitelist based on the names of trusted applications, and send the whitelist to the terminal.

[0182] Considering that different users have varying levels of trust in applications, please continue to refer to [the relevant documentation] to improve the accuracy of anomaly detection. Figure 12 In this embodiment of the application, the sample page features may further include tagging features. These tagging features can be obtained by recording user tagging information for different applications; that is, the tagging features include user tagging information for different applications. The user's tagging information for each application may include the application name and the user's rating of whether the application is trustworthy.

[0183] In this embodiment of the application, the tagging features in the sample page features can be obtained by the terminal collecting different tagging information from the user.

[0184] As an example, the terminal can detect whether the first page meets the risk conditions based on the matching results between the page features of the first page and the features of the sample pages. If the risk conditions are met, the terminal can obtain risk information indicating a higher degree of risk. If the risk conditions are not met, the terminal can obtain risk information indicating a lower degree of risk.

[0185] The risk conditions include one or more of the following: the application corresponding to the first page is an untrusted application, the first page contains sensitive information, or the first page is abnormal.

[0186] As an example, such as Figure 13 As shown, the terminal can detect the trustworthiness of the application corresponding to the first page based on the application name and the application whitelist and tag features in the sample page features, i.e., whether the application corresponding to the first page is a trustworthy application. Based on the page text information and page images of the first page, as well as the sensitive word features and image features in the sample page features, the terminal can detect the sensitivity of the first page, i.e., whether the first page contains sensitive information. Based on the page component tree and page navigation relationships of the first page, as well as the component features and navigation relationship features in the sample page features, the terminal can detect the anomaly of the first page, i.e., whether the first page has experienced any anomalies.

[0187] For example, the terminal can match the application name of the application corresponding to the first page with the application names included in the application whitelist to obtain the whitelist detection result of the application corresponding to the first page. Additionally, the terminal can match the application name of the application corresponding to the first page with the tagging information included in the tagging features to obtain the user tagging information of the application corresponding to the first page. Based on the user tagging information of the application corresponding to the first page, a trusted detection result of the application corresponding to the first page can be obtained.

[0188] Understandably, when the page features of the first page include user tagging information, the terminal can directly obtain the trusted detection result of the application corresponding to the first page based on the user tagging information in the page features.

[0189] If the application name on the first page matches any of the application names included in the application whitelist, the whitelist detection result for the application on the first page indicates that the application on the first page is a whitelisted application. If the application name on the first page does not match any of the application names included in the application whitelist, the whitelist detection result for the application on the first page indicates that the application on the first page is not a whitelisted application.

[0190] If the user-labeled information for the application on the first page indicates that the application is marked as trusted, then the trustworthiness detection result for the application on the first page indicates that the application is trusted. If the user-labeled information for the application on the first page indicates that the application is marked as untrustworthy, then the trustworthiness detection result for the application on the first page indicates that the application is untrustworthy. If the user-labeled information for the application on the first page indicates that the application is not marked, then the trustworthiness detection result for the application on the first page indicates that the application is untrustworthy.

[0191] As an example, if the application corresponding to the first page is a whitelisted application and / or the trusted detection result of the application corresponding to the first page indicates that the application corresponding to the first page is trusted, then the application corresponding to the first page is determined to be a trusted application.

[0192] If the application corresponding to the first page is not a whitelisted application and the trusted detection result of the application corresponding to the first page indicates that the application corresponding to the first page is untrustworthy, then the application corresponding to the first page is determined to be an untrustworthy application.

[0193] For example, the terminal can match the page text information of the first page with the sensitive words included in the sensitive word features, and match the page image of the first page with the page image included in the image features, and detect whether the first page contains sensitive information based on the matching results.

[0194] If the matching degree between the page text information of the first page and any one of the sensitive words included in the sensitive word features is greater than the sensitive word matching threshold, and / or if the matching degree between the page image of the first page and any one of the page images included in the image features is greater than the image matching threshold, then the first page is determined to contain sensitive information. The image matching threshold can be set according to actual needs, and this application embodiment does not impose specific limitations.

[0195] If the matching degree between the page text information of the first page and the sensitive words included in the sensitive word features is not greater than the sensitive word matching threshold, and the matching degree between the page image of the first page and the page image included in the image features is not greater than the image matching threshold, then it is determined that the first page does not contain sensitive information.

[0196] For example, the terminal can match the page component tree of the first page with the component tree included in the component features, and match the page jump relationship of the first page with the page jump relationship included in the jump relationship features, and detect whether the first page is abnormal based on the matching results.

[0197] If the matching degree between the page component tree of the first page and any component tree included in the component feature is less than the component matching threshold, and / or if the matching degree between the page jump relationship of the first page and any jump relationship included in the jump relationship feature is less than the relationship matching threshold, then an anomaly is determined to have occurred on the first page. The component matching threshold and the relationship matching threshold can be set according to actual needs, and this embodiment does not impose specific limitations.

[0198] If the component matching degree of the page component tree of the first page and the component tree included by the component features is not less than the component matching threshold, and the matching degree of the page jump relationship of the first page and the jump relationship included by the jump relationship features is not less than the relationship matching threshold, it is determined that the first page has not experienced any abnormalities.

[0199] In this embodiment of the application, the characteristics of the sample page are used as the basis for comparison. Based on the matching result between the characteristics of the first page and the characteristics of the sample page, it is detected whether the first page meets the risk conditions, which can accurately identify the risk of the page.

[0200] As an example, in order to improve the accuracy of risk detection, the terminal can also obtain the degree of abnormality of the first page in the risk item based on the matching results of the page features of the first page and the features of the sample page, and obtain the risk information of the first page based on the degree of abnormality of the first page in the risk item.

[0201] The risk items include one or more of the following: application trustworthiness, page sensitivity, and page anomalies.

[0202] For example, the terminal can determine the degree of anomaly in application trustworthiness of the first page based on the matching results between the application name and the application whitelist and tag features in the sample page features. For instance, the terminal can determine the degree of anomaly in application trustworthiness of the first page based on the whitelist detection results of the application corresponding to the first page and the user tagging information of the application corresponding to the first page. The process by which the terminal obtains the whitelist detection results and user tagging information can be referred to the above description and will not be repeated here.

[0203] The terminal stores the anomaly levels corresponding to different detection results, including whitelist detection results and user tagging information. As shown in Table 1, Table 1 displays the anomaly levels corresponding to different detection results.

[0204] Table 1

[0205]

[0206]

[0207] It is understood that Table 1 only lists some of the abnormality levels corresponding to the detection results in the embodiments of this application, and is not intended as a limitation. The specific amount can be set according to actual needs.

[0208] Based on the degree of anomaly corresponding to different detection results, the terminal can obtain the degree of anomaly of the first page under application trustworthiness based on the whitelist detection results of the application corresponding to the first page and the user tagging information of the application corresponding to the first page.

[0209] Taking Table 1 as an example, if the whitelist detection result of the application corresponding to the first page indicates that the application corresponding to the first page is a whitelisted application, regardless of whether the user tagging information of the application corresponding to the first page indicates that the application corresponding to the first page is marked as trusted, the degree of anomaly of the first page under application trust is 0.1.

[0210] If the whitelist detection result of the application corresponding to the first page indicates that the application corresponding to the first page is not a whitelisted application, and the user tagging information of the application corresponding to the first page indicates that the application corresponding to the first page is marked as trusted, then the anomaly level of the first page under application trust is 0.2.

[0211] If the whitelist detection result of the application corresponding to the first page indicates that the application corresponding to the first page is not a whitelisted application, and the user tagging information of the application corresponding to the first page indicates that the application corresponding to the first page has not been tagged, then the anomaly level of the first page under application trustworthiness is 1.

[0212] If the user tagging information of the application corresponding to the first page indicates that the application corresponding to the first page is marked as untrusted, regardless of whether the whitelist detection result of the application corresponding to the first page indicates that the application corresponding to the first page is a whitelisted application, the degree of anomaly of the first page under application trustworthiness is 1.

[0213] For example, the terminal can determine the degree of anomalousness of the first page in terms of page sensitivity based on the matching results between the page text information of the first page and the sensitive word features in the sample page features, and the matching results between the page image of the first page and the image features in the sample page features. For instance, the terminal can determine the degree of anomalousness of the first page under page sensitivity based on the matching degree between the page text information of the first page and the sensitive words included in the sensitive word features, and the matching degree between the page image of the first page and the page images included in the image features.

[0214] The terminal stores the degree of anomaly corresponding to different sensitivity word matching scores and different image matching scores. As shown in Table 2, Table 2 displays the degree of anomaly corresponding to different sensitivity word matching scores and different image matching scores.

[0215] Table 2

[0216] Match abnormality Sensitive word match score 0-1 0-1 Image matching degree 0-1 0-1

[0217] Among them, the degree of matching of sensitive words is positively correlated with the degree of abnormality. For example, the higher the degree of matching of sensitive words, the higher the degree of abnormality.

[0218] Correspondingly, the degree of image matching is positively correlated with the degree of anomaly. For example, the higher the degree of image matching, the higher the degree of anomaly.

[0219] Based on the degree of anomaly corresponding to different degrees of sensitive word matching, the terminal can obtain the first degree of anomaly of the first page under page sensitivity by matching the page text information of the first page with the sensitive words included in the sensitive word features.

[0220] For example, the terminal can compare the page text information of the first page with the sensitivity matching degree of the sensitive words included in the sensitive word features to obtain the maximum sensitivity matching degree. The degree of abnormality corresponding to the maximum sensitivity matching degree is determined as the first degree of abnormality of the first page under page sensitivity.

[0221] Accordingly, based on the degree of anomaly corresponding to different image matching degrees, the terminal can obtain the second degree of anomaly of the first page under page sensitivity according to the image matching degree between the page image of the first page and the page image included in the image features.

[0222] For example, the terminal can compare the image matching degree of the page image of the first page with the page images included in the image features to obtain the maximum image matching degree. The degree of anomaly corresponding to the maximum image matching degree is determined as the second degree of anomaly of the first page under page sensitivity.

[0223] For example, the terminal can determine the degree of anomalousness of the first page under page anomaly based on the matching results of the page component tree of the first page with the component tree features in the sample page features, and the matching results of the page jump relationships of the first page with the jump relationship features in the sample page features. For instance, the terminal can determine the degree of anomalousness of the first page under page anomaly based on the component tree matching degree of the page component tree of the first page with the component tree included in the component features, and the jump relationship matching degree of the page jump relationships of the first page with the page jump relationships included in the jump relationship features.

[0224] The terminal stores the anomaly levels corresponding to different component tree matching degrees. The component tree matching degree is negatively correlated with the anomaly level. For example, the higher the component tree matching degree, the lower the anomaly level.

[0225] The terminal stores the anomaly levels corresponding to different redirection match degrees. The redirection match degree is negatively correlated with the anomaly level. For example, the higher the redirection match degree, the lower the anomaly level.

[0226] As shown in Table 3, Table 3 shows the degree of anomaly corresponding to different component tree matching degrees and different jump relationship matching degrees.

[0227] Table 3

[0228] Match degree abnormality Component tree matching degree 0-1 1-0 (negatively correlated with matching degree) Redirection matching degree 0-1 1-0 (negatively correlated with matching degree)

[0229] Based on the degree of anomaly corresponding to different component tree matching degrees, the terminal can obtain the first degree of anomaly of the first page under page anomaly by matching the component tree of the first page with the component tree included in the component features.

[0230] For example, the terminal can compare the component tree matching degree of the page component tree of the first page with the component tree included in the component features to obtain the minimum component tree matching degree. The degree of anomalousness corresponding to the minimum component tree matching degree is determined as the first degree of anomalousness of the first page under page anomalousness.

[0231] Based on the degree of abnormality corresponding to different jump relationship matching degrees, the terminal can obtain the second degree of abnormality of the first page under page abnormality according to the degree of matching between the page jump relationship of the first page and the jump relationship of the page jump relationship included in the jump relationship feature.

[0232] For example, the terminal can compare the page navigation relationship of the first page with the navigation relationship matching degree of the page navigation relationships included in the navigation relationship features to obtain the minimum relationship matching degree. The degree of anomalousness corresponding to the minimum relationship matching degree is determined as the second degree of anomalousness of the first page under page anomalousness.

[0233] In some examples, to improve the accuracy of anomaly identification and avoid frequent application blocking that could negatively impact user experience, after obtaining the first and second degrees of anomaly for the first page under page anomaly conditions, the magnitudes of the first and second degrees of anomaly can be compared, and the smaller degree of anomaly is determined as the final degree of anomaly for the first page under page anomaly conditions. For example, if the first degree of anomaly for the first page under page anomaly conditions is less than the second degree of anomaly for the first page under page anomaly conditions, then the first degree of anomaly for the first page under page anomaly conditions is taken as the final degree of anomaly for the first page under page anomaly conditions.

[0234] After obtaining the degree of abnormality of each risk item on the first page, the terminal can calculate the abnormality index value of the first page for each risk item. Based on the abnormality index value of the first page for each risk item, the risk information of the first page can be obtained.

[0235] For example, the terminal can multiply the degree of abnormality of the first page under each risk item and determine the multiplied value as the abnormality index value. For example, the terminal can multiply the degree of abnormality of the first page under application trustworthiness, the first degree of abnormality of the first page under page sensitivity, the second degree of abnormality of the first page under page sensitivity, the first degree of abnormality of the first page under page abnormality, and the second degree of abnormality of the first page under page abnormality, and determine the multiplied value as the abnormality index value.

[0236] It is understood that the above is merely an example illustrating the use of cumulative values ​​as anomaly indicator values ​​in this application. In some examples, other implementations are possible. For instance, the terminal may also determine one or more of the average, variance, or other values ​​representing the degree of abnormality of each risk item on the first page as the anomaly indicator value. The specific settings can be configured according to actual needs.

[0237] For example, after obtaining the abnormal indicator value of the first page, the terminal can determine the abnormal indicator value of the first page as the risk information of the first page.

[0238] In some examples, after receiving the abnormal indicator values ​​from the first page, the terminal can also determine the abnormal level corresponding to the abnormal indicator values ​​on the first page as the risk information for the first page. Different abnormal levels correspond to different abnormal indicator values.

[0239] In this embodiment, the characteristics of the sample page are used as the basis for comparison to detect the degree of abnormality of the first page in the risk items. Based on the degree of abnormality of the first page in the risk items, the first page including sensitive components is identified as abnormal, which can accurately identify the risk of the page.

[0240] by Figure 6 Taking the architecture shown as an example, after obtaining the page features of the first page, the page feature acquisition module can transmit these features to the page anomaly detection module. Upon receiving the page features, the page anomaly detection module can perform anomaly detection using an anomaly detection model, and then obtain the application page's risk information based on the detection results. Specifically, anomaly detection using the anomaly detection model can either determine whether the first page meets the risk conditions based on sample page features in the model, or it can determine the degree of anomaly of the first page under the risk category based on the sample page features in the model.

[0241] The page anomaly identification module obtains risk information about the application page based on the detection results of the anomaly identification model. This risk information can be obtained based on the detection results of whether the first risk condition is met, or it can be obtained based on the detection results of the degree of anomaly of the first page under the risk item.

[0242] This application embodiment constructs sample page features by collecting page features of normal application pages, and uses the sample page features as a comparison basis to identify anomalies in the first page, including sensitive components, which can accurately identify the risk of the page.

[0243] S404, if the risk information on the first page meets the preset conditions, the terminal outputs a risk warning for the application.

[0244] The preset conditions can be set according to actual needs. For example, if the risk information on the first page is an abnormal indicator value, the preset condition could be that the abnormal indicator value is greater than a set abnormal threshold. Or, if the risk information on the first page is an abnormal gear level, the preset condition could be that the abnormal gear level is higher than a set gear level. Or, if the risk information on the first page represents the degree of risk, the preset condition could also be that the degree of risk represented by the risk information is greater than a preset degree threshold. The specific settings can be customized according to actual needs. This application's embodiments do not impose specific limitations.

[0245] If the risk information on the first page meets the preset conditions, it indicates that there is a risk on the first page. That is, the page characteristics of the first page indicate that there is a risk on the first page. Therefore, the terminal can output a risk warning for the application when the risk information on the first page meets the preset conditions, so as to indicate that the running application is an abnormal application.

[0246] Understandably, the page features of the first page indicate that there is a risk on the first page, which means that the risk information on the first page meets the preset conditions.

[0247] The following explanation uses the risk information on the first page as an example of anomaly indicators. After receiving the risk information from the first page, the terminal can check whether the risk information exceeds a set anomaly threshold. If it does, the terminal can output a risk warning for the application corresponding to the first page, indicating to the user that the current application poses a risk, thus preventing the user from entering sensitive information and improving security.

[0248] For example, to make it easier for users to intuitively receive risk warnings, the terminal can display a risk warning via a pop-up window on the first page if the risk information meets preset conditions. For instance, a pop-up window could display a risk warning such as "There are security risks on this page, please enter with caution."

[0249] In this scenario, after the terminal displays a risk warning via a pop-up window on the first page, the user is prevented from entering any information on the first page, thereby improving the security of the user's sensitive information.

[0250] It is understood that the above is merely an illustrative example of how risk warnings are output in the embodiments of this application, and is not intended to be limiting. In some examples, other methods may also be used. For example, risk warnings may also be output via voice, which can be set according to actual needs.

[0251] To facilitate user operation, as an example, if the risk information on the first page meets the preset conditions, the terminal can also display the target component on the first page to control whether to block the application.

[0252] After the target component is displayed on the first page, the user can choose whether to block the application based on the target component, which facilitates user operation and also improves the security of sensitive user information. For example, the target component displayed on the first page may include a first component and a second component. The first component is used to control exiting the application, and the second component is used to control running the application.

[0253] After the first component and the second component are displayed on the first page, the terminal can receive user operations on the first component to exit the application; or, it can receive user operations on the second component to stop outputting risk warnings for the application and continue running the application.

[0254] In some examples, the first and second components can be visual button components. For example, such as... Figure 14 As shown in (a), the first page 40 includes a first component 41a, a second component 41b, and a risk warning 41c. The first component 41a can be a "Exit Application" button component, the second component 41b can be a "Trust Application" button component, and the risk warning 41c can be a message stating "This page has security risks; please enter with caution."

[0255] After displaying a risk warning via a pop-up on the first page, if the user needs to block the application, they can interact with the "Exit Application" button. The terminal receives the user's interaction with the "Exit Application" button and exits the application. If the user trusts the application and needs to continue running it, they can interact with the "Trust Application" button. The terminal receives the user's interaction with the "Trust Application" button, closes the risk warning, and continues running the application.

[0256] In this embodiment of the application, when the risk information on the detection page meets preset conditions, a risk warning for the application and a component for blocking the application are displayed. This allows for direct error prompting and blocking of anomalies during the user's input of sensitive information, thereby reducing the probability of sensitive information leakage and improving the security of sensitive information.

[0257] To improve the efficiency and accuracy of subsequent anomaly identification, as an example, after receiving the user's operation on the displayed component used to control whether to block the application, the terminal can also mark the application based on the user's operation on the component, thereby updating the sample page features and improving the accuracy of the sample page features, thus improving the efficiency and accuracy of anomaly identification.

[0258] For example, after receiving the user's operation on the first component, the terminal can mark the application with a first mark; after receiving the user's operation on the second component, the terminal can mark the application with a second mark; the first mark is used to characterize the application as untrustworthy, and the second mark is used to characterize the application as trustworthy.

[0259] In some examples, if an application is marked as untrusted, and the terminal runs the application again, the application can be exited directly based on the untrusted mark (i.e., the second mark) during anomaly identification, thereby improving the security of sensitive information and increasing processing efficiency.

[0260] Considering that in some examples, users may only trust the application in the current usage scenario, but not in other scenarios, the second component displayed on the terminal's first page can include a first trusted component and a second trusted component. The first trusted component refers to the component that performs a second marking on the application while it continues to run. The second trusted component refers to the component that does not mark the application while it continues to run.

[0261] For example, such as Figure 14 As shown in (b), the first page 50 may further include a first component 51a, a first trusted component 51b, a second trusted component 51c, and a risk warning 51d. The first component 51a may be a "Exit Application" button component, the first trusted component 51b may be a "Trust Application" button component, the second trusted component 51c may be a "Trust Application Only This Time" button component, and the risk warning 51d may be a message stating "This page has security risks; please enter with caution."

[0262] After displaying a risk warning via a pop-up on the first page, if the user needs to block the application, they can interact with the "Exit Application" button. The terminal receives the user's interaction with the "Exit Application" button, exits the application, and marks the application with a first flag. If the user trusts the application and needs to continue running it, they can interact with the "Trust Application" button. The terminal receives the user's interaction with the "Trust Application" button, closes the risk warning, continues running the application, and marks the application with a second flag. If the user only trusts the application for this specific run, they can interact with the "Trust Application Only for This Run" button. The terminal receives the user's interaction with the "Trust Application Only for This Run" button, closes the risk warning, continues running the application, and does not mark the application.

[0263] like Figure 15 As shown, when the risk information on the first page meets the preset conditions, the terminal displays the target control and pop-up window, and receives user operations on the target component.

[0264] If a user action is received on the first trusted component, exit the application and assign a first tag to the application. If a user action is received on the first trusted component, exit the pop-up window, continue running the application, and assign a second tag to the application. If a user action is received on the second trusted component, exit the pop-up window and continue running the application.

[0265] In some examples, the terminal can also receive user actions on a second trusted component and assign a third label to the application, indicating that the application is only trusted during this run. Understandably, after the current run ends, the terminal will still need to perform anomaly detection on the application's first page the next time the application is run.

[0266] To improve the accuracy of page anomaly identification, as an example, after the terminal marks the application, it can also update the marking features in the sample page features based on the application's marking.

[0267] For example, if the tagging feature does not include the tagging information of the application, the application name of the application can be associated with the tag obtained based on the user's operation on the target component and added to the tagging feature.

[0268] If the tagging features include tagging information for the application, and the tag in the application's tagging information differs from the tag obtained based on the user's operation on the target component, then the tag for the application in the tagging features can be updated based on the tag obtained based on the user's operation on the target component. Conversely, if the tag in the application's tagging information is the same as the tag obtained based on the user's operation on the target component, then updating the tag for the application in the tagging features is unnecessary.

[0269] Understandably, if the user's actions on the target component result in no tagging of the application, or if the resulting tag is a third tag, then updating the application's tag in the tagging features is unnecessary.

[0270] In this embodiment, the target component is displayed so that the user can operate the application through the target component, which improves the convenience of user operation and reduces the probability of sensitive information leakage, thereby improving the security of sensitive information.

[0271] Due to application updates, parameter changes, and other reasons, page features are constantly changing. In order to improve the accuracy of anomaly identification, the sample page features can also be updated in this embodiment of the application.

[0272] As an example, the terminal can collect features locally and update the features of the sample page based on the locally collected features.

[0273] For example, if an application is tagged, the terminal can update the tagging features in the sample page features based on the user's tagging information for the application. The specific process of the terminal updating the tagging features in the sample page features can be referred to the description above, and will not be repeated here.

[0274] For example, the terminal can also update the sample page features after a set time period has elapsed. For instance, while the trusted application is running, the terminal can collect features from the application page of the trusted application to obtain sensitive word features, image features, component features, and navigation relationship features. After the set time period has elapsed, the terminal can update the sample page features based on the collected trusted application features, such as updating the sensitive word features, image features, component features, and navigation relationship features within the sample page features.

[0275] The duration can be set according to actual needs. For example, if the duration is set to T hours, the terminal can update the sample page features every T hours. Trusted applications include whitelisted applications and applications marked as trusted.

[0276] For example, the terminal can also update the sample page features each time a trusted application is run. For instance, the terminal can collect features of the trusted application's application pages while the trusted application is running, obtaining sensitive word features, image features, component features, and navigation relationship features of the trusted application. Then, based on the collected features of the trusted application, the terminal can update the sample page features, such as updating the sensitive word features, image features, component features, and navigation relationship features in the sample page features.

[0277] Considering that most application updates are initiated by the application developer, in some examples, the terminal can also receive update features sent by the server and update the sample page features according to the update features.

[0278] The updated features may include, but are not limited to, sensitive word features, component features, image features, jump relationship features, application whitelists, etc.

[0279] For example, the terminal can receive updated features sent by a feature server. The feature server can obtain the application's target updated features from the application server, such as sensitive word features, component features, image features, and navigation relationship features. Then, it sends the target updated features to the terminal. Figure 16 As shown, the application server can call the API to transmit one or more features, such as sensitive word features, component features, image features, and navigation relationship features, to the SDK. The SDK then forwards these features from the application server to the feature server. Upon receiving the features from the SDK, the feature server can preprocess them and then send the preprocessed features to the terminal. The terminal can then update the locally stored sample page features based on the features sent by the feature server.

[0280] Correspondingly, after updating the application whitelist, the feature server can also send the updated application whitelist to the terminal. The terminal can then update the locally stored sample page features based on the updated application whitelist sent by the feature server.

[0281] Understandably, in some examples, the terminal can also directly receive the target update features sent by the application server and store the sample page features locally based on the target update features.

[0282] As an example, when the terminal does not receive updated features from the server, it can update the sample page features based on locally collected features (such as sensitive word features, component features, image features, and navigation relationship features). After the terminal receives updated features from the server, it updates the sample page features according to the updated features sent by the server. That is, the updated features sent by the server can have a higher priority than locally collected features (such as sensitive word features, component features, image features, and navigation relationship features).

[0283] This application embodiment can improve the accuracy of anomaly identification and enhance the security of user sensitive information by updating the features of sample pages.

[0284] In this embodiment of the application, after the application is running on the terminal, when the application displays a page containing sensitive components, the features of the page are collected, and the risk of the page is identified based on the page features. For pages whose risk meets preset conditions, the terminal will prompt the user and intercept the anomaly, which can prevent the user's information from being leaked in scenarios with security risks and ensure the security of user information.

[0285] Furthermore, this application embodiment also provides an application risk warning device. The application risk warning device provided in this application embodiment can be applied to... Figure 3 The system shown. As an example, the application risk warning device can be a hardware device that includes multiple software modules, integrated into... Figure 4 and Figure 5 The terminal shown. The application risk warning device can also be a collection of modules including multiple software modules, and these software modules can be stored in... Figure 4 and Figure 5 In the terminal shown.

[0286] like Figure 17 As shown, the application risk warning device 500 includes a display module 510, a page feature acquisition module 520, a page anomaly recognition module 530, and an interception module 540.

[0287] Display module 510 is used to display the first page of the application, which includes sensitive components.

[0288] The page feature acquisition module 520 is used to acquire the page features of the first page.

[0289] The page anomaly identification module 530 is used to obtain risk information of the first page based on the page characteristics of the first page. The risk information is whether the first page is risky.

[0290] The interception module 540 is used to output a risk warning for the application when the risk information on the first page meets the preset conditions.

[0291] For the sake of convenience and brevity, the specific working process of the application risk warning device 500 described above can be referred to the corresponding process in the foregoing embodiments, and will not be repeated here.

[0292] Furthermore, this application embodiment also provides an application risk warning system, including a terminal and a server; wherein, the server is used to obtain first sample page features, the first sample page features including one or more of the following: sensitive word features of normal application pages, image features of normal application pages, component tree features of normal application pages, jump relationship features of normal application pages, and application whitelist, and the server sends the first sample page features to the terminal.

[0293] The terminal is also used to collect features of a second sample page, which include marker features.

[0294] The terminal is used to identify risks in the first page of the displayed application based on the first sample page features and the second sample page features. The first page includes sensitive components. When the page features of the first page indicate that there is a risk in the first page, a risk warning is output. The risk warning is used to indicate that the application is an abnormal application. The page features of the first page are features collected from the first page.

[0295] Optionally, the server includes a feature server and an application server. The feature server can receive sensitive word features, image features, component tree features, and navigation relationship features of a normal application page from the application server. The feature server is used to send these features to the terminal.

[0296] The signature server is also used to record the names of applications that are pre-marked as trusted applications, build a whitelist based on the names of trusted applications, and send the whitelist to the terminal.

[0297] For the sake of convenience and brevity, the specific working process of the application risk warning system described above can be referred to the corresponding process in the foregoing embodiments, and will not be repeated here.

[0298] Furthermore, embodiments of this application also provide a device, including a memory for storing a program and a processor for running the program to support the device in implementing the methods described above.

[0299] This application also provides a computer-readable storage medium storing computer program instructions, which, when executed by a processing circuit, implement the functions or steps in the above-described method.

[0300] Furthermore, embodiments of this application may also provide a computer program product containing instructions, which, when run on a computer, causes the computer to perform the functions or steps in the above-described methods.

[0301] Furthermore, embodiments of this application also provide a chip system, including: at least one processor and a communication interface, wherein the at least one processor is coupled to a memory through the communication interface, and when the at least one processor executes a computer program or instructions in the memory, the above-described method is executed.

[0302] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the chip system, computer-readable storage medium, computer program product containing instructions, and device described above can be referred to the corresponding process in the foregoing embodiments.

[0303] The steps of the methods or algorithms described in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, read-only optical discs, or any other form of storage medium. One exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0304] In an alternative approach, when implemented in software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are implemented. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disk (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0305] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for application risk warning, characterized in that, The method includes: Display the first page of the application, the first page including a sensitive component, the sensitive component being a component on the first page used for users to input sensitive information; If the page features of the first page indicate that the first page has a risk, a risk warning is output, and the risk warning is used to indicate that the application is an abnormal application; The page features include one or more of the following: page text information of the first page, page component tree, page image, page navigation relationship of the first page, and application name of the application.

2. The method according to claim 1, characterized in that, When the page features of the first page indicate that the first page poses a risk, the method further includes: The first component and the second component are displayed on the first page; The system can receive user input on the first component and exit the application; or, it can receive user input on the second component, stop outputting risk warnings for the application, and continue running the application.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Based on the matching results between the page features of the first page and the features of the sample page, risk information of the first page is obtained; the risk information is used to determine whether there is any risk on the first page.

4. The method according to claim 3, characterized in that, The step of obtaining risk information for the first page based on the matching results between the page features of the first page and the sample page features includes: Based on the matching results between the page features of the first page and the features of the sample page, the degree of abnormality of the first page in the risk item is obtained; Based on the degree of abnormality of the risk item on the first page, the risk information of the first page is obtained; The risk items include one or more of the following: application trustworthiness, page sensitivity, and page anomaly.

5. The method according to claim 4, characterized in that, The step of determining the degree of abnormality of the first page in the risk item based on the matching result between the page features of the first page and the features of the sample page includes: Based on the matching results between the application name and the application whitelist and tag features in the sample page features, the degree of anomalousness of the first page in the application's credibility is obtained; and / or, Based on the matching results between the page text information of the first page and the sensitive word features in the sample page features, and the matching results between the page image of the first page and the image features in the sample page features, the degree of abnormality of the first page in the page sensitivity is obtained; and / or, Based on the matching results of the page component tree of the first page with the component tree features in the sample page features, and the matching results of the page jump relationship of the first page with the jump relationship features in the sample page features, the degree of abnormality of the first page in the page abnormality is obtained.

6. The method according to any one of claims 3-5, characterized in that, The method further includes: The system receives updated features sent by the server, which include one or more of the following: sensitive word features, image features, component tree features, jump relationship features, and application whitelist. Update the sample page features based on the updated features.

7. The method according to any one of claims 2-6, characterized in that, The method further includes: Based on the user's operation on the first component, the application is marked with a first tag, which is used to characterize the application as untrustworthy. Update the sample page features based on the first tag.

8. The method according to any one of claims 2-7, characterized in that, The second component includes a first trust component and a second trust component; the method further includes: Based on the user's actions on the first trusted component, the application is given a second label, which characterizes the application's trustworthiness; based on the second label, the sample page features are updated; or... The application is not flagged based on the user's actions on the second trusted component.

9. A server, characterized in that, The server is used for: Obtain the features of the first sample page, which include one or more of the following: sensitive word features of the normal application page, image features of the normal application page, component tree features of the normal application page, jump relationship features of the normal application page, and application whitelist. The first sample page features are sent to the terminal, which is used by the terminal to identify risks in the first page of the displayed application. The first page includes sensitive components, which are components on the first page used for users to input sensitive information.

10. A device, characterized in that, include: Including memory and processor; The processor is configured to execute a computer program stored in the memory to cause the device to perform the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a computer program or instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, The computer program product includes: a computer program or instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1-8.

Images