SDK (Software Development Kit) security detection method and device, equipment, storage medium and program product
By automatically traversing the functions and components of the target application during SDK dynamic detection, the problem of low detection efficiency in existing technologies is solved, and efficient SDK security detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUAWEI TECH CO LTD
- Filing Date
- 2024-11-12
- Publication Date
- 2026-05-12
AI Technical Summary
The existing SDK's dynamic detection process is inefficient, requiring testers to manually traverse the application's functional interfaces, resulting in low efficiency and high labor costs.
By acquiring the functional and component information of the target application, a user interface traversal control tree is generated. During the operation of the target application, each function and component is automatically traversed, and the behavior is recorded to obtain security detection results, including personal information collection, permission usage, and sensitive call behavior.
It enables automatic traversal of SDK security detection, improving detection efficiency, reducing labor costs, and increasing detection accuracy and efficiency.
Smart Images
Figure CN122020652A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of software technology, and in particular to an SDK security detection method, apparatus, electronic device, computer-readable storage medium, and computer program product. Background Technology
[0002] A software development kit (SDK) is a collection of documentation, libraries, sample code, and tools used to help developers create software applications.
[0003] By performing security testing on an SDK, developers can understand its security status and promptly identify and address potential security issues. SDK security testing is the process of analyzing and evaluating the security of an SDK. SDK security testing methods can include static analysis and dynamic testing. Static analysis refers to scanning the execution logic of the code within the SDK package and its Application Programming Interface (API) calls. Dynamic testing, on the other hand, involves generating a runnable application (App) from the SDK, actually running that application to trigger the SDK's behavior, and then monitoring that behavior.
[0004] Currently, during the dynamic testing of the SDK, testers need to manually traverse the functional interfaces of the application corresponding to the SDK, which is very inefficient. Summary of the Invention
[0005] This application provides an SDK security detection method, apparatus, electronic device, computer-readable storage medium, and computer program product, which can solve the problem of low detection efficiency in existing SDK dynamic detection.
[0006] In a first aspect, embodiments of this application provide an SDK security detection method. In this method, an electronic device obtains the functional information and component information of a target application, wherein the target application is a demo application generated based on the SDK to be detected; obtains the traversal configuration information of each function; and after the target application runs, traverses each function and its components based on the traversal configuration information, component information, and functional information to obtain the security detection result of the SDK to be detected.
[0007] As can be seen from the above technical solutions, the embodiments of this application automatically traverse the functions and components of the target application based on the acquired functional information, component information and traversal configuration information during the operation of the target application, thereby realizing automatic traversal of SDK security detection. This eliminates the need for testers to manually identify business functions and traverse them, thus improving the detection efficiency of SDK dynamic detection.
[0008] In one possible implementation of the first aspect, obtaining the functional information of the target application and the component information of each function includes:
[0009] The system identifies each tab interface of the target application to obtain the user interface entry information corresponding to each function, as well as the component information of each component on the user interface; wherein, each tab interface integrates at least one function of the SDK to be detected; the function information includes user interface entry information.
[0010] In this implementation, when developing a demo application based on the SDK to be tested, each tab interface integrates at least one function, thus standardizing the application interface design. This allows for the automatic identification of the SDK's functional and component information from each tab interface, eliminating the need for testers to manually analyze the SDK's functional scenarios and related components, thereby reducing labor costs and improving the efficiency of dynamic SDK testing.
[0011] In one possible implementation of the first aspect, after obtaining the traversal configuration information for each function, the method further includes: generating a user interface traversal control tree based on the traversal configuration information and component information; and displaying the user interface traversal control tree. In this way, by generating and displaying the user interface traversal control tree, the traversal process can be visualized, thereby facilitating testers to understand relevant information such as the traversal order and traversal range in a timely manner.
[0012] In one possible implementation of the first aspect, after displaying the user interface traversal control tree, the method further includes: obtaining an adjustment operation for the user interface traversal control tree; and in response to the adjustment operation, obtaining the adjusted traversal configuration information. This allows users to perform adjustment operations such as pruning or reordering the control tree based on the user interface traversal control tree, thereby modifying traversal configuration information such as the traversal range or traversal order, resulting in greater convenience.
[0013] In one possible implementation of the first aspect, the traversal configuration information includes at least one of the following: the range of traversed elements, the preconditions for triggering the function action, and the traversal priority.
[0014] In this implementation, customized traversal is achieved by configuring at least one of the following: the range of traversed elements, the preconditions for triggering functional actions, and the traversal priority, thereby improving detection efficiency and accuracy.
[0015] In one possible implementation of the first aspect, based on the traversal configuration information, component information, and functional information, each function and its components are traversed to obtain the security detection result of the SDK to be tested, including:
[0016] Based on the traversal configuration information, component information, and function information, traverse each function and the components of the function;
[0017] During the traversal, the functions of each component are triggered based on the component information, and the security detection results are obtained by recording the behavior of the target application.
[0018] In this implementation, detection efficiency is further improved by automatically triggering various business scenarios during the traversal process and automatically recording the behavior of the target application under each business scenario.
[0019] In one possible implementation of the first aspect, security detection results are obtained by recording the behavior of the target application, including:
[0020] By recording at least one of the target application's personal information collection behavior, permission usage behavior, and sensitive call behavior, and capturing permission pop-up interfaces, security detection results can be obtained.
[0021] Secondly, embodiments of this application provide an SDK security detection device applied to electronic devices, the device comprising:
[0022] The information acquisition module is used to acquire the functional information and component information of the target application. The target application is a demo application generated based on the SDK to be tested.
[0023] The configuration information acquisition module is used to obtain the traversal configuration information for each function;
[0024] The detection module is used to traverse each function and its components based on the configuration information, component information and function information after the target application is running, and obtain the security detection results of the SDK to be detected.
[0025] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any of the first aspects above.
[0026] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the first aspects above.
[0027] Fifthly, embodiments of this application provide a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in any of the first aspects above. The chip system may be a single chip or a chip module composed of multiple chips.
[0028] Sixthly, embodiments of this application provide a computer program product that, when run on an electronic device, causes the electronic device to implement the method described in any of the first aspects above.
[0029] It is understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description
[0030] Figure 1 This is a schematic diagram of the structure of the electronic device 100 provided in the embodiments of this application;
[0031] Figure 2 A schematic flowchart of an SDK security detection method provided in this application embodiment;
[0032] Figure 3 This is a schematic diagram of the label interface provided in an embodiment of this application;
[0033] Figure 4 This is a schematic diagram of the permission detection record provided in an embodiment of this application;
[0034] Figure 5 This is a schematic diagram of personal information collection records provided in an embodiment of this application;
[0035] Figure 6 Another schematic flowchart of the SDK security detection method provided in the embodiments of this application;
[0036] Figure 7 This is a schematic block diagram of the SDK dynamic detection automation method provided in the embodiments of this application;
[0037] Figure 8 A schematic diagram of the UI traversal control tree provided in the application embodiment;
[0038] Figure 9 This is a schematic diagram of the SDK security detection system architecture provided in the embodiments of this application;
[0039] Figure 10This application provides a schematic diagram of the SDK security detection system architecture for its embodiments.
[0040] Figure 11 This is a schematic block diagram of the SDK security detection device provided in the embodiments of this application. Detailed Implementation
[0041] In the following description, specific details such as particular system architectures and technologies are set forth for illustrative purposes and not for limiting purposes, in order to provide a thorough understanding of the embodiments of this application.
[0042] The technical solutions provided in this application can be applied to electronic devices such as mobile phones, tablets, computers, and cloud servers. No specific type or structure of the electronic device is limited herein.
[0043] For example, Figure 1 A schematic diagram of the structure of an electronic device 100 is shown. The electronic device 100 may include, but is not limited to, a processor 110 and a memory 120. Optionally, the electronic device 100 may also include a display screen 130.
[0044] The structures illustrated in this application embodiment do not constitute a specific limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. For example, when the electronic device 100 is specifically a mobile phone, it may also include a universal serial bus (USB) interface, a charging management module, a power management module, a camera, a battery, an antenna, a mobile communication module, a wireless communication module, a speaker, a receiver, a headphone jack, sensors, buttons, a motor, an indicator, a touch sensor, and a subscriber identification module (SIM) card interface, etc. The touch sensor may be disposed on the display screen 130, and the touch sensor and the display screen 130 constitute a touch screen, also known as a "touchscreen".
[0045] Processor 110 may include one or more processing units, such as an application processor (AP), a graphics processing unit (GPU), an image signal processor (ISP), and a controller. These different processing units may be independent devices or integrated into one or more processors. The controller can generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution.
[0046] The processor 110 may include one or more interfaces. The interfaces may include a mobile industry processor interface (MIPI) and a general-purpose input / output (GPIO) interface, etc.
[0047] The MIPI interface can be used to connect the processor 110 to peripheral devices such as the display screen 130. The MIPI interface includes a display serial interface (DSI). In some embodiments, the processor 110 and the display screen 130 communicate via the DSI interface to realize the display function of the electronic device 100.
[0048] The GPIO interface can be configured via software. The GPIO interface can be configured as a control signal or a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 to the display screen 130, etc.
[0049] The interface connection relationships between the modules illustrated in the embodiments of this application are merely illustrative and do not constitute a structural limitation on the electronic device 100. In other embodiments of this application, the electronic device 100 may also employ different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.
[0050] Electronic device 100 implements display functions through a GPU, display screen 130, and application processor. The GPU is a microprocessor for image processing, connected to the display screen 130 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering. Processor 110 may include one or more GPUs, which execute program instructions to generate or modify display information.
[0051] The display screen 130 is used to display images, videos, etc. The display screen 130 includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a miniature LED, a microLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include one or N display screens 130, where N is a positive integer greater than 1.
[0052] The memory 120 can be used to store computer executable program code, including instructions. The memory 120 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as image playback), etc. The data storage area may store data created during the use of the electronic device 100. Furthermore, the memory 120 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the memory 120 and / or instructions stored in memory disposed in the processor. For example, by running a computer program on the memory 120, the electronic device implements the various steps in the SDK security detection method embodiment.
[0053] The following uses electronic device 100 as an example to introduce the technical solution provided in the embodiments of this application.
[0054] Please see Figure 2 This is a schematic flowchart of an SDK security detection method provided in an embodiment of this application. The method may include the following steps:
[0055] Step S201: Electronic device 100 acquires the functional information and component information of the target application. The target application is a demo application generated based on the SDK to be tested.
[0056] It should be noted that by conducting security testing on the SDK, potential security vulnerabilities, unauthorized collection of privacy data, abuse of permissions, non-compliant content, and malicious behaviors (such as traffic hijacking) can be discovered and assessed.
[0057] SDK security testing methods include dynamic testing and static testing. For items that depend on runtime conditions, such as the frequency of personal information collection and whether information is shared with third parties, static testing cannot directly detect them or has low accuracy. Dynamic testing can detect items that depend on runtime conditions. However, dynamic testing requires generating an application from the SDK to be tested and actually running that application to perform the detection of runtime-dependent items.
[0058] Typically, SDK developers or testers can develop a target application based on the core functional interfaces of the SDK to be tested. This target application is a demo application. This demo can support function calls and user interface (UI) traversal of the SDK to be tested, covering the functionality and exposed APIs of the SDK to be tested, and it can run normally.
[0059] The functional information of the target application may include, but is not limited to: the functional type information of the SDK to be tested, the permission information for each function, the personal data collection information for each function, and the calling information for each function.
[0060] The function type information of the SDK to be tested is used to characterize which functions the SDK includes and the type of each function. For example, the SDK to be tested may include three types: pre-operation tasks, basic business functions, and extended business functions. Among them, pre-operation tasks may include non-business functions such as privacy disclosure and initialization. For example, for a navigation application, the basic business function is the navigation business function, and the extended business functions may include call business functions and photo business functions, etc.
[0061] Permission usage information is used to characterize the permissions required for a function. For example, a function may require permissions such as location access and camera access.
[0062] Personal data collection information is used to characterize which personal data a function needs to collect. Based on the type of personal data collected, basic business functions can be divided into basic business functions that collect only necessary personal data and basic business functions that collect non-essential personal data. Extended business functions can be divided into extended business functions that collect only necessary personal data and extended business functions that collect non-essential personal data.
[0063] Necessary personal data refers to personal information that a certain function must use, while non-necessary personal data refers to information that a certain function does not require.
[0064] The call information for each function is used to characterize the call order and call method of each function.
[0065] The component information for each function may include, but is not limited to: which components each function includes, the type, position, size and action attributes of each component, and the text or pattern on the component.
[0066] Component types can include, for example, text components and image components. Component position indicates the component's location on the user interface. Component size refers to the screen space occupied by the component on the user interface. Component action attributes can include click, swipe, and text input. When a component's action attribute is click, it indicates that the component is interacted with by the user clicking; when a component's action attribute is swipe, it indicates that the user can swipe on the component.
[0067] In some embodiments, testers can manually obtain the aforementioned functional and component information from documents such as SDK integration documentation and compliance usage guidelines. Alternatively, the electronic device 100 can obtain functional information by parsing integration documentation and compliance usage guidelines; then testers can manually obtain the aforementioned component information.
[0068] In other embodiments, the electronic device 100 can identify the various tab interfaces of the target application to obtain user interface entry information corresponding to each function, as well as component information of each component on the user interface. The function information may include user interface entry information.
[0069] At this point, when developing an application based on the SDK to be tested, by standardizing the interface style, each tab of the target application integrates at least one function of the SDK to be tested, and each tab can clearly display the functional points and example effects of the SDK to be tested. In this way, the electronic device 100 can automatically identify the functional information and component information from each tab.
[0070] For example, see Figure 3The illustrated tab interface diagram provided in this application embodiment includes tab interfaces 31 to 35. Tab interface 31 integrates the pre-operation tasks of the SDK to be tested, including non-business functions such as privacy disclosure and initialization. Tab interface 32 integrates the basic business functions of the SDK to be tested, which only collect necessary personal information. Tab interface 33 integrates the basic business functions of the SDK to be tested, which collect non-essential personal information. Tab interface 34 integrates the extended business functions of the SDK to be tested, which only collect necessary personal information. Tab interface 35 integrates the extended business functions of the SDK to be tested, which collect non-essential personal information. Similarly, if the SDK to be tested has other extended functions, the tab interfaces can be extended according to tab interfaces 34 and 35, and other extended functions can be integrated into other tab interfaces such as tab interface 36.
[0071] Tab interfaces 31 to 36 may include components that integrate the functions of each tab interface. Figure 3 Examples of text components and controls (Buttons) are shown in the example.
[0072] When developing a target application based on the SDK to be tested, the tab interface is differentiated according to scenario dimensions such as basic business functions and extended business functions. That is, each tab interface integrates a function, and displays the relevant components involved in that function on each tab interface.
[0073] 100 pairs of electronic devices Figure 3 By identifying the various tab interfaces within the device, functional and component information can be obtained. Specifically, since a function is integrated into each tab interface during demo development according to a standardized demo interface style, the device can automatically identify the UI interface entry points for pre-operation tasks, basic business functions (collecting only necessary personal information), basic business functions (collecting non-necessary personal information), extended business functions (collecting only necessary personal information), and extended business functions (collecting non-necessary personal information). That is, the electronic device 100 can identify which functions the SDK to be tested includes and the UI interface entry points for each function. Furthermore, the electronic device 100 can also obtain information such as the type, position, size, and action attributes (e.g., click, swipe, etc.) of components from each tab interface, and identify the text and graphic icons of the components through optical character recognition (OCR) text recognition, image recognition, and other methods, thereby obtaining the component information of each component.
[0074] Since each tab interface integrates the functionality of an SDK to be detected, the components included in each function can be obtained by identifying the components on a tab interface.
[0075] It is worth noting that different SDKs have significantly different functions and interfaces, resulting in complex and diverse interfaces for applications developed using different SDKs. Therefore, testers typically have to manually identify the functions and component information of each function within the SDK. However, this method is inefficient and labor-intensive. In this embodiment, when developing a demo based on the SDK to be tested, each tab interface integrates at least one function, thus standardizing the application interface design. Consequently, the electronic device 100 can automatically identify the functional and component information of the SDK from each tab interface, eliminating the need for testers to manually analyze the SDK's functional scenarios and related components. This reduces labor costs and improves the efficiency of dynamic SDK testing.
[0076] Step S202: Electronic device 100 obtains the traversal configuration information of each function.
[0077] In some embodiments, the traversal configuration information includes at least one of the following: the range of traversed elements, the preconditions for triggering the function action, and the traversal priority.
[0078] The scope of elements to be traversed, also known as the path of elements to be traversed, is used to represent which part or which controls of the user interface are being traversed.
[0079] Traversal priority is used to indicate which user interface or part of the user interface should be traversed first. Typically, if the target application is complex, it may have multiple user interfaces, some of which are related. In this case, if no traversal priority is set, traversal will be random, leading to low detection efficiency. However, the embodiments of this application improve detection efficiency by setting traversal priority.
[0080] The preconditions for triggering a function refer to the conditions or prerequisite actions that precede the triggering of a certain function. For example, if a function is to jump from one interface to another, the prerequisite is clicking a certain button.
[0081] It is worth noting that this embodiment can achieve customized traversal by setting at least one of the traversal element range, preconditions, and traversal priority, thereby improving detection efficiency and accuracy. For example, if the traversal element range or traversal element path is not set, all components will be traversed during automatic traversal. However, for SDK security detection, it is usually unnecessary to traverse all components, as traversing all components would result in unnecessary traversal and reduce detection efficiency. This embodiment sets the traversal element range according to the scope of personal information collection and usage permissions required for testing, which can reduce unnecessary traversal and thus improve detection efficiency.
[0082] For example, without configuring preconditions for triggering functional actions, missed or invalid detections may occur, affecting detection accuracy and efficiency. For instance, a functional action might be sequential: execute action 'a' first, then 'b', and finally 'c'. If no preconditions are configured, and actions 'a', 'b', and 'c' are triggered randomly, it might take many invalid checks before the correct sequence of actions (a, b, c) is achieved; or it might not even achieve this sequence after many checks, leading to missed detections.
[0083] In other embodiments, the traversal configuration information may also exclude the traversal element range, the preconditions for triggering the function action, and the traversal priority.
[0084] Step S203: After the target application runs, the electronic device 100 traverses each function and its components according to the traversal configuration information, component information and function information to obtain the security detection result of the SDK to be tested.
[0085] After developing the target application based on the SDK to be detected, the target application can be run on a physical device (such as a test phone) or on an emulator (such as a sandbox emulator) to dynamically detect the target application in its running state.
[0086] In some embodiments, the electronic device 100 can traverse various functions and components of functions based on traversal configuration information, component information, and function information; and during the traversal, the functions of each component are triggered according to the component information, and the security detection results are obtained by recording the behavior of the target application. That is, the behavior of the target application is automatically triggered and recorded during the traversal.
[0087] Compared to the requirement for testers to manually trigger business scenarios and manually record the behavior of each target application, the embodiments of this application automatically trigger and record the behavior of the target applications during the traversal process, which can improve detection efficiency.
[0088] In practical applications, electronic device 100 can automatically trigger the functions of user interface components during the traversal process based on the type, position, size, action attributes, etc. of each component, and automatically record the behavior of the target application in the record log based on technologies such as hook.
[0089] The behavior of the target application may include, for example, at least one of the following: personal information collection behavior, permission usage behavior, sensitive access behavior, and permission pop-up interface. That is, the electronic device 100 can record at least one of the target application's personal information collection behavior, permission usage behavior, and sensitive access behavior, and automatically capture the permission pop-up interface to obtain security detection results.
[0090] By examining the collection of personal information, one can determine what personal information a particular function has collected; by examining the use of permissions, one can determine what permissions a particular function has used.
[0091] Security test results may include, but are not limited to: personal information collected by a certain function, permissions used by a certain function, sensitive call behavior, and permission pop-up interfaces, and may also include descriptions and timestamps of the business functions traversed.
[0092] For example, see Figure 4 The illustrated diagram of the permission detection record provided in this application embodiment shows that the permission detection record in the security detection result may include information such as permission name, timestamp, and business function. In this case, the business function is a statistical function, which is a basic business function and only collects necessary personal information.
[0093] For example, see Figure 5 The illustrated diagram of personal information collection records provided in this application embodiment shows that the personal information collection records in the security detection results may include personal data items, timestamps, and business functions. In this case, the collected personal data item is a phone number, and the business function is a sharing function. The sharing function is a basic business function, and only necessary personal information is collected.
[0094] In this embodiment of the application, by automatically traversing the functions and components of the target application based on the acquired functional information, component information and traversal configuration information during the operation of the target application, the automatic traversal of SDK security detection is realized, eliminating the need for testers to manually identify business functions and traverse them, thereby improving the detection efficiency of SDK dynamic detection.
[0095] Please see Figure 6 This is another schematic flowchart of the SDK security detection method provided in this application embodiment. The method may include the following steps:
[0096] Step S601: The electronic device 100 identifies each tab interface of the target application, obtains the user interface entry information corresponding to each function, and the component information of each component on the user interface; wherein, each tab interface integrates at least one function of the SDK to be detected; the function information includes user interface entry information.
[0097] In practical applications, based on a standardized demo interface design, a demo application (i.e., the target application) is developed according to the SDK to be tested, so that each tab of the developed demo application integrates the corresponding functions. In this way, the electronic device 100 can automatically identify functional information and component information from each tab.
[0098] Step S602: Electronic device 100 obtains the traversal configuration information of each function. The traversal configuration information includes at least one of the following: the range of traversed elements, the preconditions for triggering the function action, and the traversal priority.
[0099] In practical applications, testers can configure the traversal configuration information for each function based on the component and function information identified in the above steps, as well as the target scope to be tested (e.g., which usage permissions and which personal information collections need to be tested), in order to achieve customized traversal.
[0100] Step S603: The electronic device 100 generates a user interface traversal control tree based on the traversal configuration information and component information, and displays the user interface traversal control tree.
[0101] After obtaining the traversal configuration information, before executing the traversal, a UI traversal control tree is generated to visualize the traversal process, which makes it easier for testers to adjust the traversal process (such as adjusting the traversal order and traversal range).
[0102] Step S604: Electronic device 100 obtains the adjustment operation for traversing the control tree of the user interface, and in response to the adjustment operation, obtains the adjusted traversal configuration information.
[0103] After the UI traversal control tree is displayed, testers can adjust it. These adjustments may include, but are not limited to: pruning operations to trim the UI traversal control tree, and operations to adjust the traversal order of the UI traversal control tree.
[0104] Pruning the UI control tree reduces unnecessary traversals, thereby improving detection efficiency. Adjusting the UI control tree can be considered as adjusting the traversal configuration information. For example, pruning the UI control tree can be seen as adjusting the range of traversed elements in the traversal configuration information.
[0105] In step S605, the electronic device 100 traverses each function and its components according to the traversal configuration information, component information and function information. During the traversal, the functions of each component are triggered according to the component information. At least one of the target application's personal information collection behavior, permission usage behavior and sensitive call behavior is recorded, and the permission pop-up interface is captured to obtain the security detection result.
[0106] The above traversal configuration information can be the adjusted traversal configuration information.
[0107] See Figure 7 The diagram shown is a schematic block diagram of the automated SDK dynamic detection method provided in the embodiments of this application. The SDK dynamic detection process may include stages such as standardizing the demo interface design, configuring traversal information, automatic UI traversal, dynamic behavior monitoring, and outputting detection results.
[0108] During the standardized demo interface design phase, demo development is carried out based on the SDK to be tested, and each tab of the demo integrates a function during the development phase. For example... Figure 7 As shown, the demo application's interface design employs a tabbed navigation approach, with navigation buttons for four tabs (Tab1 to Tab4) at the bottom. Clicking these bottom navigation buttons allows users to switch to the corresponding tab. By standardizing the demo interface design, the electronic device 100 can automatically identify functional and component information from the tabs, further improving detection efficiency.
[0109] During the traversal information configuration phase, relevant parameters of the interface traversal process can be configured based on the identified functional and component information, as well as the scope to be tested. For example, the range of traversed elements, the preconditions for triggering functional actions, and the traversal priority can be configured to achieve customized traversal.
[0110] During the UI auto-traversal phase, each component and function on the four tabs (Tab1 to Tab4) is traversed based on traversal configuration information, component information, and function information. Before traversal, a UI traversal control tree can be generated based on component information and traversal configuration information, and the adjusted traversal configuration information can be obtained based on user adjustments to the UI traversal control tree.
[0111] For example, users can prune the UI traversal control tree to remove controls that don't need to be traversed. See, for example, [link to relevant documentation]. Figure 8 The illustrated block diagram of the UI traversal control tree provided in this application embodiment assumes that the UI traversal control tree includes nodes 0 to 9, and each node is a control. The user prunes nodes 8 and 0 (i.e. Figure 8 The cross in the code means that the controls corresponding to node 8 and node 0 are not traversed during the traversal process.
[0112] The component's Artificial Intelligence (AI) recognition engine can identify text and icons on various components. Specifically, it can recognize text on components through OCR text detection and recognize icons through icon image recognition.
[0113] During the traversal, dynamic behavior monitoring of the demo application is performed to monitor the collection of personal information, permission usage, and sensitive behavior calls. Log recording can be performed based on HOOK technology, and the detection results can be output.
[0114] In this embodiment, by standardizing the demo interface design, the electronic device 100 can automatically identify functional and component information from the label interface, reducing labor costs and improving testing efficiency. By automatically traversing configuration information, component information, and functional information, each function and functional component is traversed without the need for testers to manually traverse, thereby improving testing efficiency. During the traversal process, automatic point recording is performed based on technologies such as HOOK to achieve automatic monitoring and recording of personal information collection, permission usage, and sensitive behavior invocation, without the need for testers to manually trigger testing scenarios and manually record, thus improving testing efficiency.
[0115] The SDK security detection solution provided in this application can be used in the SDK submission platform's submission detection process, or it can be used in SDK detection tools. SDK detection tools can be cloud-based detection platforms or applications integrated into terminal devices such as mobile phones, tablets, and computers; no limitation is made here.
[0116] The system architecture of the embodiments of this application will be described below by way of example.
[0117] See Figure 9 The illustrated embodiment of this application provides a schematic diagram of an SDK security detection system architecture, which may include a detection platform 91 and a device platform 92. The detection platform 91 includes a cloud-based detection service, which comprises a data processing and report generation module, a dynamic detection module, and a device management module. The device platform 92 includes a user agent and a test mobile phone.
[0118] The test phone has the demo application of the SDK to be tested installed and runs the demo application; the user agent is used to interact with the cloud detection service to obtain task requests from the cloud detection service, etc.
[0119] The dynamic detection module controls the test phone to perform operations such as traversal and logging; the device management module manages tasks on the device platform; and the data processing and report generation module generates detection reports based on the logging data. In practical applications, the dynamic detection module interacts with the user agent to control the test phone to automatically traverse various functions and components based on traversal configuration information, component information, and function information, obtaining detection results (such as logging data showing personal information collection and permission usage). The test phone then transmits the detection results to the cloud-based detection service.
[0120] In other embodiments, the test phone on device platform 92 can be implemented using a sandbox simulator. See also Figure 10 The illustrated embodiment of this application provides a schematic diagram of an SDK security detection system architecture, which may include a detection platform 91 and a device platform 92. The detection platform 91 includes a cloud-based detection service, which comprises a data processing and report generation module, a dynamic detection module, and a device management module. The device platform 92 includes a user agent, a sandbox simulator, and an operating platform. The cloud device may be, for example, a cloud server.
[0121] Testers can install the demo application of the SDK to be tested onto the sandbox simulator, which will then run the demo application. Testers can operate the cloud device through the platform. In specific applications, the dynamic detection module can interact with the user agent to control the sandbox simulator to automatically traverse each function and component based on traversal configuration information, component information, and functional information to obtain the detection results. The sandbox simulator then transmits the detection results to the cloud detection service.
[0122] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0123] Corresponding to the SDK security detection method described in the above embodiments, Figure 11 A schematic block diagram of the structure of the SDK security detection device provided in the embodiments of this application is shown. For ease of explanation, only the parts related to the embodiments of this application are shown.
[0124] See Figure 11 The device may include:
[0125] The information acquisition module 1110 is used to acquire the functional information and component information of each function of the target application. The target application is a demo application generated based on the SDK to be tested.
[0126] The configuration information acquisition module 1120 is used to acquire the traversal configuration information of each function;
[0127] The detection module 1130 is used to traverse each function and its components based on the traversal configuration information, component information and function information after the target application is running, and obtain the security detection result of the SDK to be detected.
[0128] In one possible implementation, the information acquisition module 1110 is specifically used to: identify each tab interface of the target application, obtain the user interface entry information corresponding to each function, and the component information of each component on the user interface; wherein, each tab interface integrates at least one function of the SDK to be detected; the function information includes user interface entry information.
[0129] In one possible implementation, the device further includes a UI control tree generation module for generating a user interface traversal control tree based on traversal configuration information and component information; and displaying the user interface traversal control tree.
[0130] In one possible implementation, the device further includes an adjustment module for obtaining an adjustment operation for traversing the control tree of the user interface; and in response to the adjustment operation, obtaining the adjusted traversal configuration information.
[0131] In one possible implementation, the traversal configuration information includes at least one of the following: the range of elements to be traversed, the preconditions for triggering the function action, and the traversal priority.
[0132] In one possible implementation, the detection module 1130 is specifically used to: traverse each function and its components according to the traversal configuration information, component information and function information; during the traversal, trigger the functions of each component according to the component information, and obtain security detection results by recording the behavior of the target application.
[0133] In one possible implementation of the first aspect, the detection module 1130 is specifically used to: record at least one of the target application's personal information collection behavior, permission usage behavior, and sensitive call behavior, and capture the permission pop-up interface to obtain security detection results.
[0134] The aforementioned SDK security detection device has the function of implementing the SDK security detection method for the aforementioned electronic device. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned function, and the modules can be software and / or hardware.
[0135] It should be noted that the information interaction and execution process between the above-mentioned SDK security detection devices are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.
[0136] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0137] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.
[0138] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0139] In the embodiments provided in this application, it should be understood that the disclosed devices, electronic devices, and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.
[0140] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0141] The electronic device provided in this application embodiment may include a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method as described in any of the above method embodiments.
[0142] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps described in the various method embodiments above.
[0143] This application provides a computer program product that, when run on an electronic device, enables the electronic device to perform the steps described in the various method embodiments above.
[0144] This application also provides a chip system, which includes a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the methods described in the above embodiments. The chip system may be a single chip or a chip module composed of multiple chips.
[0145] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not detailed or described in a particular embodiment can be referred to in the relevant descriptions of other embodiments. It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. Furthermore, in the description of this application specification and appended claims, the terms "first," "second," "third," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first," "second," "third," and "fourth" may explicitly or implicitly include one or more of that feature. Additionally, it should be understood that at least one in the embodiments of this application includes one or more; where "more" means greater than or equal to two. In the embodiments of this application, "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the objects before and after it are in an "or" relationship.
[0146] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.
[0147] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. An SDK security detection method, characterized in that, Applied to electronic devices, the method includes: Obtain functional information and component information of each function of the target application, wherein the target application is a demo application generated based on the SDK to be detected; Obtain the traversal configuration information for each of the aforementioned functions; After the target application runs, based on the traversal configuration information, the component information, and the function information, each function and its component are traversed to obtain the security detection result of the SDK to be detected.
2. The method according to claim 1, characterized in that, Obtain functional information and component information for each function of the target application, including: The various tab interfaces of the target application are identified to obtain the user interface entry information corresponding to each function, as well as the component information of each component on the user interface. Each of the aforementioned label interfaces integrates at least one of the functions of the SDK to be detected; The functional information includes the user interface entry information.
3. The method according to claim 1, characterized in that, After obtaining the traversal configuration information for each of the aforementioned functions, the method further includes: Based on the traversal configuration information and the component information, a user interface traversal control tree is generated; The user interface is displayed by traversing the control tree.
4. The method according to claim 3, characterized in that, After displaying the user interface traversing the control tree, the method further includes: Obtain the adjustment operations for traversing the control tree of the user interface; In response to the adjustment operation, the adjusted traversal configuration information is obtained.
5. The method according to claim 1, characterized in that, The traversal configuration information includes at least one of the following: the range of traversed elements, the preconditions for triggering the function action, and the traversal priority.
6. The method according to any one of claims 1 to 5, characterized in that, Based on the traversal configuration information, the component information, and the function information, each function and its components are traversed to obtain the security detection result of the SDK to be detected, including: Based on the traversal configuration information, the component information, and the function information, each function and its component are traversed. During the traversal, the functions of each component are triggered based on the component information, and the security detection results are obtained by recording the behavior of the target application.
7. The method according to claim 6, characterized in that, The security detection results are obtained by recording the behavior of the target application, including: The security detection results are obtained by recording at least one of the target application's personal information collection behavior, permission usage behavior, and sensitive call behavior, and by capturing the permission pop-up interface.
8. An SDK security detection device, characterized in that, Applied to electronic devices, the device includes: The information acquisition module is used to acquire the functional information and component information of each function of the target application, wherein the target application is a demo application generated based on the SDK to be detected. The configuration information acquisition module is used to acquire the traversal configuration information for each of the aforementioned functions; The detection module is used to, after the target application runs, traverse each of the functions and the components of the functions according to the traversal configuration information, the component information and the function information, and obtain the security detection result of the SDK to be detected.
9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.
11. A computer program product, characterized in that, When the computer program product is run on an electronic device, it causes the electronic device to perform the method as described in any one of claims 1 to 7.