Application program compliance verification method and apparatus, electronic device and storage medium

Abstract

Disclosed in the present invention are an application program compliance verification method and apparatus, an electronic device and a storage medium. The method comprises: acquiring at least one privacy API, the privacy API being an API which can track user information or relates to user information; scanning a code file of a target APP to separately determine at least one first reference chain corresponding to each privacy API, and acquiring the class of each first reference chain, root nodes of all the first reference chains corresponding to a same privacy API all being the privacy API; determining a target static variable on the basis of the class of each first reference chain, the target static variable being related to a page jump scenario or a view multiplexing scenario of the target APP in an operation process; scanning the code file of the target APP to determine at least one second reference chain corresponding to the target static variable; and, on the basis of the second reference chain, verifying whether the target APP is compliant. The present solution can comprehensively verify whether an APP meets the requirements of related laws and regulations about privacy protection in various scenarios, thus avoiding risks caused by non-compliance of APPs.

Description

Application compliance detection method, device, electronic device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application CN202311121557.6, entitled “Application Compliance Detection Method, Device, Electronic Device and Storage Medium” filed on September 1, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present invention relates to the field of information security technology, and in particular to a compliance detection method, device, electronic device, and storage medium for an application program. Background Art

[0004] According to privacy protection requirements, applications (APPs) that collect and use user privacy information through the Application Programming Interface (API) without user consent will violate laws and regulations and may even face penalties such as removal from the app store. Therefore, before an APP is officially released online, it is often necessary to conduct an audit to avoid the risk of removal due to non-compliance.

[0005] Currently, the method for verifying apps typically involves using syntax tree analysis to scan the app's code files and determine whether the app calls privacy APIs. However, conventional syntax tree analysis can only perform static analysis of code files and cannot detect dynamic behavior during app runtime. For example, in engineering design, to improve code reusability, relatively independent pages (such as the photo page) are often encapsulated into separate pages for use elsewhere. These pages often call privacy APIs (such as opening the camera). In Android apps, jumping from page A (such as the avatar upload page) to page B (such as the photo page) is achieved by calling a system API, with all intermediate work performed by the Android operating system. Conventional syntax tree analysis cannot analyze the connection between the two pages, even though it is actually the avatar upload function on page A that uses the privacy API. For another example, functional modules with broad applicability (such as mapping modules) are typically not designed to be implemented solely on a single page, as such functionality requires flexible integration into multiple user interface views to build a complete user experience (for example, embedding a map in the address entry process to assist users in locating the delivery address). The construction method of such views generally involves directly declaring components in the layout file. This process goes beyond the scope of traditional syntax tree analysis based on code files. Therefore, traditional syntax tree analysis tools mainly focus on parsing source code and cannot directly parse layout files.

[0006] Summary of the Invention

[0007] The present invention provides an application compliance detection method, device, electronic device and storage medium, which can comprehensively detect whether the APP complies with the requirements of relevant laws and regulations on privacy protection in various scenarios, avoiding the risks caused by APP non-compliance.

[0008] According to one aspect of the present invention, a method for detecting compliance of an application is provided, comprising:

[0009] Obtain at least one privacy API, wherein the privacy API is an API that can trace user information or involves user information;

[0010] Scan the code files of the target app to determine at least one first reference chain corresponding to the privacy API, and obtain the class of the first reference chain, wherein the root node of the first reference chain corresponding to the same privacy API is the privacy API;

[0011] Determine a target static variable according to the class of the first reference chain, wherein the target static variable is related to a page jump scenario or a view reuse scenario of the target APP during operation;

[0012] Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable;

[0013] According to the second reference chain, whether the target APP is compliant is detected.

[0014] Optionally, determining the target static variable according to the class of the first reference chain includes:

[0015] Determine a candidate static variable according to the class of the first reference chain;

[0016] The target static variable is obtained by screening from the candidate static variables.

[0017] Optionally, determining a candidate static variable according to the class of the first reference chain includes:

[0018] Determine the base class to which the class of the first reference chain belongs;

[0019] Determine whether the base class to which the class of the first reference chain belongs is related to the page;

[0020] If the base class to which the class of the first reference chain belongs is not related to the page, determining that the class of the first reference chain is not the candidate static variable, and discarding the class of the first reference chain;

[0021] If the base class to which the class in the first reference chain belongs is related to the page, the class in the first reference chain is used as the candidate static variable.

[0022] Optionally, the target static variable includes a first target static variable and a second target static variable, the first target static variable is related to a page jump scenario of the target APP during operation, and the second target static variable is related to a view reuse scenario of the target APP during operation;

[0023] The step of screening the target static variable from the candidate static variables includes:

[0024] Determine whether the base class to which the candidate static variable belongs is a class of a preset type, wherein the preset type includes at least a view type;

[0025] If the base class to which the candidate static variable belongs is not a class of a preset type, taking the candidate static variable as the first target static variable;

[0026] If the base class to which the candidate static variable belongs is a class of a preset type, scanning the layout file of the target APP, determining a target layout file related to the base class to which the candidate static variable belongs, and obtaining the class of the target layout file;

[0027] The second target static variable is determined according to the class of the target layout file.

[0028] Optionally, determining the target static variable according to the class of the first reference chain includes:

[0029] Determine a candidate static variable according to the class of the first reference chain;

[0030] The target static variable is obtained by screening from the candidate static variables.

[0031] Optionally, determining a candidate static variable according to the class of the first reference chain includes:

[0032] Determine the base class to which the class of the first reference chain belongs;

[0033] Determine whether the base class to which the class of the first reference chain belongs is related to the page;

[0034] If the base class to which the class of the first reference chain belongs is not related to the page, determining that the class of the first reference chain is not the candidate static variable, and discarding the class of the first reference chain;

[0035] If the base class to which the class in the first reference chain belongs is related to the page, the class in the first reference chain is used as the candidate static variable.

[0036] Optionally, the target static variable includes a first target static variable and a second target static variable, the first target static variable is related to a page jump scenario of the target APP during operation, and the second target static variable is related to a view reuse scenario of the target APP during operation;

[0037] The step of screening the target static variable from the candidate static variables includes:

[0038] Determine whether the base class to which the candidate static variable belongs is a class of a preset type, wherein the preset type includes at least a view type;

[0039] If the base class to which the candidate static variable belongs is not a class of a preset type, taking the candidate static variable as the first target static variable;

[0040] If the base class to which the candidate static variable belongs is a class of a preset type, scanning the layout file of the target APP, determining a target layout file related to the base class to which the candidate static variable belongs, and obtaining the class of the target layout file;

[0041] The second target static variable is determined according to the class of the target layout file.

[0042] Optionally, determining the second target static variable according to the class of the target layout file includes:

[0043] Determine the base class to which the class of the target layout file belongs;

[0044] Determine whether the base class to which the class of the target layout file belongs is related to the page;

[0045] If the base class to which the class of the target layout file belongs is not related to the page, determining that the candidate static variable related to the target layout file is not the second target static variable, and discarding the candidate static variable related to the target layout file;

[0046] If the base class to which the class of the target layout file belongs is related to the page, the candidate static variable related to the target layout file is used as the second target static variable.

[0047] Optionally, detecting whether the target APP is compliant according to the second reference chain includes:

[0048] Determining whether the second reference chain corresponds to a business scenario that meets preset conditions;

[0049] If the second reference chain corresponds to a business scenario that meets the preset conditions, the target APP is determined to be compliant;

[0050] If the second reference chain does not correspond to a business scenario that meets the preset conditions, it is determined that the target APP is non-compliant.

[0051] Optionally, after determining that the target APP is non-compliant, the method further includes:

[0052] Prompt information is generated and displayed, wherein the prompt information includes at least information about the target APP and information about a second reference chain that does not correspond to a business scenario that meets preset conditions.

[0053] Optionally, after determining the candidate static variables and before screening the target static variable from the candidate static variables, the method further includes:

[0054] Displaying the candidate static variables;

[0055] First confirmation information triggered based on the candidate static variable is received, where the first confirmation information is used to indicate that the candidate static variable is correct or to instruct to modify the candidate static variable.

[0056] Optionally, after determining the second target static variable, the method further includes:

[0057] Display the second target static variable;

[0058] Second confirmation information triggered based on the second target static variable is received, where the second confirmation information is used to indicate that the second target static variable is correct or to instruct modification of the second target static variable.

[0059] According to another aspect of the present invention, a method for detecting compliance of an application is provided, comprising:

[0060] Obtain at least one privacy API, wherein the privacy API is an API that can track user information or involves user information;

[0061] Scan the target app's code files, identify at least one first reference chain corresponding to each privacy API, and obtain the class of each first reference chain. The root node of all first reference chains corresponding to the same privacy API is the privacy API.

[0062] Determine the target static variable based on the class of the first reference chain, where the target static variable is related to the page jump scenario or view reuse scenario during the operation of the target app;

[0063] Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable;

[0064] Based on the second reference chain, check whether the target APP is compliant.

[0065] Optionally, determining the target static variable according to the class of the first reference chain includes:

[0066] Determine candidate static variables according to the class of the first reference chain; and obtain a target static variable from the candidate static variables.

[0067] Optionally, determining a candidate static variable according to the class of the first reference chain includes:

[0068] Determine the base class to which the class of each first reference chain belongs respectively;

[0069] Determine whether the base class to which the class of the first reference chain belongs is related to the page;

[0070] If the base class to which the class of the first reference chain belongs is not related to the page, it is determined that the class of the first reference chain is not a candidate static variable, and the class of the first reference chain is discarded;

[0071] If the base class to which the class of the first reference chain belongs is related to the page, the class of the first reference chain is used as a candidate static variable.

[0072] Optionally, the target static variable includes a first target static variable and a second target static variable, the first target static variable is related to a page jump scenario during the running of the target APP, and the second target static variable is related to a view reuse scenario during the running of the target APP;

[0073] Target static variables are obtained by screening from candidate static variables, including:

[0074] Determine whether the base class to which the candidate static variable belongs is a class of a preset type, wherein the preset type includes at least a view type; if the base class to which the candidate static variable belongs is not a class of the preset type, use the candidate static variable as the first target static variable;

[0075] If the base class to which the candidate static variable belongs is a class of a preset type, the layout file of the target APP is scanned to determine the target layout file related to the base class to which the candidate static variable belongs, and the class of each target layout file is obtained;

[0076] A second target static variable is determined according to a class of the target layout file.

[0077] Optionally, determining the second target static variable according to the class of the target layout file includes:

[0078] Determine the base class to which the class of each target layout file belongs;

[0079] Determine whether the base class to which the target layout file's class belongs is related to the page;

[0080] If the base class to which the class of the target layout file belongs is not related to the page, determining that the candidate static variable related to the target layout file is not the second target static variable, and discarding the candidate static variable related to the target layout file;

[0081] If the base class to which the class of the target layout file belongs is related to the page, the candidate static variable related to the target layout file is used as the second target static variable.

[0082] Optionally, based on the second reference chain, checking whether the target app is compliant includes:

[0083] Determine whether each second reference chain corresponds to a business scenario that meets the preset conditions;

[0084] If all second reference chains correspond to business scenarios that meet the preset conditions, the target app is determined to be compliant;

[0085] If any second reference chain does not correspond to a business scenario that meets the preset conditions, the target APP is determined to be non-compliant.

[0086] Optionally, after determining that the target app is non-compliant, the following is also included:

[0087] Prompt information is generated and displayed, wherein the prompt information at least includes information about the target APP and information about a second reference chain that does not correspond to a business scenario that meets preset conditions.

[0088] Optionally, after determining the candidate static variables and before screening the target static variables from the candidate static variables, the method further includes:

[0089] Display candidate static variables;

[0090] A first confirmation message triggered by a user based on the candidate static variable is received, where the first confirmation message is used to indicate that the candidate static variable is correct or to instruct modification of the candidate static variable.

[0091] Optionally, after determining the second target static variable, the method further includes:

[0092] Display the second target static variable;

[0093] Second confirmation information triggered by the user based on the second target static variable is received, where the second confirmation information is used to indicate that the second target static variable is correct or to instruct modification of the second target static variable.

[0094] According to another aspect of the present invention, there is provided an application compliance detection device, comprising: an acquisition module, a scanning module, a processing module, and a detection module;

[0095] an acquisition module, configured to acquire at least one privacy API, wherein the privacy API is an API that can trace user information or involves user information;

[0096] A scanning module, configured to scan the code files of a target app and determine at least one first reference chain corresponding to a privacy API, wherein the root node of the first reference chain corresponding to a same privacy API is the privacy API;

[0097] A processing module is configured to obtain a class of the first reference chain; and determine a target static variable based on the class of the first reference chain, wherein the target static variable is related to a page jump scenario or a view reuse scenario during the operation of the target APP;

[0098] The scanning module is further used to scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable;

[0099] The detection module is used to detect whether the target APP is compliant based on the second reference chain.

[0100] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0101] at least one processor; and

[0102] a memory communicatively connected to at least one processor; wherein,

[0103] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the compliance detection method for an application program according to any embodiment of the present invention.

[0104] According to another aspect of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores computer instructions, which are used to enable a processor to implement the compliance detection method for an application according to any embodiment of the present invention when executed.

[0105] The technical solution of the embodiment of the present invention determines at least one privacy API by analyzing the privacy protection policy, performs a first scan on the code file of the target APP, determines at least one first reference chain and the class of the first reference chain corresponding to the privacy API, and then determines the target static variable related to the page jump scenario or view reuse scenario of the target APP during operation based on the class of the first reference chain; then performs a second scan on the code file of the target APP to determine at least one second reference chain corresponding to the target static variable, so as to detect whether the target APP is compliant. Compared with the existing method of using syntax tree analysis to scan the code file of the APP to determine whether the APP has a privacy API call, the solution provided by the present invention can analyze the real caller of the privacy API, which is closer to actual business, and this solution takes into account the page jump scenario or view reuse scenario of the target APP during operation, so that the target APP can comply with the requirements of relevant laws and regulations on privacy protection in various scenarios, avoiding the risks caused by the non-compliance of the target APP.

[0106] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0108] FIG1 is a schematic diagram of a flow chart of a compliance detection method for an application program provided in a first embodiment of the present invention;

[0109] FIG2 is a schematic diagram of the first part of the flow chart of a compliance detection method for an application provided in a second embodiment of the present invention;

[0110] FIG3 is a schematic diagram of the latter part of the flow chart of a compliance detection method for an application provided in a second embodiment of the present invention;

[0111] FIG4 is a flow chart of a compliance detection method for an application program provided in a third embodiment of the present invention;

[0112] FIG5 is a schematic diagram of the structure of an application compliance detection device provided in a third embodiment of the present invention;

[0113] FIG6 is a schematic diagram of the structure of another application compliance detection device provided in Embodiment 3 of the present invention;

[0114] FIG7 is a schematic structural diagram of an electronic device provided in a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0115] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0116] It should be noted that the terms "first", "second", "candidate", "target", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0117] Example 1

[0118] Figure 1 is a flow chart of a compliance detection method for an application provided in Example 1 of the present invention. This embodiment is applicable to detecting whether an APP complies with relevant laws and regulations. The method can be executed by an application compliance detection device, which can be implemented in the form of hardware and / or software. The application compliance detection device can be configured in an electronic device (such as a computer or server). As shown in Figure 1, the method includes:

[0119] S110. Obtain at least one privacy API.

[0120] Among them, privacy API is an API that can track user information or involves user information.

[0121] Privacy APIs refer to system APIs provided by an electronic device's operating system (such as the Android operating system) that involve private information. These APIs can track or involve user information. System APIs are Java functions provided by the operating system to developers. These Java functions can be used to obtain information provided by the operating system (such as the unique identifier of the user's device, the screen size of the user's device, the version number of the operating system installed on the user's device, etc.). Private information includes, but is not limited to, the unique identifier of the electronic device, the user's Internet Protocol (IP) address, and the user's photo album.

[0122] Specifically, the privacy API can be obtained in any of the following two ways: the first way is to pre-store the privacy API list in the compliance detection device of the application. When detecting whether the APP is compliant, the compliance detection device of the application can directly read the privacy API list to obtain at least one privacy API included in the privacy API list; the second way is for the compliance detection device of the application to obtain relevant laws and regulations on privacy protection through the Internet, and then interpret the relevant laws and regulations on privacy protection to obtain the privacy API. It can be seen that the first way is more convenient to obtain because the privacy API list is directly stored in the compliance detection device of the application, which can improve the detection efficiency; and the second way is that the relevant laws and regulations on privacy protection are obtained through the Internet, which can ensure the timeliness of the interpreted privacy API.

[0123] Optionally, the privacy API list in the first method described above can be updated according to updates to relevant laws and regulations on privacy protection, or the user can also edit, modify, and perform other operations on the privacy API list.

[0124] S120: Scan the code files of the target APP, determine at least one first reference chain corresponding to the privacy API, and obtain the class of the first reference chain.

[0125] Among them, the root node of the first reference chain corresponding to the same privacy API is the privacy API. In some embodiments, there may be multiple first reference chains corresponding to the same privacy API. The root nodes of these multiple first reference chains can all be the privacy API, or the root nodes of some of the multiple first reference chains can be the privacy API.

[0126] The target APP is any APP that needs to be tested for compliance, such as an APP adapted to the Android operating system, etc. The number of target APPs can be one or more, and the embodiment of the present invention does not impose any specific limitation on this.

[0127] The target APP has a code file. After obtaining at least one privacy API, each or some of the privacy APIs can be used as the target of syntax tree analysis to scan the code file of the target APP, thereby determining at least one first reference chain corresponding to each privacy API.

[0128] In mainstream implementations of mainstream commercial programming languages, reachability analysis is used to determine whether an object is alive. The algorithm uses the object to be judged as the root node for the search, and the path traversed by the search is called a reference chain. The reference relationship between each node in the reference chain is static. In this embodiment of the present invention, the first reference chain is the path obtained by scanning the code file of the target app and searching with the privacy API as the root node.

[0129] Specifically, the number of first reference chains corresponding to a privacy API can be one or more. All or part of the first reference chains corresponding to the same privacy API can be considered a group of reference chains, and the root node of this group of reference chains is the privacy API.

[0130] For example, assume that two privacy APIs were obtained in step S110, denoted as Privacy API 1 and Privacy API 2. Using Privacy API 1 and Privacy API 2 as the targets of syntax tree analysis, the target app's code files are scanned to determine the first reference chains 1 and 2 corresponding to Privacy API 1, and the first reference chains 3, 4, and 5 corresponding to Privacy API 2. The root nodes of First Reference Chains 1 and 2 are both Privacy API 1, and the root nodes of First Reference Chains 3, 4, and 5 are all Privacy API 2.

[0131] After determining at least one first reference chain corresponding to each privacy API, the class of each or some of these first reference chains can be obtained. Classes are commonly used in code to implement certain features of the app. The class of a first reference chain can be understood as the class information of the first reference chain.

[0132] S130. Determine the target static variable according to the class of the first reference chain.

[0133] Among them, the target static variable is related to the page jump scenario or view reuse scenario of the target APP during operation.

[0134] In order to solve the problem that conventional syntax tree analysis can only perform static analysis on code files but cannot detect the dynamic behavior of the APP during runtime, an embodiment of the present invention provides an implementation method for determining the target static variables related to the page jump scenario or view reuse scenario of the target APP during operation based on the class of the first reference chain.

[0135] Usually, a screen of content displayed in an APP corresponds to a page. Each page can be composed of views of different sizes. These views can be a line of text, a picture, a button, and so on.

[0136] Specifically, the method of "determining the target static variable according to the class of the first reference chain" in step S130 may include the following two steps:

[0137] Step a1: Determine candidate static variables based on the class of the first reference chain.

[0138] Candidate static variables are classes of the first reference chain that may be related to the page during the operation of the target app, obtained by screening from the classes of the first reference chain. The present invention can determine whether a class of the first reference chain is a candidate static variable based on the base class to which the class belongs. The base class to which the class of the first reference chain belongs can be obtained by recursive detection.

[0139] Optionally, after step a1 is completed and before step a2 is executed, the compliance detection device of the application can also display candidate static variables to the user for the user to review whether these candidate static variables are classes of the first reference chain that may be related to the page during the operation of the target APP; when these candidate static variables are classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a first confirmation message triggered based on the candidate static variables, and the first confirmation message is used to indicate that the candidate static variables are correct; when these candidate static variables are not all classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a first confirmation message triggered based on the candidate static variables, and the first confirmation message is used to indicate that the candidate static variables are modified. The first confirmation message can be triggered by the user on the qualified detection device, or it can be triggered by an instruction sent by an external device, and so on.

[0140] Step a2: Filter the target static variable from the candidate static variables.

[0141] The target static variable is the class of the first reference chain related to the page jump scenario or view reuse scenario during the operation of the target APP obtained by screening from the candidate static variables.

[0142] In some embodiments, the target static variable includes a first target static variable and a second target static variable. The first target static variable is related to the page jump scenario of the target APP during operation, and the second target static variable is related to the view reuse scenario of the target APP during operation.

[0143] By using the target static variables, we can analyze the real callers of the privacy API in combination with the page jump scenarios or view reuse scenarios during the operation of the target APP, which is closer to actual business.

[0144] S140: Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable.

[0145] After obtaining the target static variable, the target static variable may be used as a target for syntax tree analysis to scan the code file of the target APP, thereby determining at least one second reference chain corresponding to the target static variable.

[0146] In the embodiment of the present invention, the second reference chain is a path scanned from the target app's code file, with the target static variable as the root node. The second reference chain is used to ultimately detect whether the target app is compliant.

[0147] For example, assume that five target static variables are obtained in step S130, which are respectively recorded as target static variable 1, target static variable 2, target static variable 3, target static variable 4 and target static variable 5. Target static variables 1-5 are respectively used as the targets of syntax tree analysis, and the code file of the target APP is scanned to determine the second reference chain 1 corresponding to target static variable 1, the second reference chain 2 and the second reference chain 3 corresponding to target static variable 2, the second reference chain 4 corresponding to target static variable 3, the second reference chain 5 and the second reference chain 6 corresponding to target static variable 4, and the second reference chain 7 and the second reference chain 8 corresponding to target static variable 5. These eight second reference chains are the basis for the final detection of whether the target APP is compliant.

[0148] S150. Check whether the target APP is compliant based on the second reference chain.

[0149] Specifically, the method of "detecting whether the target app is compliant based on the second reference chain" in step S150 may include the following three steps:

[0150] Step b1: Determine whether the second reference chain corresponds to a business scenario that meets preset conditions.

[0151] Business scenarios that meet the preset conditions include but are not limited to business scenarios that comply with relevant laws and regulations on privacy protection and reasonable business scenarios.

[0152] In some embodiments, it may be determined separately whether each second reference chain has a corresponding business scenario that meets the preset conditions, or it may be determined whether some of the second reference chains have corresponding business scenarios that meet the preset conditions, where some of the second reference chains may be randomly selected or specified.

[0153] Step b2: If the second reference chain corresponds to a business scenario that meets the preset conditions, the target APP is determined to be compliant.

[0154] In some implementations, the target app is determined to be compliant if a first set percentage of second reference chains corresponds to business scenarios that meet the preset conditions. The first set percentage can be set based on actual needs. For example, if the first set percentage is 90% and the number of second reference chains is 10, the target app is determined to be compliant if 9 or more second reference chains correspond to business scenarios that meet the preset conditions.

[0155] In some other implementations, when all second reference chains correspond to business scenarios that meet preset conditions, it means that all calls to the privacy API at this time comply with the requirements of relevant laws and regulations on privacy protection, and the target APP is determined to be compliant.

[0156] Step b3: If the second reference chain does not correspond to a business scenario that meets the preset conditions, the target APP is determined to be non-compliant.

[0157] In some implementations, if no second reference chains that meet a second set percentage correspond to a business scenario that meets the preset conditions, the target app is determined to be non-compliant. The second set percentage can be set based on actual needs. For example, if the second set percentage is 20%, and the number of second reference chains is 10, then if two or more second reference chains do not correspond to a business scenario that meets the preset conditions, the target app is determined to be non-compliant.

[0158] In some other implementations, when any second reference chain does not correspond to a business scenario that meets the preset conditions, it may indicate that the call of the privacy API does not comply with the requirements of relevant laws and regulations on privacy protection, and the target APP is determined to be non-compliant.

[0159] Optionally, after determining that the target APP is non-compliant, a prompt message can be generated and displayed, which includes at least information about the target APP and information about a second reference chain that does not correspond to a business scenario that meets the preset conditions, for the user or developer to confirm / modify.

[0160] Example 2

[0161] FIG2 is a flow chart of a compliance detection method for an application provided in Example 2 of the present invention. Based on the above Example 1, this embodiment provides a specific implementation method for determining a target static variable. As shown in FIG2 , the method includes:

[0162] S201. Obtain at least one privacy API.

[0163] Among them, privacy API is an API that can track user information or involves user information.

[0164] Privacy API refers to the API involving privacy information in the system API provided by the operating system of the electronic device (such as the Android operating system), that is, the API that can track user information or involve user information.

[0165] Specifically, the privacy API can be obtained in any of the following two ways: the first way is to pre-store the privacy API list in the compliance detection device of the application. When detecting whether the APP is compliant, the compliance detection device of the application can directly read the privacy API list, thereby obtaining at least one privacy API included in the privacy API list; the second way is that the compliance detection device of the application obtains relevant laws and regulations on privacy protection through the Internet, and then interprets the relevant laws and regulations on privacy protection to obtain the privacy API.

[0166] S202: Scan the code files of the target APP, determine at least one first reference chain corresponding to the privacy API, and obtain the class of the first reference chain.

[0167] Among them, the root nodes of the first reference chains corresponding to the same privacy API are all the privacy API. In some implementations, there may be multiple first reference chains corresponding to the same privacy API. The root nodes of these multiple first reference chains can all be the privacy API, or the root nodes of some of the multiple first reference chains can be the privacy API.

[0168] The target app has code files. After obtaining at least one privacy API, the target app's code files can be scanned, using each privacy API as a target for syntax tree analysis, to determine at least one first reference chain corresponding to each privacy API. In this embodiment of the present invention, the first reference chain is a path scanned from the target app's code files, traversed by the search with the privacy API as the root node.

[0169] Specifically, the number of first reference chains corresponding to a privacy API can be one or more. All or part of the first reference chains corresponding to the same privacy API can be considered a group of reference chains, and the root node of this group of reference chains is the privacy API.

[0170] After determining at least one first reference chain corresponding to each privacy API, the class of each or some of these first reference chains can be obtained. Classes are commonly used in code to implement certain features of an app. The class of a first reference chain can be understood as the class information of the first reference chain.

[0171] S203: Determine the base class to which the class of the first reference chain belongs.

[0172] Specifically, in the embodiment of the present invention, a recursive detection method may be used to determine the base class to which the class of each first reference chain belongs.

[0173] For example, taking a class of the first reference chain as an example, the method for determining the base class to which the class of the first reference chain belongs is: first determine the parent class of the class of the first reference chain, then determine the parent class of the parent class of the class of the first reference chain, and so on until there is no parent class. The last parent class determined is the base class to which the class of the first reference chain belongs.

[0174] In this invention, the parent class is also a common design in the code. Compared with the class, the parent class is designed to facilitate the subsequent addition of some performance monitoring logs. Usually, a parent class is designed for a large functional module (such as a complex page processing flow). This parent class is intended to encapsulate the basic behaviors or attributes shared by the functional module, while the specific business logic or specific details are implemented and refined by the subclass through the inheritance mechanism. The inheritance mechanism is that the subclass explicitly declares that it inherits from a parent class in its definition, so that the code in the parent class can be reused and expanded or customized on this basis.

[0175] S204: Determine whether the base class to which the class in the first reference chain belongs is related to the page. If not, execute S205; if so, execute S206.

[0176] In the embodiment of the present invention, taking the Android operating system as an example, basic classes related to pages include but are not limited to Activity, Fragment, and View.

[0177] S205: Determine that the class of the first reference chain is not a candidate static variable, and discard the class of the first reference chain.

[0178] When the base class to which the class of the first reference chain belongs is not related to the page, it means that the class of the first reference chain will not be related to the page during the operation of the target APP, and there is no possibility of violation. In this case, it is determined that the class of the first reference chain is not a candidate static variable, and the class of the first reference chain is discarded, and the process ends.

[0179] S206: Use the class of the first reference chain as a candidate static variable.

[0180] When the base class to which the class of the first reference chain belongs is related to the page, it means that the class of the first reference chain may be related to the page during the operation of the target APP, then the class of the first reference chain is used as a candidate static variable and the subsequent process is continued.

[0181] Optionally, after step S206 is completed and before step S207 is executed, the compliance detection device of the application can also display candidate static variables to the user for the user to review whether these candidate static variables are classes of the first reference chain that may be related to the page during the operation of the target APP; when these candidate static variables are classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a first confirmation message triggered by the user based on the candidate static variables, and the first confirmation message is used to indicate that the candidate static variables are correct; when these candidate static variables are not all classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a first confirmation message triggered by the user based on the candidate static variables, and the first confirmation message is used to indicate the modification of the candidate static variables. The first confirmation message can be triggered by the user on the qualified detection device, or it can be triggered by an instruction sent by an external device, and so on.

[0182] S207: Determine whether the base class to which the candidate static variable belongs is a class of a preset type, wherein the preset type at least includes a view type. If not, execute S208; if so, execute S209.

[0183] When a candidate static variable is obtained, it is also necessary to determine whether the candidate static variable is actually related to the page during the target app's operation and to what scenario it is related. Therefore, it is also necessary to determine whether the base class to which the candidate static variable belongs is a class of the preset type.

[0184] In the embodiment of the present invention, the candidate static variables related to the page during the running of the target APP are referred to as target static variables. The target static variables include a first target static variable and a second target static variable.

[0185] S208: Use the candidate static variable as the first target static variable.

[0186] When the base class to which the candidate static variable belongs is not a class of the preset type, it means that the candidate static variable is related to the page jump scenario during the operation of the target APP, so the candidate static variable is used as the first target static variable.

[0187] Optionally, the first target static variable may be temporarily stored in the result set.

[0188] S209: Scan the layout file of the target APP, determine the target layout file related to the base class to which the candidate static variable belongs, and obtain the class of the target layout file.

[0189] When the base class of a candidate static variable is a class of a preset type, it means that the candidate static variable may be related to the view reuse scenario of the target app during operation, or it may not be related to the page at all during the target app's operation. Therefore, to further determine the answer, it is necessary to scan the layout files of the target app, filter out all target layout files related to the base class of the candidate static variable, and obtain the class of each target layout file.

[0190] Because each screen of content displayed in an app corresponds to a page, and each page can be composed of views of varying sizes, developers must layout and set parameters for each page to display properly. The file that stores these layouts and parameters is called a layout file. Layout files correspond one-to-one to pages and are typically stored in XML format.

[0191] Specifically, the layout file of the target APP can be regarded as a text file, and the name of the layout file can be directly scanned to see whether it includes the name of the base class to which the candidate static variable belongs; if it does, the layout file is used as the target layout file.

[0192] In addition, the method for obtaining the class of the target layout file is similar to the method for obtaining the class of the first reference chain mentioned above. You can refer to the description of the method for obtaining the class of the first reference chain mentioned above. For the sake of brevity, it will not be repeated here.

[0193] S210: Determine the base class to which the class of the target layout file belongs.

[0194] Specifically, in the embodiment of the present invention, a recursive detection method may be used to determine the base class to which the class of each target layout file belongs.

[0195] Exemplarily, taking the class of a target layout file as an example, the method for determining the base class to which the class of the target layout file belongs is: first determine the parent class of the class of the target layout file, then determine the parent class of the parent class of the class of the target layout file, and so on until there is no parent class. The last parent class determined is the base class to which the class of the target layout file belongs.

[0196] S211: Determine whether the base class to which the class of the target layout file belongs is related to the page. If not, execute S212; if so, execute S213.

[0197] In the embodiment of the present invention, taking the Android operating system as an example, basic classes related to pages include but are not limited to Activity, Fragment, and View.

[0198] S212: Determine that the candidate static variable related to the target layout file is not the second target static variable, and discard the candidate static variable related to the target layout file.

[0199] When the base class to which the class of the target layout file belongs is not related to the page, it means that the candidate static variable related to the target layout file will not be related to the page during the operation of the target APP, and there is no possibility of violation. It is determined that the candidate static variable related to the target layout file is not the second target static variable, and the candidate static variable related to the target layout file is discarded, and the process ends.

[0200] S213: Use the candidate static variable related to the target layout file as the second target static variable.

[0201] When the base class to which the class of the target layout file belongs is related to the page, it means that the candidate static variable related to the target layout file is related to the view reuse scenario of the target APP during operation. In this case, the candidate static variable related to the target layout file will be used as the second target static variable, and the subsequent process will continue.

[0202] Optionally, the second target static variable may also be temporarily stored in the result set.

[0203] Optionally, after step S213 is completed, the compliance detection device of the application can also display the second target static variables to the user for the user to review whether these second target static variables are classes of the first reference chain that may be related to the page during the operation of the target APP; when these second target static variables are classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a second confirmation message triggered by the user based on the second target static variables, and the second confirmation message is used to indicate that the second target static variables are correct; when these second target static variables are not all classes of the first reference chain that may be related to the page during the operation of the target APP, the compliance detection device of the application receives a second confirmation message triggered by the user based on the second target static variables, and the second confirmation message is used to indicate the modification of the second target static variables. The second confirmation message can be triggered by the user on the qualified detection device, or it can be triggered by an instruction sent by an external device, and so on.

[0204] 3 , after step S213 or step S205, the following process is continued:

[0205] S214: Scan the code file of the target APP to determine at least one second reference chain corresponding to the first target static variable and the second target static variable.

[0206] After determining the first target static variable and the second target static variable in step S208 and step S213 respectively, each first target static variable / second target static variable can be used as a target for syntax tree analysis to scan the code file of the target APP, thereby determining at least one second reference chain corresponding to the first target static variable and the second target static variable.

[0207] In the embodiment of the present invention, the second reference chain is a path scanned from the target app's code file, with the target static variable as the root node. The second reference chain is used to ultimately detect whether the target app is compliant.

[0208] This allows analysis of the actual caller of the privacy API through the second reference chain, providing a closer look at the business. For example, the delivery address entry page utilizes precise location tracking. Conventional syntax tree analysis can only determine whether the delivery address entry page utilizes precise location tracking. However, the solution provided by the present invention can analyze whether the address entry page was accessed from the payment page or from the delivery address module on the personal information page.

[0209] S215: Determine whether the second reference chain corresponds to a business scenario that meets the preset conditions. If so, execute S216; if not, execute S217.

[0210] Business scenarios that meet the preset conditions include but are not limited to business scenarios that comply with relevant laws and regulations on privacy protection and reasonable business scenarios.

[0211] In some embodiments, it may be determined separately whether each second reference chain has a corresponding business scenario that meets the preset conditions, or it may be determined whether some of the second reference chains have corresponding business scenarios that meet the preset conditions, where some of the second reference chains may be randomly selected or specified.

[0212] S216. Determine whether the target app is compliant.

[0213] In some implementations, the target app is determined to be compliant if a first set percentage of second reference chains corresponds to business scenarios that meet the preset conditions. The first set percentage can be set based on actual needs. For example, if the first set percentage is 90% and the number of second reference chains is 10, the target app is determined to be compliant if 9 or more second reference chains correspond to business scenarios that meet the preset conditions.

[0214] In some other implementations, when all second reference chains correspond to business scenarios that meet preset conditions, it means that all calls to the privacy API at this time comply with the requirements of relevant laws and regulations on privacy protection, and the target APP is determined to be compliant.

[0215] S217. Determine whether the target APP is non-compliant.

[0216] In some implementations, if no second reference chains that meet a second set percentage correspond to a business scenario that meets the preset conditions, the target app is determined to be non-compliant. The second set percentage can be set based on actual needs. For example, if the second set percentage is 20%, and the number of second reference chains is 10, then if two or more second reference chains do not correspond to a business scenario that meets the preset conditions, the target app is determined to be non-compliant.

[0217] In some other implementations, when any second reference chain does not correspond to a business scenario that meets the preset conditions, it may indicate that the call of the privacy API does not comply with the requirements of relevant laws and regulations on privacy protection, and the target APP is determined to be non-compliant.

[0218] S218. Generate and display prompt information, where the prompt information at least includes information about the target APP and information about a second reference chain that does not correspond to a business scenario that meets preset conditions.

[0219] After determining that the target APP is non-compliant, the compliance detection device of the application can also generate and display prompt information, which at least includes information about the target APP and information about the second reference chain that does not correspond to a business scenario that meets the preset conditions, for users or developers to confirm / modify.

[0220] The technical solution of the embodiment of the present invention determines at least one privacy API by analyzing relevant laws and regulations on privacy protection, performs a first scan on the code file of the target APP, determines at least one first reference chain corresponding to the privacy API and the class of each first reference chain, and then determines the target static variable related to the page jump scenario or view reuse scenario of the target APP during operation based on the class of the first reference chain; then performs a second scan on the code file of the target APP to determine at least one second reference chain corresponding to the target static variable to detect whether the target APP is compliant. Compared with the existing method of using syntax tree analysis to scan the code file of the APP to determine whether the APP has a privacy API call, the solution provided by the present invention can analyze the real caller of the privacy API, which is closer to actual business, and this solution takes into account the page jump scenario or view reuse scenario of the target APP during operation, so that the target APP can comply with the requirements of relevant laws and regulations on privacy protection in various scenarios, avoiding the risks caused by the non-compliance of the target APP.

[0221] Example 3

[0222] FIG4 is a flowchart of a compliance detection method for an application provided in a third embodiment of the present invention, including the following steps:

[0223] Step S310: Obtain at least one privacy API.

[0224] The privacy API is an API that can track user information or involves user information.

[0225] Step S320: Scan the code file of the target APP, determine at least one first reference chain corresponding to each of the privacy APIs, and obtain the class of each of the first reference chains.

[0226] Among them, the root nodes of all the first reference chains corresponding to the same privacy API are the privacy API.

[0227] Step S330: Determine the target static variable according to the class of the first reference chain.

[0228] Among them, the target static variable is related to the page jump scenario or view reuse scenario of the target APP during operation.

[0229] Step S340: Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable.

[0230] Step S350: Detect whether the target APP is compliant based on the second reference chain.

[0231] It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific implementation process of this embodiment three can refer to the corresponding processes in the aforementioned method embodiments one and two, and will not be repeated here.

[0232] Example 4

[0233] FIG5 is a schematic diagram of the structure of an application compliance detection device provided by Embodiment 4 of the present invention. As shown in FIG5 , the device includes: an acquisition module 401 , a scanning module 402 , a processing module 403 and a detection module 404 .

[0234] An acquisition module 401 is configured to acquire at least one privacy API, wherein the privacy API is an API that can track user information or involves user information;

[0235] Scanning module 402 is configured to scan the code files of the target app and determine at least one first reference chain corresponding to the privacy API, wherein the root nodes of the first reference chains corresponding to the same privacy API are all the privacy API;

[0236] Processing module 403 is used to obtain the class of the first reference chain; and determine the target static variable according to the class of the first reference chain, wherein the target static variable is related to the page jump scenario or view reuse scenario of the target app during operation;

[0237] The scanning module 402 is further configured to scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable;

[0238] The detection module 404 is used to detect whether the target APP is compliant based on the second reference chain.

[0239] Optionally, the processing module 403 is specifically configured to determine candidate static variables according to the class of the first reference chain; and obtain a target static variable from the candidate static variables.

[0240] Optionally, processing module 403 is specifically used to determine the base class to which the class of the first reference chain belongs; judge whether the base class to which the class of the first reference chain belongs is related to the page; if the base class to which the class of the first reference chain belongs is not related to the page, determine that the class of the first reference chain is not a candidate static variable, and discard the class of the first reference chain; if the base class to which the class of the first reference chain belongs is related to the page, use the class of the first reference chain as a candidate static variable.

[0241] Optionally, the target static variable includes a first target static variable and a second target static variable, the first target static variable is related to a page jump scenario during the running of the target APP, and the second target static variable is related to a view reuse scenario during the running of the target APP;

[0242] Processing module 403 is specifically used to determine whether the basic class to which the candidate static variable belongs is a class of a preset type, wherein the preset type includes at least a view type; if the basic class to which the candidate static variable belongs is not a class of the preset type, the candidate static variable is used as the first target static variable; if the basic class to which the candidate static variable belongs is a class of the preset type, the layout file of the target APP is scanned to determine the target layout file related to the basic class to which the candidate static variable belongs, and obtain the class of the target layout file; according to the class of the target layout file, the second target static variable is determined.

[0243] Optionally, processing module 403 is specifically used to determine the base class to which the class of the target layout file belongs; determine whether the base class to which the class of the target layout file belongs is related to the page; if the base class to which the class of the target layout file belongs is not related to the page, determine that the candidate static variable related to the target layout file is not the second target static variable, and discard the candidate static variable related to the target layout file; if the base class to which the class of the target layout file belongs is related to the page, use the candidate static variable related to the target layout file as the second target static variable.

[0244] Optionally, the detection module 404 is specifically used to determine whether the second reference chain corresponds to a business scenario that meets the preset conditions; if the second reference chain corresponds to a business scenario that meets the preset conditions, the target APP is determined to be compliant; if the second reference chain does not correspond to a business scenario that meets the preset conditions, the target APP is determined to be non-compliant.

[0245] It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0246] Optionally, in combination with Figure 5 , Figure 6 is a schematic structural diagram of another application compliance detection device provided by Embodiment 3 of the present invention. As shown in Figure 6 , the device further includes: an interaction module 405 .

[0247] The interaction module 405 is used to generate and display prompt information after the detection module 404 determines that the target APP is non-compliant, wherein the prompt information at least includes information about the target APP and information about the second reference chain that does not correspond to a business scenario that meets the preset conditions.

[0248] Optionally, the interaction module 405 is further configured to display the candidate static variables; and receive first confirmation information triggered based on the candidate static variables, where the first confirmation information is used to indicate that the candidate static variables are correct or to instruct modification of the candidate static variables.

[0249] Optionally, the interaction module 405 is further configured to display the second target static variable; and receive second confirmation information triggered based on the second target static variable, the second confirmation information being configured to indicate that the second target static variable is correct or to instruct modification of the second target static variable.

[0250] The application compliance detection device provided in the embodiment of the present invention can execute the application compliance detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0251] Example 5

[0252] FIG7 shows a block diagram of an electronic device 10 that can be used to implement an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0253] As shown in FIG7 , the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 and a random access memory (RAM) 13, that is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0254] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0255] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any other suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as the application compliance detection method.

[0256] In some embodiments, the compliance detection method for an application program may be implemented as a computer program that is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the compliance detection method for an application program described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the compliance detection method for an application program in any other appropriate manner (e.g., by means of firmware).

[0257] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0258] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0259] In the context of the present invention, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device or any suitable combination of the foregoing.

[0260] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and the input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0261] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0262] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0263] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0264] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A compliance detection method for an application, characterized in that: include: Acquire at least one privacy API, wherein the privacy API is an API that can trace user information or involves user information; Scan the code file of the target APP to determine at least one first reference chain corresponding to the privacy API, and obtain the class of the first reference chain, wherein the root node of the first reference chain corresponding to the same privacy API is the privacy API; Determine a target static variable according to the class of the first reference chain, wherein the target static variable is related to a page jump scenario or a view reuse scenario of the target APP during operation; Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable; According to the second reference chain, check whether the target APP is compliant.

2. The compliance detection method for an application according to claim 1, characterized in that: The step of determining the target static variable according to the class of the first reference chain includes: Determine a candidate static variable according to the class of the first reference chain; The target static variable is obtained by screening from the candidate static variables.

3. The compliance detection method for an application according to claim 2, characterized in that: The step of determining a candidate static variable according to the class of the first reference chain includes: Determine the base class to which the class of the first reference chain belongs; Determine whether the base class to which the class of the first reference chain belongs is related to the page; If the base class to which the class of the first reference chain belongs is not related to the page, determining that the class of the first reference chain is not the candidate static variable, and discarding the class of the first reference chain; If the base class to which the class in the first reference chain belongs is related to the page, the class in the first reference chain is used as the candidate static variable.

4. The compliance detection method for an application according to claim 2 or 3, characterized in that: The target static variable includes a first target static variable and a second target static variable, the first target static variable is related to a page jump scenario of the target APP during operation, and the second target static variable is related to a view reuse scenario of the target APP during operation; The step of selecting the target static variable from the candidate static variables includes: Determine whether the base class to which the candidate static variable belongs is a class of a preset type, wherein the preset type at least includes a view type; If the base class to which the candidate static variable belongs is not a class of a preset type, taking the candidate static variable as the first target static variable; If the base class to which the candidate static variable belongs is a class of a preset type, scanning the layout file of the target APP, determining a target layout file related to the base class to which the candidate static variable belongs, and obtaining the class of the target layout file; The second target static variable is determined according to the class of the target layout file.

5. The compliance detection method for an application according to claim 4, characterized in that: The determining the second target static variable according to the class of the target layout file includes: Determine the base class to which the class of the target layout file belongs; Determine whether the base class to which the class of the target layout file belongs is related to the page; If the base class to which the class of the target layout file belongs is not related to the page, determining that the candidate static variable related to the target layout file is not the second target static variable, and discarding the candidate static variable related to the target layout file; If the base class to which the class of the target layout file belongs is related to the page, the candidate static variable related to the target layout file is used as the second target static variable.

6. The compliance detection method for an application according to any one of claims 1 to 5, characterized in that: The detecting whether the target APP is compliant according to the second reference chain includes: Determining whether the second reference chain corresponds to a business scenario that meets preset conditions; If the second reference chain corresponds to a business scenario that meets the preset conditions, the target APP is determined to be compliant; If the second reference chain does not correspond to a business scenario that meets the preset conditions, it is determined that the target APP is non-compliant.

7. The compliance detection method for an application according to claim 6, characterized in that: After determining that the target APP is non-compliant, it also includes: Prompt information is generated and displayed, wherein the prompt information at least includes information about the target APP and information about a second reference chain that does not correspond to a business scenario that meets preset conditions.

8. The compliance detection method for an application according to claim 2 or 3, characterized in that: After determining the candidate static variables and before selecting the target static variable from the candidate static variables, the method further includes: Display the candidate static variables; First confirmation information triggered based on the candidate static variable is received, where the first confirmation information is used to indicate that the candidate static variable is correct or to indicate that the candidate static variable is to be modified.

9. The compliance detection method for an application according to claim 4 or 5, characterized in that: After determining the second target static variable, the method further includes: Display the second target static variable; Second confirmation information triggered based on the second target static variable is received, where the second confirmation information is used to indicate that the second target static variable is correct or to indicate that the second target static variable is to be modified.

10. A compliance detection method for an application, characterized in that: include: Acquire at least one privacy API, wherein the privacy API is an API that can trace user information or involves user information; Scan the code file of the target APP, determine at least one first reference chain corresponding to each of the privacy APIs, and obtain the class of each of the first reference chains, wherein the root nodes of all the first reference chains corresponding to the same privacy API are the privacy API; Determine a target static variable according to the class of the first reference chain, wherein the target static variable is related to a page jump scenario or a view reuse scenario of the target APP during operation; Scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable; According to the second reference chain, check whether the target APP is compliant.

11. The method according to claim 10, characterized in that The detecting whether the target APP is compliant according to the second reference chain includes: Determine respectively whether each of the second reference chains corresponds to a business scenario that meets preset conditions; If all the second reference chains correspond to business scenarios that meet the preset conditions, the target APP is determined to be compliant; If any of the second reference chains does not correspond to a business scenario that meets the preset conditions, it is determined that the target APP is non-compliant.

12. A compliance detection device for an application, characterized in that: include: Acquisition module, scanning module, processing module and detection module; The acquisition module is used to acquire at least one privacy API, wherein the privacy API is an API that can trace user information or involves user information; The scanning module is used to scan the code file of the target APP to determine at least one first reference chain corresponding to the privacy API, wherein the root node of the first reference chain corresponding to the same privacy API is the privacy API; The processing module is used to obtain the class of the first reference chain; and determine the target static variable according to the class of the first reference chain, wherein the target static variable is related to the page jump scenario or view reuse scenario of the target APP during operation; The scanning module is further used to scan the code file of the target APP to determine at least one second reference chain corresponding to the target static variable; The detection module is used to detect whether the target APP is compliant based on the second reference chain.

13. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the compliance detection method for the application program described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the compliance detection method for an application program according to any one of claims 1 to 11 when executed.

Images