Method and apparatus for monitoring interface calling, and electronic device

Abstract

Provided in the present application are a method and apparatus for monitoring interface calling, and an electronic device. The method can comprise: acquiring interface authentication information corresponding to an interface to be called; and if a target interface calling method matching the interface authentication information is found in a monitoring list, determining that said interface is suspected of violation, wherein interface calling methods and interface authentication information which correspond to a plurality of interfaces that are suspected of violation are stored in the monitoring list in an associated manner, a plurality of interface calling methods being acquired from a library file for inter-process communication in an Android system, and a plurality of interface calling methods provided with hooks being stored in the library file. By means of the method, interface calling conditions can be monitored more accurately and comprehensively in inter-process communication.

Description

Method, device and electronic device for monitoring interface call

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application No. 2023112473077, filed on September 25, 2023, entitled “Method, device and electronic device for monitoring interface calls,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present application relates to the field of information security, and in particular to a method, device and electronic device for monitoring interface calls. Background Art

[0004] With the continuous development of technology, various applications are emerging in an endless stream. Applications may call APIs (Application Program Interfaces) during their operation. If APIs are called in violation of regulations (for example, APIs involving sensitive information, such as personal identity information, address information, and account information), this may lead to information security issues (such as information leakage). Therefore, it is necessary to monitor API calls.

[0005] In related technologies, API calls can be monitored through manual analysis of static code, bytecode instrumentation, and other solutions, but there is a problem of incomplete monitoring.

[0006] Summary of the Invention

[0007] The purpose of the embodiments of the present application is to provide a method, device and electronic device for monitoring interface calls, so as to more accurately and comprehensively monitor the call status of the interface in cross-process communication.

[0008] In a first aspect, an embodiment of the present application provides a method for monitoring interface calls, the method comprising: obtaining interface authentication information corresponding to a to-be-called interface; determining that the to-be-called interface is suspected of violating a rule if a target interface call method matching the interface authentication information is found in a monitoring list; the monitoring list stores, in association, multiple interface call methods and interface authentication information corresponding to the suspected violating interfaces; the multiple interface call methods are obtained from a library file for inter-process communication in an Android system; the library file stores multiple interface call methods with hooks. In this way, interface call status can be monitored more accurately and comprehensively in cross-process communication.

[0009] Optionally, the interface authentication information includes a call type and a call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the location of the interface call method to be processed corresponding to the interface to be called in the class.

[0010] Optionally, before determining that the interface to be called is suspected of violating a rule if a target interface call method matching the interface authentication information is found in the monitoring list, the method further includes: for any suspected interface call method that is suspected of violating a rule, if the interface call method is found in the library file, determining that the method is a hookable interface call method; for any hookable interface call method, obtaining the interface authentication information corresponding to the interface call method during its operation; and associating and storing the interface call method and the interface authentication information in the monitoring list. In this way, the interface call method, call type, and call location information can correspond to each other.

[0011] Optionally, for any hookable interface call method, obtaining interface authentication information corresponding to the interface call method during its execution includes: obtaining the call type corresponding to the interface call method via a type acquisition function; and obtaining the call location information corresponding to the interface call method via a location acquisition function. In this implementation, the interface authentication information of the interface call method can be obtained via the type acquisition function and the location acquisition function to facilitate the establishment of a monitoring list.

[0012] Optionally, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored at the same address respectively; and the associated storage of the interface call method and interface authentication information includes: if the call type and the call location information are acquired in the same thread, and the call type and the call location information are stored at the same address, then the interface call method, call type, and call location information are associated and stored. In this way, it is possible to confirm whether the call type, call location information, and interface call method correspond to each other, and if they correspond to each other, the three are stored in an associated manner, which improves the accuracy of the monitoring list to a certain extent.

[0013] Optionally, the call type is determined by the package name and AIDL file name of the interface to be called, and obtaining the interface authentication information corresponding to the interface to be called includes: obtaining the package name and AIDL file name of the interface to be called from a preset type storage location; the preset type storage location stores type information corresponding to multiple interfaces; and obtaining the call location information from a preset location information storage location; the preset location information storage location stores location information of multiple interface call methods in a class. In this way, accurate interface authentication information can be obtained from the preset location to facilitate determination of whether the interface to be called is a sensitive interface.

[0014] Optionally, after determining that the interface to be called is suspected of violating a rule if a target interface call method matching the interface authentication information is found in the monitoring list, the method further includes: if the target interface call method is not authorized by the user, prohibiting the call of the interface to be called. In this way, the illegal interface call method to be processed can be intercepted in a timely manner, thereby improving the information security corresponding to the interface to be called.

[0015] In the second aspect, an embodiment of the present application provides a device for monitoring interface calls, which includes: an acquisition module for acquiring interface authentication information corresponding to the interface to be called; a monitoring module for determining that the interface to be called is suspected of violating regulations if a target interface calling method matching the interface authentication information is found in a monitoring list; the monitoring list stores in association multiple interface calling methods and interface authentication information corresponding to interfaces suspected of violating regulations; multiple interface calling methods are obtained from a library file for inter-process communication in the Android system; and the library file stores multiple interface calling methods with hooks.

[0016] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect above are executed.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are executed.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, runs the method described in the first aspect above.

[0019] Other features and advantages of the present application will be described in the following description and, in part, will become apparent from the description or be understood by practicing the embodiments of the present application. The objectives and other advantages of the present application can be achieved and obtained through the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0021] FIG1 is a flowchart of a method for monitoring interface calls provided by an embodiment of the present application;

[0022] FIG2 is a structural block diagram of a device for monitoring interface calls provided in an embodiment of the present application;

[0023] FIG3 is a schematic structural diagram of an electronic device for executing a method for calling a monitoring interface according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work fall within the scope of protection of the present application.

[0025] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0026] It should be noted that, unless there is any conflict, the embodiments in this application or the technical features in the embodiments may be combined.

[0027] In the related art, there is a problem of incomplete monitoring of API call status; in order to solve this problem, the present application provides a method, device and electronic device for monitoring interface calls; further, by matching the relevant information of the interface to be called with the monitoring list, it is determined whether the interface to be called is suspected of violating the rules, thereby achieving the purpose of monitoring the API call status. Among them, the above-mentioned monitoring list pre-stores the relevant information corresponding to the interface suspected of violating the rules. In this way, it is possible to more accurately and comprehensively determine whether the interface to be called is in violation of the rules through the monitoring list.

[0028] The defects existing in the solutions in the above-mentioned related technologies are the results obtained by the inventors after practice and careful research. Therefore, the process of discovering the above-mentioned problems and the solutions proposed in the embodiments of the present invention below for the above-mentioned problems should all be the contributions made by the inventors to the present invention during the process of the invention.

[0029] In some application scenarios, the above-mentioned monitoring interface calling method can be applied to a mobile terminal, which may include, for example, a mobile phone, a tablet computer, etc.

[0030] Please refer to Figure 1, which shows a flow chart of a method for monitoring interface calls provided by an embodiment of the present application. As shown in Figure 1, the method for monitoring interface calls includes the following steps 101 to 102.

[0031] Step 101: Obtain the interface authentication information corresponding to the interface to be called;

[0032] In some application scenarios, if a mobile terminal detects an interface call instruction, it can obtain interface authentication information corresponding to the interface to be called. The interface call instruction, i.e., the instruction to call the interface, can include relevant information about the interface to be called. The relevant information may include, for example, the address of the interface to be called, the request method, the type of the interface to be called, and / or the location of the interface to be called in the class.

[0033] In some optional implementations, the interface authentication information includes a call type and call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the location of the interface call method to be processed corresponding to the interface to be called in the class.

[0034] The above-mentioned call type may include, for example, a type of obtaining an installation list of the interface to be called, a type of obtaining a geographical location, and the like.

[0035] The above-mentioned call location information may include, for example, the location code and location number of the interface call method to be processed in the class. The above-mentioned class may be, for example, the android.content.pm.IPackageManager class (for installation package related operations), the android.content.IClipboard class (for clipboard related operations), etc.

[0036] In these application scenarios, if the mobile terminal detects an interface call instruction, it can obtain the call type and call location information of the interface to be called, so as to identify whether the interface to be called is suspected of violating regulations through these two methods.

[0037] Step 102: If a target interface calling method matching the interface authentication information is found in the monitoring list, it is determined that the interface to be called is suspected of violating the regulations; the monitoring list stores a plurality of interface calling methods and interface authentication information corresponding to the interfaces suspected of violating the regulations; the plurality of interface calling methods are obtained from a library file for inter-process communication in the Android system; the library file stores a plurality of interface calling methods with hooks.

[0038] The monitoring list is used to monitor whether the interfaces being called are suspected of violating regulations. The multiple suspected illegal interface call methods stored in the list are obtained from the library file for inter-process communication in the Android system, namely libbinder.so. Therefore, the mobile terminal in question is an Android-installed terminal.

[0039] The above interface calling method is used to call the corresponding interface, which may include, for example, the following methods defined by the aidl language (Android interface definition language): android.content.pm.PackageManager.getInstalledPackages() method, android.app.ActivityManager.getRunningAppProcesses() method, and android.telephony.TelephonyManager.getDeviceId() method.

[0040] Furthermore, during cross-process communication, the mobile terminal can, after obtaining the call type and call location information of the interface to be called, search in the monitoring list whether there is a target interface call method that matches both. If so, it can be regarded as a sensitive interface to be called, and calling the sensitive interface is suspected of being in violation of regulations. Since the interface call methods stored in the monitoring list are all interface call methods with hooks (i.e., they can be hooked) obtained from libbinder.so, the mobile terminal can hook the pending interface call method corresponding to the interface to be called in libbinder.so.

[0041] In related technologies, the process of calling an interface by using reflection calls and dynamic code loading can only occur during the execution of the code. Then, solutions such as manual analysis of static code and bytecode instrumentation cannot monitor the call of the interface before the code is executed. 。 Among them, reflection calls and dynamic code loading methods ultimately need to call the peer process method through the lower-level libbinder.so, thus achieving cross-process communication. For example, the various interface call methods defined in the AIDL language mentioned above ultimately need to use the IBinder.transact method to achieve cross-process communication.

[0042] In this implementation, since the monitoring list stores the interface call methods of the suspected illegal interfaces that can be hooked in libbinder.so, if the target interface call method corresponding to the interface to be called is found in the monitoring list, it can be regarded as the interface to be called that is suspected of violating the rules, thereby enabling more accurate monitoring of interface calls in cross-process communication. Moreover, since libbinder.so is a relatively low-level library file, interface call methods executed by files at a higher level (such as the aforementioned reflective call method) can all be detected, thereby enabling more comprehensive monitoring of interface calls.

[0043] In addition, there are also solutions in the related art for dynamically monitoring interface call status. For example, such solutions can be implemented through Firda (a cross-platform hook tool) or Xposed (an open source framework service running in Android's high-privilege mode). These dynamic monitoring solutions require the pre-establishment of the corresponding detection environment to achieve the monitoring purpose. For example, the corresponding detection environment can be pre-established by pre-installing the Firda framework or Xposed framework, or by writing or installing the corresponding plug-in.

[0044] In this implementation, no matter whether the mobile terminal has built a detection environment or not, it can monitor the calling status of the interface, and can be applicable to more mobile terminals to a certain extent.

[0045] In some optional implementations, the call type is determined by the package name and AIDL file name of the interface to be called, and the step 101 of obtaining the interface authentication information corresponding to the interface to be called includes:

[0046] Sub-step 1011, obtaining the package name and AIDL file name of the interface to be called from a preset type storage location; the preset type storage location stores type information corresponding to multiple interfaces respectively;

[0047] In some application scenarios, the package name and AIDL file name can be regarded as the call type. For example, the call type of the android.content.IClipboard.aidl method can be: android.content.IClipboard.

[0048] The mobile terminal can pre-collect the type information corresponding to each interface, distinguish them by the package name and AIDL file name corresponding to each interface, and then store them in a preset type storage location. The preset type storage location can be, for example, a folder or a data table in the mobile terminal, which is not limited here.

[0049] Sub-step 1012, obtaining the calling location information from a preset location information storage location; the preset location information storage location stores location information of multiple interface calling methods in a class.

[0050] The mobile terminal may also pre-collect the location information of each interface calling method in the class and store it in a preset location information storage location. The preset location information storage location may be, for example, a folder or a data table in the mobile terminal, which is not limited here.

[0051] In some application scenarios, the mobile terminal may obtain the call type and call location information through the Stub class, for example.

[0052] In this implementation, accurate interface authentication information can be obtained from a preset location to facilitate determining whether the interface to be called is a sensitive interface.

[0053] In some optional implementations, in the above step 102, if a target interface calling method that matches the interface authentication information is found in the monitoring list, then after determining that the interface to be called is suspected of violating the regulations, the method further includes: if the target interface calling method is not authorized for use by the user, then prohibiting the calling of the interface to be called.

[0054] In some application scenarios, after determining that a to-be-called interface is suspected of violating a policy, the mobile terminal can verify whether the policy actually violates the policy. Specifically, the mobile terminal can verify this by searching historical information. This historical information can include information about whether the user authorized the method in the previous 10 days or the previous month. Alternatively, the mobile terminal can re-ask the user whether they agree to use the target interface call method to confirm whether the user authorizes the method.

[0055] In these application scenarios, the mobile terminal may not call the actual transact method when the target interface calling method is not authorized by the user, thereby achieving the purpose of prohibiting the calling of the interface to be called.

[0056] In addition, if the target interface calling method has been authorized for use by the user in the past or the user currently agrees to use it, the interface called through the target interface calling method can be deemed not to be in violation.

[0057] In this implementation, if it is determined that the interface to be called is suspected of violating the rules, further verification can be conducted to determine whether it is actually violating the rules, thereby determining whether to call the interface to be called. In this way, the illegal interface call method to be processed can be intercepted in a timely manner, thereby improving the information security corresponding to the interface to be called.

[0058] In some optional implementations, if a target interface calling method matching the interface authentication information is found in the monitoring list in step 102, before determining that the interface to be called is suspected of violating a rule, the method further includes the following steps of establishing a monitoring list:

[0059] Step 1: For any suspected illegal interface call method, if the interface call method is found in the library file, it is determined that it is an interface call method that can be hooked;

[0060] The mobile terminal may obtain in advance the interface calling methods suspected of violating regulations. These interface calling methods may be pre-configured by an operator, for example.

[0061] Then, the mobile terminal can search for the calling method corresponding to each suspected illegal interface in libbinder.so. Specifically, the mobile terminal can search in the plt table (Procedure Link Table, abbreviated as plt table) in libbinder.so, or search through inline (embedded, used to define an inline function of a class).

[0062] Furthermore, if the suspected illegal interface calling method is found in libbinder.so, it can be considered that the interface calling method can be hooked.

[0063] Step 2: For any interface call method that can be hooked, obtain the interface authentication information corresponding to the interface call method during its operation;

[0064] It should be noted that for an interface call method that can be hooked, it is necessary to run the interface call method to obtain the corresponding call type and call location information.

[0065] In some optional implementations, the interface calling method for any interface that can be hooked obtains the interface authentication information corresponding to the interface calling method during its operation, including: for any interface calling method for which a hook can be set, obtaining the call type corresponding to the interface calling method through a type acquisition function; and obtaining the call location information corresponding to the interface calling method through a location acquisition function.

[0066] The above-mentioned type acquisition function may include, for example, the android::Parcel::writeInterfaceToken method;

[0067] The position acquisition function may include, for example, an IPCThreadState::transact method.

[0068] In some application scenarios, for example, the call type can be obtained by including the code of the above-mentioned type acquisition function, and the call location information can be obtained by including the code of the above-mentioned location acquisition function.

[0069] In this implementation, the interface authentication information of the interface calling method can be obtained through the type acquisition function and the position acquisition function, so as to facilitate the establishment of a monitoring list.

[0070] Step 3: Store the interface calling method and interface authentication information in association in the monitoring list.

[0071] After obtaining the interface authentication information, the mobile terminal may associate and store the interface calling method, calling type, and calling location information in a monitoring list so that the three correspond to each other.

[0072] In some optional implementations, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are respectively stored at the same address; and the associated storage of the interface call method and interface authentication information includes: if the call type and the call location information are obtained in the same thread, and the call type and the call location information are stored at the same address, then the interface call method, call type and call location information are associated and stored.

[0073] In some application scenarios, the android::Parcel::writeInterfaceToken method and IPCThreadState::transact method are executed sequentially in the same thread, and the corresponding call type and call location information are stored at the same address. In these application scenarios, for example, the parcel pointer can simultaneously point to the call type and call location information corresponding to the same interface call method, thereby achieving the purpose of storing both at the same address.

[0074] Then, after the mobile terminal obtains the call type and call location information in the same thread, it can further determine whether the two are stored at the same address to determine whether the call type and call location information correspond to the same interface call method. In some application scenarios, the thread_local function can be used to obtain the call type and call location information from the same thread, and then the transact method can be used to determine whether the parcel pointer corresponding to the call type is the same as the parcel pointer corresponding to the call location information. If so, it can be determined that the two are stored at the same address, and then the interface call method, call type, and call location information can be stored in association.

[0075] In related technologies, if the Android system version changes, an interface call method may be inserted or removed from the same class, which will cause the call location information corresponding to the interface call method of the same type to change, resulting in a mismatch between the interface call method, call type, and call location information. For example, in the Android system version 2.0, the call location code corresponding to interface call method A is 36. When the Android system is upgraded to version 3.0, an interface call method B of the same type as interface call method A is added to the same class, causing the call location code of interface call method A to change from 36 to 37. In this way, the call location code does not correspond to interface call method A and the call type.

[0076] In this implementation, it is possible to confirm whether the call type, call location information, and interface call method correspond to each other, and if they correspond to each other, the three are stored in association, which improves the accuracy of the monitoring list to a certain extent.

[0077] Those skilled in the art will understand that, in the above-mentioned method of a specific embodiment, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0078] Please refer to Figure 2, which shows a block diagram of a device for monitoring interface calls provided in an embodiment of the present application. The device for monitoring interface calls can be a module, program segment, or code on an electronic device. It should be understood that this device corresponds to the method embodiment of Figure 1 above and can execute each step involved in the method embodiment of Figure 1. The specific functions of this device can be found in the description above. To avoid repetition, a detailed description is appropriately omitted here.

[0079] Optionally, the above-mentioned device for monitoring interface calls includes an acquisition module 201 and a monitoring module 202. The acquisition module 201 is used to obtain interface authentication information corresponding to the interface to be called; the interface authentication information includes a call type and a call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the location of the interface call method in the class; the monitoring module 202 is used to determine that the interface to be called is suspected of violating the regulations if a target interface call method matching the interface authentication information is found in the monitoring list; the monitoring list stores multiple interface call methods and interface authentication information corresponding to multiple interfaces suspected of violating the regulations; multiple interface call methods are obtained from a library file for inter-process communication in the Android system; the library file stores multiple interface call methods with hooks.

[0080] Optionally, the interface authentication information includes a call type and a call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the location of the interface call method to be processed corresponding to the interface to be called in the class.

[0081] Optionally, the device also includes a table building module, which is used to: if a target interface calling method matching the interface authentication information is found in the monitoring list, before determining that the interface to be called is suspected of violating the regulations, for any interface calling method suspected of violating the regulations, if the interface calling method is found in the library file, determine that it is an interface calling method for which a hook can be set; for any interface calling method for which a hook can be set, obtain the interface authentication information corresponding to the interface calling method during its operation; and store the interface calling method and the interface authentication information in association in the monitoring list.

[0082] Optionally, the table building module is further used to: for any interface calling method that can set a hook, obtain the calling type corresponding to the interface calling method through a type obtaining function; and obtain the calling location information corresponding to the interface calling method through a location obtaining function.

[0083] Optionally, the type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are respectively stored at the same address. The table building module is further used to: if the call type and the call location information are obtained in the same thread, and the call type and the call location information are stored at the same address, then the interface call method, call type and call location information are associated and stored.

[0084] Optionally, the call type is determined by the package name and AIDL file name of the interface to be called, and the acquisition module 201 is further used to: obtain the package name and AIDL file name of the interface to be called from a preset type storage location; the preset type storage location stores type information corresponding to multiple interfaces; and obtain the call location information from a preset location information storage location; the preset location information storage location stores location information of multiple interface call methods in the class.

[0085] Optionally, the device also includes a verification module, which is used to: if a target interface calling method matching the interface authentication information is found in the monitoring list, after determining that the interface to be called is suspected of violating the regulations, if the target interface calling method is not authorized for use by the user, prohibiting the calling of the interface to be called.

[0086] It should be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the system or device described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0087] Please refer to Figure 3, which is a structural diagram of an electronic device for executing a method for monitoring interface calls provided in an embodiment of the present application. The electronic device may include: at least one processor 301, such as a CPU, at least one communication interface 302, at least one memory 303 and at least one communication bus 304. Among them, the communication bus 304 is used to realize direct connection and communication between these components. Among them, the communication interface 302 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The memory 303 can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 303 can optionally be at least one storage device located away from the aforementioned processor. Computer-readable instructions are stored in the memory 303. When the computer-readable instructions are executed by the processor 301, the electronic device can execute the method process shown in Figure 1 above.

[0088] It is understood that the structure shown in Figure 3 is merely illustrative, and the electronic device may include more or fewer components than shown in Figure 3, or have a configuration different from that shown in Figure 3. Each component shown in Figure 3 may be implemented using hardware, software, or a combination thereof.

[0089] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method process performed by the electronic device in the method embodiment shown in FIG1 can be executed.

[0090] An embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments. For example, the method may include: obtaining interface authentication information corresponding to the interface to be called; if a target interface calling method matching the interface authentication information is found in a monitoring list, determining that the interface to be called is suspected of violating the regulations; the monitoring list stores in association the interface calling methods and interface authentication information corresponding to multiple interfaces suspected of violating the regulations; multiple interface calling methods are obtained from a library file for inter-process communication in the Android system; and the library file stores multiple interface calling methods with hooks.

[0091] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0092] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0093] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0094] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0095] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for monitoring interface calls, characterized in that: include: Get the interface authentication information corresponding to the interface to be called; If a target interface calling method matching the interface authentication information is found in the monitoring list, it is determined that the interface to be called is suspected of violating the regulations; The monitoring list stores in association the interface calling methods and interface authentication information corresponding to multiple interfaces suspected of violating regulations; A plurality of interface calling methods are obtained from a library file for inter-process communication in an Android system; the library file stores a plurality of interface calling methods provided with hooks.

2. The method according to claim 1, characterized in that: The interface authentication information includes a call type and call location information; the call type represents the type corresponding to the interface to be called; the call location information represents the location of the interface call method to be processed corresponding to the interface to be called in the class.

3. The method according to claim 2, characterized in that Before determining that the interface to be called is suspected of violating a rule if a target interface calling method matching the interface authentication information is found in the monitoring list, the method further includes: For any interface calling method suspected of violating regulations, if the interface calling method is found in the library file, it is determined to be an interface calling method for which a hook can be set; For any interface calling method that can set a hook, obtain the interface authentication information corresponding to the interface calling method during its operation; and The interface calling method and the interface authentication information are stored in association in the monitoring list.

4. The method according to claim 3, characterized in that For any interface calling method that can set a hook, obtaining the interface authentication information corresponding to the interface calling method during its operation includes: For any interface call method that can set a hook, obtain the call type corresponding to the interface call method through the type acquisition function; and The calling location information corresponding to the calling method of the interface is obtained through the location acquisition function.

5. The method according to claim 4, characterized in that The type acquisition function and the location acquisition function are executed sequentially in the same thread, and the call type and the call location information are stored at the same address respectively; as well as The association stores the interface calling method and interface authentication information, including: If the call type and the call location information are obtained in the same thread, and the call type and the call location information are stored at the same address, the interface call method, the call type and the call location information are stored in association.

6. The method according to claim 2, characterized in that The call type is determined by the package name of the interface to be called and the AIDL file name, and The obtaining of interface authentication information corresponding to the interface to be called includes: Obtaining the package name and AIDL file name of the interface to be called from a preset type storage location; the preset type storage location stores type information corresponding to a plurality of interfaces respectively; and The calling location information is obtained from a preset location information storage location; the preset location information storage location stores location information of multiple interface calling methods in a class respectively.

7. The method according to claim 1, characterized in that After the target interface calling method matching the interface authentication information is found in the monitoring list, and it is determined that the interface to be called is suspected of violating the regulations, the method further includes: If the target interface calling method is not authorized by the user, calling the interface to be called is prohibited.

8. A device for monitoring interface calls, characterized in that: include: The acquisition module is used to obtain the interface authentication information corresponding to the interface to be called; A monitoring module, configured to determine that the interface to be called is suspected of violating a rule if a target interface calling method matching the interface authentication information is found in the monitoring list; The monitoring list stores in association the interface calling methods and interface authentication information corresponding to multiple interfaces suspected of violating regulations; Multiple interface calling methods are obtained from a library file for inter-process communication in the Android system; the library file A plurality of interface calling methods with hooks are stored in it.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is executed.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is performed.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 7 is performed.

Images