Hot update detection method and apparatus, and computer device and storage medium

Abstract

A hot update detection method and apparatus, and a computer device and a storage medium. The method comprises: during the running process of an application, determining a currently executed machine-executable instruction with respect to the application; determining the current execution function which is executed on the basis of the machine-executable instruction, and when the current execution function is of a preset function type to be subjected to detection, determining transferred data which is transferred to the current execution function; determining a mark storage location of the transferred data; and when a data source mark is acquired from the mark storage location of the transferred data, determining that the application has undergone a hot update. By means of the method, the efficiency of hot update detection can be improved.

Description

Hot update detection method, device, computer equipment and storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 2024102351595, filed on March 1, 2024, entitled “Hot Update Detection Method, Device, Computer Equipment and Storage Medium,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of computer technology, and in particular to a hot update detection method, apparatus, computer equipment, and storage medium. Background Art

[0004] With the development of science and technology, hot update technology has emerged. Hot update, also known as hot fix, refers to the ability to update or repair software or applications online without downtime or restarting the system. Currently, due to its high concealment, hot update technology is often used by unscrupulous developers to circumvent compliance management. Therefore, it is necessary to detect whether hot updates occur during application operation.

[0005] Currently, the primary approach is to analyze the installation package without running the application, and use the analysis results to determine whether a hot update will occur during the application's runtime. This process involves scanning the code and resource files within the installation package, for example, checking for known hot update framework class names, method calls, or specific resource files.

[0006] However, manually analyzing the installation package files is a time-consuming process, which makes the efficiency of hot update detection low. Summary of the Invention

[0007] According to various embodiments provided in the present application, a hot update detection method, apparatus, computer device, computer-readable storage medium, and computer program product are provided.

[0008] In a first aspect, the present application provides a hot update detection method, which is performed by a computer device, and the method includes:

[0009] During the running of the application, determining a machine execution instruction currently being executed for the application;

[0010] determining a currently executed function executed based on the machine-executed instruction, and determining transfer data to be transferred to the currently executed function if the currently executed function is a preset function type to be detected;

[0011] Determining a storage location for the tag of the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the storage location for the tag of data generated by any execution function is used to record the data source tag of the data transferred to any execution function;

[0012] When a data source tag is obtained from the tag storage location of the transferred data, it is determined that the application has been hot updated; wherein the obtained data source tag is used to indicate that the transferred data comes from a local or network other than the original installation package.

[0013] In a second aspect, the present application further provides a hot update detection device, the device comprising:

[0014] The transfer data determination module is used to determine the machine execution instruction currently executed for the application during the application running process; determine the current execution function executed based on the machine execution instruction, and determine the transfer data transferred to the current execution function.

[0015] A tag storage location determination module is used to determine the tag storage location of the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the tag storage location of the data generated by any execution function is used to record the data source tag of the data transferred to any execution function.

[0016] A record generation module is used to determine that the application has been hot updated when a data source tag is obtained from the tag storage location of the transferred data; wherein the obtained data source tag is used to indicate that the transferred data comes from a local or network other than the original installation package.

[0017] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of any one of the hot update detection methods provided in the embodiments of the present application.

[0018] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any hot update detection method provided in the embodiments of the present application are implemented.

[0019] In a fifth aspect, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of any hot update detection method provided in the embodiments of the present application.

[0020] The details of one or more embodiments of the present application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the present application will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without any creative work.

[0022] FIG1 is a diagram illustrating an application environment of a hot update detection method according to an embodiment;

[0023] FIG2 is a schematic flow chart of a hot update detection method according to an embodiment;

[0024] FIG3 is a schematic diagram of an application icon in one embodiment;

[0025] FIG4 is a schematic diagram of a start screen page in one embodiment;

[0026] FIG5 is a schematic diagram of extracting a data source tag in one embodiment;

[0027] FIG6 is a schematic diagram of a virtual machine stack according to an embodiment;

[0028] FIG7 is a schematic diagram of data tag transmission in one embodiment;

[0029] FIG8 is a schematic diagram of the overall process of a hot update detection method according to an embodiment;

[0030] FIG9 is a schematic diagram of a task center in one embodiment;

[0031] FIG10 is a schematic diagram of a task center in another embodiment;

[0032] FIG11 is a schematic diagram of a detection page of a detection platform in one embodiment;

[0033] FIG12 is a schematic diagram of a task center in another embodiment;

[0034] FIG13 is a schematic diagram of the overall flow of a hot update detection method according to another embodiment;

[0035] FIG14 is an interactive diagram of a hot update detection method according to an embodiment;

[0036] FIG15 is a schematic flow chart of a hot update detection method in a specific embodiment;

[0037] FIG16 is a schematic diagram of the overall framework of a hot update detection method according to one embodiment;

[0038] FIG17 is a block diagram of a thermal update detection device according to an embodiment;

[0039] FIG18 is a diagram showing the internal structure of a computer device according to one embodiment;

[0040] FIG19 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0042] The application shake response detection method provided in the embodiments of the present application can be applied in the application environment shown in Figure 1. Terminal 102 communicates with server 104 via a network. A data storage system can store data that terminal 102 needs to process. The data storage system can be integrated with server 104, or it can be located in the cloud or on another server. Terminal 102 can run a detection platform and a virtual terminal, and server 104 can be the backend server of the detection platform. Users can upload the application installation package through the detection platform, which triggers the virtual terminal to install the installation package and obtain the application running in the virtual terminal. The virtual terminal can display the application interface. When the user clicks the start detection control in the test platform, the application's hot update behavior can be detected during the application's operation. Terminal 102 can be, but is not limited to, various desktop computers, laptops, tablets, Internet of Things devices, and portable wearable devices. Internet of Things devices can include smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices can include smart watches, smart bracelets, head-mounted devices, etc. Server 104 can also be implemented as a standalone server or a server cluster consisting of multiple servers.

[0043] It should be noted that the terms "first", "second" and similar terms used in this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Unless the context clearly indicates otherwise, the singular form "a", "an" or "the" and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The quantities of "multiple" or "multiple copies" mentioned in the various embodiments of this application refer to the quantity of "at least two", for example, "multiple" refers to "at least two" and "multiple copies" refers to "at least two copies".

[0044] In one embodiment, as shown in FIG2 , a hot update detection method is provided, which is described by taking the method applied to the terminal in FIG1 as an example, including the following steps:

[0045] Step 202: During the application running process, determine the machine execution instruction currently being executed for the application.

[0046] The machine-executable instructions for the application refer to the machine-recognizable instructions obtained after compiling the application code. The currently executed machine-executable instructions refer to the machine-executable instructions executed at the current moment.

[0047] The application can run in a virtual terminal. The virtual terminal is a virtual terminal device. For example, the virtual terminal can be a virtual Android device, which can simulate the hardware and software environment of a real Android device on the server. The virtual Android device can specifically be a cloud phone. The operating system of the virtual terminal is a customized Android system. In addition to including a virtual machine that executes machine execution instructions, the customized Android system also includes a data flow determination system, a behavior recording program and a detection system. Among them, the data flow determination system is used to capture and record all data flows during the operation of the application. The behavior recording program is used to record the behavior of the application, such as recording the local data access behavior of the application. The detection system is used to analyze the source of the data passed to the corresponding function.

[0048] Specifically, the detection platform refers to a platform used to detect applications. For example, the hot update behavior of an application can be detected through the detection platform. When a user expects to detect an application through the detection platform, the user can upload the installation package of the application to the detection platform, so that the detection platform can start a virtual terminal and enable the virtual terminal to install the application through the installation package. Furthermore, when the user decides to start detecting the application, the user can start the application through the application icon displayed in the virtual terminal and use the application, for example, navigate to different interfaces of the application, input data, etc. The virtual machine in the customized Android system will execute each machine execution instruction so that the application can run normally. The data flow determination system is built into the virtual machine and can be synchronously intercepted when the virtual machine executes the machine execution instruction to determine the machine execution instruction currently being executed.

[0049] In one embodiment, after the application is installed on the virtual terminal, the detection platform can display the terminal interface of the virtual terminal and display the application icon of the application through the terminal interface. For example, the application icon 301 shown in Figure 3 is displayed. When the user clicks the application icon, the virtual terminal can start the application and display the application interface of the application, for example, the opening screen page 401 of the application shown in Figure 4 is displayed. Figure 3 shows a schematic diagram of the application icon in one embodiment, wherein in Figure 3, 302 is the terminal interface of the virtual terminal, and 303 is the detection page of the detection platform. Figure 4 shows a schematic diagram of the opening screen page of the application in one embodiment.

[0050] Step 204 : determining a currently executed function executed based on the machine execution instruction, and determining transfer data to be transferred to the currently executed function if the currently executed function is a preset function type to be detected.

[0051] Specifically, after the data flow determination system determines the currently executed machine execution instruction, the detection system can analyze the currently executed machine execution instruction to determine the function executed based on the currently executed machine execution instruction. For the convenience of description, the function executed based on the currently executed machine execution instruction is referred to as the currently executed function. For example, when the currently executed machine execution instruction is an instruction for instructing to copy data A, the currently executed function executed based on the machine execution instruction is determined to be a data copy function. Further, the detection system can determine whether the currently executed function belongs to a preset function type to be detected. If it belongs to the preset function type to be detected, the detection system can determine the data passed to the currently executed function, that is, determine the input data of the currently executed function. For the convenience of description, the data passed to the currently executed function is referred to as the transferred data.

[0052] In one embodiment, the detection system may obtain functions belonging to a preset function type to be detected to obtain a third function set. The detection system checks whether the third function set includes the currently executed function. If so, the currently executed function is determined to be of the preset function type to be detected; if not, the currently executed function is determined not to be of the preset function type to be detected.

[0053] In one of the embodiments, the preset function type to be detected may specifically be a sink function type. A function of the sink function type refers to a function that may output data to a sensitive destination (such as class loading or dynamic library loading). A function of the sink function type may specifically be a library loading function, a class loading function, etc. Since the present application needs to detect the hot update behavior of the application, and during the hot update process, a class loader may be used to dynamically load classes, or a dynamic library may be loaded. Therefore, it is possible to determine whether the application has performed a hot update behavior by judging whether the currently executed function is a class loading function, or whether it is a library loading function.

[0054] In one embodiment, after the currently executed function is determined, the data passed to the currently executed function can be determined by using a keyword in the currently executed function. For example, the data passed to the currently executed function can be located by using the keyword "input" in the currently executed function.

[0055] Step 206, determining the tag storage location of the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the tag storage location of the data generated by any execution function is used to record the data source tag of the data transferred to any execution function.

[0056] Specifically, the detection system can determine the location for storing the data source tag of the transferred data based on the data type of the transferred data. For ease of description, the location determined for storing the data source tag of the transferred data will be referred to as the tag storage location. For example, the detection system may pre-set a correspondence between different data types and storage locations. Once the data type of the transferred data is determined, the tag storage location of the transferred data can be determined based on this correspondence.

[0057] In one embodiment, determining the storage location of the tag of the transferred data includes: when the transferred data is a data object type, determining the storage location of the tag of the transferred data to be an extended structure of the transferred data; when the transferred data is a non-data object type, determining the storage location of the tag of the transferred data to be a virtual machine stack storing the transferred data.

[0058] Specifically, the detection system can determine the data type of the transferred data, and determine the storage location of the tag of the transferred data according to the data type. For example, referring to Figure 5, when the transferred data is a data object, that is, when the transferred data is of object type, it is determined that the data source tag should be obtained from the extended structure of the transferred data. When the transferred data is simple data and is not a data object, it is determined that the data source tag should be obtained from the virtual machine stack where the transferred data is located. The data source tag refers to an identifier used to mark the source of the data. For example, the data source tag can be "network" or "local". When the data source tag is "network", it is determined that the data marked by the data source tag comes from the network; when the data source tag is "local", it is determined that the data marked by the data source tag comes from the local. Figure 5 shows a schematic diagram of extracting the data source tag in one embodiment.

[0059] In one embodiment, entities that can be defined by a set of attributes can be considered as data objects. A data object can be an instance of a class, which has its own attributes and methods. Data objects in Java are usually instances created using the new keyword. The extended structure of a data object can specifically be a set of fields of the data object, or a set of attributes of the data object. The detection system can determine whether the transferred data is a data object by determining whether the transferred data is created using a preset keyword. For example, in the case where the transferred data is created using the new keyword, it can be determined that the transferred data is a data object. For another example, the detection system can determine whether the transferred data has attributes and methods. If it has attributes and methods, it is determined that the transferred data is a data object.

[0060] In one embodiment, the virtual machine stack is a stack-like storage space that is thread-private and has the same lifecycle as the thread. Each thread creates a virtual machine stack when it is created, which stores stack frames corresponding to method calls. After determining that the tag storage location is the virtual machine stack, the detection system can further determine from which stack frame of the virtual machine stack the data source tag should be extracted. For example, the detection system can determine the location of the transferred data in the virtual machine stack and determine the specific tag storage location based on the location of the transferred data in the virtual machine stack.

[0061] The virtual machine stack in the embodiment of the present application is a stack that is twice the size of the normal size. In the traditional solution, when the size of the virtual machine stack is generally n, the size of the virtual machine stack in the embodiment of the present application is 2n. Referring to Figure 6, the 0th to n-1th stack frames are used to store data in a traditional manner, and the nth to 2n-1th stack frames are used to store data source tags. The data stored in the 0th to n-1th stack frames correspond one-to-one to the data source tags stored in the nth to 2n-1th stack frames. For example, when data is stored in the 0th stack frame, the data source tag corresponding to the data is stored in the n-1th stack frame; when data is stored in the 1st stack frame, the data source tag corresponding to the data is stored in the nth stack frame, and so on. Figure 6 shows a schematic diagram of a virtual machine stack in one embodiment.

[0062] Therefore, once the stack frame where the transferred data is located is determined, the stack frame where the mark of the data source of the transferred data is located can be determined based on the stack frame where the transferred data is located. For example, the detection system stores a correspondence between the stack frames used to store data and the stack frames used to store the mark of the data source. After the stack frame where the transferred data is located is determined, the detection system can determine the stack frame where the mark of the data source of the transferred data is located based on the correspondence, and the stack frame where the mark of the data source of the transferred data is located is the specific mark storage location. For another example, after the stack frame where the transferred data is located is determined, the distance from the stack frame where the transferred data is located to the top of the stack can be determined, with the middle of the virtual machine stack as the reference, and the stack frame where the mark of the data source of the transferred data is located can be determined based on the distance.

[0063] In one embodiment, during the execution of a series of execution functions based on the original data of the application, the tag storage location based on the data generated by any execution function is used to record the data source tag of the data passed to the any execution function. For example, referring to Figure 7, during the operation of the application, after the original data is obtained, a series of processing can be performed on the original data, and the tag storage location stores the data source tags of the data involved in the series of processing. For example, when the transmitted data is E data and the original data is A data, if A data and B data are superimposed to obtain C data, and then C data and D data are superimposed to obtain E data, the tag storage location of C data stores the data source tag of A data and the data source tag of B data; the tag storage location of E data stores the data source tag of C data and the data source tag of D data. Furthermore, since the data source tag of data A and the data source tag of data B are stored at the tag storage location of data C, it can be considered that the data source tag of data C includes the data source tag of data A and the data source tag of data B. Therefore, the data source tag of data E is actually stored at the tag storage location of data A, the data source tag of data B, and the data source tag of data D. It is easy to understand that in this example, data A can be regarded as the original data, data E can be regarded as the transfer data input to the currently executed function, and data E can be regarded as generated based on data A. At this time, the data source tag of data A will be transferred to data E and stored at the tag storage location of data E. Figure 7 shows a schematic diagram of data tag transfer in one embodiment. In one embodiment, the data source tag can be used as metadata of the transferred data and transferred together with the transferred data without affecting the normal function of the application.

[0064] In the above embodiment, by determining the type of data, the tag storage location can be accurately determined based on the type, and thus an accurate data source tag can be obtained based on the accurately determined tag storage location.

[0065] Step 208: When a data source tag is obtained from the tag storage location of the transferred data, it is determined that the application has been hot updated; wherein the obtained data source tag is used to indicate that the transferred data comes from a local or network source other than the original installation package.

[0066] Specifically, after determining the storage location of the transferred data and the tag of the transferred data, the detection system can determine whether the data source tag can be extracted from the tag storage location of the transferred data, and if it is determined that the data source tag can be obtained from the tag storage location of the transferred data, it is determined that the application has been hot updated.

[0067] Among them, since only data obtained from the network or local will have a data source mark, or data generated based on data obtained from the network or local will have a data source mark, therefore, when the data source mark is obtained from the mark storage location of the transferred data, it can be determined that the transferred data has a data source mark. When the transferred data has a data source mark, it is considered that the transferred data is obtained from the network or local, or it can be considered that the original data used to generate the transferred data is from the network or local. In the latter case, since the transferred data is generated based on the original data, when the original data is from the network or local, it can also be considered that the transferred data is from the network or local. Therefore, when the transferred data has a data source mark, regardless of whether the transferred data is obtained directly from the network or local, or obtained by a series of processing on the original data, it can be considered that the transferred data is from the local or network.

[0068] When it is determined that the transferred data originates from the local computer or the network, it can be determined that the currently executed function, which belongs to the preset type to be detected, is processing data from the network or the local computer. The currently executed function, which belongs to the preset type to be detected, is a function related to hot update behavior. For example, the currently executed function can be a class loading function or a library loading function in a hot update. Therefore, when it is determined that the transferred data executed by the currently executed function originates from the network or the local computer, and not from the original installation package, it can be considered that new unverified code has been injected into the application, and the application is being hot updated based on the new unverified code.

[0069] In one embodiment, if the transferred data does not have a data source mark, it can be considered that the transferred data is generated outside the management scope of the detection system, or it can be considered that the transferred data is data generated inside the customized Android system. In this case, the detection system will not determine that the application has been hot updated, but will allow the application to continue executing, that is, the virtual machine continues to execute the next machine execution instruction.

[0070] In one embodiment, after determining that an application has been hot-updated, a hot-update record can be generated based on the transferred data and the data source tag stored in the transferred data. This hot-update record can then be sent to a detection platform. This hot-update record records detailed information about the hot-update, providing a detailed basis for subsequent analysis, auditing, and compliance checks.

[0071] In one of the embodiments, referring to FIG8 , FIG8 shows a schematic diagram of the overall process of a hot update detection method in one embodiment. S801, the user can upload the installation package of the application to the detection platform, so that the detection platform can trigger the virtual terminal to install the application through the installation package. S802, when the detection of the application starts, the detection page can be entered. S803, open the application in the detection page. S804, the user can operate the application and use the various functions of the application. S805, after clicking the end detection control, S806 the user can obtain the detection result and determine whether the application has been hot updated based on the detection result. It can be understood that when the application is hot updated, there will be no hot update record in the detection result, so the user can determine that the application has not been hot updated based on the detection result. When the application is hot updated, there will be a hot update record in the detection result obtained by the user, so the user can determine that the application has been hot updated based on the detection result.

[0072] In the above-mentioned hot update detection method, by determining the machine execution instruction currently executed during the operation of the application, the current execution function can be determined based on the machine execution instruction currently executed. By determining the current execution function, the function type to which the current execution function belongs can be determined. When it is determined that the current execution function belongs to the preset function type to be detected, it is determined that a hot update behavior may have occurred at this time, and the transfer data passed to the current execution function is obtained. When the transfer data comes from a local or network other than the original installation package, it is determined that the application has been hot updated, thereby realizing automatic hot update detection of the application during the operation of the application; and, by executing a series of execution functions based on the original data of the application, based on the tag storage location of the data generated by any execution function, the data source tag of the data passed to any execution function can be recorded, so that after obtaining the transfer data passed to the current execution function, the tag storage location of the transfer data can be further determined, and when the data source tag is obtained from the tag storage location of the transfer data, it is determined that the application has been hot updated, wherein the obtained data source tag is used to characterize that the transfer data comes from a local or network other than the original installation package. Therefore, the algorithm of this application can efficiently and accurately identify whether a hot update has occurred by judging the source of data transmission and combining precise function types and data marking mechanisms. Compared with the traditional method of manually analyzing installation package files to detect hot updates of applications, this application improves the detection efficiency of hot updates.

[0073] In one embodiment, the application runs on a virtual terminal, and after uploading the installation package of the application to the detection platform through the installation package upload page, the application is installed through the installation package on the virtual terminal triggered by a preset installation instruction.

[0074] Specifically, before the application is tested, the application can also be installed in the virtual terminal. The detection platform may have an installation package upload control, for example, the installation package upload control may specifically be an installation package upload button. When the user triggers the installation package upload control, the detection platform may display the installation package upload page, and then the user can upload the application's installation package through the installation package upload page. For example, the user can drag the application's installation package to the installation package upload page and click the upload button. After determining that the user has uploaded the installation package through the installation package upload page, the detection platform can detect the validity of the installation package, and after the validity test passes, upload the installation package to the detection queue. Furthermore, after the installation package is successfully uploaded to the detection queue, the test platform can automatically trigger the installation of the application on the virtual terminal.

[0075] In one of the embodiments, when the user drags the installation package of the application to the installation package upload page and clicks the upload button, the detection platform can send the installation package of the application to the detection queue in the cloud, and display the task information row corresponding to the application in the task center, and display the operation identifier in the task information row. For example, referring to Figure 9, Figure 9 shows a schematic diagram of the task center in one embodiment. In the process of sending the installation package to the cloud, a task information row 901 corresponding to the application can be displayed in the task center, and the task information row displays the task identifier of the detection task performed for the application, the application name of the application, the version number, the name of the installation package, the task addition time, and the operation identifier, and the operation identifier is specifically "downloading". By displaying the operation identifier in the "downloading" style, the user can be prompted that the installation package is in the process of uploading based on the operation identifier.

[0076] In one embodiment, after the installation package is uploaded, referring to FIG10 , the operation indicator in the task center can be changed from “Downloading” to “Start Detection”. Thus, when the user clicks “Start Detection”, the detection platform can display the terminal interface of the virtual terminal and display the application icon of the application in the terminal interface. When the user clicks the application icon, the virtual terminal can display the application interface of the application. FIG10 shows a schematic diagram of the task center in another embodiment. For example, an event detector is provided for the “Start Detection” control, and the event detector is used to detect the triggering operation of the “Start Detection” control. When the event detector detects that the “Start Detection” control has been triggered, for example, when the event detector detects that the “Start Detection” control has been clicked, the event detector can generate a click event broadcast and send the click event broadcast to the virtual terminal. Thus, after receiving the click event broadcast, the virtual terminal can determine that the “Start Detection” control has been clicked based on the click event broadcast, and can then display the terminal interface containing the application icon.

[0077] In one embodiment, the detection platform may display multiple candidate installation package identifiers, such as multiple candidate installation package names. The user may select one of the candidate installation package identifiers. The detection platform then uses the selected candidate installation package identifier as the target installation package identifier, downloads the installation package corresponding to the target installation package identifier from the application store, and installs the downloaded installation package in the virtual terminal.

[0078] In one embodiment, after the installation package is uploaded, the detection platform creates a virtual terminal using a customized Android system image. This virtual terminal creates a clean detection environment and begins installing the user-submitted installation package. The installation process is recorded in detail for subsequent analysis of the application's behavior and performance. This clean detection environment improves detection accuracy and reduces the impact of environmental noise on detection.

[0079] In one embodiment, after the installation package is uploaded, the virtual terminal will automatically trigger the installation process. For example, after uploading the installation package to the cloud, the detection platform can trigger the virtual terminal to install the installation package through an installation command, thereby obtaining the application running in the virtual terminal. For example, the detection platform can install the installation package in the virtual terminal through the "adb install" command.

[0080] In one embodiment, before triggering the virtual terminal to install the application through the installation instruction, the detection platform may obtain access rights of the virtual terminal so that the virtual terminal can be triggered to install the application through the installation instruction later.

[0081] In the above embodiment, by displaying the installation package upload page, the application installation package can be uploaded through the installation package upload page. After uploading the installation package, the virtual terminal can automatically install the application based on the installation package, thereby improving the convenience of application installation.

[0082] In one embodiment, when the transferred data is generated based on the original data, the tag storage location of the transferred data records the data source tag of the original data; the step of generating the data source tag of the original data includes: when the original data is obtained from the network, determining the data source tag of the original data as a first tag used to characterize the network acquisition source; when the original data is obtained locally, determining the data source tag of the original data as a second tag used to characterize the local acquisition source.

[0083] Here, raw data refers to the benchmark data used to generate other data during the operation of the application. The raw data can be data obtained from the network based on a network request, or data read from the local file system, or data read from the local database.

[0084] Specifically, the data passed to the currently executed function can be generated based on the original data. For example, the original data can be processed to obtain intermediate data, which is then further processed to obtain the transferred data. Methods of data processing include, but are not limited to, copying, adding data content, deleting data content, modifying data content, merging data content, and so on. In this case, the data source tag of the transferred data includes the data source tag of the original data. That is, regardless of how the original data circulates during the application's execution, the data derived from the original data will include the data source tag of the original data. In other words, during the data flow process, the data source tag of the original data will be transferred along with the original data. For example, after obtaining the original data and determining its data source tag, during the application's execution, the original data may be passed from one operation to another to obtain first intermediate data based on the original data. In this case, the data source tag of the original data will be recorded in the tag storage location of the first intermediate data. For example, when the original data is copied to obtain the first intermediate data, the data source tag of the original data will be recorded in the tag storage location of the first intermediate data.

[0085] Furthermore, if the first intermediate data is transferred from one operation to another operation to obtain the second intermediate data based on the first intermediate data, the data source tag of the second intermediate data will include the data source tag of the first intermediate data. For example, when the first intermediate data is numerically modified to obtain the second intermediate data, the data source tag of the first intermediate data will be recorded at the tag storage position of the second intermediate data. The data source tag extracted from the tag storage position of the first intermediate data can be called the data source tag of the first data. Since the data source tag of the original data is recorded at the tag storage position of the first intermediate data, the data source tag of the original data will also be recorded at the tag storage position of the second intermediate data. In this way, multiple data transfers can be performed to eventually obtain the transferred data. At this time, the data source tag of the original data may also be recorded at the tag storage position of the transferred data.

[0086] Since the data source tag of the original data will be transmitted along with the original data during the data flow process, it is necessary to determine the data source tag of the original data after obtaining the original data. In the case where the original data is obtained from the network, the data flow determination system can determine the data source tag of the original data as the first tag; in the case where the original data is obtained locally, the detection system can determine the data source tag of the original data as the second tag. The first tag is a tag used to characterize that the data is obtained from the network, and the second tag is a tag used to characterize that the data is obtained locally. For example, the first tag can be "network" and the second tag can be "local".

[0087] In one embodiment, data obtained during the application startup process is referred to as raw data, and a data source tag of the raw data is determined.

[0088] In one embodiment, a machine execution instruction for obtaining the original data can be determined, and when it is determined that a network request has been sent based on the machine execution instruction, it can be determined that the original data is obtained based on the network request. At this time, the first tag is used as the data source tag of the original data.

[0089] In one embodiment, a machine execution instruction for obtaining the original data can be determined, and when it is determined based on the machine execution instruction that a local file system has been accessed, or a local database has been accessed, it can be determined that the original data is obtained from the local file system, or it can be determined that the original data is obtained from the local database. In this case, the second tag is used as the data source tag of the original data.

[0090] In the above embodiment, by determining the data source tag of the original data, the original data and the data source tag of the original data can be transmitted together during the data flow process. In this way, the data source tag of the transmitted data obtained based on the original data can include the data source tag of the original data, and the original source of the transmitted data can be determined based on the tag including the data source tag of the original data. Because the original source of the transmitted data can be determined based on the data source tag of the transmitted data, during the application operation, no matter what data transformation is performed on the data to obtain the transmitted data, the original source of the transmitted data can be traced based on the data source tag.

[0091] In hot update technology, in order to bypass compliance management, application developers will repeatedly process the information that the hot update file does not come from the original installation package, so that the detection personnel mistakenly believe that the hot update file comes from the original installation package, and thus cannot detect whether the application has been hot updated. Among them, the hot update file refers to the file used for hot update, for example, the hot update file can be a patch. The present application solves the above problem. In the present application, for the transmission data during the operation of the application, no matter what series of operations the transmission data is generated by, it can be traced back to the original source of the transmission data. Therefore, based on the original source of the transmission data, the detection system can trace back to whether the transmission data comes from the original installation package, or from a network or local other than the original installation package, and determine that the application has been hot updated when it is determined that the transmission data comes from a network or local other than the original installation package.

[0092] In one embodiment, when the original data is obtained from the network, determining that the data source mark of the original data is a first mark used to characterize the network acquisition source includes: obtaining a preset first function set; the first function set includes a system call function supported by the application for receiving network data; determining a data acquisition function for acquiring the original data; matching the data acquisition function with the system call function in the first function set; when the data acquisition function successfully matches the system call function in the first function set, determining that the original data is obtained from the network, and using the first mark as the data source mark of the original data.

[0093] Specifically, the data flow determination system can determine the function used to obtain the original data. For the convenience of description, the function used to obtain the original data will be referred to as the data acquisition function below. The data flow determination system can also obtain a preset first function set, wherein the first function set includes system call functions supported by the application for receiving network data, for example, the first function set includes a network interface call function, a network request sending function, a network request response function, and the like. Furthermore, the data flow determination system matches the data acquisition function with the first function set to determine whether there is a system call function in the first function set that matches the data acquisition function. If there is a system call function in the first function set that matches the data acquisition function, it is determined that the data acquisition function successfully matches the system call function in the first function set. At this time, it can be determined that the original data is obtained from the network.

[0094] In one embodiment, all system call functions for receiving network data supported by the kernel, such as the recvfrom function, may be found in advance, and the found system call functions may be stored in a first function set.

[0095] In one embodiment, determining whether the first function set includes a system call function that matches the data acquisition function can specifically include determining whether the first function set includes a system call function that is consistent with the data acquisition function. The detection system can determine the function name of the data acquisition function. For ease of description, the function name of the data acquisition function will be referred to as the data acquisition function name below. The detection system determines whether the first function set includes a system call function with the data acquisition function name. If the first function set includes a system call function with the data acquisition function name, then it is determined that the first function set includes a system call function that is consistent with the data acquisition function.

[0096] In one embodiment, during the application's execution, if data is obtained based on currently executed machine-executable instructions, it can be determined whether the data has a data source tag. If it does not have a data source tag, the function used to obtain the data can be determined by matching the function used to obtain the data with a first set of functions to determine whether the function used to obtain the data matches the first set of functions. If it is determined to match the first set of functions, the data is determined to be original data and to have originated from a network, and the first tag is used as the data source tag for the original data. Accordingly, if the data obtained based on the currently executed machine-executable instructions has a data source tag, it can be determined that the data is not original data.

[0097] In the above embodiment, only a matching operation is required to determine whether the original data originates from the network, thereby improving the efficiency of determining the source of the original data.

[0098] In one embodiment, when the original data is obtained locally, determining that the data source mark of the original data is a second mark used to characterize the local acquisition source includes: obtaining a preset second function set; the second function set includes a system call function supported by the application for reading and writing files; matching the data acquisition function with the system call function in the second function set; when the data acquisition function successfully matches the system call function in the second function set, determining that the original data is obtained locally, and using the second mark as the data source mark of the original data.

[0099] Specifically, the data flow determination system can determine the data acquisition function used to obtain the original data. The data flow determination system can also obtain a preset second function set, wherein the second function set includes system call functions for reading and writing files supported by the application, for example, the second function set includes local file system access functions, local database access functions, and the like. Further, the data flow determination system matches the data acquisition function with the second function set to determine whether the second function set contains a system call function that matches the data acquisition function. If the second function set contains a system call function that matches the data acquisition function, it is determined that the data acquisition function successfully matches the system call function in the second function set. At this point, it can be determined that the original data is obtained locally. Specifically, determining whether the second function set contains a system call function that matches the data acquisition function can be as follows: determining whether the second function set contains a system call function that is consistent with the data acquisition function.

[0100] In one embodiment, all system call functions supported by the kernel for receiving local data, such as a read function, may be found in advance, and the found system call functions may be stored in a second function set.

[0101] In one embodiment, during the execution of an application, if data is obtained based on currently executed machine-executable instructions, it can be determined whether the data has a data source tag. If the data does not have a data source tag, the function used to obtain the data can be determined. The function used to obtain the data is matched with a second set of functions to determine whether the function used to obtain the data matches the second set of functions. If it is determined that the data matches the second set of functions, the data is determined to be original data and to have originated from a network, and the second tag is used as the data source tag for the original data.

[0102] In the above embodiment, only a matching operation is required to determine whether the original data is from a local location, thereby improving the efficiency of determining the source of the original data.

[0103] In one embodiment, the above method also includes: in the process of passing the transfer data to the next execution function based on the current execution function, generating metadata of the transfer data according to the data source tag extracted from the tag storage location of the transfer data; and passing the transfer data and the metadata of the transfer data together to the next execution function.

[0104] Specifically, during the data flow process, the data source tag is passed along with the transferred data. For example, when transferring data to the next execution function based on the current execution function, the data flow determination system will also pass the data source tag of the transferred data to the next execution function. For example, the data determination system will use the data source tag of the transferred data as metadata for the transferred data and pass it along with the transferred data to the next execution function. Metadata refers to data used to describe data.

[0105] In one embodiment, when the data flow determination system intercepts the currently executed machine execution instruction and determines based on the currently executed machine execution instruction that the current execution function is used to pass the transfer data to the next execution function, the data flow determination system can generate metadata for the transfer data based on the data source tag of the transfer data and also pass the metadata to the next execution function.

[0106] In one embodiment, when the transferred data has metadata, a data source tag of the transferred data may be added to the original metadata; when the transferred data does not have metadata, metadata of the transferred data may be generated based on the data source tag of the transferred data.

[0107] It is easy to understand that it is not just about passing data, but all data generated during the application operation can be marked with the data and its data source and passed from one operation to another.

[0108] In the above embodiment, by transmitting the data source tag of the transmitted data as metadata together with the transmitted data, the impact of the transmission of the data source tag on the normal function of the application can be reduced, thereby realizing the detection of the hot update behavior of the application during the normal operation of the application, thereby improving the accuracy of the hot update detection.

[0109] In one embodiment, the above method also includes: when the transferred data is processed based on the next execution function to obtain processed data, and the processed data is stored in the virtual machine stack, determining the storage location of the processed data in the virtual machine stack; determining the tag storage location of the processed data based on the storage location of the processed data in the virtual machine stack; determining the data source tag extracted from the tag storage location of the transferred data based on the metadata of the transferred data, and storing the data source tag extracted from the tag storage location of the transferred data in the tag storage location of the processed data.

[0110] Specifically, when the transfer data is transferred to the next execution function, the next execution function can process the transfer data to obtain processed data. In the case where the processed data is stored in the virtual machine stack, the data flow determination system can determine the storage location of the processed data in the virtual machine stack, and determine the location where the data source tag of the processed data should be stored based on the storage location of the processed data in the virtual machine stack. For the convenience of description, the location where the data source tag of the processed data should be stored is referred to as the tag storage location of the processed data. Furthermore, since metadata is data used to describe data, the metadata of the transfer data can be used to describe which specific tags the data source tags extracted from the tag storage location of the transfer data are, so that the data flow determination system can determine the data source tags extracted from the tag storage location of the transfer data based on the metadata of the transfer data, and store the data source tags extracted from the tag storage location of the transfer data in the tag storage location of the processed data.

[0111] In one embodiment, the data flow determination system can determine the stack frame of the processing data in the virtual machine stack, and determine the distance between the stack frame and the top of the virtual machine stack. For the convenience of description, the distance between the stack frame where the processing data is located and the top of the virtual machine stack is referred to as the first distance. The data flow determines the middle position of the virtual machine stack, and uses the stack frame with a distance from the middle position of the first distance as the mark storage position. For example, the stack frame where the processing data is located is the 3rd stack frame, and the distance between it and the 0th stack frame is 3. The middle position of the virtual machine stack is the nth stack frame, and the mark storage position of the processing data is the n+3th stack frame. Afterwards, the data flow determination system can determine the data source mark of the transmitted data based on the metadata of the transmitted data, and store the data source mark of the transmitted data at the n+3th stack frame.

[0112] In the above embodiment, by storing the data source tag of the transmitted data in the tag storage location of the processed data, the data source tag of the processed data can include the data source tag of the transmitted data, thereby realizing the propagation of the data source tag as the data propagates.

[0113] In one embodiment, the above method also includes: when the transferred data is processed based on the next execution function to obtain processed data, and the processed data is a data object, adding a new member variable in the extended structure of the processed data; according to the metadata of the transferred data, determining the data source tag extracted from the tag storage position of the transferred data, and setting the value of the newly added member variable to the data source tag extracted from the tag storage position of the transferred data.

[0114] Specifically, when the transfer data is passed to the next execution function, the next execution function can process the transfer data to obtain processed data. In the case where the processed data is a data object, the data flow determination system can add a new member variable to the extended structure of the processed data, and use the data source tag extracted from the tag storage location of the transferred data as the value of the newly added member variable. For example, a field of the processed data can be added, and the data source tag extracted from the tag storage location of the transferred data can be used as the value of the field. Alternatively, an attribute of the processed data can be added, and the data source tag extracted from the tag storage location of the transferred data can be used as the value of the attribute.

[0115] In one embodiment, the newly added member variable can be a variable that represents the data source tag of the processed data. When the data source tag of the transferred data is used as the value of the newly added member variable, the data source tag of the processed data can include the data source tag of the transferred data. For example, the newly added member variable can be "tagged=network", where "network" is the data source tag of the transferred data. When determining the data source tag of the processed data, "tagged=network" can be extracted from the extended structure of the transferred data based on the keyword "tagged".

[0116] In the above embodiment, by using the data source tag of the transmitted data as the value of the newly added member variable of the processed data, the data source tag of the processed data can include the data source tag of the transmitted data, thereby achieving the data source tag being propagated as the data is propagated.

[0117] It is easy to understand that not only the data transmission and processing, but also all the data generated during the application operation can be processed with data source tags based on the above method. For example, in the process of executing a series of execution functions, for the data generated based on any execution function, when the data is stored in the virtual machine stack, the tag storage location of the data can be determined based on the storage location of the data in the virtual machine stack, and the data source tag of the data transmitted to any execution function can be stored in the tag storage location of the data generated based on the any execution function. For another example, in the process of executing a series of execution functions, for the data generated based on any execution function, when the data is a data object, a new member variable can be added to the extended structure of the data, and the data source tag of the data transmitted to any execution function can be used as the value of the newly added member variable.

[0118] In one embodiment, if the next execution function is a calculation function, in addition to passing the transferred data to the next execution function, other data will also be passed to the next execution function. For ease of description, the data other than the transferred data that will be passed to the next execution function will be referred to as calculation data. When the transferred data is passed to the next execution function, the data source tag of the transferred data will also be passed to the next execution function, and when the calculation data is passed to the next execution function, the data source tag of the calculation data will also be passed to the next execution function. Furthermore, the next execution function will perform data calculation processing on the transferred data and the calculation data to obtain processed data. When the processed data is stored in the virtual machine stack, the data source tag of the transferred data and the data source tag of the calculation data will both be stored in the virtual machine stack where the processed data is located. When the processed data is a data object, multiple member variables will be added to the extended structure of the processed data, with the value of one member variable being the data source tag of the transferred data and the value of another member variable being the data source tag of the calculation data. For example, member variables "tagged_1 = data source tag of the transferred data" and "tagged_2 = data source tag of the calculation data" can be generated.

[0119] In one embodiment, when the processed data is passed to the next function, and the next function belongs to the preset function type to be detected, the detection system needs to extract the data source tag of the processed data, and determine whether the application has been hot-updated based on the data source tag of the processed data. When it is necessary to extract the data source tag of the processed data, if the processed data is stored in the virtual machine stack, the data source tag of the processed data is extracted from the virtual machine stack. For example, in the above example, all data source tags can be extracted from the n+3th stack frame, and all extracted data source tags are used as the data source tags of the processed data. If the processed data is a data object, the data source tag of the processed data can be extracted from the extended structure of the processed data. For example, in the above example, based on the keyword "tagged", "tagged_1 = data source tag of transferred data" and "tagged_2 = data source tag of calculated data" can be extracted from the extended structure of the processed data, and the values ​​of the extracted member variables are used as the data source tags of the processed data.

[0120] In one embodiment, the application runs on a virtual terminal; when the virtual machine in the virtual terminal runs in an interpreted execution mode, during the application running process, each time after an original machine execution instruction is executed, a data source tag transfer instruction for transferring the data source tag is inserted; when the virtual machine in the virtual terminal runs in a compiled execution mode, during the process of compiling the application through the compiler of the virtual machine, a data source tag transfer instruction for transferring the data source tag is inserted.

[0121] Specifically, when the custom Android virtual machine executes application code in interpreted mode, it interprets and executes instructions one by one. During this process, the data flow determination system must ensure that all data associated with each instruction is tagged with the data origin. This means that the data flow determination system must intercept the execution of each machine instruction at runtime, check the data origin tag, and pass the data origin tag along when the data is passed from one operation to another by inserting a data origin tag transfer instruction.

[0122] In addition to interpreted execution, virtual machines also support a compiled execution mode, which allows some or all of an application's code to be compiled into native machine code during installation. To implement data flow capture in compiled execution mode, the compiler needs to insert additional data origin marker passing instructions into the generated machine code to pass the data origin markers. These data origin markers must be designed to be efficient enough to avoid significantly impacting application performance. At the same time, they must be able to consider all possible data flow paths during compilation to ensure that the detection of hot update behavior does not miss any critical data flows due to the compilation process.

[0123] In one embodiment, the above method also includes: when a tag set is extracted from the tag storage location of the transferred data, determining the data source of the transferred data based on the data source tag in the tag set; determining the data source of the transferred data based on the data source tag in the tag set; and generating a hot update record based on the data source of the transferred data, the transferred data, and the data source tag in the tag set.

[0124] Specifically, the tag storage location of the transferred data may store multiple data source tags, that is, a tag set may be extracted from the tag storage location of the transferred data. For example, when the transferred data C is obtained by superimposing data A and data B, the tag storage location of the transferred data C may record the data source tag of data A and the data source tag of data B. At this time, a tag set is extracted from the tag storage location of the transferred data. The detection system can determine the data source of the transferred data based on the tag set, and generate a hot update record based on the data source of the transferred data, the transferred data, and the tags in the tag set. The data source of the transferred data at this time is the original source of the transferred data traced by the detection system. Furthermore, the detection system can send the hot update record to the detection platform, so that the detection platform can display the hot update record, and then the user can determine whether the application has been hot updated through the displayed hot update record.

[0125] It is easy to understand that when the data source tag of the transferred data is not a tag set but only one data source tag, a hot update record will also be generated according to the transferred data and the data source tag of the transferred data.

[0126] In one embodiment, when the transferred data is data transferred to a class loading function or a library loading function, and the data source tag of the transferred data indicates that the transferred data comes from a local area or a network, it can be determined that the application has been hot updated, so that the detection system can record the transferred data and the data source tag of the transferred data together in a log, which is the hot update record.

[0127] In one embodiment, the detection system may also record in the hot update record the specific source address of the transferred data, the timestamp of when the transferred data is transferred to the class loading function or library loading function, the specific data content of the transferred data, and other metadata of the transferred data.

[0128] In one of the embodiments, each time a hot update record is generated, the hot update record can be immediately sent to the detection platform, or after the detection task is completed, the generated hot update records can be summarized to obtain a summary record, and the summary record can be sent to the detection platform. For example, referring to Figure 11, an "end task" control 1101 can be displayed in the detection platform. When the user clicks the "end task" control, the detection system can send the summary record to the detection platform. At this time, the detection platform can display a preview control and a download control. The preview control can be used to preview the summary record, and the download control can be used to download the summary record. Figure 11 shows a schematic diagram of the detection page of the detection platform in one embodiment.

[0129] Referring to Figure 11, in the detection page of the detection platform, in addition to displaying the "End Task" control, the document information of the detection task can also be displayed. The document information is the information of the document, and the document is the document submitted for the detection task. The document information may include information such as the application installation progress, document number, application name, application package name, document name, document ID, task start time, etc. By displaying the document information, it is convenient for users to fully understand the relevant information of the detection task. It is easy to understand that before clicking the "End Task" control, the user can use the application, so that the virtual terminal displays the application interface of the application accordingly.

[0130] In one embodiment, referring to Figure 12, when the user clicks the "End Task" control, the content of the task center operation item changes from "Detecting" to "Detection Completed, Reset Task." Figure 12 shows a schematic diagram of the task center in another embodiment.

[0131] In the above embodiment, by generating a hot update record, the hot update record can be sent to the detection platform, so that the user can obtain the hot update record through the detection platform, and analyze the hot update behavior of the application based on the hot update record, understand the hot update behavior of the application, and output safety measures for the hot update behavior of the application.

[0132] In one embodiment, the data source tag includes a first tag and a second tag, the first tag is used to characterize the network acquisition source, and the second tag is used to characterize the local acquisition source; the data source of the transmitted data is determined according to the tags in the tag set, including: if the tag set includes the first tag, then the data source of the transmitted data is determined to be the network; if the tag set only includes the second tag, then the data source of the transmitted data is determined to be local.

[0133] Specifically, if the tag set includes the first tag, the data source of the transferred data can be determined to be the network. For example, if the first tag is "network" and the second tag is "local," and the tag set includes both "network" and "local," it can be considered that the original data is first obtained from the network and stored locally. Thereafter, the original data is read from the local machine and processed to obtain the transferred data. If the tag set only includes the second tag, the data source of the transferred data is determined to be local. It is easy to understand that if the tag set only includes the first tag, the data source of the transferred data is determined to be the network.

[0134] In one embodiment, a hot update record is generated based on the data source, the transferred data, and the data source tag in the tag set, including: when it is determined that the data source of the transferred data is the network, obtaining the network request related to the transferred data sent by the application during operation; determining the network link carried by the network request, and matching the network link with the preset application update official link to obtain a matching result; when it is determined according to the matching result that the application is not hot updated through the official update channel, generating a hot update record based on the matching result, the data source, the transferred data, and the data source tag in the tag set.

[0135] Specifically, if the source of the transferred data is determined to be the network, the detection system may obtain all network requests sent by the application during operation and, based on the transferred data, filter out target network requests related to the transferred data from all obtained network requests. The target network requests related to the transferred data are network requests used to obtain the transferred data, or network requests used to obtain the raw data that generated the transferred data.

[0136] Furthermore, the detection system can extract the network link from the target network request and match the network link with the preset official link for the application update. When the network link matches the preset official link for the application update, for example, when the network link is consistent with the preset official link for the application update, it can be determined that the application is updated through an official channel. If the network link does not match the preset official link for the application update, for example, when the network link is inconsistent with the preset official link for the application update, it can be determined that the application is updated through an unofficial channel. At this time, the detection system generates a hot update record based on the matching result, data source, transfer data, and tags in the tag set. So that the user can determine that the application has been hot updated through an unofficial channel based on the hot update record.

[0137] In this embodiment, by determining a match between the network link and a preset official link for the application update, a hot update record can be generated based on the match result. By generating the hot update record, it is convenient for the user to determine whether the application has been hot updated through an unofficial channel through the hot update record.

[0138] In one embodiment, a user can test multiple applications at one time. For example, multiple virtual terminals can be created, where each virtual terminal can run an application. The user can operate each application. During the user's operation of the application in the virtual terminal, the hot update behavior of each application can be tested.

[0139] In one embodiment, referring to FIG13 , FIG13 shows a schematic diagram of the overall process of a hot update detection method in one embodiment. S1301: When a user clicks the "Start Test" control, the application can begin testing. S1302: When the application obtains data from the network, the data source tag of the data is set to a first tag; when the application obtains data locally, the data source tag of the data is set to a second tag. S1303: The data source tag can be stored in the virtual machine. S1304: If the virtual machine is running in interpreted execution mode, S1306: The application runtime data tag is propagated along with the data. S1305: If the virtual machine is running in compiled execution mode, S1306: The application runtime data tag is propagated along with the data. S1307: If the currently executing function is of a preset function type, it is determined whether the data input to the currently executing function has a data source tag. S1308: If the data source tag is present, a hot update record is generated based on the data input to the currently executing function and the data source tag of the data. If the data input to the currently executed function does not have a data source tag, the process jumps to step 1309 to continue executing the application. In step 1310, when the end task control is clicked, the application detection ends.

[0140] In one embodiment, referring to Figure 14, Figure 14 shows an interactive diagram of a hot update detection method in one embodiment. A user can submit an installation package to a customized Android system, which can then install the application based on the installation package. After the application is installed, the user can open the application for testing, and the customized Android system can determine the application's behavior. When the application obtains data from the network, the customized Android system marks the data as a network source. When the application obtains data locally, the customized Android system marks the data as a local source. The customized Android system transfers data while the application is running. When a class loader or library loader function is called, the customized Android system determines whether the data passed to the class loader or library loader function has a data source tag. If the data source tag is present, a hot update record is generated and detection continues. When the detection is complete, the detection results are uploaded, the application is uninstalled, and the environment is reset. It will be readily understood that the execution steps corresponding to the application can be the steps executed based on the original code in the original installation package. The steps executed by the customized Android system can be additional execution steps added to this application.

[0141] In one embodiment, referring to FIG15 , FIG15 shows a schematic flow chart of a hot update detection method in a specific embodiment:

[0142] S1502 , during the application running process, when raw data is obtained based on a historical execution function, the customized Android system determines a data acquisition function for obtaining the raw data.

[0143] S1504, customize the Android system to obtain a preset first function set, and match the data acquisition function with the system call function in the first function set; when the data acquisition function successfully matches the system call function in the first function set, determine that the original data is obtained from the network, and use the first tag as the data source tag of the original data.

[0144] S1506, customize the Android system to obtain a preset second function set, and match the data acquisition function with the system call function in the second function set; when the data acquisition function successfully matches the system call function in the second function set, determine that the original data is obtained locally, and use the second tag as the data source tag of the original data.

[0145] S1508, the customized Android system determines the currently executed machine execution instruction for the application, and determines the current execution function executed based on the machine execution instruction.

[0146] S1510, when the currently executed function is of the preset function type to be detected, the customized Android system determines the transfer data to the currently executed function, and determines the tag storage location of the transfer data based on the data type of the transfer data; when the transfer data is generated based on the original data, the tag storage location is used to record the data source tag of the data transferred to each execution function during the execution of a series of execution functions based on the original data of the application.

[0147] S1512, when a tag set is obtained from the tag storage location, the customized Android system determines the data source of the transferred data according to the tags in the tag set; and determines the data source of the transferred data according to the tags in the tag set.

[0148] S1514, when it is determined that the data source of the transferred data is the network, the customized Android system obtains the network request related to the transferred data sent by the application during operation; determines the network link carried by the network request, and matches the network link with the preset official link of the application update to obtain a matching result.

[0149] S1516, when it is determined based on the matching result that the application is not hot updated through the official update channel, the customized Android system generates a hot update record based on the matching result, the data source, the transferred data, and the tags in the tag set.

[0150] S1518, continue running the application, process the transferred data based on the next execution function to obtain processed data, and when the processed data is a data object, customize the Android system to add a new member variable in the extended structure of the processed data; set the value of the newly added member variable as the data source tag of the transferred data; when the processed data is stored in the virtual machine stack, determine the storage location of the processed data in the virtual machine stack; determine the tag storage location of the processed data based on the storage location of the processed data in the virtual machine stack; store the data source tag of the transferred data in the tag storage location of the processed data.

[0151] S1520, when the detection is completed, the customized Android system sends the hot update behavior record to the detection platform.

[0152] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0153] This application also provides an application scenario, which applies the above-mentioned hot update detection method. Specifically, the application of the hot update detection method in this application scenario is as follows:

[0154] Hot update detection can be performed on applications in the application store. The overall framework of the hot update detection method can be referred to Figure 16. More specifically, 1. Start the test:

[0155] In the data flow determination system for hot update detection, initiating detection is the beginning of the entire process. Initialization begins by configuring the necessary management environment and enabling real-time hot update detection for the application. Detection initialization includes loading detection components, setting data collection parameters, defining update event triggers, and configuring logging methods. Furthermore, the system ensures that all necessary permissions are obtained to facilitate seamless detection of application behavior.

[0156] 2. The original data is marked:

[0157] Data tagging is a critical step in determining data flows. During this step, the data flow determination system tags all data that may be subject to hot updates, such as data retrieved from the file system, data obtained through network interfaces, or data retrieved from local databases. These tags are special metadata or identifiers that identify the source of the original data in subsequent data flows. This tagging process must ensure that it does not affect the normal functionality of the application.

[0158] 3. The data source tag is stored on the virtual machine stack or in the object extension structure:

[0159] Once data is tagged, this tag information needs to be stored in a traceable location. In Android applications, this is usually achieved by storing data source tags on the virtual machine stack or in an object's extended structure (such as a field or attribute). This ensures that the data source tags can be passed along with the data during data flow and can be retrieved and analyzed at any time.

[0160] 4. When the Android virtual machine interprets and executes, it propagates the data source tags related to the instructions sentence by sentence:

[0161] When the Android virtual machine executes application code in interpreted mode, it interprets and executes instructions one by one. During this process, the data flow determination system must ensure that all data associated with each instruction is tagged with the data source. This means that the data flow determination system must intercept the execution of each instruction at runtime, check the data source tag, and pass the data source tag along when the data is passed from one operation to another. This facilitates subsequent analysis of hot update behavior.

[0162] 5. When the Android virtual machine is compiled and executed, the compiler adds data source mark transfer instructions to the compiled instructions:

[0163] In addition to interpreted execution, virtual machines also support compiled execution, which allows some or all of an application's code to be compiled into native machine code during installation. The compiler must insert additional instructions into the generated machine code to propagate data tags. These instructions must be designed to be efficient enough to avoid significantly impacting application performance. Furthermore, they must be able to consider all possible data flow paths during compilation, ensuring that hot update detection does not miss any critical data flows due to the compilation process.

[0164] 6. When the virtual machine is running, the data source tag is propagated along with the data:

[0165] Within an application's runtime environment, the virtual machine is a key component responsible for executing application bytecode. To determine the flow of application data, particularly during hot updates, a mechanism is implemented that embeds data provenance markers within the virtual machine. These markers are transmitted along with application data as metadata, without impacting the application's functionality. To ensure the propagation of data provenance markers, data manipulation instructions within the virtual machine are enhanced to ensure that the data provenance markers correctly follow the data flow during operations or transfers.

[0166] 7. When the system executes the Sink function, it reads the tag and determines the Sink source:

[0167] Sink functions include class loading functions or dynamic library loading functions. When the program executes the Sink function, the detection system intervenes and reads the data source tag passed to the function. By analyzing the data source tag, the detection system can determine the source of the data. This step is particularly critical for detecting hot update behavior because it can reveal whether the updated data comes from uncontrollable channels such as the network. If the data source tag indicates that the data comes from the network or local, and it does not match the official update channel of the application, the detection system will record this behavior and generate a hot update record.

[0168] 8. If the data source is marked as Network or Local, record the result and continue:

[0169] Once the detection system determines that data originates from the network or local file system and is relevant to a hot update, it records the relevant information. This information includes the data's source address, timestamp, updated content, and other relevant metadata. While recording the results, the detection system does not block further processing of the data, allowing the program to continue executing. This non-intrusive approach ensures that the application's normal functionality is not affected by the detection process.

[0170] 9. If there is no data source mark, continue to execute:

[0171] In some cases, data passed to a Sink function may not have a data source tag. This may be because the data was generated outside the scope of the detection system or because the data was generated internally. In this case, the detection system will choose not to record any data and allow the program to continue executing.

[0172] 10. End of test:

[0173] After testing the functionality, users click the "End Testing" button, which ends the test. The testing platform summarizes all recorded hot update behaviors and generates a report. This report provides valuable insights for app developers or security analysts, helping them understand their app's hot update behavior and take appropriate security measures.

[0174] The beneficial effects of this application:

[0175] 1. Enhanced application security: By detecting and analyzing hot update behavior, we can ensure that no malicious code is introduced during the update process. This helps protect users from security threats such as privacy leakage, data theft, or other potential malicious behavior.

[0176] 2. Ensure transparency: This technology can determine the exact source of the code and ensure that the hot update process is transparent, allowing developers and users to understand the source and purpose of the code being executed.

[0177] 3. Compliance review: By detecting hot update behavior, it can help ensure that application updates comply with relevant regulations and reduce the risks caused by illegal update regulations.

[0178] 4. Improve user trust: Users may be skeptical of opaque hot updates. Providing a method to accurately detect and report hot update behavior can improve user trust in the application.

[0179] 5. Optimize the update process: By detecting hot update behavior, potential problems in the update process can be discovered and optimized accordingly, thereby improving application performance and user experience.

[0180] 6. Preventing Abuse: Hot update mechanisms are sometimes used to bypass the App Store's review mechanism. This detection method helps prevent such abuse and ensures that all updates are properly reviewed.

[0181] 7. Maintain market order: By ensuring the proper use of the hot update mechanism, the healthy development of the application market can be maintained and unfair competition caused by improper updates can be avoided.

[0182] 8. Data flow transparency: It allows developers and regulators to have a clearer understanding of the data flow within the application, thereby better protecting user data and privacy.

[0183] Based on the same inventive concept, the present application also provides a thermal update detection device for implementing the aforementioned thermal update detection method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. The specific limitations of one or more thermal update detection device embodiments provided below can be found in the above-mentioned limitations of the thermal update detection method and will not be repeated here.

[0184] In one embodiment, as shown in FIG17 , a hot update detection device 1700 is provided, comprising: a transfer data determination module 1702 , a tag storage location determination module 1704 , and a record generation module 1706 , wherein:

[0185] The transfer data determination module 1702 is used to determine the machine execution instruction currently executed for the application during the application running process; determine the current execution function executed based on the machine execution instruction, and when the current execution function is a preset function type to be detected, determine the transfer data passed to the current execution function.

[0186] The tag storage location determination module 1704 is used to determine the tag storage location of the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the tag storage location of the data generated by any execution function is used to record the data source tag of the data transferred to any execution function.

[0187] The determination module 1706 is configured to determine that the application has been hot-updated when a data source tag is obtained from the tag storage location; wherein the obtained data source tag is used to indicate that the transmitted data originates from a local or network source other than the original installation package.

[0188] In the above embodiment, by determining the machine execution instruction currently being executed during the running of the application, the currently executed function can be determined based on the machine execution instruction currently being executed. By determining the currently executed function, the function type to which the currently executed function belongs can be determined. When it is determined that the currently executed function belongs to the preset function type to be detected, it is determined that a hot update behavior may have occurred at this time, and the transfer data passed to the currently executed function is obtained. When the transfer data comes from a local or network other than the original installation package, it is determined that the application has been hot updated, thereby automatically performing hot update detection on the application during the running of the application; and, by executing a series of execution functions based on the original data of the application, based on the tag storage location of the data generated by any execution function, the data source tag of the data passed to any execution function can be recorded, so that after obtaining the transfer data passed to the currently executed function, the tag storage location of the transfer data can be further determined, and when the data source tag is obtained from the tag storage location of the transfer data, it is determined that the application has been hot updated, wherein the obtained data source tag is used to characterize that the transfer data comes from a local or network other than the original installation package. Therefore, the algorithm of this application can efficiently and accurately identify whether a hot update has occurred by judging the source of data transmission and combining precise function types and data marking mechanisms. Compared with the traditional method of manually analyzing installation package files to detect hot updates of applications, this application improves the detection efficiency of hot updates.

[0189] In one embodiment, the application runs on a virtual terminal, and after uploading the installation package of the application to the detection platform through the installation package upload page, the application is installed through the installation package on the virtual terminal triggered by a preset installation instruction.

[0190] In one embodiment, when the transferred data is generated based on the original data, the data source tag of the original data is recorded at the tag storage location of the transferred data; the hot update detection device 1700 also includes a tag generation module, which is used to determine that the data source tag of the original data is a first tag used to characterize the network acquisition source when the original data is obtained from the network; and when the original data is obtained locally, the data source tag of the original data is determined to be a second tag used to characterize the local acquisition source.

[0191] In one embodiment, the tag generation module is also used to obtain a preset first function set; the first function set includes a system call function supported by the application for receiving network data; determine a data acquisition function for obtaining raw data; match the data acquisition function with the system call function in the first function set; if the data acquisition function successfully matches the system call function in the first function set, determine that the raw data is obtained from the network, and use the first tag as the data source tag of the raw data.

[0192] In one embodiment, the tag generation module is also used to obtain a preset second function set; the second function set includes system call functions supported by the application for reading and writing files; matching the data acquisition function with the system call function in the second function set; when the data acquisition function successfully matches the system call function in the second function set, determining that the original data is obtained locally, and using the second tag as the data source tag of the original data.

[0193] In one embodiment, the tag storage location determination module 1704 is also used to determine that the tag storage location of the transferred data is an extended structure of the transferred data when the transferred data is a data object type; and to determine that the tag storage location of the transferred data is a virtual machine stack storing the transferred data when the transferred data is a non-data object type.

[0194] In one embodiment, the hot update detection device 1700 further includes a tag transfer module for transferring a data source tag of the transferred data as metadata of the transferred data to the next execution function in the process of transferring the transferred data to the next execution function based on the current execution function.

[0195] In one embodiment, the tag transfer module is also used to determine the storage location of the processed data in the virtual machine stack when the transferred data is processed based on the next execution function to obtain processed data, and the processed data is stored in the virtual machine stack; determine the tag storage location of the processed data based on the storage location of the processed data in the virtual machine stack; and store the data source tag of the transferred data at the tag storage location of the processed data.

[0196] In one embodiment, the tag transfer module is also used to process the transferred data based on the next execution function to obtain processed data, and when the processed data is a data object, add a new member variable in the extended structure of the processed data; and use the data source tag extracted from the tag storage location of the transferred data as the value of the newly added member variable.

[0197] In one embodiment, the application runs on a virtual terminal; when the virtual machine in the virtual terminal runs in an interpreted execution mode, during the running of the application, each time an original machine execution instruction is executed, a data source tag transfer instruction for transferring the data source tag is inserted; the original machine execution instruction refers to a machine execution instruction generated based on the application installation package; when the virtual machine in the virtual terminal runs in a compiled execution mode, during the process of compiling the application through the compiler of the virtual machine, a data source tag transfer instruction for transferring the data source tag is inserted.

[0198] In one embodiment, the hot update detection device 1700 further includes a record generation module for: generating a hot update record based on the transferred data and a data source tag obtained from a tag storage location of the transferred data; and sending the hot update record to the detection platform.

[0199] In one embodiment, the record generation module is also used to determine the data source of the transferred data based on the tags in the tag set when a tag set is extracted from the tag storage location of the transferred data; determine the data source of the transferred data based on the tags in the tag set; generate a hot update record based on the data source of the transferred data, the transferred data and the tags in the tag set; and send the hot update record to the detection platform.

[0200] In one embodiment, the record generation module is also used to determine that the data source of the transmitted data is the network if the tag set includes a first tag used to characterize the network acquisition source; if the tag set only includes a second tag used to characterize the local acquisition source, then determine that the data source of the transmitted data is local.

[0201] In one of the embodiments, the record generation module is also used to obtain the network request related to the transferred data sent by the application during operation when it is determined that the data source of the transferred data is the network; determine the network link carried by the network request, and match the network link with the preset application update official link to obtain a matching result; when it is determined according to the matching result that the application is not hot updated through the official update channel, generate a hot update record based on the matching result, the data source, the transferred data and the tag in the tag set.

[0202] Each module in the above-mentioned hot update detection device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0203] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in Figure 18. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer-readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile storage medium. The database of the computer device is used to store hot update detection data. The I / O interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer-readable instructions are executed by the processor, a hot update detection method is implemented.

[0204] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in Figure 19. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer-readable instructions. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with an external terminal via wired or wireless communication, and the wireless communication may be implemented via Wi-Fi, a mobile cellular network, NFC (near field communication), or other technologies. When executed by the processor, the computer-readable instructions implement a hot update detection method. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0205] Those skilled in the art will understand that the structures shown in Figures 18 and 19 are merely block diagrams of partial structures related to the scheme of the present application, and do not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.

[0206] In one embodiment, a computer device is further provided, including a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps in the above-mentioned method embodiments when executing the computer-readable instructions.

[0207] In one embodiment, a computer-readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0208] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above-described method embodiments.

[0209] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0210] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through computer-readable instructions. The computer-readable instructions can be stored in a non-volatile computer-readable storage medium. When the computer-readable instructions are executed, they can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0211] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0212] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A hot update detection method, executed by a computer device, comprising: During the running of the application, determining a machine execution instruction currently being executed for the application; determining a currently executed function executed based on the machine-executed instruction, and determining transfer data to be transferred to the currently executed function if the currently executed function is a preset function type to be detected; Determining a storage location for the tag of the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the storage location for the tag of data generated by any execution function is used to record the data source tag of the data transferred to any execution function; When a data source tag is obtained from the tag storage location of the transferred data, it is determined that the application has been hot updated; wherein the obtained data source tag is used to indicate that the transferred data comes from a local or network other than the original installation package.

2. According to the method of claim 1, the application runs on a virtual terminal, and the application is installed by uploading the installation package of the application to the detection platform through the installation package upload page, and then triggering the virtual terminal to install the installation package based on a preset installation instruction.

3. The method according to claim 1, wherein when the transferred data is generated based on the original data, a data source tag of the original data is recorded in the tag storage location of the transferred data; The step of generating the data source mark of the original data includes: In the case where the original data is obtained from the network, determining the data source mark of the original data as a first mark used to characterize the network acquisition source; In the case where the original data is obtained locally, the data source tag of the original data is determined to be a second tag used to characterize the local acquisition source.

4. The method according to claim 3, wherein, when the original data is obtained from the network, determining the data source tag of the original data as a first tag used to characterize the network acquisition source comprises: Get the preset first function set; The first function set includes a system call function supported by the application for receiving network data; determining a data acquisition function for acquiring the raw data; Matching the data acquisition function with the system call function in the first function set; When the data acquisition function successfully matches the system call function in the first function set, it is determined that the original data is obtained from the network, and the first tag is used as the data source tag of the original data.

5. The method according to claim 4, wherein, when the original data is obtained locally, determining the data source tag of the original data as a second tag used to characterize the local acquisition source comprises: Get the preset second function set; The second function set includes system call functions supported by the application for reading and writing files; Matching the data acquisition function with the system call function in the second function set; In the case that the data acquisition function successfully matches the system call function in the second function set, it is determined that the original data is obtained locally, and the second tag is used as the data source tag of the original data.

6. The method according to claim 1, wherein determining the marked storage location of the transfer data comprises: In the case where the transfer data is of a data object type, determining the tag storage location of the transfer data to be an extended structure of the transfer data; In a case where the transfer data is of a non-data object type, the marked storage location of the transfer data is determined to be a virtual machine stack storing the transfer data.

7. The method according to claim 1, further comprising: In a process of transferring the transfer data to a next execution function based on the current execution function, generating metadata of the transfer data according to the data source tag extracted from the tag storage location of the transfer data; The transfer data and metadata of the transfer data are transferred together to the next execution function.

8. The method according to claim 7, further comprising: determining a storage location of the processed data in the virtual machine stack when the transferred data is processed based on the next execution function to obtain processed data and the processed data is stored in the virtual machine stack; determining a marked storage location of the processed data according to a storage location of the processed data in the virtual machine stack; According to the metadata of the transferred data, a data source tag extracted from the tag storage location of the transferred data is determined, and the data source tag extracted from the tag storage location of the transferred data is stored in the tag storage location of the processed data.

9. The method according to claim 7, further comprising: When the transferred data is processed based on the next execution function to obtain processed data, and the processed data is a data object, a member variable is added to the extended structure of the processed data; According to the metadata of the transferred data, a data source tag extracted from the tag storage location of the transferred data is determined, and the data source tag extracted from the tag storage location of the transferred data is used as the value of the newly added member variable.

10. The method according to claim 1, wherein the application is run on a virtual terminal; when the virtual machine in the virtual terminal is run in interpreted execution mode, during the running of the application, each time an original machine execution instruction is executed, a data source tag transfer instruction for transferring the data source tag is inserted; the original machine execution instruction is a machine execution instruction generated based on the installation package of the application; When the virtual machine in the virtual terminal runs in a compilation execution mode, a data source tag transfer instruction for transferring the data source tag is inserted during the process of compiling the application by the compiler of the virtual machine.

11. The method according to any one of claims 1 to 10, further comprising: generating a hot update record according to the transferred data and a data source tag obtained from a tag storage location of the transferred data; The hot update record is sent to the detection platform.

12. The method according to claim 11, wherein generating a hot update record based on the transferred data and obtaining a data source tag from a tag storage location of the transferred data comprises: In a case where a tag set is extracted from the tag storage location of the transferred data, determining the data source of the transferred data according to the data source tag in the tag set; Determining the data source of the transferred data according to the data source tag in the tag set; A hot update record is generated according to the data source of the transferred data, the transferred data, and the data source tag in the tag set.

13. The method according to claim 12, wherein the data source tag includes a first tag and a second tag, the first tag is used to represent a network acquisition source, and the second tag is used to represent a local acquisition source; The step of determining the data source of the transferred data according to the data source tag in the tag set includes: If the tag set includes the first tag, determining that the data source of the transmitted data is a network; If the tag set includes the second tag, it is determined that the data source of the transferred data is local.

14. The method according to claim 13, wherein generating a hot update record according to the data source of the transferred data, the transferred data, and the data source tag in the tag set comprises: When it is determined that the data source of the transfer data is a network, obtaining a network request related to the transfer data sent by the application during operation; Determining a network link carried in the network request, and matching the network link with a preset official link for application updates to obtain a matching result; When it is determined according to the matching result that the application is not hot-updated through the official update channel, a hot-update record is generated according to the matching result, the data source, the transferred data, and the data source tag in the tag set.

15. A thermal update detection device, comprising: A transfer data determination module, configured to determine, during the running of an application, a machine execution instruction currently being executed for the application; determining a currently executed function executed based on the machine-executed instruction, and determining transfer data to be transferred to the currently executed function if the currently executed function is a preset function type to be detected; a tag storage location determining module, configured to determine a tag storage location for the transferred data; wherein, in the process of executing a series of execution functions based on the original data of the application, the tag storage location of data generated by any execution function is used to record a data source tag of the data transferred to the any execution function; A record generation module is used to generate a hot update record based on the transferred data and the data source tag obtained from the tag storage location of the transferred data, when a data source tag is obtained from the tag storage location of the transferred data; wherein the hot update record is used to determine whether the application has been hot updated. 16 . A computer device comprising a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the method according to claim 1 when executing the computer-readable instructions.

17. A computer-readable storage medium having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by a processor, the steps of the method according to any one of claims 1 to 14 are implemented.

18. A computer program product comprising computer-readable instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 14.

Images