API Hooking for Intercepting Implanted Information in Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for intercepting implanted information in applications, such as advertisements, are ineffective when the information server uses dynamic IP or random port numbers, leading to bandwidth occupation and system efficiency issues.
Innovation Solution
A method and apparatus that determine and monitor specific Application Programming Interface (API) calls made by implanted information codes, allowing for interception of these requests to prevent the execution of advertisement code, thereby avoiding bandwidth occupation and improving interception accuracy without interfering with the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network connections of the implanted information server are filtered from all network connections, then the implanted information can be intercepted, but the execution efficiency of other applications in the system is substantially lowered
Solution Approach 1:
The patent segments the network connection filtering process by introducing a whitelist mechanism that specifically identifies and excludes certain connections (those to system servers providing basic services) from the filtering operation. This allows the filtering to be applied selectively rather than universally, maintaining interception effectiveness for implanted information while preserving system execution efficiency by not filtering legitimate system connections.
2Adaptability or versatility
If the implanted information server uses dynamic IP or random port number, then the server flexibility is improved, but the above scheme cannot successfully interrupt advertisements
Solution Approach 1:
The patent introduces an intermediary approach by using a whitelist of known system server connections as a reference framework. Instead of directly identifying implanted information servers through their IP and port (which may be dynamic), the system mediates the filtering process by comparing connections against the whitelist and identifying deviations. This allows the system to adapt to dynamic IPs and random ports while maintaining interception accuracy through the systematic comparison approach.
3Reliability
If all network connections are filtered to intercept implanted information, then interception coverage is improved, but problems such as unsmooth running occur
Solution Approach 1:
The patent applies preliminary action by pre-establishing a whitelist containing network connections to system servers that provide basic services. This whitelist is created and configured in advance, allowing the system to quickly identify and exclude these legitimate connections during runtime without performing complex real-time analysis. This preliminary preparation ensures both comprehensive interception coverage for non-whitelisted connections and smooth system operation by preventing interference with essential services.
Data Source
AI summary
The present invention discloses a method and apparatus for intercepting implanted information in an application. The method comprises: determining an Application Programming interface API invoked by an implanted information code as a key API in accordance with information collected in advance, wherein the key API is the API provided by an implanted information provider; after starting a target application, monitoring an act of the target application invoking the key API by hooking the key API; and if the target application initiates a request to invoke the key API, determining that the implanted information code is contained in the target application and intercepting the request to invoke the key API so as to stop the implanted information code from running and to realize the interception of the implanted information in the target application.